Heap buffer overflow in Media in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

The remote host is affected by the vulnerability described in GLSA-202104-08 (Chromium, Google Chrome: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and Google       Chrome. Please review the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

This update for opera fixes the following issues :

  - Update to version 74.0.3911.203

  - CHR-8324 Update chromium on desktop-stable-88-3911 to     88.0.4324.182(boo#1182358)

  - DNA-90762 Replace &ldquo;Don&rsquo;t show again&rdquo;
    with &ldquo;Discard&rdquo;

  - DNA-90974 Crash at     opera::PersistentRecentlyClosedWindows::GetEntryType(Ses     sionID)

  - DNA-91289 [Search tabs] Wrong tab stays highlighted     after removing another tab

  - DNA-91476 Invalid memory dereference     PlayerServiceBrowsertest

  - DNA-91502 Change system name on opera://about page for     MacOS

  - DNA-91740 Missing title in Extensions Toolbar Menu

  - The update to chromium 88.0.4324.182 fixes following     issues: CVE-2021-21149, CVE-2021-21150, CVE-2021-21151,     CVE-2021-21152, CVE-2021-21153, CVE-2021-21154,     CVE-2021-21155, CVE-2021-21156, CVE-2021-21157

  - Update to version 74.0.3911.160

  - DNA-90409 Cleanup JavaScript dialogs: app modal & tab     modal

  - DNA-90720 [Search Tabs] Allow discarding recently closed     items

  - DNA-90802 [Windows] Debug fails on linking

  - DNA-91130 heap-use-after-free in     CashbackBackendServiceTest.AutoUpdateSchedule

  - DNA-91152 Allow reading agent variables in trigger     conditions

  - DNA-91225 [Search tabs] The webpage doesn&rsquo;t move     from &ldquo;Open tabs&rdquo; to &ldquo;Recently     closed&rdquo; section

  - DNA-91243 Add Rich Hint support for the cashback badge     and popup

  - DNA-91483 component_unittests are timing out

  - DNA-91516 Sidebar setup opens only with cashback enabled

  - DNA-91601 No text in 1st line of address bar dropdown     suggestions

  - DNA-91603 Jumbo build problem on desktop-stable-88-3911

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-c88a96bd4b advisory.

  - Stack buffer overflow in Data Transfer in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote     attacker to perform out of bounds memory access via a crafted HTML page. (CVE-2021-21149)

  - Use after free in Downloads in Google Chrome on Windows prior to 88.0.4324.182 allowed a remote attacker     who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2021-21150)

  - Use after free in Payments in Google Chrome prior to 88.0.4324.182 allowed a remote attacker to     potentially perform a sandbox escape via a crafted HTML page. (CVE-2021-21151)

  - Heap buffer overflow in Media in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote attacker     to potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21152)

  - Stack buffer overflow in GPU Process in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote     attacker to potentially perform out of bounds memory access via a crafted HTML page. (CVE-2021-21153)

  - Heap buffer overflow in Tab Strip in Google Chrome prior to 88.0.4324.182 allowed a remote attacker who     had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2021-21154)

  - Heap buffer overflow in Tab Strip in Google Chrome on Windows prior to 88.0.4324.182 allowed a remote     attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted     HTML page. (CVE-2021-21155)

  - Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.182 allowed a remote attacker to     potentially exploit heap corruption via a crafted script. (CVE-2021-21156)

  - Use after free in Web Sockets in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote attacker     to potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21157)

  - Heap buffer overflow in TabStrip in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21159, CVE-2021-21161)

  - Heap buffer overflow in WebAudio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21160)

  - Use after free in WebRTC in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2021-21162)

  - Insufficient data validation in Reader Mode in Google Chrome on iOS prior to 89.0.4389.72 allowed a remote     attacker to leak cross-origin data via a crafted HTML page and a malicious server. (CVE-2021-21163)

  - Insufficient data validation in Chrome on iOS in Google Chrome on iOS prior to 89.0.4389.72 allowed a     remote attacker to leak cross-origin data via a crafted HTML page. (CVE-2021-21164)

  - Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit     heap corruption via a crafted HTML page. (CVE-2021-21165, CVE-2021-21166)

  - Use after free in bookmarks in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21167)

  - Insufficient policy enforcement in appcache in Google Chrome prior to 89.0.4389.72 allowed a remote     attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
    (CVE-2021-21168)

  - Out of bounds memory access in V8 in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to     potentially perform out of bounds memory access via a crafted HTML page. (CVE-2021-21169)

  - Incorrect security UI in Loader in Google Chrome prior to 89.0.4389.72 allowed a remote attacker who had     compromised the renderer process to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
    (CVE-2021-21170)

  - Incorrect security UI in TabStrip and Navigation in Google Chrome on Android prior to 89.0.4389.72 allowed     a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (CVE-2021-21171)

  - Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 89.0.4389.72     allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page. (CVE-2021-21172)

  - Side-channel information leakage in Network Internals in Google Chrome prior to 89.0.4389.72 allowed a     remote attacker to leak cross-origin data via a crafted HTML page. (CVE-2021-21173)

  - Inappropriate implementation in Referrer in Google Chrome prior to 89.0.4389.72 allowed a remote attacker     to bypass navigation restrictions via a crafted HTML page. (CVE-2021-21174)

  - Inappropriate implementation in Site isolation in Google Chrome prior to 89.0.4389.72 allowed a remote     attacker to leak cross-origin data via a crafted HTML page. (CVE-2021-21175)

  - Inappropriate implementation in full screen mode in Google Chrome prior to 89.0.4389.72 allowed a remote     attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (CVE-2021-21176)

  - Insufficient policy enforcement in Autofill in Google Chrome prior to 89.0.4389.72 allowed a remote     attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
    (CVE-2021-21177)

  - Inappropriate implementation in Compositing in Google Chrome on Linux and Windows prior to 89.0.4389.72     allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
    (CVE-2021-21178)

  - Use after free in Network Internals in Google Chrome on Linux prior to 89.0.4389.72 allowed a remote     attacker to potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21179)

  - Use after free in tab search in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21180)

  - Side-channel information leakage in autofill in Google Chrome prior to 89.0.4389.72 allowed a remote     attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
    (CVE-2021-21181)

  - Insufficient policy enforcement in navigations in Google Chrome prior to 89.0.4389.72 allowed a remote     attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML     page. (CVE-2021-21182)

  - Inappropriate implementation in performance APIs in Google Chrome prior to 89.0.4389.72 allowed a remote     attacker to leak cross-origin data via a crafted HTML page. (CVE-2021-21183, CVE-2021-21184)

  - Insufficient policy enforcement in extensions in Google Chrome prior to 89.0.4389.72 allowed an attacker     who convinced a user to install a malicious extension to obtain sensitive information via a crafted Chrome     Extension. (CVE-2021-21185)

  - Insufficient policy enforcement in QR scanning in Google Chrome on iOS prior to 89.0.4389.72 allowed an     attacker who convinced the user to scan a QR code to bypass navigation restrictions via a crafted QR code.
    (CVE-2021-21186)

  - Insufficient data validation in URL formatting in Google Chrome prior to 89.0.4389.72 allowed a remote     attacker to perform domain spoofing via IDN homographs via a crafted domain name. (CVE-2021-21187)

  - Use after free in Blink in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2021-21188)

  - Insufficient policy enforcement in payments in Google Chrome prior to 89.0.4389.72 allowed a remote     attacker to bypass navigation restrictions via a crafted HTML page. (CVE-2021-21189)

  - Uninitialized data in PDFium in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain     potentially sensitive information from process memory via a crafted PDF file. (CVE-2021-21190)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for chromium fixes the following issues :

Update to 89.0.4389.72 (boo#1182358, boo#1182960) :

  - CVE-2021-21159: Heap buffer overflow in TabStrip.

  - CVE-2021-21160: Heap buffer overflow in WebAudio.

  - CVE-2021-21161: Heap buffer overflow in TabStrip.

  - CVE-2021-21162: Use after free in WebRTC.

  - CVE-2021-21163: Insufficient data validation in Reader     Mode.

  - CVE-2021-21164: Insufficient data validation in Chrome     for iOS.

  - CVE-2021-21165: Object lifecycle issue in audio.

  - CVE-2021-21166: Object lifecycle issue in audio.

  - CVE-2021-21167: Use after free in bookmarks.

  - CVE-2021-21168: Insufficient policy enforcement in     appcache.

  - CVE-2021-21169: Out of bounds memory access in V8.

  - CVE-2021-21170: Incorrect security UI in Loader.

  - CVE-2021-21171: Incorrect security UI in TabStrip and     Navigation.

  - CVE-2021-21172: Insufficient policy enforcement in File     System API.

  - CVE-2021-21173: Side-channel information leakage in     Network Internals.

  - CVE-2021-21174: Inappropriate implementation in     Referrer.

  - CVE-2021-21175: Inappropriate implementation in Site     isolation.

  - CVE-2021-21176: Inappropriate implementation in full     screen mode.

  - CVE-2021-21177: Insufficient policy enforcement in     Autofill.

  - CVE-2021-21178: Inappropriate implementation in     Compositing.

  - CVE-2021-21179: Use after free in Network Internals.

  - CVE-2021-21180: Use after free in tab search.

  - CVE-2020-27844: Heap buffer overflow in OpenJPEG.

  - CVE-2021-21181: Side-channel information leakage in     autofill.

  - CVE-2021-21182: Insufficient policy enforcement in     navigations.

  - CVE-2021-21183: Inappropriate implementation in     performance APIs.

  - CVE-2021-21184: Inappropriate implementation in     performance APIs.

  - CVE-2021-21185: Insufficient policy enforcement in     extensions.

  - CVE-2021-21186: Insufficient policy enforcement in QR     scanning.

  - CVE-2021-21187: Insufficient data validation in URL     formatting.

  - CVE-2021-21188: Use after free in Blink.

  - CVE-2021-21189: Insufficient policy enforcement in     payments.

  - CVE-2021-21190: Uninitialized Use in PDFium.

  - CVE-2021-21149: Stack overflow in Data Transfer.

  - CVE-2021-21150: Use after free in Downloads.

  - CVE-2021-21151: Use after free in Payments.

  - CVE-2021-21152: Heap buffer overflow in Media.

  - CVE-2021-21153: Stack overflow in GPU Process. 

  - CVE-2021-21154: Heap buffer overflow in Tab Strip.

  - CVE-2021-21155: Heap buffer overflow in Tab Strip.

  - CVE-2021-21156: Heap buffer overflow in V8.

  - CVE-2021-21157: Use after free in Web Sockets. 

  - Fixed Sandbox with glibc 2.33 (boo#1182233)

  - Fixed an issue where chromium hangs on opening     (boo#1182775).

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-aa764a8531 advisory.

  - Stack buffer overflow in Data Transfer in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote     attacker to perform out of bounds memory access via a crafted HTML page. (CVE-2021-21149)

  - Use after free in Downloads in Google Chrome on Windows prior to 88.0.4324.182 allowed a remote attacker     who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2021-21150)

  - Use after free in Payments in Google Chrome prior to 88.0.4324.182 allowed a remote attacker to     potentially perform a sandbox escape via a crafted HTML page. (CVE-2021-21151)

  - Heap buffer overflow in Media in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote attacker     to potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21152)

  - Stack buffer overflow in GPU Process in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote     attacker to potentially perform out of bounds memory access via a crafted HTML page. (CVE-2021-21153)

  - Heap buffer overflow in Tab Strip in Google Chrome prior to 88.0.4324.182 allowed a remote attacker who     had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2021-21154)

  - Heap buffer overflow in Tab Strip in Google Chrome on Windows prior to 88.0.4324.182 allowed a remote     attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted     HTML page. (CVE-2021-21155)

  - Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.182 allowed a remote attacker to     potentially exploit heap corruption via a crafted script. (CVE-2021-21156)

  - Use after free in Web Sockets in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote attacker     to potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21157)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2021-21148     Mattias Buelens discovered a buffer overflow issue in     the v8 JavaScript library.

  - CVE-2021-21149     Ryoya Tsukasaki discovered a stack overflow issue in the     Data Transfer implementation.

  - CVE-2021-21150     Woojin Oh discovered a use-after-free issue in the file     downloader.

  - CVE-2021-21151     Khalil Zhani discovered a use-after-free issue in the     payments system.

  - CVE-2021-21152     A buffer overflow was discovered in media handling.

  - CVE-2021-21153     Jan Ruge discovered a stack overflow issue in the GPU     process.

  - CVE-2021-21154     Abdulrahman Alqabandi discovered a buffer overflow issue     in the Tab Strip implementation.

  - CVE-2021-21155     Khalil Zhani discovered a buffer overflow issue in the     Tab Strip implementation.

  - CVE-2021-21156     Sergei Glazunov discovered a buffer overflow issue in     the v8 JavaScript library.

  - CVE-2021-21157     A use-after-free issue was discovered in the Web Sockets     implementation.

The version of Microsoft Edge installed on the remote Windows host is prior to 88.0.705.74. It is, therefore, affected by multiple vulnerabilities as referenced in the February 17, 2021 advisory.

  - Stack buffer overflow in Data Transfer in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote     attacker to perform out of bounds memory access via a crafted HTML page. (CVE-2021-21149)

  - Use after free in Downloads in Google Chrome on Windows prior to 88.0.4324.182 allowed a remote attacker     who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2021-21150)

  - Use after free in Payments in Google Chrome prior to 88.0.4324.182 allowed a remote attacker to     potentially perform a sandbox escape via a crafted HTML page. (CVE-2021-21151)

  - Heap buffer overflow in Media in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote attacker     to potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21152)

  - Stack buffer overflow in GPU Process in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote     attacker to potentially perform out of bounds memory access via a crafted HTML page. (CVE-2021-21153)

  - Heap buffer overflow in Tab Strip in Google Chrome prior to 88.0.4324.182 allowed a remote attacker who     had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2021-21154)

  - Heap buffer overflow in Tab Strip in Google Chrome on Windows prior to 88.0.4324.182 allowed a remote     attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted     HTML page. (CVE-2021-21155)

  - Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.182 allowed a remote attacker to     potentially exploit heap corruption via a crafted script. (CVE-2021-21156)

  - Use after free in Web Sockets in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote attacker     to potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21157)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Chrome Releases reports :

This release contains 10 security fixes, including :

- [1138143] High CVE-2021-21149: Stack overflow in Data Transfer.
Reported by Ryoya Tsukasaki on 2020-10-14

- [1172192] High CVE-2021-21150: Use after free in Downloads. Reported by Woojin Oh(@pwn_exploit) of STEALIEN on 2021-01-29

- [1165624] High CVE-2021-21151: Use after free in Payments. Reported by Khalil Zhani on 2021-01-12

- [1166504] High CVE-2021-21152: Heap buffer overflow in Media.
Reported by Anonymous on 2021-01-14

- [1155974] High CVE-2021-21153: Stack overflow in GPU Process.
Reported by Jan Ruge of ERNW GmbH on 2020-12-06

- [1173269] High CVE-2021-21154: Heap buffer overflow in Tab Strip.
Reported by Abdulrahman Alqabandi, Microsoft Browser Vulnerability Research on 2021-02-01

- [1175500] High CVE-2021-21155: Heap buffer overflow in Tab Strip.
Reported by Khalil Zhani on 2021-02-07

- [1177341] High CVE-2021-21156: Heap buffer overflow in V8. Reported by Sergei Glazunov of Google Project Zero on 2021-02-11

- [1170657] Medium CVE-2021-21157: Use after free in Web Sockets.
Reported by Anonymous on 2021-01-26

The version of Google Chrome installed on the remote Windows host is prior to 88.0.4324.182. It is, therefore, affected by multiple vulnerabilities as referenced in the 2021_02_stable-channel-update-for-desktop_16 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote macOS host is prior to 88.0.4324.182. It is, therefore, affected by multiple vulnerabilities as referenced in the 2021_02_stable-channel-update-for-desktop_16 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
149223	GLSA-202104-08 : Chromium, Google Chrome: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
148839	openSUSE Security Update : opera (openSUSE-2021-413)	Nessus	SuSE Local Security Checks	critical
147941	Fedora 32 : chromium (2021-c88a96bd4b)	Nessus	Fedora Local Security Checks	critical
147606	openSUSE Security Update : chromium (openSUSE-2021-392)	Nessus	SuSE Local Security Checks	critical
146909	Fedora 33 : chromium (2021-aa764a8531)	Nessus	Fedora Local Security Checks	critical
146757	Debian DSA-4858-1 : chromium - security update	Nessus	Debian Local Security Checks	critical
146586	Microsoft Edge (Chromium) < 88.0.705.74 Multiple Vulnerabilities	Nessus	Windows	critical
146578	FreeBSD : chromium -- multiple vulnerabilities (48514901-711d-11eb-9846-e09467587c17)	Nessus	FreeBSD Local Security Checks	critical
146544	Google Chrome < 88.0.4324.182 Multiple Vulnerabilities	Nessus	Windows	critical
146543	Google Chrome < 88.0.4324.182 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical

Detections

Analytics

CVE-2021-21152

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical