You are here
Home > Preporuke > Sigurnosni nedostaci programskog paketa chromium

Sigurnosni nedostaci programskog paketa chromium

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Critical: chromium-browser security update
Advisory ID: RHSA-2019:4238-01
Product: Red Hat Enterprise Linux Supplementary
Advisory URL: https://access.redhat.com/errata/RHSA-2019:4238
Issue date: 2019-12-16
CVE Names: CVE-2019-13725 CVE-2019-13726 CVE-2019-13727
CVE-2019-13728 CVE-2019-13729 CVE-2019-13730
CVE-2019-13732 CVE-2019-13734 CVE-2019-13735
CVE-2019-13736 CVE-2019-13737 CVE-2019-13738
CVE-2019-13739 CVE-2019-13740 CVE-2019-13741
CVE-2019-13742 CVE-2019-13743 CVE-2019-13744
CVE-2019-13745 CVE-2019-13746 CVE-2019-13747
CVE-2019-13748 CVE-2019-13749 CVE-2019-13750
CVE-2019-13751 CVE-2019-13752 CVE-2019-13753
CVE-2019-13754 CVE-2019-13755 CVE-2019-13756
CVE-2019-13757 CVE-2019-13758 CVE-2019-13759
CVE-2019-13761 CVE-2019-13762 CVE-2019-13763
CVE-2019-13764
=====================================================================

1. Summary:

An update for chromium-browser is now available for Red Hat Enterprise
Linux 6 Supplementary.

Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Desktop Supplementary (v. 6) – i386, i686, x86_64
Red Hat Enterprise Linux HPC Node Supplementary (v. 6) – i686, x86_64
Red Hat Enterprise Linux Server Supplementary (v. 6) – i386, i686, x86_64
Red Hat Enterprise Linux Workstation Supplementary (v. 6) – i386, i686, x86_64

3. Description:

Chromium is an open-source web browser, powered by WebKit (Blink).

This update upgrades Chromium to version 79.0.3945.79.

Security Fix(es):

* chromium-browser: Use after free in Bluetooth (CVE-2019-13725)

* chromium-browser: Heap buffer overflow in password manager
(CVE-2019-13726)

* chromium-browser: Insufficient policy enforcement in WebSockets
(CVE-2019-13727)

* chromium-browser: Out of bounds write in V8 (CVE-2019-13728)

* chromium-browser: Use after free in WebSockets (CVE-2019-13729)

* chromium-browser: Type Confusion in V8 (CVE-2019-13730)

* chromium-browser: Use after free in WebAudio (CVE-2019-13732)

* chromium-browser: Out of bounds write in SQLite (CVE-2019-13734)

* chromium-browser: Out of bounds write in V8 (CVE-2019-13735)

* chromium-browser: Type Confusion in V8 (CVE-2019-13764)

* chromium-browser: Integer overflow in PDFium (CVE-2019-13736)

* chromium-browser: Insufficient policy enforcement in autocomplete
(CVE-2019-13737)

* chromium-browser: Insufficient policy enforcement in navigation
(CVE-2019-13738)

* chromium-browser: Incorrect security UI in Omnibox (CVE-2019-13739)

* chromium-browser: Incorrect security UI in sharing (CVE-2019-13740)

* chromium-browser: Insufficient validation of untrusted input in Blink
(CVE-2019-13741)

* chromium-browser: Incorrect security UI in Omnibox (CVE-2019-13742)

* chromium-browser: Incorrect security UI in external protocol handling
(CVE-2019-13743)

* chromium-browser: Insufficient policy enforcement in cookies
(CVE-2019-13744)

* chromium-browser: Insufficient policy enforcement in audio
(CVE-2019-13745)

* chromium-browser: Insufficient policy enforcement in Omnibox
(CVE-2019-13746)

* chromium-browser: Uninitialized Use in rendering (CVE-2019-13747)

* chromium-browser: Insufficient policy enforcement in developer tools
(CVE-2019-13748)

* chromium-browser: Incorrect security UI in Omnibox (CVE-2019-13749)

* chromium-browser: Insufficient data validation in SQLite (CVE-2019-13750)

* chromium-browser: Uninitialized Use in SQLite (CVE-2019-13751)

* chromium-browser: Out of bounds read in SQLite (CVE-2019-13752)

* chromium-browser: Out of bounds read in SQLite (CVE-2019-13753)

* chromium-browser: Insufficient policy enforcement in extensions
(CVE-2019-13754)

* chromium-browser: Insufficient policy enforcement in extensions
(CVE-2019-13755)

* chromium-browser: Incorrect security UI in printing (CVE-2019-13756)

* chromium-browser: Incorrect security UI in Omnibox (CVE-2019-13757)

* chromium-browser: Insufficient policy enforcement in navigation
(CVE-2019-13758)

* chromium-browser: Incorrect security UI in interstitials (CVE-2019-13759)

* chromium-browser: Incorrect security UI in Omnibox (CVE-2019-13761)

* chromium-browser: Insufficient policy enforcement in downloads
(CVE-2019-13762)

* chromium-browser: Insufficient policy enforcement in payments
(CVE-2019-13763)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

1781973 – CVE-2019-13725 chromium-browser: Use after free in Bluetooth
1781974 – CVE-2019-13726 chromium-browser: Heap buffer overflow in password manager
1781975 – CVE-2019-13727 chromium-browser: Insufficient policy enforcement in WebSockets
1781976 – CVE-2019-13728 chromium-browser: Out of bounds write in V8
1781977 – CVE-2019-13729 chromium-browser: Use after free in WebSockets
1781978 – CVE-2019-13730 chromium-browser: Type Confusion in V8
1781979 – CVE-2019-13732 chromium-browser: Use after free in WebAudio
1781980 – CVE-2019-13734 chromium-browser: Out of bounds write in SQLite
1781981 – CVE-2019-13735 chromium-browser: Out of bounds write in V8
1781982 – CVE-2019-13764 chromium-browser: Type Confusion in V8
1781983 – CVE-2019-13736 chromium-browser: Integer overflow in PDFium
1781984 – CVE-2019-13737 chromium-browser: Insufficient policy enforcement in autocomplete
1781985 – CVE-2019-13738 chromium-browser: Insufficient policy enforcement in navigation
1781986 – CVE-2019-13739 chromium-browser: Incorrect security UI in Omnibox
1781987 – CVE-2019-13740 chromium-browser: Incorrect security UI in sharing
1781988 – CVE-2019-13741 chromium-browser: Insufficient validation of untrusted input in Blink
1781989 – CVE-2019-13742 chromium-browser: Incorrect security UI in Omnibox
1781990 – CVE-2019-13743 chromium-browser: Incorrect security UI in external protocol handling
1781991 – CVE-2019-13745 chromium-browser: Insufficient policy enforcement in audio
1781992 – CVE-2019-13746 chromium-browser: Insufficient policy enforcement in Omnibox
1781993 – CVE-2019-13747 chromium-browser: Uninitialized Use in rendering
1781994 – CVE-2019-13748 chromium-browser: Insufficient policy enforcement in developer tools
1781995 – CVE-2019-13749 chromium-browser: Incorrect security UI in Omnibox
1781997 – CVE-2019-13750 chromium-browser: Insufficient data validation in SQLite
1781998 – CVE-2019-13751 chromium-browser: Uninitialized Use in SQLite
1781999 – CVE-2019-13752 chromium-browser: Out of bounds read in SQLite
1782000 – CVE-2019-13753 chromium-browser: Out of bounds read in SQLite
1782001 – CVE-2019-13754 chromium-browser: Insufficient policy enforcement in extensions
1782002 – CVE-2019-13755 chromium-browser: Insufficient policy enforcement in extensions
1782003 – CVE-2019-13756 chromium-browser: Incorrect security UI in printing
1782004 – CVE-2019-13757 chromium-browser: Incorrect security UI in Omnibox
1782005 – CVE-2019-13759 chromium-browser: Incorrect security UI in interstitials
1782006 – CVE-2019-13761 chromium-browser: Incorrect security UI in Omnibox
1782007 – CVE-2019-13762 chromium-browser: Insufficient policy enforcement in downloads
1782008 – CVE-2019-13763 chromium-browser: Insufficient policy enforcement in payments
1782017 – CVE-2019-13758 chromium-browser: Insufficient policy enforcement in navigation
1782021 – CVE-2019-13744 chromium-browser: Insufficient policy enforcement in cookies

6. Package List:

Red Hat Enterprise Linux Desktop Supplementary (v. 6):

i386:
chromium-browser-79.0.3945.79-1.el6_10.i686.rpm
chromium-browser-debuginfo-79.0.3945.79-1.el6_10.i686.rpm

i686:
chromium-browser-79.0.3945.79-1.el6_10.i686.rpm
chromium-browser-debuginfo-79.0.3945.79-1.el6_10.i686.rpm

x86_64:
chromium-browser-79.0.3945.79-1.el6_10.x86_64.rpm
chromium-browser-debuginfo-79.0.3945.79-1.el6_10.x86_64.rpm

Red Hat Enterprise Linux HPC Node Supplementary (v. 6):

i686:
chromium-browser-79.0.3945.79-1.el6_10.i686.rpm
chromium-browser-debuginfo-79.0.3945.79-1.el6_10.i686.rpm

x86_64:
chromium-browser-79.0.3945.79-1.el6_10.x86_64.rpm
chromium-browser-debuginfo-79.0.3945.79-1.el6_10.x86_64.rpm

Red Hat Enterprise Linux Server Supplementary (v. 6):

i386:
chromium-browser-79.0.3945.79-1.el6_10.i686.rpm
chromium-browser-debuginfo-79.0.3945.79-1.el6_10.i686.rpm

i686:
chromium-browser-79.0.3945.79-1.el6_10.i686.rpm
chromium-browser-debuginfo-79.0.3945.79-1.el6_10.i686.rpm

x86_64:
chromium-browser-79.0.3945.79-1.el6_10.x86_64.rpm
chromium-browser-debuginfo-79.0.3945.79-1.el6_10.x86_64.rpm

Red Hat Enterprise Linux Workstation Supplementary (v. 6):

i386:
chromium-browser-79.0.3945.79-1.el6_10.i686.rpm
chromium-browser-debuginfo-79.0.3945.79-1.el6_10.i686.rpm

i686:
chromium-browser-79.0.3945.79-1.el6_10.i686.rpm
chromium-browser-debuginfo-79.0.3945.79-1.el6_10.i686.rpm

x86_64:
chromium-browser-79.0.3945.79-1.el6_10.x86_64.rpm
chromium-browser-debuginfo-79.0.3945.79-1.el6_10.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2019-13725
https://access.redhat.com/security/cve/CVE-2019-13726
https://access.redhat.com/security/cve/CVE-2019-13727
https://access.redhat.com/security/cve/CVE-2019-13728
https://access.redhat.com/security/cve/CVE-2019-13729
https://access.redhat.com/security/cve/CVE-2019-13730
https://access.redhat.com/security/cve/CVE-2019-13732
https://access.redhat.com/security/cve/CVE-2019-13734
https://access.redhat.com/security/cve/CVE-2019-13735
https://access.redhat.com/security/cve/CVE-2019-13736
https://access.redhat.com/security/cve/CVE-2019-13737
https://access.redhat.com/security/cve/CVE-2019-13738
https://access.redhat.com/security/cve/CVE-2019-13739
https://access.redhat.com/security/cve/CVE-2019-13740
https://access.redhat.com/security/cve/CVE-2019-13741
https://access.redhat.com/security/cve/CVE-2019-13742
https://access.redhat.com/security/cve/CVE-2019-13743
https://access.redhat.com/security/cve/CVE-2019-13744
https://access.redhat.com/security/cve/CVE-2019-13745
https://access.redhat.com/security/cve/CVE-2019-13746
https://access.redhat.com/security/cve/CVE-2019-13747
https://access.redhat.com/security/cve/CVE-2019-13748
https://access.redhat.com/security/cve/CVE-2019-13749
https://access.redhat.com/security/cve/CVE-2019-13750
https://access.redhat.com/security/cve/CVE-2019-13751
https://access.redhat.com/security/cve/CVE-2019-13752
https://access.redhat.com/security/cve/CVE-2019-13753
https://access.redhat.com/security/cve/CVE-2019-13754
https://access.redhat.com/security/cve/CVE-2019-13755
https://access.redhat.com/security/cve/CVE-2019-13756
https://access.redhat.com/security/cve/CVE-2019-13757
https://access.redhat.com/security/cve/CVE-2019-13758
https://access.redhat.com/security/cve/CVE-2019-13759
https://access.redhat.com/security/cve/CVE-2019-13761
https://access.redhat.com/security/cve/CVE-2019-13762
https://access.redhat.com/security/cve/CVE-2019-13763
https://access.redhat.com/security/cve/CVE-2019-13764
https://access.redhat.com/security/updates/classification/#critical

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2019 Red Hat, Inc.
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1

iQIVAwUBXfdJs9zjgjWX9erEAQhLew//QvXpeADCSwIw6mOpun14JVvWnNqFxqnw
vmW3zrB8b3eVAN+MK//iag0iWatwFnEhShmj1XxJ7OEV1lK0bINzgeeLned9OghY
V5l7XuTey7yasMjYAYs6N0imuGmqZX5PeMShX/d61shX10F6gWKhfoMuo+Klw17U
VJ5JsLpSsC8wgsv600xI0c/Qb1iHT7GKaSNiG0eNe+2EUM+uT6M0LnHERLG3AlZb
IxwlEqQfeg4sm4k83oIo4BC+hohBSupcnAT7WIsRvIdgsC3wulEldoRN+RzZMZJc
uRi0t5o9TKDI386v/+2X1tiMgHGovuclThTdW0ZbbOu8pzC6VS3dUJRfS7H9gu6C
NeEjJmkX9osWXh3Yr7b0duDuWkScEqaOpLZMQSyqlJz5u9m2ZmnQelE3yKG7IkbA
d4cfx9EQwsIGlu7GTInZGvEoAnX/+oX09IQqA94oIW5HF1ALolPCI+oZy256K9NE
3FtNxJhJKy3qc9ab+OvpQPlnjnUvX8ttdEI0q+bspQgv6rQplHodB5hpzQ75NiKI
IeA8tesEFCmwy/7tTugGtHlh3b0yrbTuA9ON/DB1/cGnIYC+SNoKn5CezJOJ6VIh
/NiC0j3gJuBs6TxEJPRcFB0vYUgDa63ob0j+0MFXUR5t931E9fqgT+D+xgDeJYIx
Ch/qp3Y5Pzc=
=jKmI
—–END PGP SIGNATURE—–


RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

Top
More in Preporuke
Sigurnosni nedostatak jezgre operacijskog sustava

Otkriven je sigurnosni nedostatak jezgre operacijskog sustava Fedora. Otkriveni nedostatak potencijalnim napadačima omogućuje izazivanje DoS stanja ili izvršavanje proizvoljnog programskog...

Close