Out of bounds write in V8 in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

The remote CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1487 advisory.

  - Out of bounds write in V8 in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6419)

  - Use after free in audio in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6423)

  - Type Confusion in V8 in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6430)

  - Insufficient policy enforcement in full screen in Google Chrome prior to 81.0.4044.92 allowed a remote     attacker to spoof security UI via a crafted HTML page. (CVE-2020-6431)

  - Insufficient policy enforcement in navigations in Google Chrome prior to 81.0.4044.92 allowed a remote     attacker to bypass navigation restrictions via a crafted HTML page. (CVE-2020-6432)

  - Insufficient policy enforcement in extensions in Google Chrome prior to 81.0.4044.92 allowed a remote     attacker to bypass navigation restrictions via a crafted HTML page. (CVE-2020-6433)

  - Use after free in devtools in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6434)

  - Insufficient policy enforcement in extensions in Google Chrome prior to 81.0.4044.92 allowed a remote     attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML     page. (CVE-2020-6435)

  - Use after free in window management in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-6436)

  - Inappropriate implementation in WebView in Google Chrome prior to 81.0.4044.92 allowed a remote attacker     to spoof security UI via a crafted application. (CVE-2020-6437)

  - Insufficient policy enforcement in extensions in Google Chrome prior to 81.0.4044.92 allowed an attacker     who convinced a user to install a malicious extension to obtain potentially sensitive information from     process memory via a crafted Chrome Extension. (CVE-2020-6438)

  - Insufficient policy enforcement in navigations in Google Chrome prior to 81.0.4044.92 allowed a remote     attacker to bypass security UI via a crafted HTML page. (CVE-2020-6439)

  - Inappropriate implementation in extensions in Google Chrome prior to 81.0.4044.92 allowed an attacker who     convinced a user to install a malicious extension to obtain potentially sensitive information via a     crafted Chrome Extension. (CVE-2020-6440)

  - Insufficient policy enforcement in omnibox in Google Chrome prior to 81.0.4044.92 allowed a remote     attacker to bypass security UI via a crafted HTML page. (CVE-2020-6441)

  - Inappropriate implementation in cache in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to     leak cross-origin data via a crafted HTML page. (CVE-2020-6442)

  - Insufficient data validation in developer tools in Google Chrome prior to 81.0.4044.92 allowed a remote     attacker who had convinced the user to use devtools to execute arbitrary code via a crafted HTML page.
    (CVE-2020-6443)

  - Uninitialized use in WebRTC in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-6444)

  - Insufficient policy enforcement in trusted types in Google Chrome prior to 81.0.4044.92 allowed a remote     attacker to bypass content security policy via a crafted HTML page. (CVE-2020-6445, CVE-2020-6446)

  - Inappropriate implementation in developer tools in Google Chrome prior to 81.0.4044.92 allowed a remote     attacker who had convinced the user to use devtools to potentially exploit heap corruption via a crafted     HTML page. (CVE-2020-6447)

  - Use after free in V8 in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6448)

  - Use after free in extensions in Google Chrome prior to 81.0.4044.92 allowed an attacker who convinced a     user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome     Extension. (CVE-2020-6454)

  - Out of bounds read in WebSQL in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-6455)

  - Insufficient validation of untrusted input in clipboard in Google Chrome prior to 81.0.4044.92 allowed a     local attacker to bypass site isolation via crafted clipboard contents. (CVE-2020-6456)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the nodejs package has been released.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1487 advisory.

    Chromium is an open-source web browser, powered by WebKit (Blink).

    This update upgrades Chromium to version 81.0.4044.92.

    Security Fix(es):

    * chromium-browser: Use after free in audio (CVE-2020-6423)

    * chromium-browser: Use after free in extensions (CVE-2020-6454)

    * chromium-browser: Out of bounds read in WebSQL (CVE-2020-6455)

    * chromium-browser: Type Confusion in V8 (CVE-2020-6430)

    * chromium-browser: Insufficient policy enforcement in full screen (CVE-2020-6431)

    * chromium-browser: Insufficient policy enforcement in navigations (CVE-2020-6432)

    * chromium-browser: Insufficient policy enforcement in extensions (CVE-2020-6433)

    * chromium-browser: Use after free in devtools (CVE-2020-6434)

    * chromium-browser: Insufficient policy enforcement in extensions (CVE-2020-6435)

    * chromium-browser: Use after free in window management (CVE-2020-6436)

    * chromium-browser: Insufficient validation of untrusted input in clipboard (CVE-2020-6456)

    * chromium-browser: Inappropriate implementation in WebView (CVE-2020-6437)

    * chromium-browser: Insufficient policy enforcement in extensions (CVE-2020-6438)

    * chromium-browser: Insufficient policy enforcement in navigations (CVE-2020-6439)

    * chromium-browser: Inappropriate implementation in extensions (CVE-2020-6440)

    * chromium-browser: Insufficient policy enforcement in omnibox (CVE-2020-6441)

    * chromium-browser: Inappropriate implementation in cache (CVE-2020-6442)

    * chromium-browser: Insufficient data validation in developer tools (CVE-2020-6443)

    * chromium-browser: Uninitialized use in WebRTC (CVE-2020-6444)

    * chromium-browser: Insufficient policy enforcement in trusted types (CVE-2020-6445)

    * chromium-browser: Insufficient policy enforcement in trusted types (CVE-2020-6446)

    * chromium-browser: Inappropriate implementation in developer tools (CVE-2020-6447)

    * chromium-browser: Use after free in V8 (CVE-2020-6448)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
208461	CentOS 6 : chromium-browser (RHSA-2020:1487)	Nessus	CentOS Local Security Checks	high
204114	Photon OS 3.0: Nodejs PHSA-2023-3.0-0602	Nessus	PhotonOS Local Security Checks	critical
135688	RHEL 6 : chromium-browser (RHSA-2020:1487)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2020-6419

high

Tenable Plugins

high

critical

high