You are here
Home > Preporuke > Sigurnosni nedostaci programskog paketa chromium-browser

Sigurnosni nedostaci programskog paketa chromium-browser

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Important: chromium-browser security update
Advisory ID: RHSA-2018:2818-01
Product: Red Hat Enterprise Linux Supplementary
Advisory URL: https://access.redhat.com/errata/RHSA-2018:2818
Issue date: 2018-09-26
CVE Names: CVE-2018-17458 CVE-2018-17459
=====================================================================

1. Summary:

An update for chromium-browser is now available for Red Hat Enterprise
Linux 6 Supplementary.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Desktop Supplementary (v. 6) – i386, x86_64
Red Hat Enterprise Linux Server Supplementary (v. 6) – i386, x86_64
Red Hat Enterprise Linux Workstation Supplementary (v. 6) – i386, x86_64

3. Description:

Chromium is an open-source web browser, powered by WebKit (Blink).

This update upgrades Chromium to version 69.0.3497.100.

Security Fix(es):

* chromium-browser: Function signature mismatch in WebAssembly
(CVE-2018-17458)

* chromium-browser: URL Spoofing in Omnibox (CVE-2018-17459)

For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

1628078 – CVE-2018-17458 chromium-browser: Function signature mismatch in WebAssembly
1628080 – CVE-2018-17459 chromium-browser: URL Spoofing in Omnibox

6. Package List:

Red Hat Enterprise Linux Desktop Supplementary (v. 6):

i386:
chromium-browser-69.0.3497.100-1.el6_10.i686.rpm
chromium-browser-debuginfo-69.0.3497.100-1.el6_10.i686.rpm

x86_64:
chromium-browser-69.0.3497.100-1.el6_10.x86_64.rpm
chromium-browser-debuginfo-69.0.3497.100-1.el6_10.x86_64.rpm

Red Hat Enterprise Linux Server Supplementary (v. 6):

i386:
chromium-browser-69.0.3497.100-1.el6_10.i686.rpm
chromium-browser-debuginfo-69.0.3497.100-1.el6_10.i686.rpm

x86_64:
chromium-browser-69.0.3497.100-1.el6_10.x86_64.rpm
chromium-browser-debuginfo-69.0.3497.100-1.el6_10.x86_64.rpm

Red Hat Enterprise Linux Workstation Supplementary (v. 6):

i386:
chromium-browser-69.0.3497.100-1.el6_10.i686.rpm
chromium-browser-debuginfo-69.0.3497.100-1.el6_10.i686.rpm

x86_64:
chromium-browser-69.0.3497.100-1.el6_10.x86_64.rpm
chromium-browser-debuginfo-69.0.3497.100-1.el6_10.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2018-17458
https://access.redhat.com/security/cve/CVE-2018-17459
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2018 Red Hat, Inc.
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1

iQIVAwUBW6uTutzjgjWX9erEAQgYrRAAljFTI2Yqx/jdC8Yk+T8AgenF6nG/M9qe
Jjhwkgk4E9QhybnkSdO6EnxxhJOj99LJNwwQAuucpzSHVQ2IsGeEVxtlH/dqwfg2
57xF5dQKGCWbGIt0RjUH7giiZjY7knUbsZugjnO8GrEChRuVhEGA4lm0WdNr299R
J1awuCvL+4lzHaXFGBOgkFkhJosZ/p9b8ga5MZ4+bRg8XHqUBR0TgwpzG8a6YQWU
L3OAz1HOB6FZq5JmggnpPMRN3Uh5tX6mXVL6h1FoPgwuLvObalZJLYL4SPF8V0uq
P0x3pEG70tQHrXp15BP4f73Ya4ez3U45w62qV1nASYFflwmbsMHqVdYo46nLufU0
GRaqlbDTx/z31HDY6AWY74X+BBFUyROaYeoZLl370iNbB1IDzgUV5LmVP2GNKjqj
1+DA7gujE+zTqyavy4JbLtopR7rzBW9RZMfoP+hNDdpBBHSRLt9Fk2UUw8NWUNjo
F0YbB5ZZWt5zIokYYsj9brAmRUEGNvVjWJJmOrmd4sXKs+9JERd+nIXdfaW2UjWe
JD3t8+zBdhakZNJOpFhnlb3agy5BrELNgOwMDIigfTqnaj/jF+U+GGyHBg6p3Uc4
13TNuTM7r6yGuBLACiFZ5LL2VR4w7Rt34GXvcrSp6g8nrSfjVhYkl2N/S/OVHcml
Ye2lxLXHjq4=
=GtMz
—–END PGP SIGNATURE—–


RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

Top
More in Preporuke
Sigurnosni nedostatak jezgre operacijskog sustava

Otkriven je sigurnosni nedostatak jezgre operacijskog sustava RHEL. Otkriveni nedostatak potencijalnim napadačima omogućuje izazivanje DoS stanja, izvršavanje proizvoljnog programskog koda,...

Close