The implementation of the Page.downloadBehavior backend unconditionally marked downloaded files as safe, regardless of file type in Google Chrome prior to 66.0.3359.117 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted HTML page and user interaction.

Update to Chromium 68. Security fix for CVE-2018-4117 CVE-2018-6044 CVE-2018-6150 CVE-2018-6151 CVE-2018-6152 CVE-2018-6153 CVE-2018-6154 CVE-2018-6155 CVE-2018-6156 CVE-2018-6157 CVE-2018-6158 CVE-2018-6159 CVE-2018-6161 CVE-2018-6162 CVE-2018-6163 CVE-2018-6149

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to Chromium 69. (EPEL-7 update is blocked by a GCC bug:
1629813, so as soon as devtoolset-8 arrives...)

Fixes a lot of security issues, like every major release of Chromium, including CVE-2018-16087 CVE-2018-16088 CVE-2018-16086CVE-2018-16065 CVE-2018-16066 CVE-2018-16067 CVE-2018-16068 CVE-2018-16069 CVE-2018-16070 CVE-2018-16071 CVE-2018-16072 CVE-2018-16073 CVE-2018-16074 CVE-2018-16075 CVE-2018-16076 CVE-2018-16077 CVE-2018-16078

----

Update to Chromium 68. Security fix for CVE-2018-4117 CVE-2018-6044 CVE-2018-6150 CVE-2018-6151 CVE-2018-6152 CVE-2018-6153 CVE-2018-6154 CVE-2018-6155 CVE-2018-6156 CVE-2018-6157 CVE-2018-6158 CVE-2018-6159 CVE-2018-6161 CVE-2018-6162 CVE-2018-6163 CVE-2018-6149

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201808-01 (Chromium, Google Chrome: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and Google       Chrome. Please review the referenced CVE identifiers and Google Chrome       Releases for details.
  Impact :

    A remote attacker could escalate privileges, cause a heap buffer       overflow, obtain sensitive information or spoof a URL.
  Workaround :

    There is no known workaround at this time.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2018:2282 advisory.

    Chromium is an open-source web browser, powered by WebKit (Blink).

    This update upgrades Chromium to version 68.0.3440.75.

    Security Fix(es):

    * chromium-browser: Stack buffer overflow in Skia (CVE-2018-6153)

    * chromium-browser: Heap buffer overflow in WebGL (CVE-2018-6154)

    * chromium-browser: Use after free in WebRTC (CVE-2018-6155)

    * chromium-browser: Heap buffer overflow in WebRTC (CVE-2018-6156)

    * chromium-browser: Type confusion in WebRTC (CVE-2018-6157)

    * chromium-browser: Cross origin information disclosure in Service Workers (CVE-2018-6150)

    * chromium-browser: Bad cast in DevTools (CVE-2018-6151)

    * chromium-browser: Local file write in DevTools (CVE-2018-6152)

    * chromium-browser: Use after free in Blink (CVE-2018-6158)

    * chromium-browser: Same origin policy bypass in ServiceWorker (CVE-2018-6159)

    * chromium-browser: Same origin policy bypass in WebAudio (CVE-2018-6161)

    * chromium-browser: Heap buffer overflow in WebGL (CVE-2018-6162)

    * chromium-browser: URL spoof in Omnibox (CVE-2018-6163)

    * chromium-browser: Same origin policy bypass in ServiceWorker (CVE-2018-6164)

    * chromium-browser: URL spoof in Omnibox (CVE-2018-6165)

    * chromium-browser: URL spoof in Omnibox (CVE-2018-6166)

    * chromium-browser: URL spoof in Omnibox (CVE-2018-6167)

    * chromium-browser: CORS bypass in Blink (CVE-2018-6168)

    * chromium-browser: Permissions bypass in extension installation (CVE-2018-6169)

    * chromium-browser: Type confusion in PDFium (CVE-2018-6170)

    * chromium-browser: Use after free in WebBluetooth (CVE-2018-6171)

    * chromium-browser: URL spoof in Omnibox (CVE-2018-6172)

    * chromium-browser: URL spoof in Omnibox (CVE-2018-6173)

    * chromium-browser: Integer overflow in SwiftShader (CVE-2018-6174)

    * chromium-browser: URL spoof in Omnibox (CVE-2018-6175)

    * chromium-browser: Local user privilege escalation in Extensions (CVE-2018-6176)

    * chromium-browser: Cross origin information leak in Blink (CVE-2018-4117)

    * chromium-browser: Request privilege escalation in Extensions (CVE-2018-6044)

    * chromium-browser: Cross origin information leak in Blink (CVE-2018-6177)

    * chromium-browser: UI spoof in Extensions (CVE-2018-6178)

    * chromium-browser: Local file information leak in Extensions (CVE-2018-6179)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Google Chrome Releases reports :

42 security fixes in this release, including :

- [850350] High CVE-2018-6153: Stack buffer overflow in Skia. Reported by Zhen Zhou of NSFOCUS Security Team on 2018-06-07

- [848914] High CVE-2018-6154: Heap buffer overflow in WebGL. Reported by Omair on 2018-06-01

- [842265] High CVE-2018-6155: Use after free in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-05-11

- [841962] High CVE-2018-6156: Heap buffer overflow in WebRTC.
Reported by Natalie Silvanovich of Google Project Zero on 2018-05-10

- [840536] High CVE-2018-6157: Type confusion in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-05-07

- [812667] Medium CVE-2018-6150: Cross origin information disclosure in Service Workers. Reported by Rob Wu on 2018-02-15

- [805905] Medium CVE-2018-6151: Bad cast in DevTools. Reported by Rob Wu on 2018-01-25

- [805445] Medium CVE-2018-6152: Local file write in DevTools.
Reported by Rob Wu on 2018-01-24

- [841280] Medium CVE-2018-6158: Use after free in Blink. Reported by Zhe Jin, Luyao Liu from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd on 2018-05-09

- [837275] Medium CVE-2018-6159: Same origin policy bypass in ServiceWorker. Reported by Jun Kokatsu (@shhnjk) on 2018-04-26

- [839822] Medium CVE-2018-6160: URL spoof in Chrome on iOS. Reported by evi1m0 of Bilibili Security Team on 2018-05-04

- [826552] Medium CVE-2018-6161: Same origin policy bypass in WebAudio. Reported by Jun Kokatsu (@shhnjk) on 2018-03-27

- [804123] Medium CVE-2018-6162: Heap buffer overflow in WebGL.
Reported by Omair on 2018-01-21

- [849398] Medium CVE-2018-6163: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-06-04

- [848786] Medium CVE-2018-6164: Same origin policy bypass in ServiceWorker. Reported by Jun Kokatsu (@shhnjk) on 2018-06-01

- [847718] Medium CVE-2018-6165: URL spoof in Omnibox. Reported by evi1m0 of Bilibili Security Team on 2018-05-30

- [835554] Medium CVE-2018-6166: URL spoof in Omnibox. Reported by Lnyas Zhang on 2018-04-21

- [833143] Medium CVE-2018-6167: URL spoof in Omnibox. Reported by Lnyas Zhang on 2018-04-15

- [828265] Medium CVE-2018-6168: CORS bypass in Blink. Reported by Gunes Acar and Danny Y. Huang of Princeton University, Frank Li of UC Berkeley on 2018-04-03

- [394518] Medium CVE-2018-6169: Permissions bypass in extension installation. Reported by Sam P on 2014-07-16

- [862059] Medium CVE-2018-6170: Type confusion in PDFium. Reported by Anonymous on 2018-07-10

- [851799] Medium CVE-2018-6171: Use after free in WebBluetooth.
Reported by amazon@mimetics.ca on 2018-06-12

- [847242] Medium CVE-2018-6172: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-05-28

- [836885] Medium CVE-2018-6173: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-04-25

- [835299] Medium CVE-2018-6174: Integer overflow in SwiftShader.
Reported by Mark Brand of Google Project Zero on 2018-04-20

- [826019] Medium CVE-2018-6175: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-03-26

- [666824] Medium CVE-2018-6176: Local user privilege escalation in Extensions. Reported by Jann Horn of Google Project Zero on 2016-11-18

- [826187] Low CVE-2018-6177: Cross origin information leak in Blink.
Reported by Ron Masas (Imperva) on 2018-03-27

- [823194] Low CVE-2018-6178: UI spoof in Extensions. Reported by Khalil Zhani on 2018-03-19

- [816685] Low CVE-2018-6179: Local file information leak in Extensions. Reported by Anonymous on 2018-02-26

- [797461] Low CVE-2018-6044: Request privilege escalation in Extensions. Reported by Wob Wu on 2017-12-23

- [791324] Low CVE-2018-4117: Cross origin information leak in Blink.
Reported by AhsanEjaz - @AhsanEjazA on 2017-12-03

- [866821] Various fixes from internal audits, fuzzing and other initiatives

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2018-4117     AhsanEjaz discovered an information leak.

  - CVE-2018-6044     Rob Wu discovered a way to escalate privileges using     extensions.

  - CVE-2018-6150     Rob Wu discovered an information disclosure issue (this     problem was fixed in a previous release but was     mistakenly omitted from upstream's announcement at the     time).

  - CVE-2018-6151     Rob Wu discovered an issue in the developer tools (this     problem was fixed in a previous release but was     mistakenly omitted from upstream's announcement at the     time).

  - CVE-2018-6152     Rob Wu discovered an issue in the developer tools (this     problem was fixed in a previous release but was     mistakenly omitted from upstream's announcement at the     time).

  - CVE-2018-6153     Zhen Zhou discovered a buffer overflow issue in the skia     library.

  - CVE-2018-6154     Omair discovered a buffer overflow issue in the WebGL     implementation.

  - CVE-2018-6155     Natalie Silvanovich discovered a use-after-free issue in     the WebRTC implementation.

  - CVE-2018-6156     Natalie Silvanovich discovered a buffer overflow issue     in the WebRTC implementation.

  - CVE-2018-6157     Natalie Silvanovich discovered a type confusion issue in     the WebRTC implementation.

  - CVE-2018-6158     Zhe Jin discovered a use-after-free issue.

  - CVE-2018-6159     Jun Kokatsu discovered a way to bypass the same origin     policy.

  - CVE-2018-6161     Jun Kokatsu discovered a way to bypass the same origin     policy.

  - CVE-2018-6162     Omair discovered a buffer overflow issue in the WebGL     implementation.

  - CVE-2018-6163     Khalil Zhani discovered a URL spoofing issue.

  - CVE-2018-6164     Jun Kokatsu discovered a way to bypass the same origin     policy.

  - CVE-2018-6165     evil1m0 discovered a URL spoofing issue.

  - CVE-2018-6166     Lynas Zhang discovered a URL spoofing issue.

  - CVE-2018-6167     Lynas Zhang discovered a URL spoofing issue.

  - CVE-2018-6168     Gunes Acar and Danny Y. Huang discovered a way to bypass     the Cross Origin Resource Sharing policy.

  - CVE-2018-6169     Sam P discovered a way to bypass permissions when     installing extensions.

  - CVE-2018-6170     A type confusion issue was discovered in the pdfium     library.

  - CVE-2018-6171     A use-after-free issue was discovered in the     WebBluetooth implementation.

  - CVE-2018-6172     Khalil Zhani discovered a URL spoofing issue.

  - CVE-2018-6173     Khalil Zhani discovered a URL spoofing issue.

  - CVE-2018-6174     Mark Brand discovered an integer overflow issue in the     swiftshader library.

  - CVE-2018-6175     Khalil Zhani discovered a URL spoofing issue.

  - CVE-2018-6176     Jann Horn discovered a way to escalate privileges using     extensions.

  - CVE-2018-6177     Ron Masas discovered an information leak.

  - CVE-2018-6178     Khalil Zhani discovered a user interface spoofing issue.

  - CVE-2018-6179     It was discovered that information about files local to     the system could be leaked to extensions.

This version also fixes a regression introduced in the previous security update that could prevent decoding of particular audio/video codecs.

ID	Name	Product	Family	Severity
120392	Fedora 28 : chromium (2018-499f2dbc96)	Nessus	Fedora Local Security Checks	critical
117647	Fedora 27 : chromium (2018-4a16e37c81)	Nessus	Fedora Local Security Checks	critical
112075	GLSA-201808-01 : Chromium, Google Chrome: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
111487	RHEL 6 : chromium-browser (RHSA-2018:2282)	Nessus	Red Hat Local Security Checks	critical
111407	FreeBSD : chromium -- multiple vulnerabilities (b9c525d9-9198-11e8-beba-080027ef1a23)	Nessus	FreeBSD Local Security Checks	critical
111360	Debian DSA-4256-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2018-6152

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical