Incorrect implementation in Content Security Policy in Google Chrome prior to 67.0.3396.79 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.

This update for Chromium to version 67.0.3396.99 fixes multiple issues.

Security issues fixed (bsc#1095163) :

  - CVE-2018-6123: Use after free in Blink

  - CVE-2018-6124: Type confusion in Blink

  - CVE-2018-6125: Overly permissive policy in WebUSB

  - CVE-2018-6126: Heap buffer overflow in Skia

  - CVE-2018-6127: Use after free in indexedDB

  - CVE-2018-6129: Out of bounds memory access in WebRTC

  - CVE-2018-6130: Out of bounds memory access in WebRTC

  - CVE-2018-6131: Incorrect mutability protection in     WebAssembly

  - CVE-2018-6132: Use of uninitialized memory in WebRTC

  - CVE-2018-6133: URL spoof in Omnibox

  - CVE-2018-6134: Referrer Policy bypass in Blink

  - CVE-2018-6135: UI spoofing in Blink

  - CVE-2018-6136: Out of bounds memory access in V8

  - CVE-2018-6137: Leak of visited status of page in Blink

  - CVE-2018-6138: Overly permissive policy in Extensions

  - CVE-2018-6139: Restrictions bypass in the debugger     extension API

  - CVE-2018-6140: Restrictions bypass in the debugger     extension API

  - CVE-2018-6141: Heap buffer overflow in Skia

  - CVE-2018-6142: Out of bounds memory access in V8

  - CVE-2018-6143: Out of bounds memory access in V8

  - CVE-2018-6144: Out of bounds memory access in PDFium

  - CVE-2018-6145: Incorrect escaping of MathML in Blink

  - CVE-2018-6147: Password fields not taking advantage of     OS protections in Views

  - CVE-2018-6148: Incorrect handling of CSP header     (boo#1096508)

  - CVE-2018-6149: Out of bounds write in V8 (boo#1097452)

The following tracked packaging changes are included :

  - Require ffmpeg >= 4.0 (boo#1095545)

Update to Chromium 67. Security fix for CVE-2018-6123 CVE-2018-6124 CVE-2018-6125 CVE-2018-6126 CVE-2018-6127 CVE-2018-6128 CVE-2018-6129 CVE-2018-6130 CVE-2018-6131 CVE-2018-6132 CVE-2018-6133 CVE-2018-6134 CVE-2018-6135 CVE-2018-6136 CVE-2018-6137 CVE-2018-6148

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Google Chrome installed on the remote host is prior to 67.0.3396.79, and is affected by an unspecified flaw that is triggered when handling character rangers in CSP headers. This may allow a context-dependent attacker to have an unspecified impact. (CVE-2018-6148)

This update for Opera 54.0.2952.41 fixes multiple issues.

  - CVE-2018-6148: Incorrect handling of CSP header     (boo#1096508)

This update to version 54.0.2952.41 also contains all security and bug fixes in this upstream version, including all fixes in the chromium engine.

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2018-6118     Ned Williamson discovered a use-after-free issue.

  - CVE-2018-6120     Zhou Aiting discovered a buffer overflow issue in the     pdfium library.

  - CVE-2018-6121     It was discovered that malicious extensions could     escalate privileges.

  - CVE-2018-6122     A type confusion issue was discovered in the v8     JavaScript library.

  - CVE-2018-6123     Looben Yang discovered a use-after-free issue.

  - CVE-2018-6124     Guang Gong discovered a type confusion issue.

  - CVE-2018-6125     Yubico discovered that the WebUSB implementation was too     permissive.

  - CVE-2018-6126     Ivan Fratric discovered a buffer overflow issue in the     skia library.

  - CVE-2018-6127     Looben Yang discovered a use-after-free issue.

  - CVE-2018-6129     Natalie Silvanovich discovered an out-of-bounds read     issue in WebRTC.

  - CVE-2018-6130     Natalie Silvanovich discovered an out-of-bounds read     issue in WebRTC.

  - CVE-2018-6131     Natalie Silvanovich discovered an error in WebAssembly.

  - CVE-2018-6132     Ronald E. Crane discovered an uninitialized memory     issue.

  - CVE-2018-6133     Khalil Zhani discovered a URL spoofing issue.

  - CVE-2018-6134     Jun Kokatsu discovered a way to bypass the Referrer     Policy.

  - CVE-2018-6135     Jasper Rebane discovered a user interface spoofing     issue.

  - CVE-2018-6136     Peter Wong discovered an out-of-bounds read issue in the     v8 JavaScript library.

  - CVE-2018-6137     Michael Smith discovered an information leak.

  - CVE-2018-6138     Francois Lajeunesse-Robert discovered that the     extensions policy was too permissive.

  - CVE-2018-6139     Rob Wu discovered a way to bypass restrictions in the     debugger extension.

  - CVE-2018-6140     Rob Wu discovered a way to bypass restrictions in the     debugger extension.

  - CVE-2018-6141     Yangkang discovered a buffer overflow issue in the skia     library.

  - CVE-2018-6142     Choongwoo Han discovered an out-of-bounds read in the v8     JavaScript library.

  - CVE-2018-6143     Guang Gong discovered an out-of-bounds read in the v8     JavaScript library.

  - CVE-2018-6144     pdknsk discovered an out-of-bounds read in the pdfium     library.

  - CVE-2018-6145     Masato Kinugawa discovered an error in the MathML     implementation.

  - CVE-2018-6147     Michail Pishchagin discovered an error in password entry     fields.

  - CVE-2018-6148     Michal Bentkowski discovered that the Content Security     Policy header was handled incorrectly.

  - CVE-2018-6149     Yu Zhou and Jundong Xie discovered an out-of-bounds     write issue in the v8 JavaScript library.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2018:1825 advisory.

    Chromium is an open-source web browser, powered by WebKit (Blink).

    This update upgrades Chromium to version 67.0.3396.79.

    Security Fix(es):

    * chromium-browser: Incorrect handling of CSP header (CVE-2018-6148)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Google Chrome Releases reports :

1 security fix contributed by external researchers :

- [845961] High CVE-2018-6148: Incorrect handling of CSP header.
Reported by Michal Bentkowski on 2018-05-23

ID	Name	Product	Family	Severity
123234	openSUSE Security Update : Chromium (openSUSE-2019-548)	Nessus	SuSE Local Security Checks	critical
120558	Fedora 28 : chromium (2018-7c80aaef26)	Nessus	Fedora Local Security Checks	critical
700359	Google Chrome < 67.0.3396.79 Security Bypass	Nessus Network Monitor	Web Clients	medium
111345	openSUSE Security Update : Chromium (openSUSE-2018-759)	Nessus	SuSE Local Security Checks	critical
110832	openSUSE Security Update : Opera (openSUSE-2018-687)	Nessus	SuSE Local Security Checks	medium
110820	Debian DSA-4237-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	critical
110625	Fedora 27 : chromium (2018-09b59b0227)	Nessus	Fedora Local Security Checks	critical
110468	RHEL 6 : chromium-browser (RHSA-2018:1825)	Nessus	Red Hat Local Security Checks	medium
110429	FreeBSD : chromium -- Incorrect handling of CSP header (4cb49a23-6c89-11e8-8b33-e8e0b747a45a)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2018-6148

medium

Tenable Plugins

critical

critical

medium

critical

medium

critical

critical

medium

medium