Use after free in offline mode in Google Chrome prior to 77.0.3865.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

The remote host is affected by the vulnerability described in GLSA-201911-06 (Chromium, Google Chrome: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and Google       Chrome. Please review the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2019-5869     Zhe Jin discovered a use-after-free issue.

  - CVE-2019-5870     Guang Gong discovered a use-after-free issue.

  - CVE-2019-5871     A buffer overflow issue was discovered in the skia     library.

  - CVE-2019-5872     Zhe Jin discovered a use-after-free issue.

  - CVE-2019-5874     James Lee discovered an issue with external Uniform     Resource Identifiers.

  - CVE-2019-5875     Khalil Zhani discovered a URL spoofing issue.

  - CVE-2019-5876     Man Yue Mo discovered a use-after-free issue.

  - CVE-2019-5877     Guang Gong discovered an out-of-bounds read issue.

  - CVE-2019-5878     Guang Gong discovered an use-after-free issue in the v8     JavaScript library.

  - CVE-2019-5879     Jinseo Kim discover that extensions could read files on     the local system.

  - CVE-2019-5880     Jun Kokatsu discovered a way to bypass the SameSite     cookie feature.

  - CVE-2019-13659     Lnyas Zhang discovered a URL spoofing issue.

  - CVE-2019-13660     Wenxu Wu discovered a user interface error in full     screen mode.

  - CVE-2019-13661     Wenxu Wu discovered a user interface spoofing issue in     full screen mode.

  - CVE-2019-13662     David Erceg discovered a way to bypass the Content     Security Policy.

  - CVE-2019-13663     Lnyas Zhang discovered a way to spoof Internationalized     Domain Names.

  - CVE-2019-13664     Thomas Shadwell discovered a way to bypass the SameSite     cookie feature.

  - CVE-2019-13665     Jun Kokatsu discovered a way to bypass the multiple file     download protection feature.

  - CVE-2019-13666     Tom Van Goethem discovered an information leak.

  - CVE-2019-13667     Khalil Zhani discovered a URL spoofing issue.

  - CVE-2019-13668     David Erceg discovered an information leak.

  - CVE-2019-13669     Khalil Zhani discovered an authentication spoofing     issue.

  - CVE-2019-13670     Guang Gong discovered a memory corruption issue in the     v8 JavaScript library.

  - CVE-2019-13671     xisigr discovered a user interface error.

  - CVE-2019-13673     David Erceg discovered an information leak.

  - CVE-2019-13674     Khalil Zhani discovered a way to spoof Internationalized     Domain Names.

  - CVE-2019-13675     Jun Kokatsu discovered a way to disable extensions.

  - CVE-2019-13676     Wenxu Wu discovered an error in a certificate warning.

  - CVE-2019-13677     Jun Kokatsu discovered an error in the chrome web store.

  - CVE-2019-13678     Ronni Skansing discovered a spoofing issue in the     download dialog window.

  - CVE-2019-13679     Conrad Irwin discovered that user activation was not     required for printing.

  - CVE-2019-13680     Thijs Alkamade discovered an IP address spoofing issue.

  - CVE-2019-13681     David Erceg discovered a way to bypass download     restrictions.

  - CVE-2019-13682     Jun Kokatsu discovered a way to bypass the site     isolation feature.

  - CVE-2019-13683     David Erceg discovered an information leak.

  - CVE-2019-13685     Khalil Zhani discovered a use-after-free issue.

  - CVE-2019-13686     Brendon discovered a use-after-free issue.

  - CVE-2019-13687     Man Yue Mo discovered a use-after-free issue.

  - CVE-2019-13688     Man Yue Mo discovered a use-after-free issue.

  - CVE-2019-13691     David Erceg discovered a user interface spoofing issue.

  - CVE-2019-13692     Jun Kokatsu discovered a way to bypass the Same Origin     Policy.

  - CVE-2019-13693     Guang Gong discovered a use-after-free issue.

  - CVE-2019-13694     banananapenguin discovered a use-after-free issue.

  - CVE-2019-13695     Man Yue Mo discovered a use-after-free issue.

  - CVE-2019-13696     Guang Gong discovered a use-after-free issue in the v8     JavaScript library.

  - CVE-2019-13697     Luan Herrera discovered an information leak.

  - CVE-2019-13699     Man Yue Mo discovered a use-after-free issue.

  - CVE-2019-13700     Man Yue Mo discovered a buffer overflow issue.

  - CVE-2019-13701     David Erceg discovered a URL spoofing issue.

  - CVE-2019-13702     Phillip Langlois and Edward Torkington discovered a     privilege escalation issue in the installer.

  - CVE-2019-13703     Khalil Zhani discovered a URL spoofing issue.

  - CVE-2019-13704     Jun Kokatsu discovered a way to bypass the Content     Security Policy.

  - CVE-2019-13705     Luan Herrera discovered a way to bypass extension     permissions.

  - CVE-2019-13706     pdknsk discovered an out-of-bounds read issue in the     pdfium library.

  - CVE-2019-13707     Andrea Palazzo discovered an information leak.

  - CVE-2019-13708     Khalil Zhani discovered an authentication spoofing     issue.

  - CVE-2019-13709     Zhong Zhaochen discovered a way to bypass download     restrictions.

  - CVE-2019-13710     bernardo.mrod discovered a way to bypass download     restrictions.

  - CVE-2019-13711     David Erceg discovered an information leak.

  - CVE-2019-13713     David Erceg discovered an information leak.

  - CVE-2019-13714     Jun Kokatsu discovered an issue with Cascading Style     Sheets.

  - CVE-2019-13715     xisigr discovered a URL spoofing issue.

  - CVE-2019-13716     Barron Hagerman discovered an error in the service     worker implementation.

  - CVE-2019-13717     xisigr discovered a user interface spoofing issue.

  - CVE-2019-13718     Khalil Zhani discovered a way to spoof Internationalized     Domain Names.

  - CVE-2019-13719     Khalil Zhani discovered a user interface spoofing issue.

  - CVE-2019-13720     Anton Ivanov and Alexey Kulaev discovered a     use-after-free issue.

  - CVE-2019-13721     banananapenguin discovered a use-after-free issue in the     pdfium library.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:3211 advisory.

    Chromium is an open-source web browser, powered by WebKit (Blink).

    This update upgrades Chromium to version 77.0.3865.120.

    Security Fix(es):

    * chromium-browser: Use-after-free in media (CVE-2019-5870)

    * chromium-browser: Heap overflow in Skia (CVE-2019-5871)

    * chromium-browser: Use-after-free in Mojo (CVE-2019-5872)

    * chromium-browser: External URIs may trigger other browsers (CVE-2019-5874)

    * chromium-browser: URL bar spoof via download redirect (CVE-2019-5875)

    * chromium-browser: Use-after-free in media (CVE-2019-5876)

    * chromium-browser: Out-of-bounds access in V8 (CVE-2019-5877)

    * chromium-browser: Use-after-free in V8 (CVE-2019-5878)

    * chromium-browser: Use-after-free in offline pages (CVE-2019-13686)

    * chromium-browser: Use-after-free in media (CVE-2019-13688)

    * chromium-browser: Omnibox spoof (CVE-2019-13691)

    * chromium-browser: SOP bypass (CVE-2019-13692)

    * chromium-browser: Use-after-free in IndexedDB (CVE-2019-13693)

    * chromium-browser: Use-after-free in WebRTC (CVE-2019-13694)

    * chromium-browser: Use-after-free in audio (CVE-2019-13695)

    * chromium-browser: Use-after-free in V8 (CVE-2019-13696)

    * chromium-browser: Cross-origin size leak (CVE-2019-13697)

    * chromium-browser: Extensions can read some local files (CVE-2019-5879)

    * chromium-browser: SameSite cookie bypass (CVE-2019-5880)

    * chromium-browser: Arbitrary read in SwiftShader (CVE-2019-5881)

    * chromium-browser: URL spoof (CVE-2019-13659)

    * chromium-browser: Full screen notification overlap (CVE-2019-13660)

    * chromium-browser: Full screen notification spoof (CVE-2019-13661)

    * chromium-browser: CSP bypass (CVE-2019-13662)

    * chromium-browser: IDN spoof (CVE-2019-13663)

    * chromium-browser: CSRF bypass (CVE-2019-13664)

    * chromium-browser: Multiple file download protection bypass (CVE-2019-13665)

    * chromium-browser: Side channel using storage size estimate (CVE-2019-13666)

    * chromium-browser: URI bar spoof when using external app URIs (CVE-2019-13667)

    * chromium-browser: Global window leak via console (CVE-2019-13668)

    * chromium-browser: HTTP authentication spoof (CVE-2019-13669)

    * chromium-browser: V8 memory corruption in regex (CVE-2019-13670)

    * chromium-browser: Dialog box fails to show origin (CVE-2019-13671)

    * chromium-browser: Cross-origin information leak using devtools (CVE-2019-13673)

    * chromium-browser: IDN spoofing (CVE-2019-13674)

    * chromium-browser: Extensions can be disabled by trailing slash (CVE-2019-13675)

    * chromium-browser: Google URI shown for certificate warning (CVE-2019-13676)

    * chromium-browser: Chrome web store origin needs to be isolated (CVE-2019-13677)

    * chromium-browser: Download dialog spoofing (CVE-2019-13678)

    * chromium-browser: User gesture needed for printing (CVE-2019-13679)

    * chromium-browser: IP address spoofing to servers (CVE-2019-13680)

    * chromium-browser: Bypass on download restrictions (CVE-2019-13681)

    * chromium-browser: Site isolation bypass (CVE-2019-13682)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for chromium to version 77.0.3865.90 fixes the following issues :

  - CVE-2019-13685: Fixed a use-after-free in UI.
    (boo#1151229)

  - CVE-2019-13688: Fixed a use-after-free in media.
    (boo#1151229)

  - CVE-2019-13687: Fixed a use-after-free in media.
    (boo#1151229)

  - CVE-2019-13686: Fixed a use-after-free in offline pages.
    (boo#1151229)

The version of Google Chrome installed on the remote Windows host is prior to 77.0.3865.90. It is, therefore, affected by multiple vulnerabilities as referenced in the 2019_09_stable-channel-update-for-desktop_18 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote macOS host is prior to 77.0.3865.90. It is, therefore, affected by multiple vulnerabilities as referenced in the 2019_09_stable-channel-update-for-desktop_18 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
131266	GLSA-201911-06 : Chromium, Google Chrome: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
130774	Debian DSA-4562-1 : chromium - security update	Nessus	Debian Local Security Checks	critical
130372	RHEL 6 : chromium-browser (RHSA-2019:3211)	Nessus	Red Hat Local Security Checks	critical
129378	openSUSE Security Update : chromium (openSUSE-2019-2186)	Nessus	SuSE Local Security Checks	high
129054	Google Chrome < 77.0.3865.90 Multiple Vulnerabilities	Nessus	Windows	high
129053	Google Chrome < 77.0.3865.90 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high

Detections

Analytics

CVE-2019-13686

high

Tenable Plugins

critical

critical

critical

high

high

high