Use after free in Printing in Google Chrome prior to 92.0.4515.159 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.

The remote SUSE Linux SUSE15 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1221-1 advisory.

  - Type confusion in V8 in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to execute     arbitrary code inside a sandbox via a crafted HTML page. (CVE-2021-30598, CVE-2021-30599)

  - Use after free in Printing in Google Chrome prior to 92.0.4515.159 allowed a remote attacker who had     compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
    (CVE-2021-30600)

  - Use after free in Extensions API in Google Chrome prior to 92.0.4515.159 allowed an attacker who convinced     a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
    (CVE-2021-30601)

  - Use after free in WebRTC in Google Chrome prior to 92.0.4515.159 allowed an attacker who convinced a user     to visit a malicious website to potentially exploit heap corruption via a crafted HTML page.
    (CVE-2021-30602)

  - Data race in WebAudio in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2021-30603)

  - Use after free in ANGLE in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2021-30604)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1180-1 advisory.

  - Type Confusion in V8. (CVE-2021-30598, CVE-2021-30599)

  - Use after free in Printing. (CVE-2021-30600)

  - Use after free in Extensions API. (CVE-2021-30601)

  - Use after free in WebRTC. (CVE-2021-30602)

  - Race in WebAudio. (CVE-2021-30603)

  - Use after free in ANGLE. (CVE-2021-30604)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1172-1 advisory.

  - Type Confusion in V8. (CVE-2021-30598, CVE-2021-30599)

  - Use after free in Printing. (CVE-2021-30600)

  - Use after free in Extensions API. (CVE-2021-30601)

  - Use after free in WebRTC. (CVE-2021-30602)

  - Race in WebAudio. (CVE-2021-30603)

  - Use after free in ANGLE. (CVE-2021-30604)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Chrome Releases reports :

This release contains 9 security fixes, including :

- [1234764] High CVE-2021-30598: Type Confusion in V8. Reported by Manfred Paul on 2021-07-30

- [1234770] High CVE-2021-30599: Type Confusion in V8. Reported by Manfred Paul on 2021-07-30

- [1231134] High CVE-2021-30600: Use after free in Printing. Reported by Leecraso and Guang Gong of 360 Alpha Lab on 2021-07-20

- [1234009] High CVE-2021-30601: Use after free in Extensions API.
Reported by koocola(@alo_cook) and Nan Wang(@eternalsakura13) of 360 Alpha Lab on 2021-07-28

- [1230767] High CVE-2021-30602: Use after free in WebRTC. Reported by Marcin Towalski of Cisco Talos on 2021-07-19

- [1233564] High CVE-2021-30603: Race in WebAudio. Reported by Sergei Glazunov of Google Project Zero on 2021-07-27

- [1234829] High CVE-2021-30604: Use after free in ANGLE. Reported by Seong-Hwan Park (SeHwa) of SecunologyLab on 2021-07-30

The version of Google Chrome installed on the remote Windows host is prior to 92.0.4515.159. It is, therefore, affected by multiple vulnerabilities as referenced in the 2021_08_stable-channel-update-for-desktop advisory.

  - Use after free in ANGLE in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2021-30604)

  - Use after free in Printing in Google Chrome prior to 92.0.4515.159 allowed a remote attacker who had     compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
    (CVE-2021-30600)

  - Use after free in Extensions API in Google Chrome prior to 92.0.4515.159 allowed an attacker who convinced     a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
    (CVE-2021-30601)

  - Use after free in WebRTC in Google Chrome prior to 92.0.4515.159 allowed an attacker who convinced a user     to visit a malicious website to potentially exploit heap corruption via a crafted HTML page.
    (CVE-2021-30602)

  - Data race in WebAudio in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2021-30603)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote macOS host is prior to 92.0.4515.159. It is, therefore, affected by multiple vulnerabilities as referenced in the 2021_08_stable-channel-update-for-desktop advisory.

  - Use after free in ANGLE in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2021-30604)

  - Use after free in Printing in Google Chrome prior to 92.0.4515.159 allowed a remote attacker who had     compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
    (CVE-2021-30600)

  - Use after free in Extensions API in Google Chrome prior to 92.0.4515.159 allowed an attacker who convinced     a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
    (CVE-2021-30601)

  - Use after free in WebRTC in Google Chrome prior to 92.0.4515.159 allowed an attacker who convinced a user     to visit a malicious website to potentially exploit heap corruption via a crafted HTML page.
    (CVE-2021-30602)

  - Data race in WebAudio in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2021-30603)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
157241	GLSA-202201-02 : Chromium, Google Chrome: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
153000	openSUSE 15 Security Update : opera (openSUSE-SU-2021:1221-1)	Nessus	SuSE Local Security Checks	high
152770	openSUSE 15 Security Update : chromium (openSUSE-SU-2021:1180-1)	Nessus	SuSE Local Security Checks	high
152731	openSUSE 15 Security Update : chromium (openSUSE-SU-2021:1172-1)	Nessus	SuSE Local Security Checks	high
152657	FreeBSD : chromium -- multiple vulnerabilities (128deba6-ff56-11eb-8514-3065ec8fd3ec)	Nessus	FreeBSD Local Security Checks	high
152609	Google Chrome < 92.0.4515.159 Multiple Vulnerabilities	Nessus	Windows	high
152608	Google Chrome < 92.0.4515.159 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high

Detections

Analytics

CVE-2021-30600

high

Tenable Plugins

critical

high

high

high

high

high

high