Inappropriate implementation in base in Google Chrome prior to 86.0.4240.193 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

The remote CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:5165 advisory.

  - Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.198 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-16013)

  - Inappropriate implementation in base in Google Chrome prior to 86.0.4240.193 allowed a remote attacker who     had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2020-16016)

  - Use after free in site isolation in Google Chrome prior to 86.0.4240.198 allowed a remote attacker who had     compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2020-16017)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple security issues were discovered in the Chromium web browser, which could result in the execution of arbitrary code, denial of service or information disclosure.

Update to 87.0.4280.66. Fixes bugs and security holes. Yay!

CVE-2020-16012 CVE-2020-16018 CVE-2020-16019 CVE-2020-16020 CVE-2020-16021 CVE-2020-16022 CVE-2020-16015 CVE-2020-16014 CVE-2020-16023 CVE-2020-16024 CVE-2020-16025 CVE-2020-16026 CVE-2020-16027 CVE-2020-16028 CVE-2020-16029 CVE-2020-16030 CVE-2020-16031 CVE-2020-16032 CVE-2020-16033 CVE-2020-16034 CVE-2020-16035 CVE-2020-16036

----

Update to 86.0.4240.198. Fixes the following security issues :

CVE-2020-16013 CVE-2020-16016 CVE-2020-16017

----

Update to 86.0.4240.183.

Fixes the following security issues: CVE-2020-16004 CVE-2020-16005 CVE-2020-16006 CVE-2020-16008 CVE-2020-16009

Also disables the very verbose output going to stdout.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:5165 advisory.

    Chromium is an open-source web browser, powered by WebKit (Blink).

    This update upgrades Chromium to version 86.0.4240.198.

    Security Fix(es):

    * chromium-browser: Inappropriate implementation in V8 (CVE-2020-16013)

    * chromium-browser: Inappropriate implementation in base (CVE-2020-16016)

    * chromium-browser: Use after free in site isolation (CVE-2020-16017)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Update to 86.0.4240.198. Fixes the following security issues :

CVE-2020-16013 CVE-2020-16016 CVE-2020-16017

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for chromium fixes the following issues :

Update to 86.0.4240.198 (boo#1178703)

  - CVE-2020-16013: Inappropriate implementation in V8

  - CVE-2020-16017: Use after free in site isolation

Update to 86.0.4240.193 (boo#1178630)

  - CVE-2020-16016: Inappropriate implementation in base.

The remote host is affected by the vulnerability described in GLSA-202011-12 (Chromium, Google Chrome: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and Google       Chrome. Please review the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The version of Microsoft Edge installed on the remote Windows host is prior to 86.0.622.68. It is, therefore, affected by a vulnerability as referenced in the ADV200002-11-11-2020 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
208553	CentOS 6 : chromium-browser (RHSA-2020:5165)	Nessus	CentOS Local Security Checks	critical
144672	Debian DSA-4824-1 : chromium - security update	Nessus	Debian Local Security Checks	critical
143227	Fedora 32 : chromium (2020-3e005ce2e0)	Nessus	Fedora Local Security Checks	critical
143164	RHEL 6 : chromium-browser (RHSA-2020:5165)	Nessus	Red Hat Local Security Checks	critical
143140	Fedora 33 : chromium (2020-2d0c0ee838)	Nessus	Fedora Local Security Checks	critical
142941	openSUSE Security Update : chromium (openSUSE-2020-1929)	Nessus	SuSE Local Security Checks	critical
142833	GLSA-202011-12 : Chromium, Google Chrome: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
142740	Microsoft Edge (Chromium) < 86.0.622.68 Vulnerability	Nessus	Windows	critical

Detections

Analytics

CVE-2020-16016

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical