Use after free in Payments in Google Chrome on Mac prior to 88.0.4324.146 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.

The remote host is affected by the vulnerability described in GLSA-202104-08 (Chromium, Google Chrome: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and Google       Chrome. Please review the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The version of Google Chrome installed on the remote host is prior to 88.0.4324.146. It is, therefore, affected by multiple vulnerabilities as referenced in the 2021_02_stable-channel-update-for-desktop advisory. Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-7fb30b9381 advisory.

  - Use after free in Payments in Google Chrome on Mac prior to 88.0.4324.146 allowed a remote attacker to     potentially perform a sandbox escape via a crafted HTML page. (CVE-2021-21142)

  - Heap buffer overflow in Extensions in Google Chrome prior to 88.0.4324.146 allowed an attacker who     convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted     Chrome Extension. (CVE-2021-21143)

  - Heap buffer overflow in Tab Groups in Google Chrome prior to 88.0.4324.146 allowed an attacker who     convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted     Chrome Extension. (CVE-2021-21144)

  - Use after free in Fonts in Google Chrome prior to 88.0.4324.146 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2021-21145)

  - Use after free in Navigation in Google Chrome prior to 88.0.4324.146 allowed a remote attacker who had     compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2021-21146)

  - Inappropriate implementation in Skia in Google Chrome prior to 88.0.4324.146 allowed a local attacker to     spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (CVE-2021-21147)

  - Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.150 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21148)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-05afa65d39 advisory.

  - Use after free in Payments in Google Chrome on Mac prior to 88.0.4324.146 allowed a remote attacker to     potentially perform a sandbox escape via a crafted HTML page. (CVE-2021-21142)

  - Heap buffer overflow in Extensions in Google Chrome prior to 88.0.4324.146 allowed an attacker who     convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted     Chrome Extension. (CVE-2021-21143)

  - Heap buffer overflow in Tab Groups in Google Chrome prior to 88.0.4324.146 allowed an attacker who     convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted     Chrome Extension. (CVE-2021-21144)

  - Use after free in Fonts in Google Chrome prior to 88.0.4324.146 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2021-21145)

  - Use after free in Navigation in Google Chrome prior to 88.0.4324.146 allowed a remote attacker who had     compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2021-21146)

  - Inappropriate implementation in Skia in Google Chrome prior to 88.0.4324.146 allowed a local attacker to     spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (CVE-2021-21147)

  - Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.150 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21148)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Microsoft Edge installed on the remote Windows host is prior to 88.0.705.62. It is, therefore, affected by multiple vulnerabilities as referenced in the February 4, 2021 advisory.

  - Use after free in Payments in Google Chrome on Mac prior to 88.0.4324.146 allowed a remote attacker to     potentially perform a sandbox escape via a crafted HTML page. (CVE-2021-21142)

  - Heap buffer overflow in Extensions in Google Chrome prior to 88.0.4324.146 allowed an attacker who     convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted     Chrome Extension. (CVE-2021-21143)

  - Heap buffer overflow in Tab Groups in Google Chrome prior to 88.0.4324.146 allowed an attacker who     convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted     Chrome Extension. (CVE-2021-21144)

  - Use after free in Fonts in Google Chrome prior to 88.0.4324.146 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2021-21145)

  - Use after free in Navigation in Google Chrome prior to 88.0.4324.146 allowed a remote attacker who had     compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2021-21146)

  - Inappropriate implementation in Skia in Google Chrome prior to 88.0.4324.146 allowed a local attacker to     spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (CVE-2021-21147)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for chromium fixes the following issues :

  - Update to 88.0.4324.146 boo#1181772

  - CVE-2021-21142: Use after free in Payments

  - CVE-2021-21143: Heap buffer overflow in Extensions

  - CVE-2021-21144: Heap buffer overflow in Tab Groups.

  - CVE-2021-21145: Use after free in Fonts

  - CVE-2021-21146: Use after free in Navigation.

  - CVE-2021-21147: Inappropriate implementation in Skia

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2020-16044     Ned Williamson discovered a use-after-free issue in the     WebRTC implementation.

  - CVE-2021-21117     Rory McNamara discovered a policy enforcement issue in     Cryptohome.

  - CVE-2021-21118     Tyler Nighswander discovered a data validation issue in     the v8 JavaScript library.

  - CVE-2021-21119     A use-after-free issue was discovered in media handling.

  - CVE-2021-21120     Nan Wang and Guang Gong discovered a use-after-free     issue in the WebSQL implementation.

  - CVE-2021-21121     Leecraso and Guang Gong discovered a use-after-free     issue in the Omnibox.

  - CVE-2021-21122     Renata Hodovan discovered a use-after-free issue in     Blink/WebKit.

  - CVE-2021-21123     Maciej Pulikowski discovered a data validation issue.

  - CVE-2021-21124     Chaoyang Ding discovered a use-after-free issue in the     speech recognizer.

  - CVE-2021-21125     Ron Masas discovered a policy enforcement issue.

  - CVE-2021-21126     David Erceg discovered a policy enforcement issue in     extensions.

  - CVE-2021-21127     Jasminder Pal Singh discovered a policy enforcement     issue in extensions.

  - CVE-2021-21128     Liang Dong discovered a buffer overflow issue in     Blink/WebKit.

  - CVE-2021-21129     Maciej Pulikowski discovered a policy enforcement issue.

  - CVE-2021-21130     Maciej Pulikowski discovered a policy enforcement issue.

  - CVE-2021-21131     Maciej Pulikowski discovered a policy enforcement issue.

  - CVE-2021-21132     David Erceg discovered an implementation error in the     developer tools.

  - CVE-2021-21133     wester0x01 discovered a policy enforcement issue.

  - CVE-2021-21134     wester0x01 discovered a user interface error.

  - CVE-2021-21135     ndevtk discovered an implementation error in the     Performance API.

  - CVE-2021-21136     Shiv Sahni, Movnavinothan V, and Imdad Mohammed     discovered a policy enforcement error.

  - CVE-2021-21137     bobbybear discovered an implementation error in the     developer tools.

  - CVE-2021-21138     Weipeng Jiang discovered a use-after-free issue in the     developer tools.

  - CVE-2021-21139     Jun Kokatsu discovered an implementation error in the     iframe sandbox.

  - CVE-2021-21140     David Manouchehri discovered uninitialized memory in the     USB implementation.

  - CVE-2021-21141     Maciej Pulikowski discovered a policy enforcement error.

  - CVE-2021-21142     Khalil Zhani discovered a use-after-free issue.

  - CVE-2021-21143     Allen Parker and Alex Morgan discovered a buffer     overflow issue in extensions.

  - CVE-2021-21144     Leecraso and Guang Gong discovered a buffer overflow     issue.

  - CVE-2021-21145     A use-after-free issue was discovered.

  - CVE-2021-21146     Alison Huffman and Choongwoo Han discovered a     use-after-free issue.

  - CVE-2021-21147     Roman Starkov discovered an implementation error in the     skia library.

Chrome Releases reports :

This update include 6 security fixes :

- 1169317] Critical CVE-2021-21142: Use after free in Payments.
Reported by Khalil Zhani on 2021-01-21

- [1163504] High CVE-2021-21143: Heap buffer overflow in Extensions.
Reported by Allen Parker and Alex Morgan of MU on 2021-01-06

- [1163845] High CVE-2021-21144: Heap buffer overflow in Tab Groups.
Reported by Leecraso and Guang Gong of 360 Alpha Lab on 2021-01-07

- [1154965] High CVE-2021-21145: Use after free in Fonts. Reported by Anonymous on 2020-12-03

- [1161705] High CVE-2021-21146: Use after free in Navigation.
Reported by Alison Huffman and Choongwoo Han of Microsoft Browser Vulnerability Research on 2020-12-24

- [1162942] Medium CVE-2021-21147: Inappropriate implementation in Skia. Reported by Roman Starkov on 2021-01-04

The version of Google Chrome installed on the remote macOS host is prior to 88.0.4324.146. It is, therefore, affected by multiple vulnerabilities as referenced in the 2021_02_stable-channel-update-for-desktop advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 88.0.4324.146. It is, therefore, affected by multiple vulnerabilities as referenced in the 2021_02_stable-channel-update-for-desktop advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
149223	GLSA-202104-08 : Chromium, Google Chrome: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
701327	Google Chrome < 88.0.4324.146 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
146559	Fedora 32 : chromium (2021-7fb30b9381)	Nessus	Fedora Local Security Checks	critical
146363	Fedora 33 : chromium (2021-05afa65d39)	Nessus	Fedora Local Security Checks	critical
146207	Microsoft Edge (Chromium) < 88.0.705.62 Multiple Vulnerabilities	Nessus	Windows	critical
146320	openSUSE Security Update : chromium (openSUSE-2021-259)	Nessus	SuSE Local Security Checks	critical
146318	Debian DSA-4846-1 : chromium - security update	Nessus	Debian Local Security Checks	critical
146166	FreeBSD : www/chromium -- multiple vulnerabilities (479fdfda-6659-11eb-83e2-e09467587c17)	Nessus	FreeBSD Local Security Checks	critical
701298	Google Chrome < 88.0.4324.146 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
146061	Google Chrome < 88.0.4324.146 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
146060	Google Chrome < 88.0.4324.146 Multiple Vulnerabilities	Nessus	Windows	critical

Detections

Analytics

CVE-2021-21142

critical

Tenable Plugins

critical

medium

critical

critical

critical

critical

critical

critical

high

critical

critical