Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
archlinuxArchLinuxASA-201902-3
HistoryFeb 11, 2019 - 12:00 a.m.

[ASA-201902-3] chromium: multiple issues

2019-02-1100:00:00
security.archlinux.org
11

9.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.149 Low

EPSS

Percentile

95.7%

JSON

Arch Linux Security Advisory ASA-201902-3

Severity: Critical
Date : 2019-02-11
CVE-ID : CVE-2019-5754 CVE-2019-5755 CVE-2019-5756 CVE-2019-5757
CVE-2019-5758 CVE-2019-5759 CVE-2019-5760 CVE-2019-5761
CVE-2019-5762 CVE-2019-5763 CVE-2019-5764 CVE-2019-5765
CVE-2019-5766 CVE-2019-5767 CVE-2019-5768 CVE-2019-5769
CVE-2019-5770 CVE-2019-5771 CVE-2019-5772 CVE-2019-5773
CVE-2019-5774 CVE-2019-5775 CVE-2019-5776 CVE-2019-5777
CVE-2019-5778 CVE-2019-5779 CVE-2019-5780 CVE-2019-5781
CVE-2019-5782 CVE-2019-5783
Package : chromium
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-861

Summary

The package chromium before version 72.0.3626.81-1 is vulnerable to
multiple issues including arbitrary code execution, access restriction
bypass, content spoofing and insufficient validation.

Resolution

Upgrade to 72.0.3626.81-1.

pacman -Syu “chromium>=72.0.3626.81-1”

The problems have been fixed upstream in version 72.0.3626.81.

Workaround

None.

Description

  • CVE-2019-5754 (arbitrary code execution)

A security issue has been found in the QUIC implementation of the
chromium browser before 72.0.3626.81.

  • CVE-2019-5755 (arbitrary code execution)

A security issue has been found in the V8 implementation of the
chromium browser before 72.0.3626.81.

  • CVE-2019-5756 (arbitrary code execution)

A use after free issue has been found in the PDFium component of the
chromium browser before 72.0.3626.81.

  • CVE-2019-5757 (arbitrary code execution)

A type confusion issue has been found in the SVG implementation in the
chromium browser before 72.0.3626.81.

  • CVE-2019-5758 (arbitrary code execution)

A use after free issue has been found in the blink component of the
chromium browser before 72.0.3626.81.

  • CVE-2019-5759 (arbitrary code execution)

A use after free issue has been found in the HTML select elements
component of the chromium browser before 72.0.3626.81.

  • CVE-2019-5760 (arbitrary code execution)

A use after free issue has been found in the WebRTC implementation in
the chromium browser before 72.0.3626.81.

  • CVE-2019-5761 (arbitrary code execution)

A use after free issue has been found in the SwiftShader component of
the chromium browser before 72.0.3626.81.

  • CVE-2019-5762 (arbitrary code execution)

A use after free issue has been found in the PDFium component of the
chromium browser before 72.0.3626.81.

  • CVE-2019-5763 (arbitrary code execution)

A security issue has been found in the V8 implementation of the
chromium browser before 72.0.3626.81.

  • CVE-2019-5764 (arbitrary code execution)

A use-after-free vulnerability has been found in the WebRTC component
of the chromium browser before 72.0.3626.81.

  • CVE-2019-5765 (access restriction bypass)

An insufficient policy enforcement issue has been found in the chromium
browser before 72.0.3626.81.

  • CVE-2019-5766 (access restriction bypass)

An insufficient policy enforcement issue has been found in the Canvas
component of the chromium browser before 72.0.3626.81.

  • CVE-2019-5767 (content spoofing)

An incorrect security UI issue has been found in the WebAPKs component
of the chromium browser before 72.0.3626.81.

  • CVE-2019-5768 (access restriction bypass)

An insufficient policy enforcement issue has been found in the DevTools
component of the chromium browser before 72.0.3626.81.

  • CVE-2019-5769 (insufficient validation)

An insufficient validation of untrusted input issue has been found in
the Blink component of the chromium browser before 72.0.3626.81.

  • CVE-2019-5770 (arbitrary code execution)

A heap-based buffer overflow vulnerability has been found in the WebGL
component of the chromium browser before 72.0.3626.81.

  • CVE-2019-5771 (arbitrary code execution)

A heap-based buffer overflow vulnerability has been found in the
SwiftShader component of the chromium browser before 72.0.3626.81.

  • CVE-2019-5772 (arbitrary code execution)

A use-after-free vulnerability has been found in the PDFium component
of the chromium browser before 72.0.3626.81.

  • CVE-2019-5773 (insufficient validation)

An insufficient data validation issue has been found in the IndexedDB
component of the chromium browser before 72.0.3626.81.

  • CVE-2019-5774 (insufficient validation)

An insufficient validation of untrusted input issue has been found in
the SafeBrowsing component of the chromium browser before 72.0.3626.81.

  • CVE-2019-5775 (content spoofing)

An insufficient policy enforcement issue has been found in the OmniBox
component of the chromium browser before 72.0.3626.81, allowing IDN URL
spoofing.

  • CVE-2019-5776 (content spoofing)

An insufficient policy enforcement issue has been found in the OmniBox
component of the chromium browser before 72.0.3626.81, allowing IDN URL
spoofing.

  • CVE-2019-5777 (content spoofing)

An insufficient policy enforcement issue has been found in the OmniBox
component of the chromium browser before 72.0.3626.81, allowing IDN URL
spoofing.

  • CVE-2019-5778 (access restriction bypass)

An insufficient policy enforcement issue has been found in the
Extensions component of the chromium browser before 72.0.3626.81.

  • CVE-2019-5779 (access restriction bypass)

An insufficient policy enforcement issue has been found in the
ServiceWorker component of the chromium browser before 72.0.3626.81.

  • CVE-2019-5780 (access restriction bypass)

A security issue has been found in the chromium browser before
72.0.3626.81 leading to Insufficient policy enforcement.

  • CVE-2019-5781 (content spoofing)

A security issue has been found in the Omnibox implementation of the
chromium browser before 72.0.3626.81.

  • CVE-2019-5782 (arbitrary code execution)

A security issue has been found in the V8 implementation of the
chromium browser before 72.0.3626.81.

  • CVE-2019-5783 (insufficient validation)

An insufficient validation of untrusted input issue has been found in
the DevTools component of the chromium browser before 72.0.3626.81.

Impact

A remote attacker can spoof the URL in the address bar, bypass security
policies or execute arbitrary code.

References

https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.html
https://bugs.chromium.org/p/chromium/issues/detail?id=914497
https://bugs.chromium.org/p/chromium/issues/detail?id=913296
https://bugs.chromium.org/p/chromium/issues/detail?id=895152
https://bugs.chromium.org/p/chromium/issues/detail?id=915469
https://bugs.chromium.org/p/chromium/issues/detail?id=913970
https://bugs.chromium.org/p/chromium/issues/detail?id=912211
https://bugs.chromium.org/p/chromium/issues/detail?id=912074
https://bugs.chromium.org/p/chromium/issues/detail?id=904714
https://bugs.chromium.org/p/chromium/issues/detail?id=900552
https://bugs.chromium.org/p/chromium/issues/detail?id=914731
https://bugs.chromium.org/p/chromium/issues/detail?id=913246
https://bugs.chromium.org/p/chromium/issues/detail?id=922627
https://bugs.chromium.org/p/chromium/issues/detail?id=907047
https://bugs.chromium.org/p/chromium/issues/detail?id=902427
https://bugs.chromium.org/p/chromium/issues/detail?id=805557
https://bugs.chromium.org/p/chromium/issues/detail?id=913975
https://bugs.chromium.org/p/chromium/issues/detail?id=908749
https://bugs.chromium.org/p/chromium/issues/detail?id=904265
https://bugs.chromium.org/p/chromium/issues/detail?id=908292
https://bugs.chromium.org/p/chromium/issues/detail?id=917668
https://bugs.chromium.org/p/chromium/issues/detail?id=904182
https://bugs.chromium.org/p/chromium/issues/detail?id=896722
https://bugs.chromium.org/p/chromium/issues/detail?id=863663
https://bugs.chromium.org/p/chromium/issues/detail?id=849421
https://bugs.chromium.org/p/chromium/issues/detail?id=918470
https://bugs.chromium.org/p/chromium/issues/detail?id=891697
https://bugs.chromium.org/p/chromium/issues/detail?id=896725
https://bugs.chromium.org/p/chromium/issues/detail?id=906043
https://bugs.chromium.org/p/chromium/issues/detail?id=895081
https://security.archlinux.org/CVE-2019-5754
https://security.archlinux.org/CVE-2019-5755
https://security.archlinux.org/CVE-2019-5756
https://security.archlinux.org/CVE-2019-5757
https://security.archlinux.org/CVE-2019-5758
https://security.archlinux.org/CVE-2019-5759
https://security.archlinux.org/CVE-2019-5760
https://security.archlinux.org/CVE-2019-5761
https://security.archlinux.org/CVE-2019-5762
https://security.archlinux.org/CVE-2019-5763
https://security.archlinux.org/CVE-2019-5764
https://security.archlinux.org/CVE-2019-5765
https://security.archlinux.org/CVE-2019-5766
https://security.archlinux.org/CVE-2019-5767
https://security.archlinux.org/CVE-2019-5768
https://security.archlinux.org/CVE-2019-5769
https://security.archlinux.org/CVE-2019-5770
https://security.archlinux.org/CVE-2019-5771
https://security.archlinux.org/CVE-2019-5772
https://security.archlinux.org/CVE-2019-5773
https://security.archlinux.org/CVE-2019-5774
https://security.archlinux.org/CVE-2019-5775
https://security.archlinux.org/CVE-2019-5776
https://security.archlinux.org/CVE-2019-5777
https://security.archlinux.org/CVE-2019-5778
https://security.archlinux.org/CVE-2019-5779
https://security.archlinux.org/CVE-2019-5780
https://security.archlinux.org/CVE-2019-5781
https://security.archlinux.org/CVE-2019-5782
https://security.archlinux.org/CVE-2019-5783

OSVersionArchitecturePackageVersionFilename
ArchLinuxanyanychromium< 72.0.3626.81-1UNKNOWN

References

Related

nessus 8
suse 4
redhat 1
openvas 7
kaspersky 1
chrome 1
debian 2
osv 1
fedora 2
veracode 28
ubuntucve 27
debiancve 29
redhatcve 28
prion 29
cve 29
hackerone 1
googleprojectzero 1
nessus
nessus
RHEL 6 : chromium-browser (RHSA-2019:0309)
2019-02-12 00:00:00
openSUSE Security Update : chromium (openSUSE-2019-204)
2019-02-19 00:00:00
Google Chrome < 72.0.3626.81 Multiple Vulnerabilities
2019-01-31 00:00:00
suse
suse
Security update for chromium (important)
2019-02-19 00:00:00
Security update for chromium (important)
2019-02-18 00:00:00
Security update for chromium (important)
2019-02-18 00:00:00
redhat
redhat
(RHSA-2019:0309) Critical: chromium-browser security update
2019-02-11 18:19:43
openvas
openvas
openSUSE: Security Advisory for chromium (openSUSE-SU-2019:0205-1)
2019-02-19 00:00:00
openSUSE: Security Advisory for chromium (openSUSE-SU-2019:0204-1)
2019-02-19 00:00:00
Debian Security Advisory DSA 4395-1 (chromium - security update)
2019-02-18 00:00:00
kaspersky
kaspersky
KLA11413 Multiple vulnerabilities in Google Chrome
2019-01-29 00:00:00
chrome
chrome
Stable Channel Update for Desktop
2019-01-29 00:00:00
debian
debian
[SECURITY] [DSA 4395-1] chromium security update
2019-02-19 02:54:08
[SECURITY] [DSA 4395-1] chromium security update
2019-02-19 02:54:08
osv
osv
chromium - security update
2019-02-18 00:00:00
fedora
fedora
[SECURITY] Fedora 29 Update: chromium-73.0.3683.75-2.fc29
2019-03-25 06:10:55
[SECURITY] Fedora 30 Update: chromium-73.0.3683.75-2.fc30
2019-03-29 19:41:48
veracode
veracode
Arbitrary Code Execution
2020-12-06 03:05:56
Information Disclosure
2020-12-06 03:05:50
Security Misconfiguration
2020-12-06 03:06:28
ubuntucve
ubuntucve
CVE-2019-5781
2019-02-19 00:00:00
CVE-2019-5775
2019-02-19 00:00:00
CVE-2019-5762
2019-02-19 00:00:00
debiancve
debiancve
CVE-2019-5781
2019-02-19 17:29:00
CVE-2019-5762
2019-02-19 17:29:00
CVE-2019-5758
2019-02-19 17:29:00
redhatcve
redhatcve
CVE-2019-5781
2019-01-30 10:49:27
CVE-2019-5761
2019-01-30 10:36:30
CVE-2019-5763
2019-01-30 10:38:02
prion
prion
Code injection
2019-02-19 17:29:00
Code injection
2019-02-19 17:29:00
Design/Logic Flaw
2019-02-19 17:29:00
cve
cve
CVE-2019-5759
2019-02-19 17:29:00
CVE-2019-5757
2019-02-19 17:29:00
CVE-2019-5765
2019-02-19 17:29:00
hackerone
hackerone
Chrome: CVE-2019-5765: 1-click HackerOne account takeover on all Android devices
2019-01-16 12:46:10
googleprojectzero
googleprojectzero
Virtually Unlimited Memory: Escaping the Chrome Sandbox
2019-04-11 00:00:00

9.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.149 Low

EPSS

Percentile

95.7%

JSON
Related for ASA-201902-3
nessus8suse4redhat1openvas7kaspersky1chrome1debian2osv1fedora2veracode28ubuntucve27debiancve29redhatcve28prion29cve29hackerone1googleprojectzero1