Heap buffer overflow in Reader Mode in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

The remote host is affected by the vulnerability described in GLSA-202107-06 (Chromium, Google Chrome: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and Google       Chrome. Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could execute arbitrary code, escalate privileges,       obtain sensitive information, spoof a URL or cause a Denial of Service       condition.
  Workaround :

    There is no known workaround at this time.

This update for opera fixes the following issues :

Update to version 76.0.4017.154

  - CHR-8420 Update chromium on desktop-stable-90-4017 to     90.0.4430.212

  - DNA-92411 Bookmarks breadcrumbs wrong color when pressed     in dark mode

  - DNA-92587 Sync settings: &ldquo;Use old password&rdquo;
    button doesn&rsquo;t work

  - DNA-92672 Make it possible for agent to inject scripts     into startpage

  - DNA-92712 Add SD reload API

  - DNA-93190 The bookmark can&rsquo;t be opened in     Workspace 5-6

  - DNA-93247 Reopen last closed tab shortcut opens random     tab on new window

  - DNA-93294 Binary diff for opera_browser.dll is not     created on 32-bit builds

  - DNA-93313 Add opauto test to cover DNA-93190

  - DNA-93368 Fix an error in Polish translation

  - DNA-93408 [Windows] widevine_cdm_component_installer     does not compile on desktop-stable-90-4017

  - The update to chromium 90.0.4430.212 fixes following     issues: CVE-2021-30506, CVE-2021-30507, CVE-2021-30508,     CVE-2021-30509, CVE-2021-30510, CVE-2021-30511,     CVE-2021-30512, CVE-2021-30513, CVE-2021-30514,     CVE-2021-30515, CVE-2021-30516, CVE-2021-30517,     CVE-2021-30518, CVE-2021-30519, CVE-2021-30520

This update for opera fixes the following issues :

Update to version 76.0.4017.154

  - CHR-8420 Update chromium on desktop-stable-90-4017 to     90.0.4430.212

  - DNA-92411 Bookmarks breadcrumbs wrong color when pressed     in dark mode

  - DNA-92587 Sync settings: &ldquo;Use old password&rdquo;
    button doesn&rsquo;t work

  - DNA-92672 Make it possible for agent to inject scripts     into startpage

  - DNA-92712 Add SD reload API

  - DNA-93190 The bookmark can&rsquo;t be opened in     Workspace 5-6

  - DNA-93247 Reopen last closed tab shortcut opens random     tab on new window

  - DNA-93294 Binary diff for opera_browser.dll is not     created on 32-bit builds

  - DNA-93313 Add opauto test to cover DNA-93190

  - DNA-93368 Fix an error in Polish translation

  - DNA-93408 [Windows] widevine_cdm_component_installer     does not compile on desktop-stable-90-4017

  - The update to chromium 90.0.4430.212 fixes following     issues: CVE-2021-30506, CVE-2021-30507, CVE-2021-30508,     CVE-2021-30509, CVE-2021-30510, CVE-2021-30511,     CVE-2021-30512, CVE-2021-30513, CVE-2021-30514,     CVE-2021-30515, CVE-2021-30516, CVE-2021-30517,     CVE-2021-30518, CVE-2021-30519, CVE-2021-30520

Update to version 76.0.4017.123

  - DNA-91951 SkipAds click by default with Adblocker on     Youtube

  - DNA-92293 [Mac] Crash at     opera::BrowserWindowImpl::Cleanup()

  - DNA-92714 [Mac] Worskpace switching lags with lot of     tabs

  - DNA-92847 DCHECK at tab_lifecycle_unit_source.cc:145

  - DNA-92860 [Windows] Fix issues when running buildsign     script with Python 3

  - DNA-92879 Fix issues when running buildsign script with     Python 3

  - DNA-92938 opera://activity/ page ignores workspaces

  - DNA-93015 [Player] Panel is too narrow

  - DNA-93044 Remove unnecessary question mark in Cashback     string in Polish

  - DNA-93070 [Search Tabs] Selecting items with cursor keys     skips over content matches

  - DNA-93122 Use input in builddiff.py

  - DNA-93175 Fix running repacking

This update for chromium fixes the following issues :

(This is a rerelease with aarch64 enabled.)

Chromium 90.0.4430.212 (boo#1185908)

  - CVE-2021-30506: Incorrect security UI in Web App     Installs

  - CVE-2021-30507: Inappropriate implementation in Offline

  - CVE-2021-30508: Heap buffer overflow in Media Feeds

  - CVE-2021-30509: Out of bounds write in Tab Strip

  - CVE-2021-30510: Race in Aura

  - CVE-2021-30511: Out of bounds read in Tab Group

  - CVE-2021-30512: Use after free in Notifications

  - CVE-2021-30513: Type Confusion in V8

  - CVE-2021-30514: Use after free in Autofill

  - CVE-2021-30515: Use after free in File API

  - CVE-2021-30516: Heap buffer overflow in History

  - CVE-2021-30517: Type Confusion in V8

  - CVE-2021-30518: Heap buffer overflow in Reader Mode

  - CVE-2021-30519: Use after free in Payments

  - CVE-2021-30520: Use after free in Tab Strip

  - FTP support disabled at runtime by default since release     88. Chromium 91 will remove support for ftp altogether     (boo#1185496)

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2021-30506     @retsew0x01 discovered an error in the Web App     installation interface.

  - CVE-2021-30507     Alison Huffman discovered an error in the Offline mode.

  - CVE-2021-30508     Leecraso and Guang Gong discovered a buffer overflow     issue in the Media Feeds implementation.

  - CVE-2021-30509     David Erceg discovered an out-of-bounds write issue in     the Tab Strip implementation.

  - CVE-2021-30510     Weipeng Jiang discovered a race condition in the aura     window manager.

  - CVE-2021-30511     David Erceg discovered an out-of-bounds read issue in     the Tab Strip implementation.

  - CVE-2021-30512     ZhanJia Song discovered a use-after-free issue in the     notifications implementation.

  - CVE-2021-30513     Man Yue Mo discovered an incorrect type in the v8     JavaScript library.

  - CVE-2021-30514     koocola and Wang discovered a use-after-free issue in     the Autofill feature.

  - CVE-2021-30515     Rong Jian and Guang Gong discovered a use-after-free     issue in the file system access API.

  - CVE-2021-30516     ZhanJia Song discovered a buffer overflow issue in the     browsing history.

  - CVE-2021-30517     Jun Kokatsu discovered a buffer overflow issue in the     reader mode.

  - CVE-2021-30518     laural discovered use of an incorrect type in the v8     JavaScript library.

  - CVE-2021-30519     asnine discovered a use-after-free issue in the Payments     feature.

  - CVE-2021-30520     Khalil Zhani discovered a use-after-free issue in the     Tab Strip implementation.

This update for chromium fixes the following issues :

Chromium 90.0.4430.212 (boo#1185908)

  - CVE-2021-30506: Incorrect security UI in Web App     Installs

  - CVE-2021-30507: Inappropriate implementation in Offline

  - CVE-2021-30508: Heap buffer overflow in Media Feeds

  - CVE-2021-30509: Out of bounds write in Tab Strip

  - CVE-2021-30510: Race in Aura

  - CVE-2021-30511: Out of bounds read in Tab Group

  - CVE-2021-30512: Use after free in Notifications

  - CVE-2021-30513: Type Confusion in V8

  - CVE-2021-30514: Use after free in Autofill

  - CVE-2021-30515: Use after free in File API

  - CVE-2021-30516: Heap buffer overflow in History

  - CVE-2021-30517: Type Confusion in V8

  - CVE-2021-30518: Heap buffer overflow in Reader Mode

  - CVE-2021-30519: Use after free in Payments

  - CVE-2021-30520: Use after free in Tab Strip

  - FTP support disabled at runtime by default since release     88. Chromium 91 will remove support for ftp altogether     (boo#1185496)

The version of Microsoft Edge installed on the remote Windows host is prior to 90.0.xxxxxx. It is, therefore, affected by multiple vulnerabilities as referenced in the May 13, 2021 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Chrome Releases reports :

This release contains 19 security fixes, including :

- [1180126] High CVE-2021-30506: Incorrect security UI in Web App Installs. Reported by @retsew0x01 on 2021-02-19

- [1178202] High CVE-2021-30507: Inappropriate implementation in Offline. Reported by Alison Huffman, Microsoft Browser Vulnerability Research on 2021-02-14

- [1195340] High CVE-2021-30508: Heap buffer overflow in Media Feeds.
Reported by Leecraso and Guang Gong of 360 Alpha Lab on 2021-04-02

- [1196309] High CVE-2021-30509: Out of bounds write in Tab Strip.
Reported by David Erceg on 2021-04-06

- [1197436] High CVE-2021-30510: Race in Aura. Reported by Weipeng Jiang (@Krace) from Codesafe Team of Legendsec at Qi'anxin Group on 2021-04-09

- [1197875] High CVE-2021-30511: Out of bounds read in Tab Groups.
Reported by David Erceg on 2021-04-10

- [1200019] High CVE-2021-30512: Use after free in Notifications.
Reported by ZhanJia Song on 2021-04-17

- [1200490] High CVE-2021-30513: Type Confusion in V8. Reported by Man Yue Mo of GitHub Security Lab on 2021-04-19

- [1200766] High CVE-2021-30514: Use after free in Autofill. Reported by koocola (@alo_cook) and Nan Wang (@eternalsakura13) of 360 Alpha Lab on 2021-04-20

- [1201073] High CVE-2021-30515: Use after free in File API. Reported by Rong Jian and Guang Gong of 360 Alpha Lab on 2021-04-21

- [1201446] High CVE-2021-30516: Heap buffer overflow in History.
Reported by ZhanJia Song on 2021-04-22

- [1203122] High CVE-2021-30517: Type Confusion in V8. Reported by laural on 2021-04-27

- [1203590] High CVE-2021-30518: Heap buffer overflow in Reader Mode.
Reported by Jun Kokatsu, Microsoft Browser Vulnerability Research on 2021-04-28

- [1194058] Medium CVE-2021-30519: Use after free in Payments.
Reported by asnine on 2021-03-30

- [1193362] Medium CVE-2021-30520: Use after free in Tab Strip.
Reported by Khalil Zhani on 2021-04-03

The version of Google Chrome installed on the remote macOS host is prior to 90.0.4430.212. It is, therefore, affected by multiple vulnerabilities as referenced in the 2021_05_stable-channel-update-for-desktop advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 90.0.4430.212. It is, therefore, affected by multiple vulnerabilities as referenced in the 2021_05_stable-channel-update-for-desktop advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
156995	GLSA-202107-06 : Chromium, Google Chrome: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
150261	openSUSE Security Update : opera (openSUSE-2021-828)	Nessus	SuSE Local Security Checks	high
150259	openSUSE Security Update : opera (openSUSE-2021-829)	Nessus	SuSE Local Security Checks	high
149891	openSUSE Security Update : chromium (openSUSE-2021-762)	Nessus	SuSE Local Security Checks	high
149635	Debian DSA-4917-1 : chromium - security update	Nessus	Debian Local Security Checks	high
149600	openSUSE Security Update : chromium (openSUSE-2021-742)	Nessus	SuSE Local Security Checks	high
149476	Microsoft Edge (Chromium) < 90.0.xxxxxx Multiple Vulnerabilities	Nessus	Windows	high
149425	FreeBSD : chromium -- multiple vulnerabilities (3cac007f-b27e-11eb-97a0-e09467587c17)	Nessus	FreeBSD Local Security Checks	high
149413	Google Chrome < 90.0.4430.212 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
149412	Google Chrome < 90.0.4430.212 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2021-30518

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high