Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
archlinuxArchLinuxASA-202010-1
HistoryOct 10, 2020 - 12:00 a.m.

[ASA-202010-1] chromium: multiple issues

2020-10-1000:00:00
security.archlinux.org
13

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.014 Low

EPSS

Percentile

86.0%

JSON

Arch Linux Security Advisory ASA-202010-1

Severity: Critical
Date : 2020-10-10
CVE-ID : CVE-2020-6557 CVE-2020-15967 CVE-2020-15968 CVE-2020-15969
CVE-2020-15970 CVE-2020-15971 CVE-2020-15972 CVE-2020-15973
CVE-2020-15974 CVE-2020-15975 CVE-2020-15976 CVE-2020-15977
CVE-2020-15978 CVE-2020-15979 CVE-2020-15980 CVE-2020-15981
CVE-2020-15982 CVE-2020-15983 CVE-2020-15984 CVE-2020-15985
CVE-2020-15986 CVE-2020-15987 CVE-2020-15988 CVE-2020-15989
CVE-2020-15990 CVE-2020-15991 CVE-2020-15992
Package : chromium
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-1238

Summary

The package chromium before version 86.0.4240.75-1 is vulnerable to
multiple issues including arbitrary code execution, access restriction
bypass, information disclosure and insufficient validation.

Resolution

Upgrade to 86.0.4240.75-1.

pacman -Syu “chromium>=86.0.4240.75-1”

The problems have been fixed upstream in version 86.0.4240.75.

Workaround

None.

Description

  • CVE-2020-6557 (access restriction bypass)

An inappropriate implementation security issue has been found in the
networking component of the chromium browser before 86.0.4240.75.

  • CVE-2020-15967 (arbitrary code execution)

A use after free security issue has been found in the payments
component of the chromium browser before 86.0.4240.75.

  • CVE-2020-15968 (arbitrary code execution)

A use after free security issue has been found in the Blink component
of the chromium browser before 86.0.4240.75.

  • CVE-2020-15969 (arbitrary code execution)

A use after free security issue has been found in the WebRTC component
of the chromium browser before 86.0.4240.75.

  • CVE-2020-15970 (arbitrary code execution)

A use after free security issue has been found in the NFC component of
the chromium browser before 86.0.4240.75.

  • CVE-2020-15971 (arbitrary code execution)

A use after free security issue has been found in the printing
component of the chromium browser before 86.0.4240.75.

  • CVE-2020-15972 (arbitrary code execution)

A use after free security issue has been found in the audio component
of the chromium browser before 86.0.4240.75.

  • CVE-2020-15973 (access restriction bypass)

An insufficient policy enforcement security issue has been found in the
extensions component of the chromium browser before 86.0.4240.75.

  • CVE-2020-15974 (arbitrary code execution)

An integer overflow security issue has been found in the Blink
component of the chromium browser before 86.0.4240.75.

  • CVE-2020-15975 (arbitrary code execution)

An integer overflow security issue has been found in the SwiftShader
component of the chromium browser before 86.0.4240.75.

  • CVE-2020-15976 (arbitrary code execution)

A use after free security issue has been found in the WebXR component
of the chromium browser before 86.0.4240.75.

  • CVE-2020-15977 (insufficient validation)

An insufficient data validation security issue has been found in the
dialogs component of the chromium browser before 86.0.4240.75.

  • CVE-2020-15978 (insufficient validation)

An insufficient data validation security issue has been found in the
navigation component of the chromium browser before 86.0.4240.75.

  • CVE-2020-15979 (access restriction bypass)

An inappropriate implementation security issue has been found in the V8
component of the chromium browser before 86.0.4240.75.

  • CVE-2020-15980 (access restriction bypass)

An insufficient policy enforcement security issue has been found in the
Intents component of the chromium browser before 86.0.4240.75.

  • CVE-2020-15981 (information disclosure)

An out of bounds read security issue has been found in the audio
component of the chromium browser before 86.0.4240.75.

  • CVE-2020-15982 (information disclosure)

A side-channel information leakage security issue has been found in the
cache component of the chromium browser before 86.0.4240.75.

  • CVE-2020-15983 (insufficient validation)

An insufficient data validation security issue has been found in the
webUI component of the chromium browser before 86.0.4240.75.

  • CVE-2020-15984 (access restriction bypass)

An insufficient policy enforcement security issue has been found in the
Omnibox component of the chromium browser before 86.0.4240.75.

  • CVE-2020-15985 (access restriction bypass)

An inappropriate implementation security issue has been found in the
Blink component of the chromium browser before 86.0.4240.75.

  • CVE-2020-15986 (arbitrary code execution)

An integer overflow security issue has been found in the media
component of the chromium browser before 86.0.4240.75.

  • CVE-2020-15987 (arbitrary code execution)

A use after free security issue has been found in the WebRTC component
of the chromium browser before 86.0.4240.75.

  • CVE-2020-15988 (access restriction bypass)

An insufficient policy enforcement security issue has been found in the
downloads component of the chromium browser before 86.0.4240.75.

  • CVE-2020-15989 (information disclosure)

An uninitialized use security issue has been found in the PDFium
component of the chromium browser before 86.0.4240.75.

  • CVE-2020-15990 (arbitrary code execution)

A use after free security issue has been found in the autofill
component of the chromium browser before 86.0.4240.75.

  • CVE-2020-15991 (arbitrary code execution)

A use after free security issue has been found in the password manager
component of the chromium browser before 86.0.4240.75.

  • CVE-2020-15992 (access restriction bypass)

An insufficient policy enforcement security issue has been found in the
networking component of the chromium browser before 86.0.4240.75.

Impact

A remote attacker can access sensitive information, bypass security
measures and execute arbitrary code on the affected host.

References

https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html
https://crbug.com/1083278
https://crbug.com/1127322
https://crbug.com/1126424
https://crbug.com/1124659
https://crbug.com/1108299
https://crbug.com/1114062
https://crbug.com/1115901
https://crbug.com/1106890
https://crbug.com/1104103
https://crbug.com/1110800
https://crbug.com/1123522
https://crbug.com/1097724
https://crbug.com/1116280
https://crbug.com/1127319
https://crbug.com/1092453
https://crbug.com/1123023
https://crbug.com/1039882
https://crbug.com/1076786
https://crbug.com/1080395
https://crbug.com/1099276
https://crbug.com/1100247
https://crbug.com/1127774
https://crbug.com/1092518
https://crbug.com/1108351
https://crbug.com/1133671
https://crbug.com/1133688
https://crbug.com/1110195
https://security.archlinux.org/CVE-2020-6557
https://security.archlinux.org/CVE-2020-15967
https://security.archlinux.org/CVE-2020-15968
https://security.archlinux.org/CVE-2020-15969
https://security.archlinux.org/CVE-2020-15970
https://security.archlinux.org/CVE-2020-15971
https://security.archlinux.org/CVE-2020-15972
https://security.archlinux.org/CVE-2020-15973
https://security.archlinux.org/CVE-2020-15974
https://security.archlinux.org/CVE-2020-15975
https://security.archlinux.org/CVE-2020-15976
https://security.archlinux.org/CVE-2020-15977
https://security.archlinux.org/CVE-2020-15978
https://security.archlinux.org/CVE-2020-15979
https://security.archlinux.org/CVE-2020-15980
https://security.archlinux.org/CVE-2020-15981
https://security.archlinux.org/CVE-2020-15982
https://security.archlinux.org/CVE-2020-15983
https://security.archlinux.org/CVE-2020-15984
https://security.archlinux.org/CVE-2020-15985
https://security.archlinux.org/CVE-2020-15986
https://security.archlinux.org/CVE-2020-15987
https://security.archlinux.org/CVE-2020-15988
https://security.archlinux.org/CVE-2020-15989
https://security.archlinux.org/CVE-2020-15990
https://security.archlinux.org/CVE-2020-15991
https://security.archlinux.org/CVE-2020-15992

OSVersionArchitecturePackageVersionFilename
ArchLinuxanyanychromium< 86.0.4240.75-1UNKNOWN

References

Related

redhat 1
freebsd 1
gentoo 1
kaspersky 1
nessus 11
openvas 7
suse 3
chrome 1
fedora 3
threatpost 1
debiancve 27
ubuntucve 27
veracode 27
cve 27
prion 27
redhatcve 27
apple 2
alpinelinux 1
debian 1
osv 1
altlinux 1
oraclelinux 1
redhat
redhat
(RHSA-2020:4235) Critical: chromium-browser security update
2020-10-13 08:00:18
freebsd
freebsd
chromium -- multiple vulnerabilities
2020-10-06 00:00:00
gentoo
gentoo
Chromium, Google Chrome: Multiple vulnerabilities
2020-10-17 00:00:00
kaspersky
kaspersky
KLA11969 Multiple vulnerabilities in Google Chrome
2020-10-06 00:00:00
nessus
nessus
Google Chrome < 86.0.4240.75 Multiple Vulnerabilities
2020-10-06 00:00:00
FreeBSD : chromium -- multiple vulnerabilities (64988354-0889-11eb-a01b-e09467587c17)
2020-10-08 00:00:00
Google Chrome < 86.0.4240.75 Multiple Vulnerabilities
2020-10-06 00:00:00
openvas
openvas
Google Chrome Security Update (stable-channel-update-for-desktop-2020-10) - Linux
2020-10-07 00:00:00
Google Chrome Security Update (stable-channel-update-for-desktop-2020-10) - Mac OS X
2020-10-07 00:00:00
Google Chrome Security Update (stable-channel-update-for-desktop-2020-10) - Windows
2020-10-07 00:00:00
suse
suse
Security update for chromium (critical)
2020-10-23 00:00:00
Security update for chromium (critical)
2020-10-22 00:00:00
Security update for chromium, gn (important)
2020-11-05 00:00:00
chrome
chrome
Stable Channel Update for Desktop
2020-10-06 00:00:00
fedora
fedora
[SECURITY] Fedora 32 Update: chromium-86.0.4240.111-1.fc32
2020-11-06 01:23:05
[SECURITY] Fedora 31 Update: chromium-86.0.4240.111-1.fc31
2020-11-07 00:23:12
[SECURITY] Fedora 33 Update: chromium-86.0.4240.183-1.fc33
2020-11-14 01:13:13
threatpost
threatpost
Google’s Chrome 86: Critical Payments Bug, Password Checker Among Security Notables
2020-10-07 15:50:15
debiancve
debiancve
CVE-2020-15970
2020-11-03 03:15:00
CVE-2020-15967
2020-11-03 03:15:00
CVE-2020-15971
2020-11-03 03:15:00
ubuntucve
ubuntucve
CVE-2020-15970
2020-11-03 00:00:00
CVE-2020-15971
2020-11-03 00:00:00
CVE-2020-15973
2020-11-03 00:00:00
veracode
veracode
Information Disclosure
2020-12-21 20:37:48
Arbitrary Code Execution
2020-12-21 20:37:50
Use After Free
2020-12-21 20:37:52
cve
cve
CVE-2020-15975
2020-11-03 03:15:00
CVE-2020-15980
2020-11-03 03:15:00
CVE-2020-15973
2020-11-03 03:15:00
prion
prion
Code injection
2020-11-03 03:15:00
Integer overflow
2020-11-03 03:15:00
Double free
2020-11-03 03:15:00
redhatcve
redhatcve
CVE-2020-15971
2020-10-07 09:35:06
CVE-2020-15970
2020-10-07 09:35:23
CVE-2020-15973
2020-10-07 09:35:07
apple
apple
About the security content of Safari 14.0.2 - Apple Support
2020-12-14 09:18:43
About the security content of Safari 14.0.2
2020-12-14 00:00:00
alpinelinux
alpinelinux
CVE-2020-15969
2020-11-03 03:15:00
debian
debian
[SECURITY] [DSA 4824-1] chromium security update
2021-01-01 18:49:56
osv
osv
chromium - security update
2021-01-01 00:00:00
altlinux
altlinux
Security fix for the ALT Linux 10 package thunderbird version 78.4.0-alt1
2020-10-22 00:00:00
oraclelinux
oraclelinux
firefox security update
2020-10-26 00:00:00

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.014 Low

EPSS

Percentile

86.0%

JSON
Related for ASA-202010-1
redhat1freebsd1gentoo1kaspersky1nessus11openvas7suse3chrome1fedora3threatpost1debiancve27ubuntucve27veracode27cve27prion27redhatcve27apple2alpinelinux1debian1osv1altlinux1oraclelinux1