Use after free in extensions in Google Chrome prior to 83.0.4103.116 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension.

The remote CentOS Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:2761 advisory.

  - Use after free in extensions in Google Chrome prior to 83.0.4103.116 allowed an attacker who convinced a     user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome     Extension. (CVE-2020-6509)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for opera fixes the following issues :

  - Update to version 69.0.3686.49

  - CHR-7971 Update chromium on desktop-stable-83-3686 to     83.0.4103.116 (CVE-2020-6509)

  - DNA-79195 Wrong date on history

  - DNA-86090 Crash at     views::View::ReorderChildView(views::View*, int)

  - DNA-86122 [Mac] Some popovers have incorrectly themed     arrow

  - DNA-86833 Add hint to tell users that tab content is now     searched

  - DNA-86906 [Search in tabs] No matching results in your     open tabs label not displayed for some strings not     found.

  - DNA-86983 Allow to search from the tile

  - DNA-87029 Search in tabs dropdown should disappear when     resizing window

  - DNA-87051 No autocompletion in the address bar for Speed     Dials

  - DNA-87091 Do not vertically center search-in-tabs dialog

  - DNA-87113 Crash at     content::NavigationRequest::GetRenderFrameHost()

  - DNA-87114 Double scrollbar in bookmarks popup

  - DNA-87117 Hide &ldquo;Provide additional details&rdquo;
    button when crash is discarded by Socorro

  - DNA-87122 Hide provide more information button from     infobar when crash is discarded

  - DNA-87153 The icons cover the inscription on the BABE     picture title

  - DNA-87203 The scroll view changes visible area     unexpectedly

  - DNA-87243 Provide missing translations

  - DNA-87245 Extend schema and report search events

  - DNA-87261 Allow to use search and modal at the same time

  - DNA-87273 Switch to dedicated subdomain

  - Complete Opera 69.0 changelog at:
    https://blogs.opera.com/desktop/changelog-for-69/

The remote host is affected by the vulnerability described in GLSA-202007-08 (Chromium, Google Chrome: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and Google       Chrome. Please review the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

This update for chromium fixes the following issues :

Chromium was updated to 83.0.4103.116 (boo#1173251) :

  - CVE-2020-6509: Use after free in extensions

Chromium was updated to 83.0.4103.106 (boo#1173029) :

  - CVE-2020-6505: Use after free in speech

  - CVE-2020-6506: Insufficient policy enforcement in     WebView

  - CVE-2020-6507: Out of bounds write in V8

Other fixes :

  - Add patch to work with new ffmpeg wrt boo#1173292 :

  - Add multimedia fix for disabled location and also try     one additional patch from Debian on the same issue     boo#1173107

  - Disable wayland integration on 15.x boo#1173187     boo#1173188 boo#1173254

  - Enforce to not use system borders boo#1173063

This update for chromium fixes the following issues :

Update to 83.0.4103.116 boo#1173251 :

  - CVE-2020-6509: Use after free in extensions

  - Add patch to work with new ffmpeg (bsc#1173292)

  - Add multimedia fix for disabled location and also try     one additional patch from Debian on the same issue     boo#1173107

  - Disable wayland integration on openSUSE Leap 15.x     (boo#1173187 boo#1173188 boo#1173254)

Update to 83.0.4103.116. Fixes CVE-2020-6509.

----

Black Lives Matter. Saying this does not mean that other lives do not matter. It should not be controversial to say this. If I say Chromium updates matter, it does not mean that other Fedora packages do not matter, it means that a Chromium update is needed to fix this giant pile of severe security vulnerabilities, here, today, now :

CVE-2020-6463 CVE-2020-6465 CVE-2020-6466 CVE-2020-6467 CVE-2020-6468 CVE-2020-6469 CVE-2020-6470 CVE-2020-6471 CVE-2020-6472 CVE-2020-6473 CVE-2020-6474 CVE-2020-6475 CVE-2020-6476 CVE-2020-6478 CVE-2020-6479 CVE-2020-6480 CVE-2020-6481 CVE-2020-6482 CVE-2020-6483 CVE-2020-6484 CVE-2020-6485 CVE-2020-6486 CVE-2020-6487 CVE-2020-6488 CVE-2020-6489 CVE-2020-6490 CVE-2020-6491 CVE-2020-6505 CVE-2020-6506 CVE-6507

In making that analogy, I do not intend to trivialize BLM. In no way do I mean to compare the lives of people to a silly web browser update. People are infinitely important than software. But since I'm here to push this software update out, I am also choosing to say clearly and unambiguously that Black Lives Matter. 

Open Source proves that many voices, many contributions, together can change the world. It depends on it. This is my voice.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 83.0.4103.116. Fixes CVE-2020-6509.

----

Black Lives Matter. Saying this does not mean that other lives do not matter. It should not be controversial to say this. If I say Chromium updates matter, it does not mean that other Fedora packages do not matter, it means that a Chromium update is needed to fix this giant pile of severe security vulnerabilities, here, today, now :

CVE-2020-6463 CVE-2020-6465 CVE-2020-6466 CVE-2020-6467 CVE-2020-6468 CVE-2020-6469 CVE-2020-6470 CVE-2020-6471 CVE-2020-6472 CVE-2020-6473 CVE-2020-6474 CVE-2020-6475 CVE-2020-6476 CVE-2020-6478 CVE-2020-6479 CVE-2020-6480 CVE-2020-6481 CVE-2020-6482 CVE-2020-6483 CVE-2020-6484 CVE-2020-6485 CVE-2020-6486 CVE-2020-6487 CVE-2020-6488 CVE-2020-6489 CVE-2020-6490 CVE-2020-6491 CVE-2020-6505 CVE-2020-6506 CVE-2020-6507

In making that analogy, I do not intend to trivialize BLM. In no way do I mean to compare the lives of people to a silly web browser update. People are infinitely important than software. But since I'm here to push this software update out, I am also choosing to say clearly and unambiguously that Black Lives Matter. 

Open Source proves that many voices, many contributions, together can change the world. It depends on it. This is my voice.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2020-6423     A use-after-free issue was found in the audio     implementation.

  - CVE-2020-6430     Avihay Cohen discovered a type confusion issue in the v8     JavaScript library.

  - CVE-2020-6431     Luan Herrera discovered a policy enforcement error.

  - CVE-2020-6432     Luan Herrera discovered a policy enforcement error.

  - CVE-2020-6433     Luan Herrera discovered a policy enforcement error in     extensions.

  - CVE-2020-6434     HyungSeok Han discovered a use-after-free issue in the     developer tools.

  - CVE-2020-6435     Sergei Glazunov discovered a policy enforcement error in     extensions.

  - CVE-2020-6436     Igor Bukanov discovered a use-after-free issue.

  - CVE-2020-6437     Jann Horn discovered an implementation error in WebView.

  - CVE-2020-6438     Ng Yik Phang discovered a policy enforcement error in     extensions.

  - CVE-2020-6439     remkoboonstra discovered a policy enforcement error.

  - CVE-2020-6440     David Erceg discovered an implementation error in     extensions.

  - CVE-2020-6441     David Erceg discovered a policy enforcement error.

  - CVE-2020-6442     B@rMey discovered an implementation error in the page     cache.

  - CVE-2020-6443     @lovasoa discovered an implementation error in the     developer tools.

  - CVE-2020-6444     mlfbrown discovered an uninitialized variable in the     WebRTC implementation.

  - CVE-2020-6445     Jun Kokatsu discovered a policy enforcement error.

  - CVE-2020-6446     Jun Kokatsu discovered a policy enforcement error.

  - CVE-2020-6447     David Erceg discovered an implementation error in the     developer tools.

  - CVE-2020-6448     Guang Gong discovered a use-after-free issue in the v8     JavaScript library.

  - CVE-2020-6454     Leecraso and Guang Gong discovered a use-after-free     issue in extensions.

  - CVE-2020-6455     Nan Wang and Guang Gong discovered an out-of-bounds read     issue in the WebSQL implementation.

  - CVE-2020-6456     Michal Bentkowski discovered insufficient validation of     untrusted input.

  - CVE-2020-6457     Leecraso and Guang Gong discovered a use-after-free     issue in the speech recognizer.

  - CVE-2020-6458     Aleksandar Nikolic discoved an out-of-bounds read and     write issue in the pdfium library.

  - CVE-2020-6459     Zhe Jin discovered a use-after-free issue in the     payments implementation.

  - CVE-2020-6460     It was discovered that URL formatting was insufficiently     validated.

  - CVE-2020-6461     Zhe Jin discovered a use-after-free issue.

  - CVE-2020-6462     Zhe Jin discovered a use-after-free issue in task     scheduling.

  - CVE-2020-6463     Pawel Wylecial discovered a use-after-free issue in the     ANGLE library.

  - CVE-2020-6464     Looben Yang discovered a type confusion issue in     Blink/Webkit.

  - CVE-2020-6465     Woojin Oh discovered a use-after-free issue.

  - CVE-2020-6466     Zhe Jin discovered a use-after-free issue.

  - CVE-2020-6467     ZhanJia Song discovered a use-after-free issue in the     WebRTC implementation.

  - CVE-2020-6468     Chris Salls and Jake Corina discovered a type confusion     issue in the v8 JavaScript library.

  - CVE-2020-6469     David Erceg discovered a policy enforcement error in the     developer tools.

  - CVE-2020-6470     Michal Bentkowski discovered insufficient validation of     untrusted input.

  - CVE-2020-6471     David Erceg discovered a policy enforcement error in the     developer tools.

  - CVE-2020-6472     David Erceg discovered a policy enforcement error in the     developer tools.

  - CVE-2020-6473     Soroush Karami and Panagiotis Ilia discovered a policy     enforcement error in Blink/Webkit.

  - CVE-2020-6474     Zhe Jin discovered a use-after-free issue in     Blink/Webkit.

  - CVE-2020-6475     Khalil Zhani discovered a user interface error.

  - CVE-2020-6476     Alexandre Le Borgne discovered a policy enforcement     error.

  - CVE-2020-6478     Khalil Zhani discovered an implementation error in full     screen mode.

  - CVE-2020-6479     Zhong Zhaochen discovered an implementation error.

  - CVE-2020-6480     Marvin Witt discovered a policy enforcement error.

  - CVE-2020-6481     Rayyan Bijoora discovered a policy enforcement error.

  - CVE-2020-6482     Abdulrahman Alqabandi discovered a policy enforcement     error in the developer tools.

  - CVE-2020-6483     Jun Kokatsu discovered a policy enforcement error in     payments.

  - CVE-2020-6484     Artem Zinenko discovered insufficient validation of user     data in the ChromeDriver implementation.

  - CVE-2020-6485     Sergei Glazunov discovered a policy enforcement error.

  - CVE-2020-6486     David Erceg discovered a policy enforcement error.

  - CVE-2020-6487     Jun Kokatsu discovered a policy enforcement error.

  - CVE-2020-6488     David Erceg discovered a policy enforcement error.

  - CVE-2020-6489     @lovasoa discovered an implementation error in the     developer tools.

  - CVE-2020-6490     Insufficient validation of untrusted data was     discovered.

  - CVE-2020-6491     Sultan Haikal discovered a user interface error.

  - CVE-2020-6493     A use-after-free issue was discovered in the     WebAuthentication implementation.

  - CVE-2020-6494     Juho Nurimen discovered a user interface error.

  - CVE-2020-6495     David Erceg discovered a policy enforcement error in the     developer tools.

  - CVE-2020-6496     Khalil Zhani discovered a use-after-free issue in     payments.

  - CVE-2020-6497     Rayyan Bijoora discovered a policy enforcement issue.

  - CVE-2020-6498     Rayyan Bijoora discovered a user interface error.

  - CVE-2020-6505     Khalil Zhani discovered a use-after-free issue.

  - CVE-2020-6506     Alesandro Ortiz discovered a policy enforcement error.

  - CVE-2020-6507     Sergei Glazunov discovered an out-of-bounds write issue     in the v8 JavaScript library.

  - CVE-2020-6509     A use-after-free issue was discovered in extensions.

  - CVE-2020-6831     Natalie Silvanovich discovered a buffer overflow issue     in the SCTP library.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:2761 advisory.

    Chromium is an open-source web browser, powered by WebKit (Blink).

    This update upgrades Chromium to version 83.0.4103.116.

    Security Fix(es):

    * chromium-browser: Use after free in extensions (CVE-2020-6509)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Chrome Releases reports :

This update includes 2 security fixes, including :

- [1092308] High CVE-2020-6509: Use after free in extensions. Reported by Anonymous on 2020-06-08

The version of Google Chrome installed on the remote host is prior to 83.0.4103.116. It is, therefore, affected by a vulnerability as referenced in the 2020_06_stable-channel-update-for-desktop_22 advisory. Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 83.0.4103.116. It is, therefore, affected by a vulnerability as referenced in the 2020_06_stable-channel-update-for-desktop_22 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote macOS host is prior to 83.0.4103.116. It is, therefore, affected by a vulnerability as referenced in the 2020_06_stable-channel-update-for-desktop_22 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
208542	CentOS 6 : chromium-browser (RHSA-2020:2761)	Nessus	CentOS Local Security Checks	critical
139307	openSUSE Security Update : opera (openSUSE-2020-949)	Nessus	SuSE Local Security Checks	critical
138991	openSUSE Security Update : opera (openSUSE-2020-950)	Nessus	SuSE Local Security Checks	critical
138931	GLSA-202007-08 : Chromium, Google Chrome: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
138711	openSUSE Security Update : chromium (openSUSE-2020-893)	Nessus	SuSE Local Security Checks	critical
138709	openSUSE Security Update : chromium (openSUSE-2020-887)	Nessus	SuSE Local Security Checks	critical
138194	Fedora 31 : chromium (2020-77f89ab772)	Nessus	Fedora Local Security Checks	critical
138069	Fedora 32 : chromium (2020-08561721ad)	Nessus	Fedora Local Security Checks	critical
138066	Debian DSA-4714-1 : chromium - security update	Nessus	Debian Local Security Checks	critical
137884	RHEL 6 : chromium-browser (RHSA-2020:2761)	Nessus	Red Hat Local Security Checks	critical
137791	FreeBSD : chromium -- multiple vulnerabilities (6a5d15b6-b661-11ea-8015-e09467587c17)	Nessus	FreeBSD Local Security Checks	critical
701279	Google Chrome < 83.0.4103.116 Vulnerability	Nessus Network Monitor	Web Clients	high
137701	Google Chrome < 83.0.4103.116 Vulnerability	Nessus	Windows	critical
137700	Google Chrome < 83.0.4103.116 Vulnerability	Nessus	MacOS X Local Security Checks	critical

Detections

Analytics

CVE-2020-6509

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

critical

critical