Race in image burner in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a remote attacker who had compromised the browser process to perform OS-level privilege escalation via a malicious file.

The version of Google Chrome installed on the remote macOS host is prior to 87.0.4280.67. It is, therefore, affected by multiple vulnerabilities as referenced in the 2020_11_stable-channel-update-for-desktop_17 advisory.

  - Use after free in payments in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had     compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2020-16018)

  - Inappropriate implementation in filesystem in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a     remote attacker who had compromised the browser process to bypass noexec restrictions via a malicious     file. (CVE-2020-16019)

  - Inappropriate implementation in cryptohome in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a     remote attacker who had compromised the browser process to bypass discretionary access control via a     malicious file. (CVE-2020-16020)

  - Race in image burner in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a remote attacker who had     compromised the browser process to perform OS-level privilege escalation via a malicious file.
    (CVE-2020-16021)

  - Insufficient policy enforcement in networking in Google Chrome prior to 87.0.4280.66 allowed a remote     attacker to potentially bypass firewall controls via a crafted HTML page. (CVE-2020-16022)

  - Insufficient data validation in WASM in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-16015)

  - Use after free in PPAPI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had     compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2020-16014)

  - Use after free in WebCodecs in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-16023)

  - Heap buffer overflow in UI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had     compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2020-16024)

  - Heap buffer overflow in clipboard in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had     compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2020-16025)

  - Use after Free in Payments in Google Chrome on Android prior to 87.0.4280.66 allowed a remote attacker who     had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2020-16045)

  - Use after free in WebRTC in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-16026)

  - Insufficient policy enforcement in developer tools in Google Chrome prior to 87.0.4280.66 allowed an     attacker who convinced a user to install a malicious extension to obtain potentially sensitive information     from the user's disk via a crafted Chrome Extension. (CVE-2020-16027)

  - Heap buffer overflow in WebRTC in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-16028)

  - Inappropriate implementation in PDFium in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to     bypass navigation restrictions via a crafted PDF file. (CVE-2020-16029)

  - Insufficient data validation in Blink in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to     inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (CVE-2020-16030)

  - Adobe Flash Player version 32.0.0.192 and earlier versions have a Same Origin Policy Bypass vulnerability.
    Successful exploitation could lead to Information Disclosure in the context of the current user.
    (CVE-2019-8075)

  - Insufficient data validation in UI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to     spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (CVE-2020-16031)

  - Insufficient data validation in sharing in Google Chrome prior to 87.0.4280.66 allowed a remote attacker     to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (CVE-2020-16032)

  - Inappropriate implementation in WebUSB in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to     spoof security UI via a crafted HTML page. (CVE-2020-16033)

  - Inappropriate implementation in WebRTC in Google Chrome prior to 87.0.4280.66 allowed a local attacker to     bypass policy restrictions via a crafted HTML page. (CVE-2020-16034)

  - Insufficient data validation in cros-disks in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a     remote attacker who had compromised the browser process to bypass noexec restrictions via a malicious     file. (CVE-2020-16035)

  - Side-channel information leakage in graphics in Google Chrome prior to 87.0.4280.66 allowed a remote     attacker to leak cross-origin data via a crafted HTML page. (CVE-2020-16012)

  - Inappropriate implementation in cookies in Google Chrome prior to 87.0.4280.66 allowed a remote attacker     to bypass cookie restrictions via a crafted HTML page. (CVE-2020-16036)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - chromium-browser: Heap buffer overflow in clipboard (CVE-2020-16025)

  - chromium-browser: Insufficient data validation in cros-disks (CVE-2020-16035)

  - The function ParseVP9SuperFrameIndex in common/libwebm_util.cc in libwebm through 2018-01-30 does not     validate the child_frame_length data obtained from a .webm file, which allows remote attackers to cause an     information leak or a denial of service (heap-based buffer over-read and later out-of-bounds write), or     possibly have unspecified other impact. (CVE-2018-6406)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

Multiple security issues were discovered in the Chromium web browser, which could result in the execution of arbitrary code, denial of service or information disclosure.

The remote host is affected by the vulnerability described in GLSA-202012-05 (Chromium, Google Chrome: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and Google       Chrome. Please review the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

This update for chromium fixes the following issues :

  - Update to 87.0.4280.66 (boo#1178923)

  - Wayland support by default

  - CVE-2020-16018: Use after free in payments. 

  - CVE-2020-16019: Inappropriate implementation in     filesystem. 

  - CVE-2020-16020: Inappropriate implementation in     cryptohome. 

  - CVE-2020-16021: Race in ImageBurner. 

  - CVE-2020-16022: Insufficient policy enforcement in     networking. 

  - CVE-2020-16015: Insufficient data validation in WASM. R

  - CVE-2020-16014: Use after free in PPAPI. 

  - CVE-2020-16023: Use after free in WebCodecs. 

  - CVE-2020-16024: Heap buffer overflow in UI.

  - CVE-2020-16025: Heap buffer overflow in clipboard. 

  - CVE-2020-16026: Use after free in WebRTC. 

  - CVE-2020-16027: Insufficient policy enforcement in     developer tools. R

  - CVE-2020-16028: Heap buffer overflow in WebRTC. 

  - CVE-2020-16029: Inappropriate implementation in PDFium. 

  - CVE-2020-16030: Insufficient data validation in Blink. 

  - CVE-2019-8075: Insufficient data validation in Flash. 

  - CVE-2020-16031: Incorrect security UI in tab preview. 

  - CVE-2020-16032: Incorrect security UI in sharing.

  - CVE-2020-16033: Incorrect security UI in WebUSB. 

  - CVE-2020-16034: Inappropriate implementation in WebRTC. 

  - CVE-2020-16035: Insufficient data validation in     cros-disks.

  - CVE-2020-16012: Side-channel information leakage in     graphics. 

  - CVE-2020-16036: Inappropriate implementation in cookies.

Update to 87.0.4280.66. Fixes bugs and security holes. Yay!

CVE-2020-16012 CVE-2020-16018 CVE-2020-16019 CVE-2020-16020 CVE-2020-16021 CVE-2020-16022 CVE-2020-16015 CVE-2020-16014 CVE-2020-16023 CVE-2020-16024 CVE-2020-16025 CVE-2020-16026 CVE-2020-16027 CVE-2020-16028 CVE-2020-16029 CVE-2020-16030 CVE-2020-16031 CVE-2020-16032 CVE-2020-16033 CVE-2020-16034 CVE-2020-16035 CVE-2020-16036

----

Update to 86.0.4240.198. Fixes the following security issues :

CVE-2020-16013 CVE-2020-16016 CVE-2020-16017

----

Update to 86.0.4240.183.

Fixes the following security issues: CVE-2020-16004 CVE-2020-16005 CVE-2020-16006 CVE-2020-16008 CVE-2020-16009

Also disables the very verbose output going to stdout.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 87.0.4280.66. Fixes bugs and security holes. Yay!

CVE-2020-16012 CVE-2020-16018 CVE-2020-16019 CVE-2020-16020 CVE-2020-16021 CVE-2020-16022 CVE-2020-16015 CVE-2020-16014 CVE-2020-16023 CVE-2020-16024 CVE-2020-16025 CVE-2020-16026 CVE-2020-16027 CVE-2020-16028 CVE-2020-16029 CVE-2020-16030 CVE-2020-16031 CVE-2020-16032 CVE-2020-16033 CVE-2020-16034 CVE-2020-16035 CVE-2020-16036

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Google Chrome installed on the remote Windows host is prior to 87.0.4280.66. It is, therefore, affected by multiple vulnerabilities as referenced in the 2020_11_stable-channel-update-for-desktop_17 advisory.

  - Use after free in payments in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had     compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2020-16018)

  - Inappropriate implementation in filesystem in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a     remote attacker who had compromised the browser process to bypass noexec restrictions via a malicious     file. (CVE-2020-16019)

  - Inappropriate implementation in cryptohome in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a     remote attacker who had compromised the browser process to bypass discretionary access control via a     malicious file. (CVE-2020-16020)

  - Race in image burner in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a remote attacker who had     compromised the browser process to perform OS-level privilege escalation via a malicious file.
    (CVE-2020-16021)

  - Insufficient policy enforcement in networking in Google Chrome prior to 87.0.4280.66 allowed a remote     attacker to potentially bypass firewall controls via a crafted HTML page. (CVE-2020-16022)

  - Insufficient data validation in WASM in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-16015)

  - Use after free in PPAPI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had     compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2020-16014)

  - Use after free in WebCodecs in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-16023)

  - Heap buffer overflow in UI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had     compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2020-16024)

  - Heap buffer overflow in clipboard in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had     compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2020-16025)

  - Use after Free in Payments in Google Chrome on Android prior to 87.0.4280.66 allowed a remote attacker who     had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2020-16045)

  - Use after free in WebRTC in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-16026)

  - Insufficient policy enforcement in developer tools in Google Chrome prior to 87.0.4280.66 allowed an     attacker who convinced a user to install a malicious extension to obtain potentially sensitive information     from the user's disk via a crafted Chrome Extension. (CVE-2020-16027)

  - Heap buffer overflow in WebRTC in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-16028)

  - Inappropriate implementation in PDFium in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to     bypass navigation restrictions via a crafted PDF file. (CVE-2020-16029)

  - Insufficient data validation in Blink in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to     inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (CVE-2020-16030)

  - Adobe Flash Player version 32.0.0.192 and earlier versions have a Same Origin Policy Bypass vulnerability.
    Successful exploitation could lead to Information Disclosure in the context of the current user.
    (CVE-2019-8075)

  - Insufficient data validation in UI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to     spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (CVE-2020-16031)

  - Insufficient data validation in sharing in Google Chrome prior to 87.0.4280.66 allowed a remote attacker     to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (CVE-2020-16032)

  - Inappropriate implementation in WebUSB in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to     spoof security UI via a crafted HTML page. (CVE-2020-16033)

  - Inappropriate implementation in WebRTC in Google Chrome prior to 87.0.4280.66 allowed a local attacker to     bypass policy restrictions via a crafted HTML page. (CVE-2020-16034)

  - Insufficient data validation in cros-disks in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a     remote attacker who had compromised the browser process to bypass noexec restrictions via a malicious     file. (CVE-2020-16035)

  - Side-channel information leakage in graphics in Google Chrome prior to 87.0.4280.66 allowed a remote     attacker to leak cross-origin data via a crafted HTML page. (CVE-2020-16012)

  - Inappropriate implementation in cookies in Google Chrome prior to 87.0.4280.66 allowed a remote attacker     to bypass cookie restrictions via a crafted HTML page. (CVE-2020-16036)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
209562	Google Chrome < 87.0.4280.67 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
198723	RHEL 6 : chromium-browser (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
144672	Debian DSA-4824-1 : chromium - security update	Nessus	Debian Local Security Checks	critical
143495	GLSA-202012-05 : Chromium, Google Chrome: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
143333	openSUSE Security Update : chromium (openSUSE-2020-2021)	Nessus	SuSE Local Security Checks	critical
143303	openSUSE Security Update : chromium (openSUSE-2020-2032)	Nessus	SuSE Local Security Checks	critical
143227	Fedora 32 : chromium (2020-3e005ce2e0)	Nessus	Fedora Local Security Checks	critical
143176	Fedora 33 : chromium (2020-10ec8aca61)	Nessus	Fedora Local Security Checks	critical
142971	Google Chrome < 87.0.4280.66 Multiple Vulnerabilities	Nessus	Windows	critical

Detections

Analytics

CVE-2020-16021

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical