Insufficient policy enforcement in trusted types in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass content security policy via a crafted HTML page.

The remote CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1487 advisory.

  - Out of bounds write in V8 in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6419)

  - Use after free in audio in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6423)

  - Type Confusion in V8 in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6430)

  - Insufficient policy enforcement in full screen in Google Chrome prior to 81.0.4044.92 allowed a remote     attacker to spoof security UI via a crafted HTML page. (CVE-2020-6431)

  - Insufficient policy enforcement in navigations in Google Chrome prior to 81.0.4044.92 allowed a remote     attacker to bypass navigation restrictions via a crafted HTML page. (CVE-2020-6432)

  - Insufficient policy enforcement in extensions in Google Chrome prior to 81.0.4044.92 allowed a remote     attacker to bypass navigation restrictions via a crafted HTML page. (CVE-2020-6433)

  - Use after free in devtools in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6434)

  - Insufficient policy enforcement in extensions in Google Chrome prior to 81.0.4044.92 allowed a remote     attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML     page. (CVE-2020-6435)

  - Use after free in window management in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-6436)

  - Inappropriate implementation in WebView in Google Chrome prior to 81.0.4044.92 allowed a remote attacker     to spoof security UI via a crafted application. (CVE-2020-6437)

  - Insufficient policy enforcement in extensions in Google Chrome prior to 81.0.4044.92 allowed an attacker     who convinced a user to install a malicious extension to obtain potentially sensitive information from     process memory via a crafted Chrome Extension. (CVE-2020-6438)

  - Insufficient policy enforcement in navigations in Google Chrome prior to 81.0.4044.92 allowed a remote     attacker to bypass security UI via a crafted HTML page. (CVE-2020-6439)

  - Inappropriate implementation in extensions in Google Chrome prior to 81.0.4044.92 allowed an attacker who     convinced a user to install a malicious extension to obtain potentially sensitive information via a     crafted Chrome Extension. (CVE-2020-6440)

  - Insufficient policy enforcement in omnibox in Google Chrome prior to 81.0.4044.92 allowed a remote     attacker to bypass security UI via a crafted HTML page. (CVE-2020-6441)

  - Inappropriate implementation in cache in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to     leak cross-origin data via a crafted HTML page. (CVE-2020-6442)

  - Insufficient data validation in developer tools in Google Chrome prior to 81.0.4044.92 allowed a remote     attacker who had convinced the user to use devtools to execute arbitrary code via a crafted HTML page.
    (CVE-2020-6443)

  - Uninitialized use in WebRTC in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-6444)

  - Insufficient policy enforcement in trusted types in Google Chrome prior to 81.0.4044.92 allowed a remote     attacker to bypass content security policy via a crafted HTML page. (CVE-2020-6445, CVE-2020-6446)

  - Inappropriate implementation in developer tools in Google Chrome prior to 81.0.4044.92 allowed a remote     attacker who had convinced the user to use devtools to potentially exploit heap corruption via a crafted     HTML page. (CVE-2020-6447)

  - Use after free in V8 in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6448)

  - Use after free in extensions in Google Chrome prior to 81.0.4044.92 allowed an attacker who convinced a     user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome     Extension. (CVE-2020-6454)

  - Out of bounds read in WebSQL in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-6455)

  - Insufficient validation of untrusted input in clipboard in Google Chrome prior to 81.0.4044.92 allowed a     local attacker to bypass site isolation via crafted clipboard contents. (CVE-2020-6456)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Microsoft Edge (Chromium) installed on the remote Windows host is prior to 81.0.416.53. It is, therefore, affected by multiple vulnerabilities:

  - A use-after-free error exists in the audio component of Microsoft Edge (Chromium). An unauthenticated,     remote attacker can exploit this, via a crafted HTML page, to potentially exploit heap corruption.
    (CVE-2020-6423)

  - A type confusion error exists in the V8 component of Microsoft Edge (Chromium). An unauthenticated, remote     attacker can exploit this, via a crafted HTML page, to potentially exploit heap corruption.
    (CVE-2020-6423)

  - An out-of-bounds read error exists in the WebSQL component of Microsoft Edge (Chromium). An     unauthenticated, remote attacker can exploit this, via a crafted HTML page, to potentially exploit heap     corruption. (CVE-2020-6455)

In addition, Microsoft Edge (Chromium) is also affected by several additional vulnerabilities and errors including additional use-after-free vulnerabilities, insufficient input validation, and insufficient policy enforcement. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2020-6423     A use-after-free issue was found in the audio     implementation.

  - CVE-2020-6430     Avihay Cohen discovered a type confusion issue in the v8     JavaScript library.

  - CVE-2020-6431     Luan Herrera discovered a policy enforcement error.

  - CVE-2020-6432     Luan Herrera discovered a policy enforcement error.

  - CVE-2020-6433     Luan Herrera discovered a policy enforcement error in     extensions.

  - CVE-2020-6434     HyungSeok Han discovered a use-after-free issue in the     developer tools.

  - CVE-2020-6435     Sergei Glazunov discovered a policy enforcement error in     extensions.

  - CVE-2020-6436     Igor Bukanov discovered a use-after-free issue.

  - CVE-2020-6437     Jann Horn discovered an implementation error in WebView.

  - CVE-2020-6438     Ng Yik Phang discovered a policy enforcement error in     extensions.

  - CVE-2020-6439     remkoboonstra discovered a policy enforcement error.

  - CVE-2020-6440     David Erceg discovered an implementation error in     extensions.

  - CVE-2020-6441     David Erceg discovered a policy enforcement error.

  - CVE-2020-6442     B@rMey discovered an implementation error in the page     cache.

  - CVE-2020-6443     @lovasoa discovered an implementation error in the     developer tools.

  - CVE-2020-6444     mlfbrown discovered an uninitialized variable in the     WebRTC implementation.

  - CVE-2020-6445     Jun Kokatsu discovered a policy enforcement error.

  - CVE-2020-6446     Jun Kokatsu discovered a policy enforcement error.

  - CVE-2020-6447     David Erceg discovered an implementation error in the     developer tools.

  - CVE-2020-6448     Guang Gong discovered a use-after-free issue in the v8     JavaScript library.

  - CVE-2020-6454     Leecraso and Guang Gong discovered a use-after-free     issue in extensions.

  - CVE-2020-6455     Nan Wang and Guang Gong discovered an out-of-bounds read     issue in the WebSQL implementation.

  - CVE-2020-6456     Michal Bentkowski discovered insufficient validation of     untrusted input.

  - CVE-2020-6457     Leecraso and Guang Gong discovered a use-after-free     issue in the speech recognizer.

  - CVE-2020-6458     Aleksandar Nikolic discoved an out-of-bounds read and     write issue in the pdfium library.

  - CVE-2020-6459     Zhe Jin discovered a use-after-free issue in the     payments implementation.

  - CVE-2020-6460     It was discovered that URL formatting was insufficiently     validated.

  - CVE-2020-6461     Zhe Jin discovered a use-after-free issue.

  - CVE-2020-6462     Zhe Jin discovered a use-after-free issue in task     scheduling.

  - CVE-2020-6463     Pawel Wylecial discovered a use-after-free issue in the     ANGLE library.

  - CVE-2020-6464     Looben Yang discovered a type confusion issue in     Blink/Webkit.

  - CVE-2020-6465     Woojin Oh discovered a use-after-free issue.

  - CVE-2020-6466     Zhe Jin discovered a use-after-free issue.

  - CVE-2020-6467     ZhanJia Song discovered a use-after-free issue in the     WebRTC implementation.

  - CVE-2020-6468     Chris Salls and Jake Corina discovered a type confusion     issue in the v8 JavaScript library.

  - CVE-2020-6469     David Erceg discovered a policy enforcement error in the     developer tools.

  - CVE-2020-6470     Michal Bentkowski discovered insufficient validation of     untrusted input.

  - CVE-2020-6471     David Erceg discovered a policy enforcement error in the     developer tools.

  - CVE-2020-6472     David Erceg discovered a policy enforcement error in the     developer tools.

  - CVE-2020-6473     Soroush Karami and Panagiotis Ilia discovered a policy     enforcement error in Blink/Webkit.

  - CVE-2020-6474     Zhe Jin discovered a use-after-free issue in     Blink/Webkit.

  - CVE-2020-6475     Khalil Zhani discovered a user interface error.

  - CVE-2020-6476     Alexandre Le Borgne discovered a policy enforcement     error.

  - CVE-2020-6478     Khalil Zhani discovered an implementation error in full     screen mode.

  - CVE-2020-6479     Zhong Zhaochen discovered an implementation error.

  - CVE-2020-6480     Marvin Witt discovered a policy enforcement error.

  - CVE-2020-6481     Rayyan Bijoora discovered a policy enforcement error.

  - CVE-2020-6482     Abdulrahman Alqabandi discovered a policy enforcement     error in the developer tools.

  - CVE-2020-6483     Jun Kokatsu discovered a policy enforcement error in     payments.

  - CVE-2020-6484     Artem Zinenko discovered insufficient validation of user     data in the ChromeDriver implementation.

  - CVE-2020-6485     Sergei Glazunov discovered a policy enforcement error.

  - CVE-2020-6486     David Erceg discovered a policy enforcement error.

  - CVE-2020-6487     Jun Kokatsu discovered a policy enforcement error.

  - CVE-2020-6488     David Erceg discovered a policy enforcement error.

  - CVE-2020-6489     @lovasoa discovered an implementation error in the     developer tools.

  - CVE-2020-6490     Insufficient validation of untrusted data was     discovered.

  - CVE-2020-6491     Sultan Haikal discovered a user interface error.

  - CVE-2020-6493     A use-after-free issue was discovered in the     WebAuthentication implementation.

  - CVE-2020-6494     Juho Nurimen discovered a user interface error.

  - CVE-2020-6495     David Erceg discovered a policy enforcement error in the     developer tools.

  - CVE-2020-6496     Khalil Zhani discovered a use-after-free issue in     payments.

  - CVE-2020-6497     Rayyan Bijoora discovered a policy enforcement issue.

  - CVE-2020-6498     Rayyan Bijoora discovered a user interface error.

  - CVE-2020-6505     Khalil Zhani discovered a use-after-free issue.

  - CVE-2020-6506     Alesandro Ortiz discovered a policy enforcement error.

  - CVE-2020-6507     Sergei Glazunov discovered an out-of-bounds write issue     in the v8 JavaScript library.

  - CVE-2020-6509     A use-after-free issue was discovered in extensions.

  - CVE-2020-6831     Natalie Silvanovich discovered a buffer overflow issue     in the SCTP library.

The description provided by Fedora was far too silly to endure. Please consult the NIST CVEs for details on these Google Chromium vulnerabilities.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Another day, another chromium update. This one fixes :

CVE-2020-6458 CVE-2020-6459 CVE-2020-6460

----

Fix dependency issue introduced when switching from a 'shared' build to a 'static' build.

----

A new major version of Chromium without any security bugs! Just kidding. Here's the CVE list :

CVE-2020-6454 CVE-2020-6423 CVE-2020-6455 CVE-2020-6430 CVE-2020-6456 CVE-2020-6431 CVE-2020-6433 CVE-2020-6434 CVE-2020-6435 CVE-2020-6436 CVE-2020-6437 CVE-2020-6438 CVE-2020-6439 CVE-2020-6440 CVE-2020-6441 CVE-2020-6442 CVE-2020-6443 CVE-2020-6444 CVE-2020-6445 CVE-2020-6446 CVE-2020-6447 CVE-2020-6448 CVE-2020-6432 CVE-2020-6457

Oh, and this build switches over to a static build, so the chromium-libs and chromium-libs-media subpackages are now obsolete, but it should be slightly better for performance.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1487 advisory.

    Chromium is an open-source web browser, powered by WebKit (Blink).

    This update upgrades Chromium to version 81.0.4044.92.

    Security Fix(es):

    * chromium-browser: Use after free in audio (CVE-2020-6423)

    * chromium-browser: Use after free in extensions (CVE-2020-6454)

    * chromium-browser: Out of bounds read in WebSQL (CVE-2020-6455)

    * chromium-browser: Type Confusion in V8 (CVE-2020-6430)

    * chromium-browser: Insufficient policy enforcement in full screen (CVE-2020-6431)

    * chromium-browser: Insufficient policy enforcement in navigations (CVE-2020-6432)

    * chromium-browser: Insufficient policy enforcement in extensions (CVE-2020-6433)

    * chromium-browser: Use after free in devtools (CVE-2020-6434)

    * chromium-browser: Insufficient policy enforcement in extensions (CVE-2020-6435)

    * chromium-browser: Use after free in window management (CVE-2020-6436)

    * chromium-browser: Insufficient validation of untrusted input in clipboard (CVE-2020-6456)

    * chromium-browser: Inappropriate implementation in WebView (CVE-2020-6437)

    * chromium-browser: Insufficient policy enforcement in extensions (CVE-2020-6438)

    * chromium-browser: Insufficient policy enforcement in navigations (CVE-2020-6439)

    * chromium-browser: Inappropriate implementation in extensions (CVE-2020-6440)

    * chromium-browser: Insufficient policy enforcement in omnibox (CVE-2020-6441)

    * chromium-browser: Inappropriate implementation in cache (CVE-2020-6442)

    * chromium-browser: Insufficient data validation in developer tools (CVE-2020-6443)

    * chromium-browser: Uninitialized use in WebRTC (CVE-2020-6444)

    * chromium-browser: Insufficient policy enforcement in trusted types (CVE-2020-6445)

    * chromium-browser: Insufficient policy enforcement in trusted types (CVE-2020-6446)

    * chromium-browser: Inappropriate implementation in developer tools (CVE-2020-6447)

    * chromium-browser: Use after free in V8 (CVE-2020-6448)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for chromium fixes the following issues :

Chromium was updated to 81.0.4044.92 boo#1168911 :

  - CVE-2020-6454: Use after free in extensions

  - CVE-2020-6423: Use after free in audio

  - CVE-2020-6455: Out of bounds read in WebSQL

  - CVE-2020-6430: Type Confusion in V8

  - CVE-2020-6456: Insufficient validation of untrusted     input in clipboard

  - CVE-2020-6431: Insufficient policy enforcement in full     screen

  - CVE-2020-6432: Insufficient policy enforcement in     navigations

  - CVE-2020-6433: Insufficient policy enforcement in     extensions

  - CVE-2020-6434: Use after free in devtools

  - CVE-2020-6435: Insufficient policy enforcement in     extensions

  - CVE-2020-6436: Use after free in window management

  - CVE-2020-6437: Inappropriate implementation in WebView

  - CVE-2020-6438: Insufficient policy enforcement in     extensions

  - CVE-2020-6439: Insufficient policy enforcement in     navigations

  - CVE-2020-6440: Inappropriate implementation in     extensions

  - CVE-2020-6441: Insufficient policy enforcement in     omnibox

  - CVE-2020-6442: Inappropriate implementation in cache

  - CVE-2020-6443: Insufficient data validation in developer     tools

  - CVE-2020-6444: Uninitialized Use in WebRTC

  - CVE-2020-6445: Insufficient policy enforcement in     trusted types

  - CVE-2020-6446: Insufficient policy enforcement in     trusted types

  - CVE-2020-6447: Inappropriate implementation in developer     tools

  - CVE-2020-6448: Use after free in V8

Chromium was updated to 80.0.3987.162 boo#1168421 :

  - CVE-2020-6450: Use after free in WebAudio.

  - CVE-2020-6451: Use after free in WebAudio.

  - CVE-2020-6452: Heap buffer overflow in media.

  - Use a symbolic icon for GNOME

The remote host is affected by the vulnerability described in GLSA-202004-09 (Chromium, Google Chrome: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and Google       Chrome. Please review the referenced CVE identifiers for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted HTML       or multimedia file using Chromium or Google Chrome, possibly resulting in       execution of arbitrary code with the privileges of the process or a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Google Chrome Releases reports :

This updates includes 32 security fixes, including :

- [1019161] High CVE-2020-6454: Use after free in extensions. Reported by Leecraso and Guang Gong of Alpha Lab, Qihoo 360 on 2019-10-29

- [1043446] High CVE-2020-6423: Use after free in audio. Reported by Anonymous on 2020-01-18

- [1059669] High CVE-2020-6455: Out of bounds read in WebSQL. Reported by Nan Wang(@eternalsakura13) and Guang Gong of Alpha Lab, Qihoo 360 on 2020-03-09

- [1031479] Medium CVE-2020-6430: Type Confusion in V8. Reported by Avihay Cohen @ SeraphicAlgorithms on 2019-12-06

- [1040755] Medium CVE-2020-6456: Insufficient validation of untrusted input in clipboard. Reported by Michal Bentkowski of Securitum on 2020-01-10

- [852645] Medium CVE-2020-6431: Insufficient policy enforcement in full screen. Reported by Luan Herrera (@lbherrera_) on 2018-06-14

- [965611] Medium CVE-2020-6432: Insufficient policy enforcement in navigations. Reported by David Erceg on 2019-05-21

- [1043965] Medium CVE-2020-6433: Insufficient policy enforcement in extensions. Reported by David Erceg on 2020-01-21

- [1048555] Medium CVE-2020-6434: Use after free in devtools. Reported by HyungSeok Han (DaramG) of Theori on 2020-02-04

- [1032158] Medium CVE-2020-6435: Insufficient policy enforcement in extensions. Reported by Sergei Glazunov of Google Project Zero on 2019-12-09

- [1034519] Medium CVE-2020-6436: Use after free in window management.
Reported by Igor Bukanov from Vivaldi on 2019-12-16

- [639173] Low CVE-2020-6437: Inappropriate implementation in WebView.
Reported by Jann Horn on 2016-08-19

- [714617] Low CVE-2020-6438: Insufficient policy enforcement in extensions. Reported by Ng Yik Phang on 2017-04-24

- [868145] Low CVE-2020-6439: Insufficient policy enforcement in navigations. Reported by remkoboonstra on 2018-07-26

- [894477] Low CVE-2020-6440: Inappropriate implementation in extensions. Reported by David Erceg on 2018-10-11

- [959571] Low CVE-2020-6441: Insufficient policy enforcement in omnibox. Reported by David Erceg on 2019-05-04

- [1013906] Low CVE-2020-6442: Inappropriate implementation in cache.
Reported by B@rMey on 2019-10-12

- [1040080] Low CVE-2020-6443: Insufficient data validation in developer tools. Reported by @lovasoa (Ophir LOJKINE) on 2020-01-08

- [922882] Low CVE-2020-6444: Uninitialized Use in WebRTC. Reported by mlfbrown on 2019-01-17

- [933171] Low CVE-2020-6445: Insufficient policy enforcement in trusted types. Reported by Jun Kokatsu, Microsoft Browser Vulnerability Research on 2019-02-18

- [933172] Low CVE-2020-6446: Insufficient policy enforcement in trusted types. Reported by Jun Kokatsu, Microsoft Browser Vulnerability Research on 2019-02-18

- [991217] Low CVE-2020-6447: Inappropriate implementation in developer tools. Reported by David Erceg on 2019-08-06

- [1037872] Low CVE-2020-6448: Use after free in V8. Reported by Guang Gong of Alpha Lab, Qihoo 360 on 2019-12-26

The version of Google Chrome installed on the remote Windows host is prior to 81.0.4044.92. It is, therefore, affected by multiple vulnerabilities as referenced in the 2020_04_stable-channel-update-for-desktop_7 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote macOS host is prior to 81.0.4044.92. It is, therefore, affected by multiple vulnerabilities as referenced in the 2020_04_stable-channel-update-for-desktop_7 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
208461	CentOS 6 : chromium-browser (RHSA-2020:1487)	Nessus	CentOS Local Security Checks	high
138336	Microsoft Edge (Chromium) < 81.0.416.53 Multiple Vulnerabilities	Nessus	Windows	high
138066	Debian DSA-4714-1 : chromium - security update	Nessus	Debian Local Security Checks	critical
136685	Fedora 31 : chromium (2020-da49fbb17c)	Nessus	Fedora Local Security Checks	critical
136293	Fedora 30 : chromium (2020-0e7f1b663b)	Nessus	Fedora Local Security Checks	critical
135688	RHEL 6 : chromium-browser (RHSA-2020:1487)	Nessus	Red Hat Local Security Checks	high
135577	openSUSE Security Update : chromium (openSUSE-2020-519)	Nessus	SuSE Local Security Checks	high
135427	GLSA-202004-09 : Chromium, Google Chrome: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
135425	FreeBSD : chromium -- multiple vulnerabilities (6e3b700a-7ca3-11ea-b594-3065ec8fd3ec)	Nessus	FreeBSD Local Security Checks	high
135401	Google Chrome < 81.0.4044.92 Multiple Vulnerabilities	Nessus	Windows	high
135400	Google Chrome < 81.0.4044.92 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high

Detections

Analytics

CVE-2020-6445

medium

Tenable Plugins

high

high

critical

critical

critical

high

high

high

high

high

high