Insufficient data validation in Chrome on iOS in Google Chrome on iOS prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-4740239e28 advisory.

  - Heap buffer overflow in TabStrip in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21159, CVE-2021-21161)

  - Heap buffer overflow in WebAudio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21160)

  - Use after free in WebRTC in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2021-21162)

  - Insufficient data validation in Reader Mode in Google Chrome on iOS prior to 89.0.4389.72 allowed a remote     attacker to leak cross-origin data via a crafted HTML page and a malicious server. (CVE-2021-21163)

  - Insufficient data validation in Chrome on iOS in Google Chrome on iOS prior to 89.0.4389.72 allowed a     remote attacker to leak cross-origin data via a crafted HTML page. (CVE-2021-21164)

  - Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit     heap corruption via a crafted HTML page. (CVE-2021-21165, CVE-2021-21166)

  - Use after free in bookmarks in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21167)

  - Insufficient policy enforcement in appcache in Google Chrome prior to 89.0.4389.72 allowed a remote     attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
    (CVE-2021-21168)

  - Out of bounds memory access in V8 in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to     potentially perform out of bounds memory access via a crafted HTML page. (CVE-2021-21169)

  - Incorrect security UI in Loader in Google Chrome prior to 89.0.4389.72 allowed a remote attacker who had     compromised the renderer process to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
    (CVE-2021-21170)

  - Incorrect security UI in TabStrip and Navigation in Google Chrome on Android prior to 89.0.4389.72 allowed     a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (CVE-2021-21171)

  - Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 89.0.4389.72     allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page. (CVE-2021-21172)

  - Side-channel information leakage in Network Internals in Google Chrome prior to 89.0.4389.72 allowed a     remote attacker to leak cross-origin data via a crafted HTML page. (CVE-2021-21173)

  - Inappropriate implementation in Referrer in Google Chrome prior to 89.0.4389.72 allowed a remote attacker     to bypass navigation restrictions via a crafted HTML page. (CVE-2021-21174)

  - Inappropriate implementation in Site isolation in Google Chrome prior to 89.0.4389.72 allowed a remote     attacker to leak cross-origin data via a crafted HTML page. (CVE-2021-21175)

  - Inappropriate implementation in full screen mode in Google Chrome prior to 89.0.4389.72 allowed a remote     attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (CVE-2021-21176)

  - Insufficient policy enforcement in Autofill in Google Chrome prior to 89.0.4389.72 allowed a remote     attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
    (CVE-2021-21177)

  - Inappropriate implementation in Compositing in Google Chrome on Linux and Windows prior to 89.0.4389.72     allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
    (CVE-2021-21178)

  - Use after free in Network Internals in Google Chrome on Linux prior to 89.0.4389.72 allowed a remote     attacker to potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21179)

  - Use after free in tab search in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21180)

  - Side-channel information leakage in autofill in Google Chrome prior to 89.0.4389.72 allowed a remote     attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
    (CVE-2021-21181)

  - Insufficient policy enforcement in navigations in Google Chrome prior to 89.0.4389.72 allowed a remote     attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML     page. (CVE-2021-21182)

  - Inappropriate implementation in performance APIs in Google Chrome prior to 89.0.4389.72 allowed a remote     attacker to leak cross-origin data via a crafted HTML page. (CVE-2021-21183, CVE-2021-21184)

  - Insufficient policy enforcement in extensions in Google Chrome prior to 89.0.4389.72 allowed an attacker     who convinced a user to install a malicious extension to obtain sensitive information via a crafted Chrome     Extension. (CVE-2021-21185)

  - Insufficient policy enforcement in QR scanning in Google Chrome on iOS prior to 89.0.4389.72 allowed an     attacker who convinced the user to scan a QR code to bypass navigation restrictions via a crafted QR code.
    (CVE-2021-21186)

  - Insufficient data validation in URL formatting in Google Chrome prior to 89.0.4389.72 allowed a remote     attacker to perform domain spoofing via IDN homographs via a crafted domain name. (CVE-2021-21187)

  - Use after free in Blink in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2021-21188)

  - Insufficient policy enforcement in payments in Google Chrome prior to 89.0.4389.72 allowed a remote     attacker to bypass navigation restrictions via a crafted HTML page. (CVE-2021-21189)

  - Uninitialized data in PDFium in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain     potentially sensitive information from process memory via a crafted PDF file. (CVE-2021-21190)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-c88a96bd4b advisory.

  - Stack buffer overflow in Data Transfer in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote     attacker to perform out of bounds memory access via a crafted HTML page. (CVE-2021-21149)

  - Use after free in Downloads in Google Chrome on Windows prior to 88.0.4324.182 allowed a remote attacker     who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2021-21150)

  - Use after free in Payments in Google Chrome prior to 88.0.4324.182 allowed a remote attacker to     potentially perform a sandbox escape via a crafted HTML page. (CVE-2021-21151)

  - Heap buffer overflow in Media in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote attacker     to potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21152)

  - Stack buffer overflow in GPU Process in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote     attacker to potentially perform out of bounds memory access via a crafted HTML page. (CVE-2021-21153)

  - Heap buffer overflow in Tab Strip in Google Chrome prior to 88.0.4324.182 allowed a remote attacker who     had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2021-21154)

  - Heap buffer overflow in Tab Strip in Google Chrome on Windows prior to 88.0.4324.182 allowed a remote     attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted     HTML page. (CVE-2021-21155)

  - Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.182 allowed a remote attacker to     potentially exploit heap corruption via a crafted script. (CVE-2021-21156)

  - Use after free in Web Sockets in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote attacker     to potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21157)

  - Heap buffer overflow in TabStrip in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21159, CVE-2021-21161)

  - Heap buffer overflow in WebAudio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21160)

  - Use after free in WebRTC in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2021-21162)

  - Insufficient data validation in Reader Mode in Google Chrome on iOS prior to 89.0.4389.72 allowed a remote     attacker to leak cross-origin data via a crafted HTML page and a malicious server. (CVE-2021-21163)

  - Insufficient data validation in Chrome on iOS in Google Chrome on iOS prior to 89.0.4389.72 allowed a     remote attacker to leak cross-origin data via a crafted HTML page. (CVE-2021-21164)

  - Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit     heap corruption via a crafted HTML page. (CVE-2021-21165, CVE-2021-21166)

  - Use after free in bookmarks in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21167)

  - Insufficient policy enforcement in appcache in Google Chrome prior to 89.0.4389.72 allowed a remote     attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
    (CVE-2021-21168)

  - Out of bounds memory access in V8 in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to     potentially perform out of bounds memory access via a crafted HTML page. (CVE-2021-21169)

  - Incorrect security UI in Loader in Google Chrome prior to 89.0.4389.72 allowed a remote attacker who had     compromised the renderer process to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
    (CVE-2021-21170)

  - Incorrect security UI in TabStrip and Navigation in Google Chrome on Android prior to 89.0.4389.72 allowed     a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (CVE-2021-21171)

  - Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 89.0.4389.72     allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page. (CVE-2021-21172)

  - Side-channel information leakage in Network Internals in Google Chrome prior to 89.0.4389.72 allowed a     remote attacker to leak cross-origin data via a crafted HTML page. (CVE-2021-21173)

  - Inappropriate implementation in Referrer in Google Chrome prior to 89.0.4389.72 allowed a remote attacker     to bypass navigation restrictions via a crafted HTML page. (CVE-2021-21174)

  - Inappropriate implementation in Site isolation in Google Chrome prior to 89.0.4389.72 allowed a remote     attacker to leak cross-origin data via a crafted HTML page. (CVE-2021-21175)

  - Inappropriate implementation in full screen mode in Google Chrome prior to 89.0.4389.72 allowed a remote     attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (CVE-2021-21176)

  - Insufficient policy enforcement in Autofill in Google Chrome prior to 89.0.4389.72 allowed a remote     attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
    (CVE-2021-21177)

  - Inappropriate implementation in Compositing in Google Chrome on Linux and Windows prior to 89.0.4389.72     allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
    (CVE-2021-21178)

  - Use after free in Network Internals in Google Chrome on Linux prior to 89.0.4389.72 allowed a remote     attacker to potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21179)

  - Use after free in tab search in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21180)

  - Side-channel information leakage in autofill in Google Chrome prior to 89.0.4389.72 allowed a remote     attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
    (CVE-2021-21181)

  - Insufficient policy enforcement in navigations in Google Chrome prior to 89.0.4389.72 allowed a remote     attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML     page. (CVE-2021-21182)

  - Inappropriate implementation in performance APIs in Google Chrome prior to 89.0.4389.72 allowed a remote     attacker to leak cross-origin data via a crafted HTML page. (CVE-2021-21183, CVE-2021-21184)

  - Insufficient policy enforcement in extensions in Google Chrome prior to 89.0.4389.72 allowed an attacker     who convinced a user to install a malicious extension to obtain sensitive information via a crafted Chrome     Extension. (CVE-2021-21185)

  - Insufficient policy enforcement in QR scanning in Google Chrome on iOS prior to 89.0.4389.72 allowed an     attacker who convinced the user to scan a QR code to bypass navigation restrictions via a crafted QR code.
    (CVE-2021-21186)

  - Insufficient data validation in URL formatting in Google Chrome prior to 89.0.4389.72 allowed a remote     attacker to perform domain spoofing via IDN homographs via a crafted domain name. (CVE-2021-21187)

  - Use after free in Blink in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2021-21188)

  - Insufficient policy enforcement in payments in Google Chrome prior to 89.0.4389.72 allowed a remote     attacker to bypass navigation restrictions via a crafted HTML page. (CVE-2021-21189)

  - Uninitialized data in PDFium in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain     potentially sensitive information from process memory via a crafted PDF file. (CVE-2021-21190)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for chromium fixes the following issues :

Update to 89.0.4389.72 (boo#1182358, boo#1182960) :

  - CVE-2021-21159: Heap buffer overflow in TabStrip.

  - CVE-2021-21160: Heap buffer overflow in WebAudio.

  - CVE-2021-21161: Heap buffer overflow in TabStrip.

  - CVE-2021-21162: Use after free in WebRTC.

  - CVE-2021-21163: Insufficient data validation in Reader     Mode.

  - CVE-2021-21164: Insufficient data validation in Chrome     for iOS.

  - CVE-2021-21165: Object lifecycle issue in audio.

  - CVE-2021-21166: Object lifecycle issue in audio.

  - CVE-2021-21167: Use after free in bookmarks.

  - CVE-2021-21168: Insufficient policy enforcement in     appcache.

  - CVE-2021-21169: Out of bounds memory access in V8.

  - CVE-2021-21170: Incorrect security UI in Loader.

  - CVE-2021-21171: Incorrect security UI in TabStrip and     Navigation.

  - CVE-2021-21172: Insufficient policy enforcement in File     System API.

  - CVE-2021-21173: Side-channel information leakage in     Network Internals.

  - CVE-2021-21174: Inappropriate implementation in     Referrer.

  - CVE-2021-21175: Inappropriate implementation in Site     isolation.

  - CVE-2021-21176: Inappropriate implementation in full     screen mode.

  - CVE-2021-21177: Insufficient policy enforcement in     Autofill.

  - CVE-2021-21178: Inappropriate implementation in     Compositing.

  - CVE-2021-21179: Use after free in Network Internals.

  - CVE-2021-21180: Use after free in tab search.

  - CVE-2020-27844: Heap buffer overflow in OpenJPEG.

  - CVE-2021-21181: Side-channel information leakage in     autofill.

  - CVE-2021-21182: Insufficient policy enforcement in     navigations.

  - CVE-2021-21183: Inappropriate implementation in     performance APIs.

  - CVE-2021-21184: Inappropriate implementation in     performance APIs.

  - CVE-2021-21185: Insufficient policy enforcement in     extensions.

  - CVE-2021-21186: Insufficient policy enforcement in QR     scanning.

  - CVE-2021-21187: Insufficient data validation in URL     formatting.

  - CVE-2021-21188: Use after free in Blink.

  - CVE-2021-21189: Insufficient policy enforcement in     payments.

  - CVE-2021-21190: Uninitialized Use in PDFium.

  - CVE-2021-21149: Stack overflow in Data Transfer.

  - CVE-2021-21150: Use after free in Downloads.

  - CVE-2021-21151: Use after free in Payments.

  - CVE-2021-21152: Heap buffer overflow in Media.

  - CVE-2021-21153: Stack overflow in GPU Process. 

  - CVE-2021-21154: Heap buffer overflow in Tab Strip.

  - CVE-2021-21155: Heap buffer overflow in Tab Strip.

  - CVE-2021-21156: Heap buffer overflow in V8.

  - CVE-2021-21157: Use after free in Web Sockets. 

  - Fixed Sandbox with glibc 2.33 (boo#1182233)

  - Fixed an issue where chromium hangs on opening     (boo#1182775).

The version of Microsoft Edge installed on the remote Windows host is prior to 89.0.774.45. It is, therefore, affected by multiple vulnerabilities as referenced in the March 4, 2021 advisory.

  - A flaw was found in openjpeg's src/lib/openjp2/t2.c in versions prior to 2.4.0. This flaw allows an     attacker to provide crafted input to openjpeg during conversion and encoding, causing an out-of-bounds     write. The highest threat from this vulnerability is to confidentiality, integrity, as well as system     availability. (CVE-2020-27844)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Chrome Releases reports :

This release includes 47 security fixes, including the below. Google is aware of reports that an exploit for CVE-2021-21166 exists in the wild. Please see URL for details.

The version of Google Chrome installed on the remote macOS host is prior to 89.0.4389.72. It is, therefore, affected by multiple vulnerabilities as referenced in the 2021_03_stable-channel-update-for-desktop advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 89.0.4389.72. It is, therefore, affected by multiple vulnerabilities as referenced in the 2021_03_stable-channel-update-for-desktop advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
148782	Fedora 33 : chromium (2021-4740239e28)	Nessus	Fedora Local Security Checks	high
147941	Fedora 32 : chromium (2021-c88a96bd4b)	Nessus	Fedora Local Security Checks	critical
147606	openSUSE Security Update : chromium (openSUSE-2021-392)	Nessus	SuSE Local Security Checks	critical
147192	Microsoft Edge (Chromium) < 89.0.774.45 Multiple Vulnerabilities	Nessus	Windows	high
147152	FreeBSD : chromium -- multiple vulnerabilities (f00b65d8-7ccb-11eb-b3be-e09467587c17)	Nessus	FreeBSD Local Security Checks	high
146949	Google Chrome < 89.0.4389.72 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
146948	Google Chrome < 89.0.4389.72 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2021-21164

medium

Tenable Plugins

high

critical

critical

high

high

high

high