Use after free in payments in Google Chrome on MacOS prior to 83.0.4103.97 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.

The remote CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2544 advisory.

  - Use after free in reader mode in Google Chrome on Android prior to 83.0.4103.61 allowed a remote attacker     who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2020-6465)

  - Use after free in media in Google Chrome prior to 83.0.4103.61 allowed a remote attacker who had     compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2020-6466)

  - Use after free in WebRTC in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6467)

  - Type confusion in V8 in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6468)

  - Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.61 allowed an     attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via     a crafted Chrome Extension. (CVE-2020-6469, CVE-2020-6471)

  - Insufficient validation of untrusted input in clipboard in Google Chrome prior to 83.0.4103.61 allowed a     local attacker to inject arbitrary scripts or HTML (UXSS) via crafted clipboard contents. (CVE-2020-6470)

  - Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.61 allowed an     attacker who convinced a user to install a malicious extension to obtain potentially sensitive information     from process memory or disk via a crafted Chrome Extension. (CVE-2020-6472)

  - Insufficient policy enforcement in Blink in Google Chrome prior to 83.0.4103.61 allowed a remote attacker     to obtain potentially sensitive information from process memory via a crafted HTML page. (CVE-2020-6473)

  - Use after free in Blink in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6474)

  - Incorrect implementation in full screen in Google Chrome prior to 83.0.4103.61 allowed a remote attacker     to spoof security UI via a crafted HTML page. (CVE-2020-6475)

  - Insufficient policy enforcement in tab strip in Google Chrome prior to 83.0.4103.61 allowed an attacker     who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted     Chrome Extension. (CVE-2020-6476)

  - Inappropriate implementation in full screen in Google Chrome prior to 83.0.4103.61 allowed a remote     attacker to spoof security UI via a crafted HTML page. (CVE-2020-6478)

  - Inappropriate implementation in sharing in Google Chrome prior to 83.0.4103.61 allowed a remote attacker     to spoof security UI via a crafted HTML page. (CVE-2020-6479)

  - Insufficient policy enforcement in enterprise in Google Chrome prior to 83.0.4103.61 allowed a local     attacker to bypass navigation restrictions via UI actions. (CVE-2020-6480)

  - Insufficient policy enforcement in URL formatting in Google Chrome prior to 83.0.4103.61 allowed a remote     attacker to perform domain spoofing via a crafted domain name. (CVE-2020-6481)

  - Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.61 allowed an     attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a     crafted Chrome Extension. (CVE-2020-6482)

  - Insufficient policy enforcement in payments in Google Chrome prior to 83.0.4103.61 allowed a remote     attacker to bypass navigation restrictions via a crafted HTML page. (CVE-2020-6483)

  - Insufficient data validation in ChromeDriver in Google Chrome prior to 83.0.4103.61 allowed a remote     attacker to bypass navigation restrictions via a crafted request. (CVE-2020-6484)

  - Insufficient data validation in media router in Google Chrome prior to 83.0.4103.61 allowed a remote     attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML     page. (CVE-2020-6485)

  - Insufficient policy enforcement in navigations in Google Chrome prior to 83.0.4103.61 allowed a remote     attacker to bypass navigation restrictions via a crafted HTML page. (CVE-2020-6486)

  - Insufficient policy enforcement in downloads in Google Chrome prior to 83.0.4103.61 allowed a remote     attacker to bypass navigation restrictions via a crafted HTML page. (CVE-2020-6487, CVE-2020-6488)

  - Inappropriate implementation in developer tools in Google Chrome prior to 83.0.4103.61 allowed a remote     attacker who had convinced the user to take certain actions in developer tools to obtain potentially     sensitive information from disk via a crafted HTML page. (CVE-2020-6489)

  - Insufficient data validation in loader in Google Chrome prior to 83.0.4103.61 allowed a remote attacker     who had been able to write to disk to leak cross-origin data via a crafted HTML page. (CVE-2020-6490)

  - Insufficient data validation in site information in Google Chrome prior to 83.0.4103.61 allowed a remote     attacker to spoof security UI via a crafted domain name. (CVE-2020-6491)

  - Use after free in WebAuthentication in Google Chrome prior to 83.0.4103.97 allowed a remote attacker who     had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2020-6493)

  - Incorrect security UI in payments in Google Chrome on Android prior to 83.0.4103.97 allowed a remote     attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (CVE-2020-6494)

  - Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.97 allowed an     attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via     a crafted Chrome Extension. (CVE-2020-6495)

  - Use after free in payments in Google Chrome on MacOS prior to 83.0.4103.97 allowed a remote attacker to     potentially perform a sandbox escape via a crafted HTML page. (CVE-2020-6496)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for chromium fixes the following issues :

Chromium was updated to 83.0.4103.97 (boo#1171910,bsc#1172496) :

  - CVE-2020-6463: Use after free in ANGLE (boo#1170107     boo#1171975).

  - CVE-2020-6465: Use after free in reader mode. Reported     by Woojin Oh(@pwn_expoit) of STEALIEN on 2020-04-21

  - CVE-2020-6466: Use after free in media. Reported by Zhe     Jin from cdsrc of Qihoo 360 on 2020-04-26

  - CVE-2020-6467: Use after free in WebRTC. Reported by     ZhanJia Song on 2020-04-06

  - CVE-2020-6468: Type Confusion in V8. Reported by Chris     Salls and Jake Corina of Seaside Security, Chani Jindal     of Shellphish on 2020-04-30

  - CVE-2020-6469: Insufficient policy enforcement in     developer tools. Reported by David Erceg on 2020-04-02

  - CVE-2020-6470: Insufficient validation of untrusted     input in clipboard. Reported by Micha&#x142; Bentkowski     of Securitum on 2020-03-30

  - CVE-2020-6471: Insufficient policy enforcement in     developer tools. Reported by David Erceg on 2020-03-08

  - CVE-2020-6472: Insufficient policy enforcement in     developer tools. Reported by David Erceg on 2020-03-25

  - CVE-2020-6473: Insufficient policy enforcement in Blink.
    Reported by Soroush Karami and Panagiotis Ilia on     2020-02-06

  - CVE-2020-6474: Use after free in Blink. Reported by Zhe     Jin from cdsrc of Qihoo 360 on 2020-03-07

  - CVE-2020-6475: Incorrect security UI in full screen.
    Reported by Khalil Zhani on 2019-10-31

  - CVE-2020-6476: Insufficient policy enforcement in tab     strip. Reported by Alexandre Le Borgne on 2019-12-18

  - CVE-2020-6477: Inappropriate implementation in     installer. Reported by RACK911 Labs on 2019-03-26

  - CVE-2020-6478: Inappropriate implementation in full     screen. Reported by Khalil Zhani on 2019-12-24

  - CVE-2020-6479: Inappropriate implementation in sharing.
    Reported by Zhong Zhaochen of andsecurity.cn on     2020-01-14

  - CVE-2020-6480: Insufficient policy enforcement in     enterprise. Reported by Marvin Witt on 2020-02-21

  - CVE-2020-6481: Insufficient policy enforcement in URL     formatting. Reported by Rayyan Bijoora on 2020-04-07

  - CVE-2020-6482: Insufficient policy enforcement in     developer tools. Reported by Abdulrahman Alqabandi     (@qab) on 2017-12-17

  - CVE-2020-6483: Insufficient policy enforcement in     payments. Reported by Jun Kokatsu, Microsoft Browser     Vulnerability Research on 2019-05-23

  - CVE-2020-6484: Insufficient data validation in     ChromeDriver. Reported by Artem Zinenko on 2020-01-26

  - CVE-2020-6485: Insufficient data validation in media     router. Reported by Sergei Glazunov of Google Project     Zero on 2020-01-30

  - CVE-2020-6486: Insufficient policy enforcement in     navigations. Reported by David Erceg on 2020-02-24

  - CVE-2020-6487: Insufficient policy enforcement in     downloads. Reported by Jun Kokatsu (@shhnjk) on     2015-10-06

  - CVE-2020-6488: Insufficient policy enforcement in     downloads. Reported by David Erceg on 2020-01-21

  - CVE-2020-6489: Inappropriate implementation in developer     tools. Reported by @lovasoa (Ophir LOJKINE) on     2020-02-10

  - CVE-2020-6490: Insufficient data validation in loader.
    Reported by Twitter on 2019-12-19

  - CVE-2020-6491: Incorrect security UI in site     information. Reported by Sultan Haikal M.A on 2020-02-07

  - CVE-2020-6493: Use after free in WebAuthentication.

  - CVE-2020-6494: Incorrect security UI in payments.

  - CVE-2020-6495: Insufficient policy enforcement in     developer tools.

  - CVE-2020-6496: Use after free in payments.

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2020-6423     A use-after-free issue was found in the audio     implementation.

  - CVE-2020-6430     Avihay Cohen discovered a type confusion issue in the v8     JavaScript library.

  - CVE-2020-6431     Luan Herrera discovered a policy enforcement error.

  - CVE-2020-6432     Luan Herrera discovered a policy enforcement error.

  - CVE-2020-6433     Luan Herrera discovered a policy enforcement error in     extensions.

  - CVE-2020-6434     HyungSeok Han discovered a use-after-free issue in the     developer tools.

  - CVE-2020-6435     Sergei Glazunov discovered a policy enforcement error in     extensions.

  - CVE-2020-6436     Igor Bukanov discovered a use-after-free issue.

  - CVE-2020-6437     Jann Horn discovered an implementation error in WebView.

  - CVE-2020-6438     Ng Yik Phang discovered a policy enforcement error in     extensions.

  - CVE-2020-6439     remkoboonstra discovered a policy enforcement error.

  - CVE-2020-6440     David Erceg discovered an implementation error in     extensions.

  - CVE-2020-6441     David Erceg discovered a policy enforcement error.

  - CVE-2020-6442     B@rMey discovered an implementation error in the page     cache.

  - CVE-2020-6443     @lovasoa discovered an implementation error in the     developer tools.

  - CVE-2020-6444     mlfbrown discovered an uninitialized variable in the     WebRTC implementation.

  - CVE-2020-6445     Jun Kokatsu discovered a policy enforcement error.

  - CVE-2020-6446     Jun Kokatsu discovered a policy enforcement error.

  - CVE-2020-6447     David Erceg discovered an implementation error in the     developer tools.

  - CVE-2020-6448     Guang Gong discovered a use-after-free issue in the v8     JavaScript library.

  - CVE-2020-6454     Leecraso and Guang Gong discovered a use-after-free     issue in extensions.

  - CVE-2020-6455     Nan Wang and Guang Gong discovered an out-of-bounds read     issue in the WebSQL implementation.

  - CVE-2020-6456     Michal Bentkowski discovered insufficient validation of     untrusted input.

  - CVE-2020-6457     Leecraso and Guang Gong discovered a use-after-free     issue in the speech recognizer.

  - CVE-2020-6458     Aleksandar Nikolic discoved an out-of-bounds read and     write issue in the pdfium library.

  - CVE-2020-6459     Zhe Jin discovered a use-after-free issue in the     payments implementation.

  - CVE-2020-6460     It was discovered that URL formatting was insufficiently     validated.

  - CVE-2020-6461     Zhe Jin discovered a use-after-free issue.

  - CVE-2020-6462     Zhe Jin discovered a use-after-free issue in task     scheduling.

  - CVE-2020-6463     Pawel Wylecial discovered a use-after-free issue in the     ANGLE library.

  - CVE-2020-6464     Looben Yang discovered a type confusion issue in     Blink/Webkit.

  - CVE-2020-6465     Woojin Oh discovered a use-after-free issue.

  - CVE-2020-6466     Zhe Jin discovered a use-after-free issue.

  - CVE-2020-6467     ZhanJia Song discovered a use-after-free issue in the     WebRTC implementation.

  - CVE-2020-6468     Chris Salls and Jake Corina discovered a type confusion     issue in the v8 JavaScript library.

  - CVE-2020-6469     David Erceg discovered a policy enforcement error in the     developer tools.

  - CVE-2020-6470     Michal Bentkowski discovered insufficient validation of     untrusted input.

  - CVE-2020-6471     David Erceg discovered a policy enforcement error in the     developer tools.

  - CVE-2020-6472     David Erceg discovered a policy enforcement error in the     developer tools.

  - CVE-2020-6473     Soroush Karami and Panagiotis Ilia discovered a policy     enforcement error in Blink/Webkit.

  - CVE-2020-6474     Zhe Jin discovered a use-after-free issue in     Blink/Webkit.

  - CVE-2020-6475     Khalil Zhani discovered a user interface error.

  - CVE-2020-6476     Alexandre Le Borgne discovered a policy enforcement     error.

  - CVE-2020-6478     Khalil Zhani discovered an implementation error in full     screen mode.

  - CVE-2020-6479     Zhong Zhaochen discovered an implementation error.

  - CVE-2020-6480     Marvin Witt discovered a policy enforcement error.

  - CVE-2020-6481     Rayyan Bijoora discovered a policy enforcement error.

  - CVE-2020-6482     Abdulrahman Alqabandi discovered a policy enforcement     error in the developer tools.

  - CVE-2020-6483     Jun Kokatsu discovered a policy enforcement error in     payments.

  - CVE-2020-6484     Artem Zinenko discovered insufficient validation of user     data in the ChromeDriver implementation.

  - CVE-2020-6485     Sergei Glazunov discovered a policy enforcement error.

  - CVE-2020-6486     David Erceg discovered a policy enforcement error.

  - CVE-2020-6487     Jun Kokatsu discovered a policy enforcement error.

  - CVE-2020-6488     David Erceg discovered a policy enforcement error.

  - CVE-2020-6489     @lovasoa discovered an implementation error in the     developer tools.

  - CVE-2020-6490     Insufficient validation of untrusted data was     discovered.

  - CVE-2020-6491     Sultan Haikal discovered a user interface error.

  - CVE-2020-6493     A use-after-free issue was discovered in the     WebAuthentication implementation.

  - CVE-2020-6494     Juho Nurimen discovered a user interface error.

  - CVE-2020-6495     David Erceg discovered a policy enforcement error in the     developer tools.

  - CVE-2020-6496     Khalil Zhani discovered a use-after-free issue in     payments.

  - CVE-2020-6497     Rayyan Bijoora discovered a policy enforcement issue.

  - CVE-2020-6498     Rayyan Bijoora discovered a user interface error.

  - CVE-2020-6505     Khalil Zhani discovered a use-after-free issue.

  - CVE-2020-6506     Alesandro Ortiz discovered a policy enforcement error.

  - CVE-2020-6507     Sergei Glazunov discovered an out-of-bounds write issue     in the v8 JavaScript library.

  - CVE-2020-6509     A use-after-free issue was discovered in extensions.

  - CVE-2020-6831     Natalie Silvanovich discovered a buffer overflow issue     in the SCTP library.

The remote host is affected by the vulnerability described in GLSA-202006-02 (Chromium, Google Chrome: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and Google       Chrome. Please review the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2544 advisory.

    Chromium is an open-source web browser, powered by WebKit (Blink).

    This update upgrades Chromium to version 83.0.4103.97.

    Security Fix(es):

    * chromium-browser: Use after free in reader mode (CVE-2020-6465)

    * chromium-browser: Use after free in media (CVE-2020-6466)

    * chromium-browser: Use after free in WebRTC (CVE-2020-6467)

    * chromium-browser: Type Confusion in V8 (CVE-2020-6468)

    * chromium-browser: Insufficient policy enforcement in developer tools (CVE-2020-6469)

    * chromium-browser: Use after free in WebAuthentication (CVE-2020-6493)

    * chromium-browser: Incorrect security UI in payments (CVE-2020-6494)

    * chromium-browser: Insufficient policy enforcement in developer tools (CVE-2020-6495)

    * chromium-browser: Use after free in payments (CVE-2020-6496)

    * chromium-browser: Insufficient validation of untrusted input in clipboard (CVE-2020-6470)

    * chromium-browser: Insufficient policy enforcement in developer tools (CVE-2020-6471)

    * chromium-browser: Insufficient policy enforcement in developer tools (CVE-2020-6472)

    * chromium-browser: Insufficient policy enforcement in Blink (CVE-2020-6473)

    * chromium-browser: Use after free in Blink (CVE-2020-6474)

    * chromium-browser: Incorrect security UI in full screen (CVE-2020-6475)

    * chromium-browser: Insufficient policy enforcement in tab strip (CVE-2020-6476)

    * chromium-browser: Inappropriate implementation in full screen (CVE-2020-6478)

    * chromium-browser: Inappropriate implementation in sharing (CVE-2020-6479)

    * chromium-browser: Insufficient policy enforcement in enterprise (CVE-2020-6480)

    * chromium-browser: Insufficient policy enforcement in URL formatting (CVE-2020-6481)

    * chromium-browser: Insufficient policy enforcement in developer tools (CVE-2020-6482)

    * chromium-browser: Insufficient policy enforcement in payments (CVE-2020-6483)

    * chromium-browser: Insufficient data validation in ChromeDriver (CVE-2020-6484)

    * chromium-browser: Insufficient data validation in media router (CVE-2020-6485)

    * chromium-browser: Insufficient policy enforcement in navigations (CVE-2020-6486)

    * chromium-browser: Insufficient policy enforcement in downloads (CVE-2020-6487)

    * chromium-browser: Insufficient policy enforcement in downloads (CVE-2020-6488)

    * chromium-browser: Inappropriate implementation in developer tools (CVE-2020-6489)

    * chromium-browser: Insufficient data validation in loader (CVE-2020-6490)

    * chromium-browser: Incorrect security UI in site information (CVE-2020-6491)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Chrome Releases reports :

This update includes 5 security fixes. Below, we highlight fixes that were contributed by external researchers.

- [1082105] High CVE-2020-6493: Use after free in WebAuthentication.
Reported by Anonymous on 2020-05-13

- [1083972] High CVE-2020-6494: Incorrect security UI in payments.
Reported by Juho Nurminen on 2020-05-18

- [1072116] High CVE-2020-6495: Insufficient policy enforcement in developer tools. Reported by David Erceg on 2020-04-18

- [1085990] High CVE-2020-6496: Use after free in payments. Reported by Khalil Zhani on 2020-05-24

The version of Google Chrome installed on the remote Windows host is prior to 83.0.4103.97. It is, therefore, affected by multiple vulnerabilities as referenced in the 2020_06_stable-channel-update-for-desktop advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote macOS host is prior to 83.0.4103.97. It is, therefore, affected by multiple vulnerabilities as referenced in the 2020_06_stable-channel-update-for-desktop advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
208592	CentOS 6 : chromium-browser (RHSA-2020:2544)	Nessus	CentOS Local Security Checks	critical
138688	openSUSE Security Update : chromium (openSUSE-2020-823)	Nessus	SuSE Local Security Checks	critical
138066	Debian DSA-4714-1 : chromium - security update	Nessus	Debian Local Security Checks	critical
137440	GLSA-202006-02 : Chromium, Google Chrome: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
137410	RHEL 6 : chromium-browser (RHSA-2020:2544)	Nessus	Red Hat Local Security Checks	critical
137216	FreeBSD : chromium -- multiple vulnerabilities (a2caf7bd-a719-11ea-a857-e09467587c17)	Nessus	FreeBSD Local Security Checks	critical
137081	Google Chrome < 83.0.4103.97 Multiple Vulnerabilities	Nessus	Windows	critical
137080	Google Chrome < 83.0.4103.97 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical

Detections

Analytics

CVE-2020-6496

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical