Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
archlinuxArchLinuxASA-202005-12
HistoryMay 20, 2020 - 12:00 a.m.

[ASA-202005-12] chromium: multiple issues

2020-05-2000:00:00
security.archlinux.org
8

9.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.013 Low

EPSS

Percentile

85.4%

JSON

Arch Linux Security Advisory ASA-202005-12

Severity: High
Date : 2020-05-20
CVE-ID : CVE-2020-6465 CVE-2020-6466 CVE-2020-6467 CVE-2020-6468
CVE-2020-6469 CVE-2020-6470 CVE-2020-6471 CVE-2020-6472
CVE-2020-6473 CVE-2020-6474 CVE-2020-6475 CVE-2020-6476
CVE-2020-6477 CVE-2020-6478 CVE-2020-6479 CVE-2020-6480
CVE-2020-6481 CVE-2020-6482 CVE-2020-6483 CVE-2020-6484
CVE-2020-6485 CVE-2020-6486 CVE-2020-6487 CVE-2020-6488
CVE-2020-6489 CVE-2020-6490 CVE-2020-6491
Package : chromium
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-1167

Summary

The package chromium before version 83.0.4103.61-1 is vulnerable to
multiple issues including access restriction bypass, arbitrary code
execution, content spoofing and insufficient validation.

Resolution

Upgrade to 83.0.4103.61-1.

pacman -Syu “chromium>=83.0.4103.61-1”

The problems have been fixed upstream in version 83.0.4103.61.

Workaround

None.

Description

  • CVE-2020-6465 (arbitrary code execution)

A use-after-free security issue has been found in the reader mode of
the chromium browser before 83.0.4103.61

  • CVE-2020-6466 (arbitrary code execution)

A use-after-free security issue has been found in the media component
of the chromium browser before 83.0.4103.61.

  • CVE-2020-6467 (arbitrary code execution)

A use-after-free security issue has been found in the WebRTC component
of the chromium browser before 83.0.4103.61

  • CVE-2020-6468 (arbitrary code execution)

A type confusion security issue has been found in the V8 component of
the chromium browser before 83.0.4103.61.

  • CVE-2020-6469 (access restriction bypass)

An insufficient policy enforcement security issue has been found in the
developer tools component of the chromium browser before 83.0.4103.61.

  • CVE-2020-6470 (insufficient validation)

An insufficient validation of untrusted input security issue has been
found in the clipboard component of the chromium browser before
83.0.4103.61

  • CVE-2020-6471 (access restriction bypass)

An insufficient policy enforcement security issue has been found in the
developer tools component of the chromium browser before 83.0.4103.61.

  • CVE-2020-6472 (access restriction bypass)

An insufficient policy enforcement security issue has been found in the
developer tools component of the chromium browser before 83.0.4103.61.

  • CVE-2020-6473 (access restriction bypass)

An insufficient policy enforcement security issue has been found in the
Blink component of the chromium browser before 83.0.4103.61.

  • CVE-2020-6474 (arbitrary code execution)

A use-after-free security issue has been found in the Blink component
of the chromium browser before 83.0.4103.61.

  • CVE-2020-6475 (content spoofing)

An incorrect security UI security issue has been found in the full
screen component of the chromium browser before 83.0.4103.61.

  • CVE-2020-6476 (access restriction bypass)

An insufficient policy enforcement security issue has been found in the
tab strip component of the chromium browser before 83.0.4103.61.

  • CVE-2020-6477 (access restriction bypass)

An inappropriate implementation security issue has been found in the
installer component of the chromium browser before 83.0.4103.61.

  • CVE-2020-6478 (access restriction bypass)

An inappropriate implementation security issue has been found in the
full screen component of the chromium browser before 83.0.4103.61.

  • CVE-2020-6479 (access restriction bypass)

An inappropriate implementation security issue has been found in the
sharing component of the chromium browser before 83.0.4103.61.

  • CVE-2020-6480 (access restriction bypass)

An insufficient policy enforcement security issue has been found in the
enterprise component of the chromium browser before 83.0.4103.61.

  • CVE-2020-6481 (access restriction bypass)

An insufficient policy enforcement security issue has been found in the
URL formatting component of the chromium browser before 83.0.4103.61.

  • CVE-2020-6482 (access restriction bypass)

An insufficient policy enforcement security issue has been found in the
developer tools component of the chromium browser before 83.0.4103.61.

  • CVE-2020-6483 (access restriction bypass)

An insufficient policy enforcement security issue has been found in the
payments component of the chromium browser before 83.0.4103.61.

  • CVE-2020-6484 (insufficient validation)

An insufficient data validation security issue has been found in the
ChromeDriver component of the chromium browser before 83.0.4103.61.

  • CVE-2020-6485 (insufficient validation)

An insufficient data validation security issue has been found in the
media router component of the chromium browser before 83.0.4103.61.

  • CVE-2020-6486 (access restriction bypass)

An insufficient policy enforcement security issue has been found in the
navigations component of the chromium browser before 83.0.4103.61.

  • CVE-2020-6487 (access restriction bypass)

A insufficient policy enforcement security issue has been found in the
downloads component of the chromium browser before 83.0.4103.61.

  • CVE-2020-6488 (access restriction bypass)

An insufficient policy enforcement security issue has been found in the
downloads component of the chromium browser before 83.0.4103.61.

  • CVE-2020-6489 (access restriction bypass)

An inappropriate implementation security issue has been found in the
developer tools component of the chromium browser before 83.0.4103.61.

  • CVE-2020-6490 (insufficient validation)

An insufficient data validation security issue has been found in the
loader component of the chromium browser before 83.0.4103.61.

  • CVE-2020-6491 (content spoofing)

A incorrect security UI security issue has been found in the site
information component of the chromium browser before 83.0.4103.61.

Impact

A remote attacker might be able to spoof content, bypass security
restrictions or validations checks, or execute arbitrary code on the
affected host.

References

https://chromereleases.googleblog.com/2020/05/stable-channel-update-for-desktop_19.html
https://crbug.com/1073015
https://crbug.com/1074706
https://crbug.com/1068084
https://crbug.com/1076708
https://crbug.com/1067382
https://crbug.com/1065761
https://crbug.com/1059577
https://crbug.com/1064519
https://crbug.com/1049510
https://crbug.com/1059533
https://crbug.com/1020026
https://crbug.com/1035315
https://crbug.com/946156
https://crbug.com/1037730
https://crbug.com/1041749
https://crbug.com/1054966
https://crbug.com/1068531
https://crbug.com/795595
https://crbug.com/966507
https://crbug.com/1045787
https://crbug.com/1047285
https://crbug.com/1055524
https://crbug.com/539938
https://crbug.com/1044277
https://crbug.com/1050756
https://crbug.com/1035887
https://crbug.com/1050011
https://security.archlinux.org/CVE-2020-6465
https://security.archlinux.org/CVE-2020-6466
https://security.archlinux.org/CVE-2020-6467
https://security.archlinux.org/CVE-2020-6468
https://security.archlinux.org/CVE-2020-6469
https://security.archlinux.org/CVE-2020-6470
https://security.archlinux.org/CVE-2020-6471
https://security.archlinux.org/CVE-2020-6472
https://security.archlinux.org/CVE-2020-6473
https://security.archlinux.org/CVE-2020-6474
https://security.archlinux.org/CVE-2020-6475
https://security.archlinux.org/CVE-2020-6476
https://security.archlinux.org/CVE-2020-6477
https://security.archlinux.org/CVE-2020-6478
https://security.archlinux.org/CVE-2020-6479
https://security.archlinux.org/CVE-2020-6480
https://security.archlinux.org/CVE-2020-6481
https://security.archlinux.org/CVE-2020-6482
https://security.archlinux.org/CVE-2020-6483
https://security.archlinux.org/CVE-2020-6484
https://security.archlinux.org/CVE-2020-6485
https://security.archlinux.org/CVE-2020-6486
https://security.archlinux.org/CVE-2020-6487
https://security.archlinux.org/CVE-2020-6488
https://security.archlinux.org/CVE-2020-6489
https://security.archlinux.org/CVE-2020-6490
https://security.archlinux.org/CVE-2020-6491

OSVersionArchitecturePackageVersionFilename
ArchLinuxanyanychromium< 83.0.4103.61-1UNKNOWN

References

Related

openvas 8
nessus 11
freebsd 1
chrome 1
kaspersky 1
gentoo 2
redhat 1
suse 2
fedora 2
osv 1
debian 2
debiancve 27
redhatcve 27
cve 27
prion 27
ubuntucve 27
checkpoint_advisories 4
githubexploit 1
mscve 1
photon 1
openvas
openvas
Google Chrome Security Update (stable-channel-update-for-desktop_19-2020-05) - Mac OS X
2020-05-22 00:00:00
Google Chrome Security Update (stable-channel-update-for-desktop_19-2020-05) - Windows
2020-05-22 00:00:00
Google Chrome Security Update (stable-channel-update-for-desktop_19-2020-05) - Linux
2020-05-22 00:00:00
nessus
nessus
Google Chrome < 83.0.4103.61 Multiple Vulnerabilities
2020-05-21 00:00:00
Google Chrome < 83.0.4103.61 Multiple Vulnerabilities
2020-05-21 00:00:00
Microsoft Edge (Chromium) < 83.0.478.37 Multiple Vulnerabilities
2020-05-29 00:00:00
freebsd
freebsd
chromium -- multiple vulnerabilities
2020-05-19 00:00:00
chrome
chrome
Stable Channel Update for Desktop
2020-05-19 00:00:00
kaspersky
kaspersky
KLA11787 Multiple vulnerabilities in Google Chrome
2020-05-19 00:00:00
gentoo
gentoo
Chromium, Google Chrome: Multiple vulnerabilities
2020-06-10 00:00:00
Qt WebEngine: Multiple vulnerabilities
2021-01-26 00:00:00
redhat
redhat
(RHSA-2020:2544) Important: chromium-browser security update
2020-06-15 09:17:45
suse
suse
Security update for chromium (important)
2020-06-19 00:00:00
Security update for chromium (important)
2020-06-18 00:00:00
fedora
fedora
[SECURITY] Fedora 31 Update: chromium-83.0.4103.116-3.fc31
2020-07-08 01:06:18
[SECURITY] Fedora 32 Update: chromium-83.0.4103.116-3.fc32
2020-07-02 01:14:13
osv
osv
chromium - security update
2020-07-01 00:00:00
debian
debian
[SECURITY] [DSA 4714-1] chromium security update
2020-07-02 01:58:01
[SECURITY] [DSA 4714-1] chromium security update
2020-07-02 01:58:01
debiancve
debiancve
CVE-2020-6488
2020-05-21 04:15:00
CVE-2020-6475
2020-05-21 04:15:00
CVE-2020-6486
2020-05-21 04:15:00
redhatcve
redhatcve
CVE-2020-6488
2020-05-20 08:26:40
CVE-2020-6482
2020-05-20 08:26:30
CVE-2020-6475
2020-05-20 08:25:47
cve
cve
CVE-2020-6482
2020-05-21 04:15:00
CVE-2020-6488
2020-05-21 04:15:00
CVE-2020-6475
2020-05-21 04:15:00
prion
prion
Design/Logic Flaw
2020-05-21 04:15:00
Design/Logic Flaw
2020-05-21 04:15:00
Hardcoded credentials
2020-05-21 04:15:00
ubuntucve
ubuntucve
CVE-2020-6475
2020-05-21 00:00:00
CVE-2020-6490
2020-05-21 00:00:00
CVE-2020-6482
2020-05-21 00:00:00
checkpoint_advisories
checkpoint_advisories
Google Chrome Type Confusion (CVE-2020-6468)
2020-10-26 00:00:00
Google Chrome Use After Free (CVE-2020-6465)
2020-10-15 00:00:00
Google Chrome Sandbox Escape (CVE-2020-6471)
2020-10-25 00:00:00
githubexploit
githubexploit
Exploit for Out-of-bounds Write in Google Chrome
2020-09-14 12:36:56
mscve
mscve
Chromium Security Updates for Microsoft Edge (Chromium-Based)
2020-01-28 08:00:00
photon
photon
Critical Photon OS Security Update - PHSA-2023-3.0-0602
2023-06-21 00:00:00

9.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.013 Low

EPSS

Percentile

85.4%

JSON
Related for ASA-202005-12
openvas8nessus11freebsd1chrome1kaspersky1gentoo2redhat1suse2fedora2osv1debian2debiancve27redhatcve27cve27prion27ubuntucve27checkpoint_advisories4githubexploit1mscve1photon1