Heap buffer overflow in TabStrip in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

The remote host is affected by the vulnerability described in GLSA-202104-08 (Chromium, Google Chrome: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and Google       Chrome. Please review the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-4740239e28 advisory.

  - Heap buffer overflow in TabStrip in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21159, CVE-2021-21161)

  - Heap buffer overflow in WebAudio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21160)

  - Use after free in WebRTC in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2021-21162)

  - Insufficient data validation in Reader Mode in Google Chrome on iOS prior to 89.0.4389.72 allowed a remote     attacker to leak cross-origin data via a crafted HTML page and a malicious server. (CVE-2021-21163)

  - Insufficient data validation in Chrome on iOS in Google Chrome on iOS prior to 89.0.4389.72 allowed a     remote attacker to leak cross-origin data via a crafted HTML page. (CVE-2021-21164)

  - Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit     heap corruption via a crafted HTML page. (CVE-2021-21165, CVE-2021-21166)

  - Use after free in bookmarks in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21167)

  - Insufficient policy enforcement in appcache in Google Chrome prior to 89.0.4389.72 allowed a remote     attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
    (CVE-2021-21168)

  - Out of bounds memory access in V8 in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to     potentially perform out of bounds memory access via a crafted HTML page. (CVE-2021-21169)

  - Incorrect security UI in Loader in Google Chrome prior to 89.0.4389.72 allowed a remote attacker who had     compromised the renderer process to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
    (CVE-2021-21170)

  - Incorrect security UI in TabStrip and Navigation in Google Chrome on Android prior to 89.0.4389.72 allowed     a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (CVE-2021-21171)

  - Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 89.0.4389.72     allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page. (CVE-2021-21172)

  - Side-channel information leakage in Network Internals in Google Chrome prior to 89.0.4389.72 allowed a     remote attacker to leak cross-origin data via a crafted HTML page. (CVE-2021-21173)

  - Inappropriate implementation in Referrer in Google Chrome prior to 89.0.4389.72 allowed a remote attacker     to bypass navigation restrictions via a crafted HTML page. (CVE-2021-21174)

  - Inappropriate implementation in Site isolation in Google Chrome prior to 89.0.4389.72 allowed a remote     attacker to leak cross-origin data via a crafted HTML page. (CVE-2021-21175)

  - Inappropriate implementation in full screen mode in Google Chrome prior to 89.0.4389.72 allowed a remote     attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (CVE-2021-21176)

  - Insufficient policy enforcement in Autofill in Google Chrome prior to 89.0.4389.72 allowed a remote     attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
    (CVE-2021-21177)

  - Inappropriate implementation in Compositing in Google Chrome on Linux and Windows prior to 89.0.4389.72     allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
    (CVE-2021-21178)

  - Use after free in Network Internals in Google Chrome on Linux prior to 89.0.4389.72 allowed a remote     attacker to potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21179)

  - Use after free in tab search in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21180)

  - Side-channel information leakage in autofill in Google Chrome prior to 89.0.4389.72 allowed a remote     attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
    (CVE-2021-21181)

  - Insufficient policy enforcement in navigations in Google Chrome prior to 89.0.4389.72 allowed a remote     attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML     page. (CVE-2021-21182)

  - Inappropriate implementation in performance APIs in Google Chrome prior to 89.0.4389.72 allowed a remote     attacker to leak cross-origin data via a crafted HTML page. (CVE-2021-21183, CVE-2021-21184)

  - Insufficient policy enforcement in extensions in Google Chrome prior to 89.0.4389.72 allowed an attacker     who convinced a user to install a malicious extension to obtain sensitive information via a crafted Chrome     Extension. (CVE-2021-21185)

  - Insufficient policy enforcement in QR scanning in Google Chrome on iOS prior to 89.0.4389.72 allowed an     attacker who convinced the user to scan a QR code to bypass navigation restrictions via a crafted QR code.
    (CVE-2021-21186)

  - Insufficient data validation in URL formatting in Google Chrome prior to 89.0.4389.72 allowed a remote     attacker to perform domain spoofing via IDN homographs via a crafted domain name. (CVE-2021-21187)

  - Use after free in Blink in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2021-21188)

  - Insufficient policy enforcement in payments in Google Chrome prior to 89.0.4389.72 allowed a remote     attacker to bypass navigation restrictions via a crafted HTML page. (CVE-2021-21189)

  - Uninitialized data in PDFium in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain     potentially sensitive information from process memory via a crafted PDF file. (CVE-2021-21190)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Several vulnerabilites have been discovered in the chromium web browser.

  - CVE-2021-21159     Khalil Zhani discovered a buffer overflow issue in the     tab implementation.

  - CVE-2021-21160     Marcin Noga discovered a buffer overflow issue in     WebAudio.

  - CVE-2021-21161     Khalil Zhani discovered a buffer overflow issue in the     tab implementation.

  - CVE-2021-21162     A use-after-free issue was discovered in the WebRTC     implementation.

  - CVE-2021-21163     Alison Huffman discovered a data validation issue.

  - CVE-2021-21165     Alison Huffman discovered an error in the audio     implementation.

  - CVE-2021-21166     Alison Huffman discovered an error in the audio     implementation.

  - CVE-2021-21167     Leecraso and Guang Gong discovered a use-after-free     issue in the bookmarks implementation.

  - CVE-2021-21168     Luan Herrera discovered a policy enforcement error in     the appcache.

  - CVE-2021-21169     Bohan Liu and Moon Liang discovered an out-of-bounds     access issue in the v8 JavaScript library.

  - CVE-2021-21170     David Erceg discovered a user interface error.

  - CVE-2021-21171     Irvan Kurniawan discovered a user interface error.

  - CVE-2021-21172     Maciej Pulikowski discovered a policy enforcement error     in the File System API.

  - CVE-2021-21173     Tom Van Goethem discovered a network based information     leak.

  - CVE-2021-21174     Ashish Guatam Kambled discovered an implementation error     in the Referrer policy.

  - CVE-2021-21175     Jun Kokatsu discovered an implementation error in the     Site Isolation feature.

  - CVE-2021-21176     Luan Herrera discovered an implementation error in the     full screen mode.

  - CVE-2021-21177     Abdulrahman Alqabandi discovered a policy enforcement     error in the Autofill feature.

  - CVE-2021-21178     Japong discovered an error in the Compositor     implementation.

  - CVE-2021-21179     A use-after-free issue was discovered in the networking     implementation.

  - CVE-2021-21180     Abdulrahman Alqabandi discovered a use-after-free issue     in the tab search feature.

  - CVE-2021-21181     Xu Lin, Panagiotis Ilias, and Jason Polakis discovered a     side-channel information leak in the Autofill feature.

  - CVE-2021-21182     Luan Herrera discovered a policy enforcement error in     the site navigation implementation.

  - CVE-2021-21183     Takashi Yoneuchi discovered an implementation error in     the Performance API.

  - CVE-2021-21184     James Hartig discovered an implementation error in the     Performance API.

  - CVE-2021-21185     David Erceg discovered a policy enforcement error in     Extensions.

  - CVE-2021-21186     dhirajkumarnifty discovered a policy enforcement error     in the QR scan implementation.

  - CVE-2021-21187     Kirtikumar Anandrao Ramchandani discovered a data     validation error in URL formatting.

  - CVE-2021-21188     Woojin Oh discovered a use-after-free issue in     Blink/Webkit.

  - CVE-2021-21189     Khalil Zhani discovered a policy enforcement error in     the Payments implementation.

  - CVE-2021-21190     Zhou Aiting discovered use of uninitialized memory in     the pdfium library.

  - CVE-2021-21191     raven discovered a use-after-free issue in the WebRTC     implementation.

  - CVE-2021-21192     Abdulrahman Alqabandi discovered a buffer overflow issue     in the tab implementation.

  - CVE-2021-21193     A use-after-free issue was discovered in Blink/Webkit.

  - CVE-2021-21194     Leecraso and Guang Gong discovered a use-after-free     issue in the screen capture feature.

  - CVE-2021-21195     Liu and Liang discovered a use-after-free issue in the     v8 JavaScript library.

  - CVE-2021-21196     Khalil Zhani discovered a buffer overflow issue in the     tab implementation.

  - CVE-2021-21197     Abdulrahman Alqabandi discovered a buffer overflow issue     in the tab implementation.

  - CVE-2021-21198     Mark Brand discovered an out-of-bounds read issue in the     Inter-Process Communication implementation.

  - CVE-2021-21199     Weipeng Jiang discovered a use-after-free issue in the     Aura window and event manager.

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-c88a96bd4b advisory.

  - Stack buffer overflow in Data Transfer in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote     attacker to perform out of bounds memory access via a crafted HTML page. (CVE-2021-21149)

  - Use after free in Downloads in Google Chrome on Windows prior to 88.0.4324.182 allowed a remote attacker     who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2021-21150)

  - Use after free in Payments in Google Chrome prior to 88.0.4324.182 allowed a remote attacker to     potentially perform a sandbox escape via a crafted HTML page. (CVE-2021-21151)

  - Heap buffer overflow in Media in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote attacker     to potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21152)

  - Stack buffer overflow in GPU Process in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote     attacker to potentially perform out of bounds memory access via a crafted HTML page. (CVE-2021-21153)

  - Heap buffer overflow in Tab Strip in Google Chrome prior to 88.0.4324.182 allowed a remote attacker who     had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2021-21154)

  - Heap buffer overflow in Tab Strip in Google Chrome on Windows prior to 88.0.4324.182 allowed a remote     attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted     HTML page. (CVE-2021-21155)

  - Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.182 allowed a remote attacker to     potentially exploit heap corruption via a crafted script. (CVE-2021-21156)

  - Use after free in Web Sockets in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote attacker     to potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21157)

  - Heap buffer overflow in TabStrip in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21159, CVE-2021-21161)

  - Heap buffer overflow in WebAudio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21160)

  - Use after free in WebRTC in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2021-21162)

  - Insufficient data validation in Reader Mode in Google Chrome on iOS prior to 89.0.4389.72 allowed a remote     attacker to leak cross-origin data via a crafted HTML page and a malicious server. (CVE-2021-21163)

  - Insufficient data validation in Chrome on iOS in Google Chrome on iOS prior to 89.0.4389.72 allowed a     remote attacker to leak cross-origin data via a crafted HTML page. (CVE-2021-21164)

  - Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit     heap corruption via a crafted HTML page. (CVE-2021-21165, CVE-2021-21166)

  - Use after free in bookmarks in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21167)

  - Insufficient policy enforcement in appcache in Google Chrome prior to 89.0.4389.72 allowed a remote     attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
    (CVE-2021-21168)

  - Out of bounds memory access in V8 in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to     potentially perform out of bounds memory access via a crafted HTML page. (CVE-2021-21169)

  - Incorrect security UI in Loader in Google Chrome prior to 89.0.4389.72 allowed a remote attacker who had     compromised the renderer process to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
    (CVE-2021-21170)

  - Incorrect security UI in TabStrip and Navigation in Google Chrome on Android prior to 89.0.4389.72 allowed     a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (CVE-2021-21171)

  - Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 89.0.4389.72     allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page. (CVE-2021-21172)

  - Side-channel information leakage in Network Internals in Google Chrome prior to 89.0.4389.72 allowed a     remote attacker to leak cross-origin data via a crafted HTML page. (CVE-2021-21173)

  - Inappropriate implementation in Referrer in Google Chrome prior to 89.0.4389.72 allowed a remote attacker     to bypass navigation restrictions via a crafted HTML page. (CVE-2021-21174)

  - Inappropriate implementation in Site isolation in Google Chrome prior to 89.0.4389.72 allowed a remote     attacker to leak cross-origin data via a crafted HTML page. (CVE-2021-21175)

  - Inappropriate implementation in full screen mode in Google Chrome prior to 89.0.4389.72 allowed a remote     attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (CVE-2021-21176)

  - Insufficient policy enforcement in Autofill in Google Chrome prior to 89.0.4389.72 allowed a remote     attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
    (CVE-2021-21177)

  - Inappropriate implementation in Compositing in Google Chrome on Linux and Windows prior to 89.0.4389.72     allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
    (CVE-2021-21178)

  - Use after free in Network Internals in Google Chrome on Linux prior to 89.0.4389.72 allowed a remote     attacker to potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21179)

  - Use after free in tab search in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21180)

  - Side-channel information leakage in autofill in Google Chrome prior to 89.0.4389.72 allowed a remote     attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
    (CVE-2021-21181)

  - Insufficient policy enforcement in navigations in Google Chrome prior to 89.0.4389.72 allowed a remote     attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML     page. (CVE-2021-21182)

  - Inappropriate implementation in performance APIs in Google Chrome prior to 89.0.4389.72 allowed a remote     attacker to leak cross-origin data via a crafted HTML page. (CVE-2021-21183, CVE-2021-21184)

  - Insufficient policy enforcement in extensions in Google Chrome prior to 89.0.4389.72 allowed an attacker     who convinced a user to install a malicious extension to obtain sensitive information via a crafted Chrome     Extension. (CVE-2021-21185)

  - Insufficient policy enforcement in QR scanning in Google Chrome on iOS prior to 89.0.4389.72 allowed an     attacker who convinced the user to scan a QR code to bypass navigation restrictions via a crafted QR code.
    (CVE-2021-21186)

  - Insufficient data validation in URL formatting in Google Chrome prior to 89.0.4389.72 allowed a remote     attacker to perform domain spoofing via IDN homographs via a crafted domain name. (CVE-2021-21187)

  - Use after free in Blink in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2021-21188)

  - Insufficient policy enforcement in payments in Google Chrome prior to 89.0.4389.72 allowed a remote     attacker to bypass navigation restrictions via a crafted HTML page. (CVE-2021-21189)

  - Uninitialized data in PDFium in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain     potentially sensitive information from process memory via a crafted PDF file. (CVE-2021-21190)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for chromium fixes the following issues :

Update to 89.0.4389.72 (boo#1182358, boo#1182960) :

  - CVE-2021-21159: Heap buffer overflow in TabStrip.

  - CVE-2021-21160: Heap buffer overflow in WebAudio.

  - CVE-2021-21161: Heap buffer overflow in TabStrip.

  - CVE-2021-21162: Use after free in WebRTC.

  - CVE-2021-21163: Insufficient data validation in Reader     Mode.

  - CVE-2021-21164: Insufficient data validation in Chrome     for iOS.

  - CVE-2021-21165: Object lifecycle issue in audio.

  - CVE-2021-21166: Object lifecycle issue in audio.

  - CVE-2021-21167: Use after free in bookmarks.

  - CVE-2021-21168: Insufficient policy enforcement in     appcache.

  - CVE-2021-21169: Out of bounds memory access in V8.

  - CVE-2021-21170: Incorrect security UI in Loader.

  - CVE-2021-21171: Incorrect security UI in TabStrip and     Navigation.

  - CVE-2021-21172: Insufficient policy enforcement in File     System API.

  - CVE-2021-21173: Side-channel information leakage in     Network Internals.

  - CVE-2021-21174: Inappropriate implementation in     Referrer.

  - CVE-2021-21175: Inappropriate implementation in Site     isolation.

  - CVE-2021-21176: Inappropriate implementation in full     screen mode.

  - CVE-2021-21177: Insufficient policy enforcement in     Autofill.

  - CVE-2021-21178: Inappropriate implementation in     Compositing.

  - CVE-2021-21179: Use after free in Network Internals.

  - CVE-2021-21180: Use after free in tab search.

  - CVE-2020-27844: Heap buffer overflow in OpenJPEG.

  - CVE-2021-21181: Side-channel information leakage in     autofill.

  - CVE-2021-21182: Insufficient policy enforcement in     navigations.

  - CVE-2021-21183: Inappropriate implementation in     performance APIs.

  - CVE-2021-21184: Inappropriate implementation in     performance APIs.

  - CVE-2021-21185: Insufficient policy enforcement in     extensions.

  - CVE-2021-21186: Insufficient policy enforcement in QR     scanning.

  - CVE-2021-21187: Insufficient data validation in URL     formatting.

  - CVE-2021-21188: Use after free in Blink.

  - CVE-2021-21189: Insufficient policy enforcement in     payments.

  - CVE-2021-21190: Uninitialized Use in PDFium.

  - CVE-2021-21149: Stack overflow in Data Transfer.

  - CVE-2021-21150: Use after free in Downloads.

  - CVE-2021-21151: Use after free in Payments.

  - CVE-2021-21152: Heap buffer overflow in Media.

  - CVE-2021-21153: Stack overflow in GPU Process. 

  - CVE-2021-21154: Heap buffer overflow in Tab Strip.

  - CVE-2021-21155: Heap buffer overflow in Tab Strip.

  - CVE-2021-21156: Heap buffer overflow in V8.

  - CVE-2021-21157: Use after free in Web Sockets. 

  - Fixed Sandbox with glibc 2.33 (boo#1182233)

  - Fixed an issue where chromium hangs on opening     (boo#1182775).

The version of Microsoft Edge installed on the remote Windows host is prior to 89.0.774.45. It is, therefore, affected by multiple vulnerabilities as referenced in the March 4, 2021 advisory.

  - A flaw was found in openjpeg's src/lib/openjp2/t2.c in versions prior to 2.4.0. This flaw allows an     attacker to provide crafted input to openjpeg during conversion and encoding, causing an out-of-bounds     write. The highest threat from this vulnerability is to confidentiality, integrity, as well as system     availability. (CVE-2020-27844)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Chrome Releases reports :

This release includes 47 security fixes, including the below. Google is aware of reports that an exploit for CVE-2021-21166 exists in the wild. Please see URL for details.

The version of Google Chrome installed on the remote macOS host is prior to 89.0.4389.72. It is, therefore, affected by multiple vulnerabilities as referenced in the 2021_03_stable-channel-update-for-desktop advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 89.0.4389.72. It is, therefore, affected by multiple vulnerabilities as referenced in the 2021_03_stable-channel-update-for-desktop advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
149223	GLSA-202104-08 : Chromium, Google Chrome: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
148782	Fedora 33 : chromium (2021-4740239e28)	Nessus	Fedora Local Security Checks	high
148364	Debian DSA-4886-1 : chromium - security update	Nessus	Debian Local Security Checks	high
147941	Fedora 32 : chromium (2021-c88a96bd4b)	Nessus	Fedora Local Security Checks	critical
147606	openSUSE Security Update : chromium (openSUSE-2021-392)	Nessus	SuSE Local Security Checks	critical
147192	Microsoft Edge (Chromium) < 89.0.774.45 Multiple Vulnerabilities	Nessus	Windows	high
147152	FreeBSD : chromium -- multiple vulnerabilities (f00b65d8-7ccb-11eb-b3be-e09467587c17)	Nessus	FreeBSD Local Security Checks	high
146949	Google Chrome < 89.0.4389.72 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
146948	Google Chrome < 89.0.4389.72 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2021-21161

high

Tenable Plugins

critical

high

high

critical

critical

high

high

high

high