DATABASE RESOURCES PRICING ABOUT US

{"id": "FEDORA_2018-AAFDBB5554.NASL", "vendorId": null, "type": "nessus", "bulletinFamily": "scanner", "title": "Fedora 28 : chromium (2018-aafdbb5554)", "description": "Update to Chromium 65. For EPEL7, it has been a long time since a successful build has been possible, so this will fix a LOT of CVEs.\n\nCVE-2017-15396 CVE-2017-15407 CVE-2017-15408 CVE-2017-15409 CVE-2017-15410 CVE-2017-15411 CVE-2017-15412 CVE-2017-15413 CVE-2017-15415 CVE-2017-15416 CVE-2017-15417 CVE-2017-15418 CVE-2017-15419 CVE-2017-15420 CVE-2017-15422 CVE-2018-6056 CVE-2018-6406 CVE-2018-6057 CVE-2018-6058 CVE-2018-6059 CVE-2018-6060 CVE-2018-6061 CVE-2018-6062 CVE-2018-6063 CVE-2018-6064 CVE-2018-6065 CVE-2018-6066 CVE-2018-6067 CVE-2018-6068 CVE-2018-6069 CVE-2018-6070 CVE-2018-6071\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2019-01-03T00:00:00", "modified": "2022-06-08T00:00:00", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cvss2": {"cvssV2": {"version": "2.0", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "accessVector": "NETWORK", "accessComplexity": "MEDIUM", "authentication": "NONE", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "baseScore": 6.8}, "severity": "MEDIUM", "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}, "cvss3": {"cvssV3": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}, "href": "https://www.tenable.com/plugins/nessus/120695", "reporter": "This script is Copyright (C) 2019-2022 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15413", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6075", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6065", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15409", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6056", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15423", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6071", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15408", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15422", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6069", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15427", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15396", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6066", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6074", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6082", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15410", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15424", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6083", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6063", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6076", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15416", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6067", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15417", "https://bodhi.fedoraproject.org/updates/FEDORA-2018-aafdbb5554", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6058", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6060", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6080", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6059", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6068", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15407", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15420", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15412", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6061", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6057", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15415", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6073", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6070", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15426", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6062", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15418", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15425", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6064", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6081", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6072", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6077", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15419", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15411", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6406", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6078", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6079"], "cvelist": ["CVE-2017-15396", "CVE-2017-15407", "CVE-2017-15408", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15413", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15417", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15420", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426", "CVE-2017-15427", "CVE-2018-6056", "CVE-2018-6057", "CVE-2018-6058", "CVE-2018-6059", "CVE-2018-6060", "CVE-2018-6061", "CVE-2018-6062", "CVE-2018-6063", "CVE-2018-6064", "CVE-2018-6065", "CVE-2018-6066", "CVE-2018-6067", "CVE-2018-6068", "CVE-2018-6069", "CVE-2018-6070", "CVE-2018-6071", "CVE-2018-6072", "CVE-2018-6073", "CVE-2018-6074", "CVE-2018-6075", "CVE-2018-6076", "CVE-2018-6077", "CVE-2018-6078", "CVE-2018-6079", "CVE-2018-6080", "CVE-2018-6081", "CVE-2018-6082", "CVE-2018-6083", "CVE-2018-6406"], "immutableFields": [], "lastseen": "2023-01-11T14:46:30", "viewCount": 8, "enchantments": {"dependencies": {"references": [{"type": "amazon", "idList": ["ALAS-2020-1415", "ALAS2-2020-1466"]}, {"type": "apple", "idList": ["APPLE:444B5944D49C1B1DB2F8D833473A3E28", "APPLE:6B41E03BE95C41152A91DE7584480E16", "APPLE:B3402276360A8C507F94E26E15D465F4", "APPLE:B7AA5B9368DE4BD135A602B017EB0259", "APPLE:F5ED4B2C8BF2CB139C4753A54898E258", "APPLE:FAE8F6548DA345F4466BB73DD8BE2763", "APPLE:HT208326", "APPLE:HT208331", "APPLE:HT208692", "APPLE:HT208693", "APPLE:HT208696", "APPLE:HT208698"]}, {"type": "archlinux", "idList": ["ASA-201710-31", "ASA-201712-5"]}, {"type": "attackerkb", "idList": ["AKB:E6CDC277-90E6-45A4-BF61-39942A10926A"]}, {"type": "centos", "idList": ["CESA-2020:1190"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2018-0196", "CPAI-2018-0421"]}, {"type": "chrome", "idList": ["GCSA-3542100121216698778", "GCSA-4161252286053538834", "GCSA-6993857189147290065", "GCSA-9103668740237956942", "GCSA-976802465492765680"]}, {"type": "cisa_kev", "idList": ["CISA-KEV-CVE-2018-6065"]}, {"type": "cloudfoundry", "idList": ["CFOUNDRY:21A806FB62D8EE8039931A5D1193F96D", "CFOUNDRY:81EBD6DFAEE8502A1AEE7ACA1D96C999"]}, {"type": "cve", "idList": ["CVE-2017-15396", "CVE-2017-15407", "CVE-2017-15408", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15413", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15417", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15420", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426", "CVE-2017-15427", "CVE-2018-6056", "CVE-2018-6057", "CVE-2018-6058", "CVE-2018-6059", "CVE-2018-6060", "CVE-2018-6061", "CVE-2018-6062", "CVE-2018-6063", "CVE-2018-6064", "CVE-2018-6065", "CVE-2018-6066", "CVE-2018-6067", "CVE-2018-6068", "CVE-2018-6069", "CVE-2018-6070", "CVE-2018-6071", "CVE-2018-6072", "CVE-2018-6073", "CVE-2018-6074", "CVE-2018-6075", "CVE-2018-6076", "CVE-2018-6077", "CVE-2018-6078", "CVE-2018-6079", "CVE-2018-6080", "CVE-2018-6081", "CVE-2018-6082", "CVE-2018-6083", "CVE-2018-6406"]}, {"type": "debian", "idList": ["DEBIAN:DLA-1211-1:EA9E0", "DEBIAN:DSA-4020-1:6AA59", "DEBIAN:DSA-4020-1:D6119", "DEBIAN:DSA-4064-1:25480", "DEBIAN:DSA-4086-1:58F72", "DEBIAN:DSA-4086-1:8DFD7", "DEBIAN:DSA-4103-1:4A64B", "DEBIAN:DSA-4150-1:2E864", "DEBIAN:DSA-4182-1:2D0C5", "DEBIAN:DSA-4182-1:617C4"]}, {"type": "debiancve", "idList": ["DEBIANCVE:CVE-2017-15396", "DEBIANCVE:CVE-2017-15407", "DEBIANCVE:CVE-2017-15408", "DEBIANCVE:CVE-2017-15409", "DEBIANCVE:CVE-2017-15410", "DEBIANCVE:CVE-2017-15411", "DEBIANCVE:CVE-2017-15412", "DEBIANCVE:CVE-2017-15413", "DEBIANCVE:CVE-2017-15415", "DEBIANCVE:CVE-2017-15416", "DEBIANCVE:CVE-2017-15417", "DEBIANCVE:CVE-2017-15418", "DEBIANCVE:CVE-2017-15419", "DEBIANCVE:CVE-2017-15420", "DEBIANCVE:CVE-2017-15422", "DEBIANCVE:CVE-2017-15423", "DEBIANCVE:CVE-2017-15424", "DEBIANCVE:CVE-2017-15425", "DEBIANCVE:CVE-2017-15426", "DEBIANCVE:CVE-2017-15427", "DEBIANCVE:CVE-2018-6056", "DEBIANCVE:CVE-2018-6057", "DEBIANCVE:CVE-2018-6060", "DEBIANCVE:CVE-2018-6061", "DEBIANCVE:CVE-2018-6062", "DEBIANCVE:CVE-2018-6063", "DEBIANCVE:CVE-2018-6064", "DEBIANCVE:CVE-2018-6065", "DEBIANCVE:CVE-2018-6066", "DEBIANCVE:CVE-2018-6067", "DEBIANCVE:CVE-2018-6068", "DEBIANCVE:CVE-2018-6069", "DEBIANCVE:CVE-2018-6070", "DEBIANCVE:CVE-2018-6071", "DEBIANCVE:CVE-2018-6072", "DEBIANCVE:CVE-2018-6073", "DEBIANCVE:CVE-2018-6074", "DEBIANCVE:CVE-2018-6075", "DEBIANCVE:CVE-2018-6076", "DEBIANCVE:CVE-2018-6077", "DEBIANCVE:CVE-2018-6078", "DEBIANCVE:CVE-2018-6079", "DEBIANCVE:CVE-2018-6080", "DEBIANCVE:CVE-2018-6081", "DEBIANCVE:CVE-2018-6082", "DEBIANCVE:CVE-2018-6083", "DEBIANCVE:CVE-2018-6406"]}, {"type": "f5", "idList": ["F5:K76678525"]}, {"type": "fedora", "idList": ["FEDORA:01AED601B23D", "FEDORA:0F54C60BE23D", "FEDORA:2E8D96005552", "FEDORA:546436087815", "FEDORA:5CFCF60A5875", "FEDORA:855A9625F2AD", "FEDORA:93899601DD82", "FEDORA:B171E6087BC3", "FEDORA:BD8776075EF7", "FEDORA:CAFF160478EB", "FEDORA:CEA406042D4A", "FEDORA:D5E9D604E466", "FEDORA:EC7F86046254"]}, {"type": "freebsd", "idList": ["1D951E85-FFDB-11E7-8B91-E8E0B747A45A", "3CD46257-BBC5-11E7-A3BC-E8E0B747A45A", "555AF074-22B9-11E8-9799-54EE754AF08E", "8E986B2B-1BAA-11E8-A944-54EE754AF08E", "ABFC932E-1BA8-11E8-A944-54EE754AF08E"]}, {"type": "gentoo", "idList": ["GLSA-201711-02", "GLSA-201801-03", "GLSA-201802-02", "GLSA-201803-05"]}, {"type": "ibm", "idList": ["244ECED1318E3472926D72334F870E4E52EEBDA4CBF4408680F466AF6B21AED2", "25067E9EFC2F57D4B87D7E576E40A5796CCB353EF342A1DE00D256E52E80386C", "2C79ED95B1DDF725C67F241D5C01546FA0476ABBA3CE0E75B8B5CD09C4F93D6C", "30F126C0FEE1D6C0436DFF1A6751EE8FDE2C7921F8AC99F5FF4DF624573C80E8", "3851D26A1B7DF88EA8BA11EEB80A7341FC47BF9EE9F99E03682D841ED55868A9", "3D3BF59CC576F554C3F716540167D85670B56CE61C0AA690764AE05CC62E23C5", "8AF09D39919DFCEDA59D30328E778381C2630CD9C097879DBB5204834A432A43", "B05329785ED4441E67419C72F4E8D5EFB095312F0129B7DAC17DB1F2F0780EEC", "BEE773E4A6A548D08B8B9B27B8581116109A00DD9D98FECB148AD73D2A44F35E", "CC5F277D3ACAE3335BA730A0207062A84F97F8B011460F964107C4802703541B", "E228AE26D557AC2FB8C5AF13926D0970F3BAC5922DC3700312E52FD8E2BD1B47", "F07DB3E9DE713D6D6258FA7BB69C354916D6B592DF066F85F76143C8963BA25E"]}, {"type": "kaspersky", "idList": ["KLA11130", "KLA11152", "KLA11185", "KLA11188", "KLA11194", "KLA11204", "KLA11279"]}, {"type": "mageia", "idList": ["MGAA-2018-0067", "MGASA-2017-0423", "MGASA-2017-0484", "MGASA-2018-0048", "MGASA-2018-0050", "MGASA-2018-0268"]}, {"type": "nessus", "idList": ["700347.PASL", "700351.PASL", "700352.PASL", "700354.PASL", "AL2_ALAS-2020-1466.NASL", "ALA_ALAS-2020-1415.NASL", "APPLE_IOS_113_CHECK.NBIN", "CENTOS_RHSA-2020-1190.NASL", "DEBIAN_DLA-1211.NASL", "DEBIAN_DSA-4020.NASL", "DEBIAN_DSA-4064.NASL", "DEBIAN_DSA-4086.NASL", "DEBIAN_DSA-4103.NASL", "DEBIAN_DSA-4150.NASL", "DEBIAN_DSA-4182.NASL", "EULEROS_SA-2018-1446.NASL", "EULEROS_SA-2019-1007.NASL", "EULEROS_SA-2019-1034.NASL", "EULEROS_SA-2019-1211.NASL", "EULEROS_SA-2019-2390.NASL", "EULEROS_SA-2020-1106.NASL", "EULEROS_SA-2020-1454.NASL", "EULEROS_SA-2020-1568.NASL", "EULEROS_SA-2020-2099.NASL", "FEDORA_2017-15B815B9B7.NASL", "FEDORA_2017-4D90E9FC97.NASL", "FEDORA_2017-9015553E3D.NASL", "FEDORA_2017-C2645AA935.NASL", "FEDORA_2017-EA44F172E3.NASL", "FEDORA_2018-024AFA2D48.NASL", "FEDORA_2018-1A85045C79.NASL", "FEDORA_2018-44E1C23700.NASL", "FEDORA_2018-B844991A97.NASL", "FEDORA_2018-C0D3DB441F.NASL", "FEDORA_2018-E08D828ED9.NASL", "FEDORA_2018-FAFF5F661E.NASL", "FREEBSD_PKG_1D951E85FFDB11E78B91E8E0B747A45A.NASL", "FREEBSD_PKG_3CD46257BBC511E7A3BCE8E0B747A45A.NASL", "FREEBSD_PKG_555AF07422B911E8979954EE754AF08E.NASL", "FREEBSD_PKG_8E986B2B1BAA11E8A94454EE754AF08E.NASL", "FREEBSD_PKG_ABFC932E1BA811E8A94454EE754AF08E.NASL", "GENTOO_GLSA-201711-02.NASL", "GENTOO_GLSA-201801-03.NASL", "GENTOO_GLSA-201802-02.NASL", "GENTOO_GLSA-201803-05.NASL", "GOOGLE_CHROME_63_0_3239_84.NASL", "GOOGLE_CHROME_64_0_3282_119.NASL", "GOOGLE_CHROME_64_0_3282_167.NASL", "GOOGLE_CHROME_65_0_3325_107.NASL", "MACOSX_GOOGLE_CHROME_63_0_3239_84.NASL", "MACOSX_GOOGLE_CHROME_64_0_3282_119.NASL", "MACOSX_GOOGLE_CHROME_64_0_3282_167.NASL", "MACOSX_GOOGLE_CHROME_65_0_3325_107.NASL", "MACOSX_SECUPD2017-005.NASL", "MACOSX_SECUPD2018-002.NASL", "MACOS_10_13_2.NASL", "MACOS_10_13_4.NASL", "NEWSTART_CGSL_NS-SA-2020-0060_LIBXML2.NASL", "NEWSTART_CGSL_NS-SA-2020-0091_LIBXML2.NASL", "NUTANIX_NXSA-AOS-5_17_1.NASL", "NUTANIX_NXSA-AOS-5_18.NASL", "OPENSUSE-2017-1221.NASL", "OPENSUSE-2017-1349.NASL", "OPENSUSE-2018-103.NASL", "OPENSUSE-2018-128.NASL", "OPENSUSE-2018-154.NASL", "OPENSUSE-2018-165.NASL", "OPENSUSE-2018-264.NASL", "OPENSUSE-2018-517.NASL", "REDHAT-RHSA-2017-3082.NASL", "REDHAT-RHSA-2017-3401.NASL", "REDHAT-RHSA-2018-0334.NASL", "REDHAT-RHSA-2018-0484.NASL", "REDHAT-RHSA-2020-1190.NASL", "SL_20200407_LIBXML2_ON_SL7_X.NASL", "SUSE_SU-2018-0395-1.NASL", "SUSE_SU-2018-0401-1.NASL", "SUSE_SU-2018-1401-1.NASL", "SUSE_SU-2018-1401-2.NASL", "SUSE_SU-2018-1602-1.NASL", "UBUNTU_USN-3513-1.NASL", "UBUNTU_USN-3610-1.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310704020", "OPENVAS:1361412562310704064", "OPENVAS:1361412562310704086", "OPENVAS:1361412562310704103", "OPENVAS:1361412562310704150", "OPENVAS:1361412562310704182", "OPENVAS:1361412562310811882", "OPENVAS:1361412562310811883", "OPENVAS:1361412562310811884", "OPENVAS:1361412562310812235", "OPENVAS:1361412562310812236", "OPENVAS:1361412562310812237", "OPENVAS:1361412562310812401", "OPENVAS:1361412562310812803", "OPENVAS:1361412562310812804", "OPENVAS:1361412562310812805", "OPENVAS:1361412562310812817", "OPENVAS:1361412562310812818", "OPENVAS:1361412562310812819", "OPENVAS:1361412562310843486", "OPENVAS:1361412562310843763", "OPENVAS:1361412562310851634", "OPENVAS:1361412562310851660", "OPENVAS:1361412562310851692", "OPENVAS:1361412562310851702", "OPENVAS:1361412562310851718", "OPENVAS:1361412562310851765", "OPENVAS:1361412562310873856", "OPENVAS:1361412562310873859", "OPENVAS:1361412562310873861", "OPENVAS:1361412562310873974", "OPENVAS:1361412562310873977", "OPENVAS:1361412562310874144", "OPENVAS:1361412562310874155", "OPENVAS:1361412562310874278", "OPENVAS:1361412562310874280", "OPENVAS:1361412562310874300", "OPENVAS:1361412562310875080", "OPENVAS:1361412562311220181446", "OPENVAS:1361412562311220191007", "OPENVAS:1361412562311220191034", "OPENVAS:1361412562311220191211", "OPENVAS:1361412562311220192390", "OPENVAS:1361412562311220201106", "OPENVAS:1361412562311220201454", "OPENVAS:1361412562311220201568"]}, {"type": "oraclelinux", "idList": ["ELSA-2020-1190"]}, {"type": "osv", "idList": ["OSV:DLA-1211-1", "OSV:DSA-4020-1", "OSV:DSA-4064-1", "OSV:DSA-4086-1", "OSV:DSA-4103-1", "OSV:DSA-4150-1", "OSV:DSA-4182-1"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:147025"]}, {"type": "photon", "idList": ["PHSA-2020-0288"]}, {"type": "redhat", "idList": ["RHSA-2017:3082", "RHSA-2017:3401", "RHSA-2018:0287", "RHSA-2018:0334", "RHSA-2018:0484", "RHSA-2020:1190"]}, {"type": "redhatcve", "idList": ["RH:CVE-2017-15396", "RH:CVE-2017-15406", "RH:CVE-2017-15407", "RH:CVE-2017-15408", "RH:CVE-2017-15409", "RH:CVE-2017-15410", "RH:CVE-2017-15411", "RH:CVE-2017-15412", "RH:CVE-2017-15413", "RH:CVE-2017-15415", "RH:CVE-2017-15416", "RH:CVE-2017-15417", "RH:CVE-2017-15418", "RH:CVE-2017-15419", "RH:CVE-2017-15420", "RH:CVE-2017-15422", "RH:CVE-2017-15423", "RH:CVE-2017-15424", "RH:CVE-2017-15425", "RH:CVE-2017-15426", "RH:CVE-2017-15427", "RH:CVE-2018-6056", "RH:CVE-2018-6057", "RH:CVE-2018-6058", "RH:CVE-2018-6059", "RH:CVE-2018-6060", "RH:CVE-2018-6061", "RH:CVE-2018-6062", "RH:CVE-2018-6063", "RH:CVE-2018-6064", "RH:CVE-2018-6065", "RH:CVE-2018-6066", "RH:CVE-2018-6067", "RH:CVE-2018-6068", "RH:CVE-2018-6069", "RH:CVE-2018-6070", "RH:CVE-2018-6071", "RH:CVE-2018-6072", "RH:CVE-2018-6073", "RH:CVE-2018-6074", "RH:CVE-2018-6075", "RH:CVE-2018-6076", "RH:CVE-2018-6077", "RH:CVE-2018-6078", "RH:CVE-2018-6079", "RH:CVE-2018-6080", "RH:CVE-2018-6081", "RH:CVE-2018-6082", "RH:CVE-2018-6083", "RH:CVE-2018-6406"]}, {"type": "seebug", "idList": ["SSV:97177", "SSV:97179", "SSV:97180"]}, {"type": "suse", "idList": ["OPENSUSE-SU-2017:2902-1", "OPENSUSE-SU-2017:3244-1", "OPENSUSE-SU-2017:3245-1", "OPENSUSE-SU-2018:0259-1", "OPENSUSE-SU-2018:0313-1", "OPENSUSE-SU-2018:0453-1", "OPENSUSE-SU-2018:0454-1", "OPENSUSE-SU-2018:0704-1", "OPENSUSE-SU-2018:1175-1", "OPENSUSE-SU-2018:1422-1", "OPENSUSE-SU-2018:1437-1"]}, {"type": "threatpost", "idList": ["THREATPOST:3CA10850AC14EA4F7055A21FCE8DB99F", "THREATPOST:BC7785C1AA5CE337FD6268A2941438EE"]}, {"type": "ubuntu", "idList": ["USN-3513-1", "USN-3513-2", "USN-3610-1"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2017-15396", "UB:CVE-2017-15407", "UB:CVE-2017-15408", "UB:CVE-2017-15409", "UB:CVE-2017-15410", "UB:CVE-2017-15411", "UB:CVE-2017-15412", "UB:CVE-2017-15413", "UB:CVE-2017-15415", "UB:CVE-2017-15416", "UB:CVE-2017-15417", "UB:CVE-2017-15418", "UB:CVE-2017-15419", "UB:CVE-2017-15420", "UB:CVE-2017-15422", "UB:CVE-2017-15423", "UB:CVE-2017-15424", "UB:CVE-2017-15425", "UB:CVE-2017-15426", "UB:CVE-2017-15427", "UB:CVE-2018-6056", "UB:CVE-2018-6057", "UB:CVE-2018-6058", "UB:CVE-2018-6059", "UB:CVE-2018-6060", "UB:CVE-2018-6061", "UB:CVE-2018-6062", "UB:CVE-2018-6063", "UB:CVE-2018-6064", "UB:CVE-2018-6065", "UB:CVE-2018-6066", "UB:CVE-2018-6067", "UB:CVE-2018-6068", "UB:CVE-2018-6069", "UB:CVE-2018-6070", "UB:CVE-2018-6071", "UB:CVE-2018-6072", "UB:CVE-2018-6073", "UB:CVE-2018-6074", "UB:CVE-2018-6075", "UB:CVE-2018-6076", "UB:CVE-2018-6077", "UB:CVE-2018-6078", "UB:CVE-2018-6079", "UB:CVE-2018-6080", "UB:CVE-2018-6081", "UB:CVE-2018-6082", "UB:CVE-2018-6083", "UB:CVE-2018-6406"]}, {"type": "zdi", "idList": ["ZDI-19-367", "ZDI-19-368"]}, {"type": "zdt", "idList": ["1337DAY-ID-30110", "1337DAY-ID-30308"]}]}, "score": {"value": 0.7, "vector": "NONE"}, "backreferences": {"references": [{"type": "apple", "idList": ["APPLE:444B5944D49C1B1DB2F8D833473A3E28", "APPLE:6B41E03BE95C41152A91DE7584480E16", "APPLE:B3402276360A8C507F94E26E15D465F4", "APPLE:B7AA5B9368DE4BD135A602B017EB0259", "APPLE:F5ED4B2C8BF2CB139C4753A54898E258", "APPLE:FAE8F6548DA345F4466BB73DD8BE2763", "APPLE:HT208326", "APPLE:HT208331", "APPLE:HT208692", "APPLE:HT208693", "APPLE:HT208696", "APPLE:HT208698"]}, {"type": "archlinux", "idList": ["ASA-201710-31", "ASA-201712-5"]}, {"type": "centos", "idList": ["CESA-2020:1190"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2018-0196"]}, {"type": "chrome", "idList": ["GCSA-3542100121216698778", "GCSA-4161252286053538834", "GCSA-6993857189147290065", "GCSA-9103668740237956942", "GCSA-976802465492765680"]}, {"type": "cloudfoundry", "idList": ["CFOUNDRY:81EBD6DFAEE8502A1AEE7ACA1D96C999"]}, {"type": "cve", "idList": ["CVE-2018-6406"]}, {"type": "debian", "idList": ["DEBIAN:DLA-1211-1:EA9E0", "DEBIAN:DSA-4020-1:D6119", "DEBIAN:DSA-4064-1:25480", "DEBIAN:DSA-4086-1:58F72", "DEBIAN:DSA-4103-1:4A64B", "DEBIAN:DSA-4150-1:2E864", "DEBIAN:DSA-4182-1:617C4"]}, {"type": "debiancve", "idList": ["DEBIANCVE:CVE-2017-15396", "DEBIANCVE:CVE-2017-15407", "DEBIANCVE:CVE-2017-15408", "DEBIANCVE:CVE-2017-15409", "DEBIANCVE:CVE-2017-15410", "DEBIANCVE:CVE-2017-15411", "DEBIANCVE:CVE-2017-15413", "DEBIANCVE:CVE-2017-15415", "DEBIANCVE:CVE-2017-15416", "DEBIANCVE:CVE-2017-15417", "DEBIANCVE:CVE-2017-15418", "DEBIANCVE:CVE-2017-15419", "DEBIANCVE:CVE-2017-15420", "DEBIANCVE:CVE-2017-15423", "DEBIANCVE:CVE-2017-15424", "DEBIANCVE:CVE-2017-15425", "DEBIANCVE:CVE-2017-15426", "DEBIANCVE:CVE-2017-15427", "DEBIANCVE:CVE-2018-6056", "DEBIANCVE:CVE-2018-6057", "DEBIANCVE:CVE-2018-6060", "DEBIANCVE:CVE-2018-6061", "DEBIANCVE:CVE-2018-6062", "DEBIANCVE:CVE-2018-6063", "DEBIANCVE:CVE-2018-6064", "DEBIANCVE:CVE-2018-6065", "DEBIANCVE:CVE-2018-6066", "DEBIANCVE:CVE-2018-6067", "DEBIANCVE:CVE-2018-6068", "DEBIANCVE:CVE-2018-6069", "DEBIANCVE:CVE-2018-6070", "DEBIANCVE:CVE-2018-6071", "DEBIANCVE:CVE-2018-6072", "DEBIANCVE:CVE-2018-6073", "DEBIANCVE:CVE-2018-6074", "DEBIANCVE:CVE-2018-6075", "DEBIANCVE:CVE-2018-6076", "DEBIANCVE:CVE-2018-6077", "DEBIANCVE:CVE-2018-6078", "DEBIANCVE:CVE-2018-6079", "DEBIANCVE:CVE-2018-6080", "DEBIANCVE:CVE-2018-6081", "DEBIANCVE:CVE-2018-6082", "DEBIANCVE:CVE-2018-6083", "DEBIANCVE:CVE-2018-6406"]}, {"type": "f5", "idList": ["F5:K76678525"]}, {"type": "fedora", "idList": ["FEDORA:01AED601B23D", "FEDORA:0F54C60BE23D", "FEDORA:2E8D96005552", "FEDORA:546436087815", "FEDORA:5CFCF60A5875", "FEDORA:855A9625F2AD", "FEDORA:93899601DD82", "FEDORA:B171E6087BC3", "FEDORA:BD8776075EF7", "FEDORA:CAFF160478EB", "FEDORA:CEA406042D4A", "FEDORA:D5E9D604E466", "FEDORA:EC7F86046254"]}, {"type": "freebsd", "idList": ["1D951E85-FFDB-11E7-8B91-E8E0B747A45A", "3CD46257-BBC5-11E7-A3BC-E8E0B747A45A", "8E986B2B-1BAA-11E8-A944-54EE754AF08E", "ABFC932E-1BA8-11E8-A944-54EE754AF08E"]}, {"type": "gentoo", "idList": ["GLSA-201711-02", "GLSA-201802-02"]}, {"type": "ibm", "idList": ["F07DB3E9DE713D6D6258FA7BB69C354916D6B592DF066F85F76143C8963BA25E"]}, {"type": "kaspersky", "idList": ["KLA11130", "KLA11185", "KLA11188", "KLA11194"]}, {"type": "metasploit", "idList": ["MSF:ILITIES/REDHAT_LINUX-CVE-2017-15407/", "MSF:ILITIES/REDHAT_LINUX-CVE-2017-15410/", "MSF:ILITIES/REDHAT_LINUX-CVE-2017-15415/", "MSF:ILITIES/REDHAT_LINUX-CVE-2017-15418/"]}, {"type": "nessus", "idList": ["DEBIAN_DSA-4020.NASL", "DEBIAN_DSA-4086.NASL", "DEBIAN_DSA-4103.NASL", "DEBIAN_DSA-4150.NASL", "EULEROS_SA-2020-1568.NASL", "FEDORA_2017-15B815B9B7.NASL", "FEDORA_2017-C2645AA935.NASL", "FEDORA_2018-024AFA2D48.NASL", "FEDORA_2018-44E1C23700.NASL", "FEDORA_2018-C0D3DB441F.NASL", "FEDORA_2018-E08D828ED9.NASL", "FEDORA_2018-FAFF5F661E.NASL", "FREEBSD_PKG_1D951E85FFDB11E78B91E8E0B747A45A.NASL", "FREEBSD_PKG_3CD46257BBC511E7A3BCE8E0B747A45A.NASL", "FREEBSD_PKG_8E986B2B1BAA11E8A94454EE754AF08E.NASL", "FREEBSD_PKG_ABFC932E1BA811E8A94454EE754AF08E.NASL", "GENTOO_GLSA-201711-02.NASL", "GENTOO_GLSA-201802-02.NASL", "GENTOO_GLSA-201803-05.NASL", "GOOGLE_CHROME_64_0_3282_119.NASL", "GOOGLE_CHROME_64_0_3282_167.NASL", "MACOSX_GOOGLE_CHROME_64_0_3282_119.NASL", "MACOSX_GOOGLE_CHROME_64_0_3282_167.NASL", "MACOSX_SECUPD2018-002.NASL", "MACOS_10_13_4.NASL", "OPENSUSE-2017-1221.NASL", "OPENSUSE-2018-103.NASL", "OPENSUSE-2018-128.NASL", "OPENSUSE-2018-165.NASL", "REDHAT-RHSA-2017-3082.NASL", "REDHAT-RHSA-2018-0334.NASL", "REDHAT-RHSA-2018-0484.NASL", "UBUNTU_USN-3610-1.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310704020", "OPENVAS:1361412562310704086", "OPENVAS:1361412562310704103", "OPENVAS:1361412562310704150", "OPENVAS:1361412562310811882", "OPENVAS:1361412562310811883", "OPENVAS:1361412562310811884", "OPENVAS:1361412562310812803", "OPENVAS:1361412562310812804", "OPENVAS:1361412562310812805", "OPENVAS:1361412562310843486", "OPENVAS:1361412562310851634", "OPENVAS:1361412562310851692", "OPENVAS:1361412562310851702", "OPENVAS:1361412562310874144", "OPENVAS:1361412562310874155", "OPENVAS:1361412562310874278", "OPENVAS:1361412562310874280", "OPENVAS:1361412562310874300", "OPENVAS:1361412562311220201568"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:147025"]}, {"type": "photon", "idList": ["PHSA-2020-0288"]}, {"type": "redhat", "idList": ["RHSA-2017:3401", "RHSA-2018:0287"]}, {"type": "redhatcve", "idList": ["RH:CVE-2018-6056", "RH:CVE-2018-6057", "RH:CVE-2018-6058", "RH:CVE-2018-6059", "RH:CVE-2018-6060", "RH:CVE-2018-6061", "RH:CVE-2018-6062", "RH:CVE-2018-6063", "RH:CVE-2018-6064", "RH:CVE-2018-6065", "RH:CVE-2018-6066", "RH:CVE-2018-6067", "RH:CVE-2018-6068", "RH:CVE-2018-6069", "RH:CVE-2018-6070", "RH:CVE-2018-6071", "RH:CVE-2018-6072", "RH:CVE-2018-6073", "RH:CVE-2018-6074", "RH:CVE-2018-6075", "RH:CVE-2018-6076", "RH:CVE-2018-6077", "RH:CVE-2018-6078", "RH:CVE-2018-6079", "RH:CVE-2018-6080", "RH:CVE-2018-6081", "RH:CVE-2018-6082", "RH:CVE-2018-6083", "RH:CVE-2018-6406"]}, {"type": "seebug", "idList": ["SSV:97177", "SSV:97179", "SSV:97180"]}, {"type": "suse", "idList": ["OPENSUSE-SU-2017:2902-1", "OPENSUSE-SU-2018:0259-1", "OPENSUSE-SU-2018:0313-1", "OPENSUSE-SU-2018:0453-1", "OPENSUSE-SU-2018:0454-1"]}, {"type": "threatpost", "idList": ["THREATPOST:3CA10850AC14EA4F7055A21FCE8DB99F", "THREATPOST:BC7785C1AA5CE337FD6268A2941438EE"]}, {"type": "ubuntu", "idList": ["USN-3513-1", "USN-3513-2", "USN-3610-1"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2017-15396", "UB:CVE-2017-15407", "UB:CVE-2017-15408", "UB:CVE-2017-15409", "UB:CVE-2017-15410", "UB:CVE-2017-15411", "UB:CVE-2017-15413", "UB:CVE-2017-15415", "UB:CVE-2017-15416", "UB:CVE-2017-15417", "UB:CVE-2017-15418", "UB:CVE-2017-15419", "UB:CVE-2017-15420", "UB:CVE-2017-15423", "UB:CVE-2017-15424", "UB:CVE-2017-15425", "UB:CVE-2017-15426", "UB:CVE-2017-15427", "UB:CVE-2018-6056", "UB:CVE-2018-6057", "UB:CVE-2018-6058", "UB:CVE-2018-6059", "UB:CVE-2018-6060", "UB:CVE-2018-6061", "UB:CVE-2018-6062", "UB:CVE-2018-6063", "UB:CVE-2018-6064", "UB:CVE-2018-6065", "UB:CVE-2018-6066", "UB:CVE-2018-6067", "UB:CVE-2018-6068", "UB:CVE-2018-6069", "UB:CVE-2018-6070", "UB:CVE-2018-6071", "UB:CVE-2018-6072", "UB:CVE-2018-6073", "UB:CVE-2018-6074", "UB:CVE-2018-6075", "UB:CVE-2018-6076", "UB:CVE-2018-6077", "UB:CVE-2018-6078", "UB:CVE-2018-6079", "UB:CVE-2018-6080", "UB:CVE-2018-6081", "UB:CVE-2018-6082", "UB:CVE-2018-6083", "UB:CVE-2018-6406"]}, {"type": "zdi", "idList": ["ZDI-19-367"]}, {"type": "zdt", "idList": ["1337DAY-ID-30110"]}]}, "exploitation": null, "vulnersScore": 0.7}, "_state": {"dependencies": 1673453919, "score": 1673453377}, "_internal": {"score_hash": "50de2c246903ad88ae1ead95e425a463"}, "pluginID": "120695", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2018-aafdbb5554.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(120695);\n script_version(\"1.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/06/08\");\n\n script_cve_id(\n \"CVE-2017-15396\",\n \"CVE-2017-15407\",\n \"CVE-2017-15408\",\n \"CVE-2017-15409\",\n \"CVE-2017-15410\",\n \"CVE-2017-15411\",\n \"CVE-2017-15412\",\n \"CVE-2017-15413\",\n \"CVE-2017-15415\",\n \"CVE-2017-15416\",\n \"CVE-2017-15417\",\n \"CVE-2017-15418\",\n \"CVE-2017-15419\",\n \"CVE-2017-15420\",\n \"CVE-2017-15422\",\n \"CVE-2017-15423\",\n \"CVE-2017-15424\",\n \"CVE-2017-15425\",\n \"CVE-2017-15426\",\n \"CVE-2017-15427\",\n \"CVE-2018-6056\",\n \"CVE-2018-6057\",\n \"CVE-2018-6058\",\n \"CVE-2018-6059\",\n \"CVE-2018-6060\",\n \"CVE-2018-6061\",\n \"CVE-2018-6062\",\n \"CVE-2018-6063\",\n \"CVE-2018-6064\",\n \"CVE-2018-6065\",\n \"CVE-2018-6066\",\n \"CVE-2018-6067\",\n \"CVE-2018-6068\",\n \"CVE-2018-6069\",\n \"CVE-2018-6070\",\n \"CVE-2018-6071\",\n \"CVE-2018-6072\",\n \"CVE-2018-6073\",\n \"CVE-2018-6074\",\n \"CVE-2018-6075\",\n \"CVE-2018-6076\",\n \"CVE-2018-6077\",\n \"CVE-2018-6078\",\n \"CVE-2018-6079\",\n \"CVE-2018-6080\",\n \"CVE-2018-6081\",\n \"CVE-2018-6082\",\n \"CVE-2018-6083\",\n \"CVE-2018-6406\"\n );\n script_xref(name:\"FEDORA\", value:\"2018-aafdbb5554\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/06/22\");\n\n script_name(english:\"Fedora 28 : chromium (2018-aafdbb5554)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Fedora host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"Update to Chromium 65. For EPEL7, it has been a long time since a\nsuccessful build has been possible, so this will fix a LOT of CVEs.\n\nCVE-2017-15396 CVE-2017-15407 CVE-2017-15408 CVE-2017-15409\nCVE-2017-15410 CVE-2017-15411 CVE-2017-15412 CVE-2017-15413\nCVE-2017-15415 CVE-2017-15416 CVE-2017-15417 CVE-2017-15418\nCVE-2017-15419 CVE-2017-15420 CVE-2017-15422 CVE-2018-6056\nCVE-2018-6406 CVE-2018-6057 CVE-2018-6058 CVE-2018-6059 CVE-2018-6060\nCVE-2018-6061 CVE-2018-6062 CVE-2018-6063 CVE-2018-6064 CVE-2018-6065\nCVE-2018-6066 CVE-2018-6067 CVE-2018-6068 CVE-2018-6069 CVE-2018-6070\nCVE-2018-6071\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2018-aafdbb5554\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected chromium package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/01/30\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/03/30\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/01/03\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:chromium\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:28\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Fedora Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2019-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^28([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 28\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"FC28\", reference:\"chromium-65.0.3325.181-1.fc28\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"chromium\");\n}\n", "naslFamily": "Fedora Local Security Checks", "cpe": ["p-cpe:/a:fedoraproject:fedora:chromium", "cpe:/o:fedoraproject:fedora:28"], "solution": "Update the affected chromium package.", "nessusSeverity": "Medium", "cvssScoreSource": "", "vendor_cvss2": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "vendor_cvss3": {"score": 8.8, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "vpr": {"risk factor": "Critical", "score": "9.2"}, "exploitAvailable": true, "exploitEase": "Exploits are available", "patchPublicationDate": "2018-03-30T00:00:00", "vulnerabilityPublicationDate": "2018-01-30T00:00:00", "exploitableWith": []}

{"nessus": [{"lastseen": "2023-01-11T14:43:23", "description": "Update to Chromium 65. For EPEL7, it has been a long time since a successful build has been possible, so this will fix a LOT of CVEs.\n\nCVE-2017-15396 CVE-2017-15407 CVE-2017-15408 CVE-2017-15409 CVE-2017-15410 CVE-2017-15411 CVE-2017-15412 CVE-2017-15413 CVE-2017-15415 CVE-2017-15416 CVE-2017-15417 CVE-2017-15418 CVE-2017-15419 CVE-2017-15420 CVE-2017-15422 CVE-2018-6056 CVE-2018-6406 CVE-2018-6057 CVE-2018-6058 CVE-2018-6059 CVE-2018-6060 CVE-2018-6061 CVE-2018-6062 CVE-2018-6063 CVE-2018-6064 CVE-2018-6065 CVE-2018-6066 CVE-2018-6067 CVE-2018-6068 CVE-2018-6069 CVE-2018-6070 CVE-2018-6071\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-03-28T00:00:00", "type": "nessus", "title": "Fedora 27 : chromium (2018-faff5f661e)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15396", "CVE-2017-15407", "CVE-2017-15408", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15413", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15417", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15420", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426", "CVE-2017-15427", "CVE-2018-6056", "CVE-2018-6057", "CVE-2018-6058", "CVE-2018-6059", "CVE-2018-6060", "CVE-2018-6061", "CVE-2018-6062", "CVE-2018-6063", "CVE-2018-6064", "CVE-2018-6065", "CVE-2018-6066", "CVE-2018-6067", "CVE-2018-6068", "CVE-2018-6069", "CVE-2018-6070", "CVE-2018-6071", "CVE-2018-6072", "CVE-2018-6073", "CVE-2018-6074", "CVE-2018-6075", "CVE-2018-6076", "CVE-2018-6077", "CVE-2018-6078", "CVE-2018-6079", "CVE-2018-6080", "CVE-2018-6081", "CVE-2018-6082", "CVE-2018-6083", "CVE-2018-6406"], "modified": "2022-06-08T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:chromium", "cpe:/o:fedoraproject:fedora:27"], "id": "FEDORA_2018-FAFF5F661E.NASL", "href": "https://www.tenable.com/plugins/nessus/108679", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2018-faff5f661e.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(108679);\n script_version(\"1.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/06/08\");\n\n script_cve_id(\n \"CVE-2017-15396\",\n \"CVE-2017-15407\",\n \"CVE-2017-15408\",\n \"CVE-2017-15409\",\n \"CVE-2017-15410\",\n \"CVE-2017-15411\",\n \"CVE-2017-15412\",\n \"CVE-2017-15413\",\n \"CVE-2017-15415\",\n \"CVE-2017-15416\",\n \"CVE-2017-15417\",\n \"CVE-2017-15418\",\n \"CVE-2017-15419\",\n \"CVE-2017-15420\",\n \"CVE-2017-15422\",\n \"CVE-2017-15423\",\n \"CVE-2017-15424\",\n \"CVE-2017-15425\",\n \"CVE-2017-15426\",\n \"CVE-2017-15427\",\n \"CVE-2018-6056\",\n \"CVE-2018-6057\",\n \"CVE-2018-6058\",\n \"CVE-2018-6059\",\n \"CVE-2018-6060\",\n \"CVE-2018-6061\",\n \"CVE-2018-6062\",\n \"CVE-2018-6063\",\n \"CVE-2018-6064\",\n \"CVE-2018-6065\",\n \"CVE-2018-6066\",\n \"CVE-2018-6067\",\n \"CVE-2018-6068\",\n \"CVE-2018-6069\",\n \"CVE-2018-6070\",\n \"CVE-2018-6071\",\n \"CVE-2018-6072\",\n \"CVE-2018-6073\",\n \"CVE-2018-6074\",\n \"CVE-2018-6075\",\n \"CVE-2018-6076\",\n \"CVE-2018-6077\",\n \"CVE-2018-6078\",\n \"CVE-2018-6079\",\n \"CVE-2018-6080\",\n \"CVE-2018-6081\",\n \"CVE-2018-6082\",\n \"CVE-2018-6083\",\n \"CVE-2018-6406\"\n );\n script_xref(name:\"FEDORA\", value:\"2018-faff5f661e\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/06/22\");\n\n script_name(english:\"Fedora 27 : chromium (2018-faff5f661e)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Fedora host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"Update to Chromium 65. For EPEL7, it has been a long time since a\nsuccessful build has been possible, so this will fix a LOT of CVEs.\n\nCVE-2017-15396 CVE-2017-15407 CVE-2017-15408 CVE-2017-15409\nCVE-2017-15410 CVE-2017-15411 CVE-2017-15412 CVE-2017-15413\nCVE-2017-15415 CVE-2017-15416 CVE-2017-15417 CVE-2017-15418\nCVE-2017-15419 CVE-2017-15420 CVE-2017-15422 CVE-2018-6056\nCVE-2018-6406 CVE-2018-6057 CVE-2018-6058 CVE-2018-6059 CVE-2018-6060\nCVE-2018-6061 CVE-2018-6062 CVE-2018-6063 CVE-2018-6064 CVE-2018-6065\nCVE-2018-6066 CVE-2018-6067 CVE-2018-6068 CVE-2018-6069 CVE-2018-6070\nCVE-2018-6071\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2018-faff5f661e\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected chromium package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/01/30\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/03/27\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/03/28\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:chromium\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:27\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Fedora Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2018-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^27([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 27\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"FC27\", reference:\"chromium-65.0.3325.181-1.fc27\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"chromium\");\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-01-11T14:42:04", "description": "An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.\n\nChromium is an open source web browser, powered by WebKit (Blink).\n\nThis update upgrades Chromium to version 63.0.3239.84.\n\nSecurity Fix(es) :\n\n* Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when visited by the victim. (CVE-2017-15407, CVE-2017-15408, CVE-2017-15409, CVE-2017-15410, CVE-2017-15411, CVE-2017-15412, CVE-2017-15413, CVE-2017-15415, CVE-2017-15416, CVE-2017-15417, CVE-2017-15418, CVE-2017-15419, CVE-2017-15420, CVE-2017-15422, CVE-2017-15423, CVE-2017-15424, CVE-2017-15425, CVE-2017-15426, CVE-2017-15427)", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2017-12-08T00:00:00", "type": "nessus", "title": "RHEL 6 : chromium-browser (RHSA-2017:3401)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15407", "CVE-2017-15408", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15413", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15417", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15420", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426", "CVE-2017-15427"], "modified": "2020-05-29T00:00:00", "cpe": ["p-cpe:/a:redhat:enterprise_linux:chromium-browser", "p-cpe:/a:redhat:enterprise_linux:chromium-browser-debuginfo", "cpe:/o:redhat:enterprise_linux:6"], "id": "REDHAT-RHSA-2017-3401.NASL", "href": "https://www.tenable.com/plugins/nessus/105091", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2017:3401. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(105091);\n script_version(\"3.12\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/05/29\");\n\n script_cve_id(\"CVE-2017-15407\", \"CVE-2017-15408\", \"CVE-2017-15409\", \"CVE-2017-15410\", \"CVE-2017-15411\", \"CVE-2017-15412\", \"CVE-2017-15413\", \"CVE-2017-15415\", \"CVE-2017-15416\", \"CVE-2017-15417\", \"CVE-2017-15418\", \"CVE-2017-15419\", \"CVE-2017-15420\", \"CVE-2017-15422\", \"CVE-2017-15423\", \"CVE-2017-15424\", \"CVE-2017-15425\", \"CVE-2017-15426\", \"CVE-2017-15427\");\n script_xref(name:\"RHSA\", value:\"2017:3401\");\n\n script_name(english:\"RHEL 6 : chromium-browser (RHSA-2017:3401)\");\n script_summary(english:\"Checks the rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote Red Hat host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"An update for chromium-browser is now available for Red Hat Enterprise\nLinux 6 Supplementary.\n\nRed Hat Product Security has rated this update as having a security\nimpact of Critical. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available for each\nvulnerability from the CVE link(s) in the References section.\n\nChromium is an open source web browser, powered by WebKit (Blink).\n\nThis update upgrades Chromium to version 63.0.3239.84.\n\nSecurity Fix(es) :\n\n* Multiple flaws were found in the processing of malformed web\ncontent. A web page containing malicious content could cause Chromium\nto crash, execute arbitrary code, or disclose sensitive information\nwhen visited by the victim. (CVE-2017-15407, CVE-2017-15408,\nCVE-2017-15409, CVE-2017-15410, CVE-2017-15411, CVE-2017-15412,\nCVE-2017-15413, CVE-2017-15415, CVE-2017-15416, CVE-2017-15417,\nCVE-2017-15418, CVE-2017-15419, CVE-2017-15420, CVE-2017-15422,\nCVE-2017-15423, CVE-2017-15424, CVE-2017-15425, CVE-2017-15426,\nCVE-2017-15427)\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://chromereleases.googleblog.com/2017/12/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2017:3401\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2017-15407\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2017-15408\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2017-15409\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2017-15410\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2017-15411\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2017-15412\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2017-15413\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2017-15415\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2017-15416\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2017-15417\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2017-15418\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2017-15419\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2017-15420\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2017-15422\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2017-15423\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2017-15424\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2017-15425\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2017-15426\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2017-15427\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\n\"Update the affected chromium-browser and / or\nchromium-browser-debuginfo packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:chromium-browser\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:chromium-browser-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:6\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/08/28\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/12/07\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/12/08\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^6([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 6.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2017:3401\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"chromium-browser-63.0.3239.84-1.el6_9\", allowmaj:TRUE)) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"chromium-browser-63.0.3239.84-1.el6_9\", allowmaj:TRUE)) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"chromium-browser-debuginfo-63.0.3239.84-1.el6_9\", allowmaj:TRUE)) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"chromium-browser-debuginfo-63.0.3239.84-1.el6_9\", allowmaj:TRUE)) flag++;\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"chromium-browser / chromium-browser-debuginfo\");\n }\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-01-11T14:41:20", "description": "Several vulnerabilities have been discovered in the chromium web browser.\n\n - CVE-2017-15407 Ned Williamson discovered an out-of-bounds write issue.\n\n - CVE-2017-15408 Ke Liu discovered a heap overflow issue in the pdfium library.\n\n - CVE-2017-15409 An out-of-bounds write issue was discovered in the skia library.\n\n - CVE-2017-15410 Luat Nguyen discovered a use-after-free issue in the pdfium library.\n\n - CVE-2017-15411 Luat Nguyen discovered a use-after-free issue in the pdfium library.\n\n - CVE-2017-15413 Gaurav Dewan discovered a type confusion issue.\n\n - CVE-2017-15415 Viktor Brange discovered an information disclosure issue.\n\n - CVE-2017-15416 Ned Williamson discovered an out-of-bounds read issue.\n\n - CVE-2017-15417 Max May discovered an information disclosure issue in the skia library.\n\n - CVE-2017-15418 Kushal Arvind Shah discovered an uninitialized value in the skia library.\n\n - CVE-2017-15419 Jun Kokatsu discoved an information disclosure issue.\n\n - CVE-2017-15420 WenXu Wu discovered a URL spoofing issue.\n\n - CVE-2017-15423 Greg Hudson discovered an issue in the boringssl library.\n\n - CVE-2017-15424 Khalil Zhani discovered a URL spoofing issue.\n\n - CVE-2017-15425 xisigr discovered a URL spoofing issue.\n\n - CVE-2017-15426 WenXu Wu discovered a URL spoofing issue.\n\n - CVE-2017-15427 Junaid Farhan discovered an issue with the omnibox.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2017-12-13T00:00:00", "type": "nessus", "title": "Debian DSA-4064-1 : chromium-browser - security update", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15407", "CVE-2017-15408", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15413", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15417", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15420", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426", "CVE-2017-15427"], "modified": "2021-01-04T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:chromium-browser", "cpe:/o:debian:debian_linux:9.0"], "id": "DEBIAN_DSA-4064.NASL", "href": "https://www.tenable.com/plugins/nessus/105195", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-4064. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(105195);\n script_version(\"3.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/04\");\n\n script_cve_id(\"CVE-2017-15407\", \"CVE-2017-15408\", \"CVE-2017-15409\", \"CVE-2017-15410\", \"CVE-2017-15411\", \"CVE-2017-15413\", \"CVE-2017-15415\", \"CVE-2017-15416\", \"CVE-2017-15417\", \"CVE-2017-15418\", \"CVE-2017-15419\", \"CVE-2017-15420\", \"CVE-2017-15423\", \"CVE-2017-15424\", \"CVE-2017-15425\", \"CVE-2017-15426\", \"CVE-2017-15427\");\n script_xref(name:\"DSA\", value:\"4064\");\n\n script_name(english:\"Debian DSA-4064-1 : chromium-browser - security update\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Several vulnerabilities have been discovered in the chromium web\nbrowser.\n\n - CVE-2017-15407\n Ned Williamson discovered an out-of-bounds write issue.\n\n - CVE-2017-15408\n Ke Liu discovered a heap overflow issue in the pdfium\n library.\n\n - CVE-2017-15409\n An out-of-bounds write issue was discovered in the skia\n library.\n\n - CVE-2017-15410\n Luat Nguyen discovered a use-after-free issue in the\n pdfium library.\n\n - CVE-2017-15411\n Luat Nguyen discovered a use-after-free issue in the\n pdfium library.\n\n - CVE-2017-15413\n Gaurav Dewan discovered a type confusion issue.\n\n - CVE-2017-15415\n Viktor Brange discovered an information disclosure\n issue.\n\n - CVE-2017-15416\n Ned Williamson discovered an out-of-bounds read issue.\n\n - CVE-2017-15417\n Max May discovered an information disclosure issue in\n the skia library.\n\n - CVE-2017-15418\n Kushal Arvind Shah discovered an uninitialized value in\n the skia library.\n\n - CVE-2017-15419\n Jun Kokatsu discoved an information disclosure issue.\n\n - CVE-2017-15420\n WenXu Wu discovered a URL spoofing issue.\n\n - CVE-2017-15423\n Greg Hudson discovered an issue in the boringssl\n library.\n\n - CVE-2017-15424\n Khalil Zhani discovered a URL spoofing issue.\n\n - CVE-2017-15425\n xisigr discovered a URL spoofing issue.\n\n - CVE-2017-15426\n WenXu Wu discovered a URL spoofing issue.\n\n - CVE-2017-15427\n Junaid Farhan discovered an issue with the omnibox.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2017-15407\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2017-15408\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2017-15409\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2017-15410\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2017-15411\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2017-15413\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2017-15415\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2017-15416\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2017-15417\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2017-15418\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2017-15419\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2017-15420\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2017-15423\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2017-15424\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2017-15425\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2017-15426\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2017-15427\"\n );\n # https://security-tracker.debian.org/tracker/source-package/chromium-browser\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?e33901a2\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/stretch/chromium-browser\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2017/dsa-4064\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the chromium-browser packages.\n\nFor the stable distribution (stretch), these problems have been fixed\nin version 63.0.3239.84-1~deb9u1.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:chromium-browser\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:9.0\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/08/28\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/12/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/12/13\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"9.0\", prefix:\"chromedriver\", reference:\"63.0.3239.84-1~deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"chromium\", reference:\"63.0.3239.84-1~deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"chromium-driver\", reference:\"63.0.3239.84-1~deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"chromium-l10n\", reference:\"63.0.3239.84-1~deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"chromium-shell\", reference:\"63.0.3239.84-1~deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"chromium-widevine\", reference:\"63.0.3239.84-1~deb9u1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-01-11T14:41:30", "description": "The remote host is affected by the vulnerability described in GLSA-201803-05 (Chromium, Google Chrome: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been discovered in Chromium and Google Chrome. Please review the referenced CVE identifiers and Google Chrome Releases for details.\n Impact :\n\n A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, bypass content security controls, or conduct URL spoofing.\n Workaround :\n\n There is no known workaround at this time.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-03-14T00:00:00", "type": "nessus", "title": "GLSA-201803-05 : Chromium, Google Chrome: Multiple vulnerabilities", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6057", "CVE-2018-6058", "CVE-2018-6059", "CVE-2018-6060", "CVE-2018-6061", "CVE-2018-6062", "CVE-2018-6063", "CVE-2018-6064", "CVE-2018-6065", "CVE-2018-6066", "CVE-2018-6067", "CVE-2018-6068", "CVE-2018-6069", "CVE-2018-6070", "CVE-2018-6071", "CVE-2018-6072", "CVE-2018-6073", "CVE-2018-6074", "CVE-2018-6075", "CVE-2018-6076", "CVE-2018-6077", "CVE-2018-6078", "CVE-2018-6079", "CVE-2018-6080", "CVE-2018-6081", "CVE-2018-6082", "CVE-2018-6083"], "modified": "2022-07-05T00:00:00", "cpe": ["p-cpe:/a:gentoo:linux:chromium", "p-cpe:/a:gentoo:linux:google-chrome", "cpe:/o:gentoo:linux"], "id": "GENTOO_GLSA-201803-05.NASL", "href": "https://www.tenable.com/plugins/nessus/108317", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Gentoo Linux Security Advisory GLSA 201803-05.\n#\n# The advisory text is Copyright (C) 2001-2022 Gentoo Foundation, Inc.\n# and licensed under the Creative Commons - Attribution / Share Alike \n# license. See http://creativecommons.org/licenses/by-sa/3.0/\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(108317);\n script_version(\"1.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/07/05\");\n\n script_cve_id(\"CVE-2018-6057\", \"CVE-2018-6058\", \"CVE-2018-6059\", \"CVE-2018-6060\", \"CVE-2018-6061\", \"CVE-2018-6062\", \"CVE-2018-6063\", \"CVE-2018-6064\", \"CVE-2018-6065\", \"CVE-2018-6066\", \"CVE-2018-6067\", \"CVE-2018-6068\", \"CVE-2018-6069\", \"CVE-2018-6070\", \"CVE-2018-6071\", \"CVE-2018-6072\", \"CVE-2018-6073\", \"CVE-2018-6074\", \"CVE-2018-6075\", \"CVE-2018-6076\", \"CVE-2018-6077\", \"CVE-2018-6078\", \"CVE-2018-6079\", \"CVE-2018-6080\", \"CVE-2018-6081\", \"CVE-2018-6082\", \"CVE-2018-6083\");\n script_xref(name:\"GLSA\", value:\"201803-05\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/06/22\");\n\n script_name(english:\"GLSA-201803-05 : Chromium, Google Chrome: Multiple vulnerabilities\");\n script_summary(english:\"Checks for updated package(s) in /var/db/pkg\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\n\"The remote Gentoo host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"The remote host is affected by the vulnerability described in GLSA-201803-05\n(Chromium, Google Chrome: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been discovered in Chromium and Google\n Chrome. Please review the referenced CVE identifiers and Google Chrome\n Releases for details.\n \nImpact :\n\n A remote attacker could possibly execute arbitrary code with the\n privileges of the process, cause a Denial of Service condition, bypass\n content security controls, or conduct URL spoofing.\n \nWorkaround :\n\n There is no known workaround at this time.\"\n );\n # https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?68129919\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security.gentoo.org/glsa/201803-05\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\n\"All Chromium users should upgrade to the latest version:\n # emerge --sync\n # emerge --ask --oneshot --verbose\n '>=www-client/chromium-65.0.3325.146'\n All Google Chrome users should upgrade to the latest version:\n # emerge --sync\n # emerge --ask --oneshot --verbose\n '>=www-client/google-chrome-65.0.3325.146'\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2018-6083\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:chromium\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:google-chrome\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:gentoo:linux\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/11/14\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/03/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/03/14\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Gentoo Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Gentoo/release\", \"Host/Gentoo/qpkg-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"qpkg.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Gentoo/release\")) audit(AUDIT_OS_NOT, \"Gentoo\");\nif (!get_kb_item(\"Host/Gentoo/qpkg-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (qpkg_check(package:\"www-client/chromium\", unaffected:make_list(\"ge 65.0.3325.146\"), vulnerable:make_list(\"lt 65.0.3325.146\"))) flag++;\nif (qpkg_check(package:\"www-client/google-chrome\", unaffected:make_list(\"ge 65.0.3325.146\"), vulnerable:make_list(\"lt 65.0.3325.146\"))) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:qpkg_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = qpkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"Chromium / Google Chrome\");\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-01-11T14:48:20", "description": "The version of Google Chrome installed on the remote host is prior to 63.0.3239.84, and is affected by multiple vulnerabilities :\n\n - An out-of-bounds read flaw exists in the 'StoreFrame()' function in 'demux/demux.c' that is triggered when handling animated WebP images with small frames. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents.\n - A flaw exists related to cache storage. This may allow a context-dependent attacker to disclose service worker response sizes.\n - An out-of-bounds read flaw exists that is triggered when rendering the P4_INTARRAY argument to the OP_IntegrityCk opcode in the output of EXPLAIN. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents.\n - An out-of-bounds read flaw exists in 'net/dns/dns_transaction.cc' that is triggered when handling asynchronous DNS exchanges. With specially crafted DNS responses, a context-dependent attacker can potentially disclose memory contents.\n - A flaw exists in the 'PreParser::RewriteCatchPattern()' function in 'parsing/preparser.h' that is triggered as catch variables are not properly handled during block function hoisting. This may allow a context-dependent attacker to potentially execute arbitrary code.\n - A flaw exists in the 'MediaElementEventListener::handleEvent()' function in 'modules/mediacapturefromelement/HTMLMediaElementCapture.cpp' that is triggered when handling media streams. This may allow a context-dependent attacker to potentially execute arbitrary code.\n - A flaw exists that is triggered when handling calls to the 'Reflect.'construct'()' JavaScript method. This may allow a context-dependent attacker to potentially execute arbitrary code.\n - A flaw exists in 'chrome/android/java/src/org/chromium/chrome/browser/omnibox/UrlBar.java' and 'chrome/android/java/src/org/chromium/chrome/browser/toolbar/ToolbarPhone.java' that is triggered when handling omnibox URL eliding / positioning. This may allow a context-dependent attacker to conduct a spoofing attack.\n - A type confusion flaw exists in the 'TranslatedState::CapturedObjectMaterializer()' function in 'deoptimizer.cc' that is triggered when mutable heap numbers are used in an object field. This may allow a context-dependent attacker to potentially execute arbitrary code.\n - A flaw exists in 'chrome/browser/resources/chromeos/login/oobe_screen_terms_of_service.js' that is triggered as content from the web is loaded within the privileged WebUI process when displaying the Terms of Service text. This may allow a context-dependent attacker to potentially execute code with elevated privileges.\n - An overflow condition exists in the 'InputScalesValid()' function in 'browser/themes/browser_theme_pack.cc' that is triggered as certain input is not properly validated when handling browser theme packs. This may allow a context-dependent attacker to cause a buffer overflow, potentially allowing to execute arbitrary code.\n - A type confusion flaw exists in the 'AXARIAGrid::AddRow()' function in 'modules/accessibility/AXARIAGrid.cpp' that is triggered when handling table rows. This may allow a context-dependent attacker to execute arbitrary code.\n - An overflow condition exists in 'core/fxcodec/codec/fx_codec_jpx_opj.cpp' that is triggered as improper allocate and free functions of OpenJPEG are used. This may allow a context-dependent attacker to cause a heap-based buffer overflow, potentially allowing to execute arbitrary code.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-08-23T00:00:00", "type": "nessus", "title": "Google Chrome < 63.0.3239.84 Multiple Vulnerabilities", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15407", "CVE-2017-15408", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15413", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15417", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426", "CVE-2017-15427"], "modified": "2019-03-06T00:00:00", "cpe": ["cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*"], "id": "700351.PASL", "href": "https://www.tenable.com/plugins/nnm/700351", "sourceData": "Binary data 700351.pasl", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-01-11T14:41:16", "description": "This update to Chromium 63.0.3239.84 fixes the following security issues :\n\n - CVE-2017-15408: Heap buffer overflow in PDFium\n\n - CVE-2017-15409: Out of bounds write in Skia\n\n - CVE-2017-15410: Use after free in PDFium\n\n - CVE-2017-15411: Use after free in PDFium\n\n - CVE-2017-15412: Use after free in libXML\n\n - CVE-2017-15413: Type confusion in WebAssembly\n\n - CVE-2017-15415: Pointer information disclosure in IPC call\n\n - CVE-2017-15416: Out of bounds read in Blink\n\n - CVE-2017-15417: Cross origin information disclosure in Skia\n\n - CVE-2017-15418: Use of uninitialized value in Skia\n\n - CVE-2017-15419: Cross origin leak of redirect URL in Blink\n\n - CVE-2017-15420: URL spoofing in Omnibox\n\n - CVE-2017-15422: Integer overflow in ICU\n\n - CVE-2017-15423: Issue with SPAKE implementation in BoringSSL\n\n - CVE-2017-15424: URL Spoof in Omnibox\n\n - CVE-2017-15425: URL Spoof in Omnibox\n\n - CVE-2017-15426: URL Spoof in Omnibox\n\n - CVE-2017-15427: Insufficient blocking of JavaScript in Omnibox", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2017-12-14T00:00:00", "type": "nessus", "title": "openSUSE Security Update : chromium (openSUSE-2017-1349)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15408", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15413", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15417", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15420", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426", "CVE-2017-15427"], "modified": "2021-01-19T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:chromedriver", "p-cpe:/a:novell:opensuse:chromedriver-debuginfo", "p-cpe:/a:novell:opensuse:chromium", "p-cpe:/a:novell:opensuse:chromium-debuginfo", "p-cpe:/a:novell:opensuse:chromium-debugsource", "cpe:/o:novell:opensuse:42.2", "cpe:/o:novell:opensuse:42.3"], "id": "OPENSUSE-2017-1349.NASL", "href": "https://www.tenable.com/plugins/nessus/105235", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2017-1349.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(105235);\n script_version(\"3.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2017-15408\", \"CVE-2017-15409\", \"CVE-2017-15410\", \"CVE-2017-15411\", \"CVE-2017-15412\", \"CVE-2017-15413\", \"CVE-2017-15415\", \"CVE-2017-15416\", \"CVE-2017-15417\", \"CVE-2017-15418\", \"CVE-2017-15419\", \"CVE-2017-15420\", \"CVE-2017-15422\", \"CVE-2017-15423\", \"CVE-2017-15424\", \"CVE-2017-15425\", \"CVE-2017-15426\", \"CVE-2017-15427\");\n\n script_name(english:\"openSUSE Security Update : chromium (openSUSE-2017-1349)\");\n script_summary(english:\"Check for the openSUSE-2017-1349 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update to Chromium 63.0.3239.84 fixes the following security\nissues :\n\n - CVE-2017-15408: Heap buffer overflow in PDFium\n\n - CVE-2017-15409: Out of bounds write in Skia\n\n - CVE-2017-15410: Use after free in PDFium\n\n - CVE-2017-15411: Use after free in PDFium\n\n - CVE-2017-15412: Use after free in libXML\n\n - CVE-2017-15413: Type confusion in WebAssembly\n\n - CVE-2017-15415: Pointer information disclosure in IPC\n call\n\n - CVE-2017-15416: Out of bounds read in Blink\n\n - CVE-2017-15417: Cross origin information disclosure in\n Skia\n\n - CVE-2017-15418: Use of uninitialized value in Skia\n\n - CVE-2017-15419: Cross origin leak of redirect URL in\n Blink\n\n - CVE-2017-15420: URL spoofing in Omnibox\n\n - CVE-2017-15422: Integer overflow in ICU\n\n - CVE-2017-15423: Issue with SPAKE implementation in\n BoringSSL\n\n - CVE-2017-15424: URL Spoof in Omnibox\n\n - CVE-2017-15425: URL Spoof in Omnibox\n\n - CVE-2017-15426: URL Spoof in Omnibox\n\n - CVE-2017-15427: Insufficient blocking of JavaScript in\n Omnibox\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1071691\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected chromium packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:chromedriver\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:chromedriver-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:chromium\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:chromium-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:chromium-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:42.2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:42.3\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/12/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/12/14\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE42\\.2|SUSE42\\.3)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"42.2 / 42.3\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(x86_64)$\") audit(AUDIT_ARCH_NOT, \"x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE42.2\", reference:\"chromedriver-63.0.3239.84-104.41.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"chromedriver-debuginfo-63.0.3239.84-104.41.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"chromium-63.0.3239.84-104.41.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"chromium-debuginfo-63.0.3239.84-104.41.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"chromium-debugsource-63.0.3239.84-104.41.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"chromedriver-63.0.3239.84-127.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"chromedriver-debuginfo-63.0.3239.84-127.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"chromium-63.0.3239.84-127.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"chromium-debuginfo-63.0.3239.84-127.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"chromium-debugsource-63.0.3239.84-127.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"chromedriver / chromedriver-debuginfo / chromium / etc\");\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-01-11T14:44:00", "description": "An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.\n\nChromium is an open source web browser, powered by WebKit (Blink).\n\nThis update upgrades Chromium to version 65.0.3325.146.\n\nSecurity Fix(es) :\n\n* chromium-browser: incorrect permissions on shared memory (CVE-2018-6057)\n\n* chromium-browser: use-after-free in blink (CVE-2018-6060)\n\n* chromium-browser: race condition in v8 (CVE-2018-6061)\n\n* chromium-browser: heap buffer overflow in skia (CVE-2018-6062)\n\n* chromium-browser: incorrect permissions on shared memory (CVE-2018-6063)\n\n* chromium-browser: type confusion in v8 (CVE-2018-6064)\n\n* chromium-browser: integer overflow in v8 (CVE-2018-6065)\n\n* chromium-browser: same origin bypass via canvas (CVE-2018-6066)\n\n* chromium-browser: buffer overflow in skia (CVE-2018-6067)\n\n* chromium-browser: stack-based buffer overflow in skia (CVE-2018-6069)\n\n* chromium-browser: csp bypass through extensions (CVE-2018-6070)\n\n* chromium-browser: heap bufffer overflow in skia (CVE-2018-6071)\n\n* chromium-browser: integer overflow in pdfium (CVE-2018-6072)\n\n* chromium-browser: heap bufffer overflow in webgl (CVE-2018-6073)\n\n* chromium-browser: mark-of-the-web bypass (CVE-2018-6074)\n\n* chromium-browser: overly permissive cross origin downloads (CVE-2018-6075)\n\n* chromium-browser: incorrect handling of url fragment identifiers in blink (CVE-2018-6076)\n\n* chromium-browser: timing attack using svg filters (CVE-2018-6077)\n\n* chromium-browser: url spoof in omnibox (CVE-2018-6078)\n\n* chromium-browser: information disclosure via texture data in webgl (CVE-2018-6079)\n\n* chromium-browser: information disclosure in ipc call (CVE-2018-6080)\n\n* chromium-browser: xss in interstitials (CVE-2018-6081)\n\n* chromium-browser: circumvention of port blocking (CVE-2018-6082)\n\n* chromium-browser: incorrect processing of appmanifests (CVE-2018-6083)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-03-13T00:00:00", "type": "nessus", "title": "RHEL 6 : chromium-browser (RHSA-2018:0484)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6057", "CVE-2018-6060", "CVE-2018-6061", "CVE-2018-6062", "CVE-2018-6063", "CVE-2018-6064", "CVE-2018-6065", "CVE-2018-6066", "CVE-2018-6067", "CVE-2018-6069", "CVE-2018-6070", "CVE-2018-6071", "CVE-2018-6072", "CVE-2018-6073", "CVE-2018-6074", "CVE-2018-6075", "CVE-2018-6076", "CVE-2018-6077", "CVE-2018-6078", "CVE-2018-6079", "CVE-2018-6080", "CVE-2018-6081", "CVE-2018-6082", "CVE-2018-6083"], "modified": "2022-06-08T00:00:00", "cpe": ["p-cpe:/a:redhat:enterprise_linux:chromium-browser", "p-cpe:/a:redhat:enterprise_linux:chromium-browser-debuginfo", "cpe:/o:redhat:enterprise_linux:6"], "id": "REDHAT-RHSA-2018-0484.NASL", "href": "https://www.tenable.com/plugins/nessus/108275", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2018:0484. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(108275);\n script_version(\"1.14\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/06/08\");\n\n script_cve_id(\n \"CVE-2018-6057\",\n \"CVE-2018-6060\",\n \"CVE-2018-6061\",\n \"CVE-2018-6062\",\n \"CVE-2018-6063\",\n \"CVE-2018-6064\",\n \"CVE-2018-6065\",\n \"CVE-2018-6066\",\n \"CVE-2018-6067\",\n \"CVE-2018-6069\",\n \"CVE-2018-6070\",\n \"CVE-2018-6071\",\n \"CVE-2018-6072\",\n \"CVE-2018-6073\",\n \"CVE-2018-6074\",\n \"CVE-2018-6075\",\n \"CVE-2018-6076\",\n \"CVE-2018-6077\",\n \"CVE-2018-6078\",\n \"CVE-2018-6079\",\n \"CVE-2018-6080\",\n \"CVE-2018-6081\",\n \"CVE-2018-6082\",\n \"CVE-2018-6083\"\n );\n script_xref(name:\"RHSA\", value:\"2018:0484\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/06/22\");\n\n script_name(english:\"RHEL 6 : chromium-browser (RHSA-2018:0484)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Red Hat host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"An update for chromium-browser is now available for Red Hat Enterprise\nLinux 6 Supplementary.\n\nRed Hat Product Security has rated this update as having a security\nimpact of Important. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available for each\nvulnerability from the CVE link(s) in the References section.\n\nChromium is an open source web browser, powered by WebKit (Blink).\n\nThis update upgrades Chromium to version 65.0.3325.146.\n\nSecurity Fix(es) :\n\n* chromium-browser: incorrect permissions on shared memory\n(CVE-2018-6057)\n\n* chromium-browser: use-after-free in blink (CVE-2018-6060)\n\n* chromium-browser: race condition in v8 (CVE-2018-6061)\n\n* chromium-browser: heap buffer overflow in skia (CVE-2018-6062)\n\n* chromium-browser: incorrect permissions on shared memory\n(CVE-2018-6063)\n\n* chromium-browser: type confusion in v8 (CVE-2018-6064)\n\n* chromium-browser: integer overflow in v8 (CVE-2018-6065)\n\n* chromium-browser: same origin bypass via canvas (CVE-2018-6066)\n\n* chromium-browser: buffer overflow in skia (CVE-2018-6067)\n\n* chromium-browser: stack-based buffer overflow in skia\n(CVE-2018-6069)\n\n* chromium-browser: csp bypass through extensions (CVE-2018-6070)\n\n* chromium-browser: heap bufffer overflow in skia (CVE-2018-6071)\n\n* chromium-browser: integer overflow in pdfium (CVE-2018-6072)\n\n* chromium-browser: heap bufffer overflow in webgl (CVE-2018-6073)\n\n* chromium-browser: mark-of-the-web bypass (CVE-2018-6074)\n\n* chromium-browser: overly permissive cross origin downloads\n(CVE-2018-6075)\n\n* chromium-browser: incorrect handling of url fragment identifiers in\nblink (CVE-2018-6076)\n\n* chromium-browser: timing attack using svg filters (CVE-2018-6077)\n\n* chromium-browser: url spoof in omnibox (CVE-2018-6078)\n\n* chromium-browser: information disclosure via texture data in webgl\n(CVE-2018-6079)\n\n* chromium-browser: information disclosure in ipc call (CVE-2018-6080)\n\n* chromium-browser: xss in interstitials (CVE-2018-6081)\n\n* chromium-browser: circumvention of port blocking (CVE-2018-6082)\n\n* chromium-browser: incorrect processing of appmanifests\n(CVE-2018-6083)\n\nFor more details about the security issue(s), including the impact, a\nCVSS score, and other related information, refer to the CVE page(s)\nlisted in the References section.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/errata/RHSA-2018:0484\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/cve-2018-6057\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/cve-2018-6060\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/cve-2018-6061\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/cve-2018-6062\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/cve-2018-6063\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/cve-2018-6064\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/cve-2018-6065\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/cve-2018-6066\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/cve-2018-6067\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/cve-2018-6069\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/cve-2018-6070\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/cve-2018-6071\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/cve-2018-6072\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/cve-2018-6073\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/cve-2018-6074\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/cve-2018-6075\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/cve-2018-6076\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/cve-2018-6077\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/cve-2018-6078\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/cve-2018-6079\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/cve-2018-6080\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/cve-2018-6081\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/cve-2018-6082\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/cve-2018-6083\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected chromium-browser and / or\nchromium-browser-debuginfo packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2018-6083\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/11/14\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/03/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/03/13\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:chromium-browser\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:chromium-browser-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:6\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2018-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^6([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 6.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2018:0484\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"chromium-browser-65.0.3325.146-2.el6_9\", allowmaj:TRUE)) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"chromium-browser-65.0.3325.146-2.el6_9\", allowmaj:TRUE)) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"chromium-browser-debuginfo-65.0.3325.146-2.el6_9\", allowmaj:TRUE)) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"chromium-browser-debuginfo-65.0.3325.146-2.el6_9\", allowmaj:TRUE)) flag++;\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"chromium-browser / chromium-browser-debuginfo\");\n }\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-01-11T14:37:26", "description": "Security fix for CVE-2017-15412 CVE-2017-15422 CVE-2017-15407 CVE-2017-15408 CVE-2017-15409 CVE-2017-15410 CVE-2017-15411 CVE-2017-15413 CVE-2017-15415 CVE-2017-15416 CVE-2017-15417 CVE-2017-15418 CVE-2017-15419 CVE-2017-15420 CVE-2017-15423 CVE-2017-15424 CVE-2017-15425 CVE-2017-15426 CVE-2017-15427 CVE-2017-15429\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-01-15T00:00:00", "type": "nessus", "title": "Fedora 27 : chromium (2017-c2645aa935)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15407", "CVE-2017-15408", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15413", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15417", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15420", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426", "CVE-2017-15427", "CVE-2017-15429"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:chromium", "cpe:/o:fedoraproject:fedora:27"], "id": "FEDORA_2017-C2645AA935.NASL", "href": "https://www.tenable.com/plugins/nessus/105968", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2017-c2645aa935.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(105968);\n script_version(\"1.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2017-15407\", \"CVE-2017-15408\", \"CVE-2017-15409\", \"CVE-2017-15410\", \"CVE-2017-15411\", \"CVE-2017-15412\", \"CVE-2017-15413\", \"CVE-2017-15415\", \"CVE-2017-15416\", \"CVE-2017-15417\", \"CVE-2017-15418\", \"CVE-2017-15419\", \"CVE-2017-15420\", \"CVE-2017-15422\", \"CVE-2017-15423\", \"CVE-2017-15424\", \"CVE-2017-15425\", \"CVE-2017-15426\", \"CVE-2017-15427\", \"CVE-2017-15429\");\n script_xref(name:\"FEDORA\", value:\"2017-c2645aa935\");\n\n script_name(english:\"Fedora 27 : chromium (2017-c2645aa935)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Security fix for CVE-2017-15412 CVE-2017-15422 CVE-2017-15407\nCVE-2017-15408 CVE-2017-15409 CVE-2017-15410 CVE-2017-15411\nCVE-2017-15413 CVE-2017-15415 CVE-2017-15416 CVE-2017-15417\nCVE-2017-15418 CVE-2017-15419 CVE-2017-15420 CVE-2017-15423\nCVE-2017-15424 CVE-2017-15425 CVE-2017-15426 CVE-2017-15427\nCVE-2017-15429\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2017-c2645aa935\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected chromium package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:chromium\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:27\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/08/28\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/01/01\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/01/15\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^27([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 27\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"FC27\", reference:\"chromium-63.0.3239.108-1.fc27\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"chromium\");\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-01-11T14:37:46", "description": "Google Chrome Releases reports :\n\n37 security fixes in this release, including :\n\n- [778505] Critical CVE-2017-15407: Out of bounds write in QUIC.\nReported by Ned Williamson on 2017-10-26\n\n- [762374] High CVE-2017-15408: Heap buffer overflow in PDFium.\nReported by Ke Liu of Tencent's Xuanwu LAB on 2017-09-06\n\n- [763972] High CVE-2017-15409: Out of bounds write in Skia. Reported by Anonymous on 2017-09-11\n\n- [765921] High CVE-2017-15410: Use after free in PDFium. Reported by Luat Nguyen of KeenLab, Tencent on 2017-09-16\n\n- [770148] High CVE-2017-15411: Use after free in PDFium. Reported by Luat Nguyen of KeenLab, Tencent on 2017-09-29\n\n- [727039] High CVE-2017-15412: Use after free in libXML. Reported by Nick Wellnhofer on 2017-05-27\n\n- [766666] High CVE-2017-15413: Type confusion in WebAssembly.\nReported by Gaurav Dewan of Adobe Systems India Pvt. Ltd. on 2017-09-19\n\n- [765512] Medium CVE-2017-15415: Pointer information disclosure in IPC call. Reported by Viktor Brange of Microsoft Offensive Security Research Team on 2017-09-15\n\n- [779314] Medium CVE-2017-15416: Out of bounds read in Blink.\nReported by Ned Williamson on 2017-10-28\n\n- [699028] Medium CVE-2017-15417: Cross origin information disclosure in Skia. Reported by Max May on 2017-03-07\n\n- [765858] Medium CVE-2017-15418: Use of uninitialized value in Skia.\nReported by Kushal Arvind Shah of Fortinet's FortiGuard Labs on 2017-09-15\n\n- [780312] Medium CVE-2017-15419: Cross origin leak of redirect URL in Blink. Reported by Jun Kokatsu on 2017-10-31\n\n- [777419] Medium CVE-2017-15420: URL spoofing in Omnibox. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-10-23\n\n- [774382] Medium CVE-2017-15422: Integer overflow in ICU. Reported by Yuan Deng of Ant-financial Light-Year Security Lab on 2017-10-13\n\n- [780484] Medium CVE-2017-15430: Unsafe navigation in Chromecast Plugin. Reported by jinmo123 on 2017-01-11\n\n- [778101] Low CVE-2017-15423: Issue with SPAKE implementation in BoringSSL. Reported by Greg Hudson on 2017-10-25\n\n- [756226] Low CVE-2017-15424: URL Spoof in Omnibox. Reported by Khalil Zhani on 2017-08-16\n\n- [756456] Low CVE-2017-15425: URL Spoof in Omnibox. Reported by xisigr of Tencent's Xuanwu Lab on 2017-08-17\n\n- [757735] Low CVE-2017-15426: URL Spoof in Omnibox. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-08-18\n\n- [768910] Low CVE-2017-15427: Insufficient blocking of JavaScript in Omnibox. Reported by Junaid Farhan on 2017-09-26\n\n- [792099] Various fixes from internal audits, fuzzing and other initiatives", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-01-23T00:00:00", "type": "nessus", "title": "FreeBSD : chromium -- multiple vulnerabilities (1d951e85-ffdb-11e7-8b91-e8e0b747a45a)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15407", "CVE-2017-15408", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15413", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15417", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15420", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426", "CVE-2017-15427", "CVE-2017-15430"], "modified": "2019-07-10T00:00:00", "cpe": ["p-cpe:/a:freebsd:freebsd:chromium", "cpe:/o:freebsd:freebsd"], "id": "FREEBSD_PKG_1D951E85FFDB11E78B91E8E0B747A45A.NASL", "href": "https://www.tenable.com/plugins/nessus/106236", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the FreeBSD VuXML database :\n#\n# Copyright 2003-2019 Jacques Vidrine and contributors\n#\n# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,\n# HTML, PDF, PostScript, RTF and so forth) with or without modification,\n# are permitted provided that the following conditions are met:\n# 1. Redistributions of source code (VuXML) must retain the above\n# copyright notice, this list of conditions and the following\n# disclaimer as the first lines of this file unmodified.\n# 2. Redistributions in compiled form (transformed to other DTDs,\n# published online in any format, converted to PDF, PostScript,\n# RTF and other formats) must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer\n# in the documentation and/or other materials provided with the\n# distribution.\n# \n# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \"AS IS\"\n# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,\n# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS\n# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,\n# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\n# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\n# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\n# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,\n# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(106236);\n script_version(\"3.6\");\n script_cvs_date(\"Date: 2019/07/10 16:04:13\");\n\n script_cve_id(\"CVE-2017-15407\", \"CVE-2017-15408\", \"CVE-2017-15409\", \"CVE-2017-15410\", \"CVE-2017-15411\", \"CVE-2017-15412\", \"CVE-2017-15413\", \"CVE-2017-15415\", \"CVE-2017-15416\", \"CVE-2017-15417\", \"CVE-2017-15418\", \"CVE-2017-15419\", \"CVE-2017-15420\", \"CVE-2017-15422\", \"CVE-2017-15423\", \"CVE-2017-15424\", \"CVE-2017-15425\", \"CVE-2017-15426\", \"CVE-2017-15427\", \"CVE-2017-15430\");\n\n script_name(english:\"FreeBSD : chromium -- multiple vulnerabilities (1d951e85-ffdb-11e7-8b91-e8e0b747a45a)\");\n script_summary(english:\"Checks for updated package in pkg_info output\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote FreeBSD host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Google Chrome Releases reports :\n\n37 security fixes in this release, including :\n\n- [778505] Critical CVE-2017-15407: Out of bounds write in QUIC.\nReported by Ned Williamson on 2017-10-26\n\n- [762374] High CVE-2017-15408: Heap buffer overflow in PDFium.\nReported by Ke Liu of Tencent's Xuanwu LAB on 2017-09-06\n\n- [763972] High CVE-2017-15409: Out of bounds write in Skia. Reported\nby Anonymous on 2017-09-11\n\n- [765921] High CVE-2017-15410: Use after free in PDFium. Reported by\nLuat Nguyen of KeenLab, Tencent on 2017-09-16\n\n- [770148] High CVE-2017-15411: Use after free in PDFium. Reported by\nLuat Nguyen of KeenLab, Tencent on 2017-09-29\n\n- [727039] High CVE-2017-15412: Use after free in libXML. Reported by\nNick Wellnhofer on 2017-05-27\n\n- [766666] High CVE-2017-15413: Type confusion in WebAssembly.\nReported by Gaurav Dewan of Adobe Systems India Pvt. Ltd. on\n2017-09-19\n\n- [765512] Medium CVE-2017-15415: Pointer information disclosure in\nIPC call. Reported by Viktor Brange of Microsoft Offensive Security\nResearch Team on 2017-09-15\n\n- [779314] Medium CVE-2017-15416: Out of bounds read in Blink.\nReported by Ned Williamson on 2017-10-28\n\n- [699028] Medium CVE-2017-15417: Cross origin information disclosure\nin Skia. Reported by Max May on 2017-03-07\n\n- [765858] Medium CVE-2017-15418: Use of uninitialized value in Skia.\nReported by Kushal Arvind Shah of Fortinet's FortiGuard Labs on\n2017-09-15\n\n- [780312] Medium CVE-2017-15419: Cross origin leak of redirect URL in\nBlink. Reported by Jun Kokatsu on 2017-10-31\n\n- [777419] Medium CVE-2017-15420: URL spoofing in Omnibox. Reported by\nWenXu Wu of Tencent's Xuanwu Lab on 2017-10-23\n\n- [774382] Medium CVE-2017-15422: Integer overflow in ICU. Reported by\nYuan Deng of Ant-financial Light-Year Security Lab on 2017-10-13\n\n- [780484] Medium CVE-2017-15430: Unsafe navigation in Chromecast\nPlugin. Reported by jinmo123 on 2017-01-11\n\n- [778101] Low CVE-2017-15423: Issue with SPAKE implementation in\nBoringSSL. Reported by Greg Hudson on 2017-10-25\n\n- [756226] Low CVE-2017-15424: URL Spoof in Omnibox. Reported by\nKhalil Zhani on 2017-08-16\n\n- [756456] Low CVE-2017-15425: URL Spoof in Omnibox. Reported by\nxisigr of Tencent's Xuanwu Lab on 2017-08-17\n\n- [757735] Low CVE-2017-15426: URL Spoof in Omnibox. Reported by WenXu\nWu of Tencent's Xuanwu Lab on 2017-08-18\n\n- [768910] Low CVE-2017-15427: Insufficient blocking of JavaScript in\nOmnibox. Reported by Junaid Farhan on 2017-09-26\n\n- [792099] Various fixes from internal audits, fuzzing and other\ninitiatives\"\n );\n # https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?98a7b4bd\"\n );\n # https://vuxml.freebsd.org/freebsd/1d951e85-ffdb-11e7-8b91-e8e0b747a45a.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?5706b5c2\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:chromium\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:freebsd:freebsd\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/12/06\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/01/23\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/01/23\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"FreeBSD Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/FreeBSD/release\", \"Host/FreeBSD/pkg_info\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"freebsd_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/FreeBSD/release\")) audit(AUDIT_OS_NOT, \"FreeBSD\");\nif (!get_kb_item(\"Host/FreeBSD/pkg_info\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (pkg_test(save_report:TRUE, pkg:\"chromium<63.0.3239.84\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-01-11T14:41:58", "description": "The version of Google Chrome installed on the remote macOS or Mac OS X host is prior to 63.0.3239.84. It is, therefore, affected by multiple vulnerabilities as noted in Chrome stable channel update release notes for Wednesday, December 6, 2017. Please refer to the release notes for additional information.\n\nNote that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2017-12-11T00:00:00", "type": "nessus", "title": "Google Chrome < 63.0.3239.84 Multiple Vulnerabilities (macOS)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15407", "CVE-2017-15408", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15413", "CVE-2017-15414", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15417", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15420", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426", "CVE-2017-15427"], "modified": "2019-11-12T00:00:00", "cpe": ["cpe:/a:google:chrome"], "id": "MACOSX_GOOGLE_CHROME_63_0_3239_84.NASL", "href": "https://www.tenable.com/plugins/nessus/105153", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(105153);\n script_version(\"1.7\");\n script_cvs_date(\"Date: 2019/11/12\");\n\n script_cve_id(\n \"CVE-2017-15407\",\n \"CVE-2017-15408\",\n \"CVE-2017-15409\",\n \"CVE-2017-15410\",\n \"CVE-2017-15411\",\n \"CVE-2017-15412\",\n \"CVE-2017-15413\",\n \"CVE-2017-15414\",\n \"CVE-2017-15415\",\n \"CVE-2017-15416\",\n \"CVE-2017-15417\",\n \"CVE-2017-15418\",\n \"CVE-2017-15419\",\n \"CVE-2017-15420\",\n \"CVE-2017-15422\",\n \"CVE-2017-15423\",\n \"CVE-2017-15424\",\n \"CVE-2017-15425\",\n \"CVE-2017-15426\",\n \"CVE-2017-15427\"\n );\n\n script_name(english:\"Google Chrome < 63.0.3239.84 Multiple Vulnerabilities (macOS)\");\n script_summary(english:\"Checks the version of Google Chrome.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"A web browser installed on the remote macOS or Mac OS X host is\naffected by multiple unspecified vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of Google Chrome installed on the remote macOS or Mac OS X\nhost is prior to 63.0.3239.84. It is, therefore, affected by multiple\nvulnerabilities as noted in Chrome stable channel update release notes\nfor Wednesday, December 6, 2017. Please refer to the release notes for\nadditional information.\n\nNote that Nessus has not attempted to exploit these issues but has\ninstead relied only on the application's self-reported version number.\");\n # https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?98a7b4bd\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to Google Chrome version 63.0.3239.84 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2017-15413\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/12/06\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/12/06\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/12/11\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:google:chrome\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"MacOS X Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"macosx_google_chrome_installed.nbin\");\n script_require_keys(\"MacOSX/Google Chrome/Installed\");\n\n exit(0);\n}\n\ninclude(\"google_chrome_version.inc\");\n\nget_kb_item_or_exit(\"MacOSX/Google Chrome/Installed\");\n\ngoogle_chrome_check_version(fix:'63.0.3239.84', severity:SECURITY_WARNING);\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-01-11T14:41:58", "description": "The version of Google Chrome installed on the remote Windows host is prior to 63.0.3239.84. It is, therefore, affected by multiple vulnerabilities as noted in Chrome stable channel update release notes for Wednesday, December 6, 2017. Please refer to the release notes for additional information.\n\nNote that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2017-12-11T00:00:00", "type": "nessus", "title": "Google Chrome < 63.0.3239.84 Multiple Vulnerabilities", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15407", "CVE-2017-15408", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15413", "CVE-2017-15414", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15417", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15420", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426", "CVE-2017-15427"], "modified": "2022-04-11T00:00:00", "cpe": ["cpe:/a:google:chrome"], "id": "GOOGLE_CHROME_63_0_3239_84.NASL", "href": "https://www.tenable.com/plugins/nessus/105152", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(105152);\n script_version(\"1.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/04/11\");\n\n script_cve_id(\n \"CVE-2017-15407\",\n \"CVE-2017-15408\",\n \"CVE-2017-15409\",\n \"CVE-2017-15410\",\n \"CVE-2017-15411\",\n \"CVE-2017-15412\",\n \"CVE-2017-15413\",\n \"CVE-2017-15414\",\n \"CVE-2017-15415\",\n \"CVE-2017-15416\",\n \"CVE-2017-15417\",\n \"CVE-2017-15418\",\n \"CVE-2017-15419\",\n \"CVE-2017-15420\",\n \"CVE-2017-15422\",\n \"CVE-2017-15423\",\n \"CVE-2017-15424\",\n \"CVE-2017-15425\",\n \"CVE-2017-15426\",\n \"CVE-2017-15427\"\n );\n\n script_name(english:\"Google Chrome < 63.0.3239.84 Multiple Vulnerabilities\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"A web browser installed on the remote Windows host is affected by\nmultiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of Google Chrome installed on the remote Windows host is\nprior to 63.0.3239.84. It is, therefore, affected by multiple\nvulnerabilities as noted in Chrome stable channel update release\nnotes for Wednesday, December 6, 2017. Please refer to the release\nnotes for additional information.\n\nNote that Nessus has not attempted to exploit these issues but has\ninstead relied only on the application's self-reported version number.\");\n # https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?98a7b4bd\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to Google Chrome version 63.0.3239.84 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2017-15413\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/12/06\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/12/06\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/12/11\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:google:chrome\");\n script_set_attribute(attribute:\"thorough_tests\", value:\"true\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows\");\n\n script_copyright(english:\"This script is Copyright (C) 2017-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"google_chrome_installed.nasl\");\n script_require_keys(\"SMB/Google_Chrome/Installed\");\n\n exit(0);\n}\n\ninclude(\"google_chrome_version.inc\");\n\nget_kb_item_or_exit(\"SMB/Google_Chrome/Installed\");\ninstalls = get_kb_list(\"SMB/Google_Chrome/*\");\n\ngoogle_chrome_check_version(installs:installs, fix:'63.0.3239.84', severity:SECURITY_WARNING);\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-01-11T14:37:03", "description": "The remote host is affected by the vulnerability described in GLSA-201801-03 (Chromium, Google Chrome: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been discovered in Chromium and Google Chrome. Please review the CVE identifiers referenced below for details.\n Impact :\n\n A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, bypass content security controls, or conduct URL spoofing.\n Workaround :\n\n There are no known workarounds at this time.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-01-08T00:00:00", "type": "nessus", "title": "GLSA-201801-03 : Chromium, Google Chrome: Multiple vulnerabilities", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15407", "CVE-2017-15408", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15413", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15417", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15420", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426", "CVE-2017-15427", "CVE-2017-15429"], "modified": "2018-10-25T00:00:00", "cpe": ["p-cpe:/a:gentoo:linux:chromium", "p-cpe:/a:gentoo:linux:google-chrome", "cpe:/o:gentoo:linux"], "id": "GENTOO_GLSA-201801-03.NASL", "href": "https://www.tenable.com/plugins/nessus/105629", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Gentoo Linux Security Advisory GLSA 201801-03.\n#\n# The advisory text is Copyright (C) 2001-2018 Gentoo Foundation, Inc.\n# and licensed under the Creative Commons - Attribution / Share Alike \n# license. See http://creativecommons.org/licenses/by-sa/3.0/\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(105629);\n script_version(\"3.6\");\n script_cvs_date(\"Date: 2018/10/25 11:32:02\");\n\n script_cve_id(\"CVE-2017-15407\", \"CVE-2017-15408\", \"CVE-2017-15409\", \"CVE-2017-15410\", \"CVE-2017-15411\", \"CVE-2017-15412\", \"CVE-2017-15413\", \"CVE-2017-15415\", \"CVE-2017-15416\", \"CVE-2017-15417\", \"CVE-2017-15418\", \"CVE-2017-15419\", \"CVE-2017-15420\", \"CVE-2017-15422\", \"CVE-2017-15423\", \"CVE-2017-15424\", \"CVE-2017-15425\", \"CVE-2017-15426\", \"CVE-2017-15427\", \"CVE-2017-15429\");\n script_xref(name:\"GLSA\", value:\"201801-03\");\n\n script_name(english:\"GLSA-201801-03 : Chromium, Google Chrome: Multiple vulnerabilities\");\n script_summary(english:\"Checks for updated package(s) in /var/db/pkg\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Gentoo host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote host is affected by the vulnerability described in GLSA-201801-03\n(Chromium, Google Chrome: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been discovered in Chromium and Google\n Chrome. Please review the CVE identifiers referenced below for details.\n \nImpact :\n\n A remote attacker could possibly execute arbitrary code with the\n privileges of the process, cause a Denial of Service condition, bypass\n content security controls, or conduct URL spoofing.\n \nWorkaround :\n\n There are no known workarounds at this time.\"\n );\n # https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?98a7b4bd\"\n );\n # https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop_14.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?125c6f30\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security.gentoo.org/glsa/201801-03\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"All Chromium users should upgrade to the latest version:\n # emerge --sync\n # emerge --ask --oneshot --verbose\n '>=www-client/chromium-63.0.3239.108'\n All Google Chrome users should upgrade to the latest version:\n # emerge --sync\n # emerge --ask --oneshot --verbose\n '>=www-client/google-chrome-63.0.3239.108'\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:chromium\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:google-chrome\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:gentoo:linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/01/07\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/01/08\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Gentoo Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Gentoo/release\", \"Host/Gentoo/qpkg-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"qpkg.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Gentoo/release\")) audit(AUDIT_OS_NOT, \"Gentoo\");\nif (!get_kb_item(\"Host/Gentoo/qpkg-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (qpkg_check(package:\"www-client/chromium\", unaffected:make_list(\"ge 63.0.3239.108\"), vulnerable:make_list(\"lt 63.0.3239.108\"))) flag++;\nif (qpkg_check(package:\"www-client/google-chrome\", unaffected:make_list(\"ge 63.0.3239.108\"), vulnerable:make_list(\"lt 63.0.3239.108\"))) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:qpkg_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = qpkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"Chromium / Google Chrome\");\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-01-11T14:42:31", "description": "Google Chrome Releases reports :\n\n45 security fixes in this release :\n\n- [758848] High CVE-2017-11215: Use after free in Flash. Reported by JieZeng of Tencent Zhanlu Lab on 2017-08-25\n\n- [758863] High CVE-2017-11225: Use after free in Flash. Reported by JieZeng of Tencent Zhanlu Lab on 2017-08-25\n\n- [780919] High CVE-2018-6060: Use after free in Blink. Reported by Omair on 2017-11-02\n\n- [794091] High CVE-2018-6061: Race condition in V8. Reported by Guang Gong of Alpha Team, Qihoo 360 on 2017-12-12\n\n- [780104] High CVE-2018-6062: Heap buffer overflow in Skia. Reported by Anonymous on 2017-10-31\n\n- [789959] High CVE-2018-6057: Incorrect permissions on shared memory.\nReported by Gal Beniamini of Google Project Zero on 2017-11-30\n\n- [792900] High CVE-2018-6063: Incorrect permissions on shared memory.\nReported by Gal Beniamini of Google Project Zero on 2017-12-07\n\n- [798644] High CVE-2018-6064: Type confusion in V8. Reported by lokihardt of Google Project Zero on 2018-01-03\n\n- [808192] High CVE-2018-6065: Integer overflow in V8. Reported by Mark Brand of Google Project Zero on 2018-02-01\n\n- [799477] Medium CVE-2018-6066: Same Origin Bypass via canvas.\nReported by Masato Kinugawa on 2018-01-05\n\n- [779428] Medium CVE-2018-6067: Buffer overflow in Skia. Reported by Ned Williamson on 2017-10-30\n\n- [779428] Medium CVE-2018-6067: Buffer overflow in Skia. Reported by Ned Williamson on 2017-10-30\n\n- [799918] Medium CVE-2018-6069: Stack buffer overflow in Skia.\nReported by Wanglu and Yangkang(@dnpushme) of Qihoo360 Qex Team on 2018-01-08\n\n- [668645] Medium CVE-2018-6070: CSP bypass through extensions.\nReported by Rob Wu on 2016-11-25\n\n- [777318] Medium CVE-2018-6071: Heap bufffer overflow in Skia.\nReported by Anonymous on 2017-10-23\n\n- [791048] Medium CVE-2018-6072: Integer overflow in PDFium. Reported by Atte Kettunen of OUSPG on 2017-12-01\n\n- [804118] Medium CVE-2018-6073: Heap bufffer overflow in WebGL.\nReported by Omair on 2018-01-20\n\n- [809759] Medium CVE-2018-6074: Mark-of-the-Web bypass. Reported by Abdulrahman Alqabandi (@qab) on 2018-02-06\n\n- [608669] Medium CVE-2018-6075: Overly permissive cross origin downloads. Reported by Inti De Ceukelaire (intigriti.com) on 2016-05-03\n\n- [758523] Medium CVE-2018-6076: Incorrect handling of URL fragment identifiers in Blink. Reported by Mateusz Krzeszowiec on 2017-08-24\n\n- [778506] Medium CVE-2018-6077: Timing attack using SVG filters.\nReported by Khalil Zhani on 2017-10-26\n\n- [793628] Medium CVE-2018-6078: URL Spoof in OmniBox. Reported by Khalil Zhani on 2017-12-10\n\n- [788448] Medium CVE-2018-6079: Information disclosure via texture data in WebGL. Reported by Ivars Atteka on 2017-11-24\n\n- [792028] Medium CVE-2018-6080: Information disclosure in IPC call.\nReported by Gal Beniamini of Google Project Zero on 2017-12-05\n\n- [797525] Low CVE-2018-6081: XSS in interstitials. Reported by Rob Wu on 2017-12-24\n\n- [767354] Low CVE-2018-6082: Circumvention of port blocking. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-09-21\n\n- [771709] Low CVE-2018-6083: Incorrect processing of AppManifests.\nReported by Jun Kokatsu (@shhnjk) on 2017-10-04", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2018-03-09T00:00:00", "type": "nessus", "title": "FreeBSD : chromium -- vulnerability (555af074-22b9-11e8-9799-54ee754af08e)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": true, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-11215", "CVE-2017-11225", "CVE-2018-6057", "CVE-2018-6060", "CVE-2018-6061", "CVE-2018-6062", "CVE-2018-6063", "CVE-2018-6064", "CVE-2018-6065", "CVE-2018-6066", "CVE-2018-6067", "CVE-2018-6069", "CVE-2018-6070", "CVE-2018-6071", "CVE-2018-6072", "CVE-2018-6073", "CVE-2018-6074", "CVE-2018-6075", "CVE-2018-6076", "CVE-2018-6077", "CVE-2018-6078", "CVE-2018-6079", "CVE-2018-6080", "CVE-2018-6081", "CVE-2018-6082", "CVE-2018-6083"], "modified": "2022-06-09T00:00:00", "cpe": ["p-cpe:/a:freebsd:freebsd:chromium", "cpe:/o:freebsd:freebsd"], "id": "FREEBSD_PKG_555AF07422B911E8979954EE754AF08E.NASL", "href": "https://www.tenable.com/plugins/nessus/107243", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the FreeBSD VuXML database :\n#\n# Copyright 2003-2022 Jacques Vidrine and contributors\n#\n# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,\n# HTML, PDF, PostScript, RTF and so forth) with or without modification,\n# are permitted provided that the following conditions are met:\n# 1. Redistributions of source code (VuXML) must retain the above\n# copyright notice, this list of conditions and the following\n# disclaimer as the first lines of this file unmodified.\n# 2. Redistributions in compiled form (transformed to other DTDs,\n# published online in any format, converted to PDF, PostScript,\n# RTF and other formats) must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer\n# in the documentation and/or other materials provided with the\n# distribution.\n# \n# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \"AS IS\"\n# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,\n# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS\n# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,\n# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\n# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\n# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\n# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,\n# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(107243);\n script_version(\"1.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/06/09\");\n\n script_cve_id(\"CVE-2017-11215\", \"CVE-2017-11225\", \"CVE-2018-6057\", \"CVE-2018-6060\", \"CVE-2018-6061\", \"CVE-2018-6062\", \"CVE-2018-6063\", \"CVE-2018-6064\", \"CVE-2018-6065\", \"CVE-2018-6066\", \"CVE-2018-6067\", \"CVE-2018-6069\", \"CVE-2018-6070\", \"CVE-2018-6071\", \"CVE-2018-6072\", \"CVE-2018-6073\", \"CVE-2018-6074\", \"CVE-2018-6075\", \"CVE-2018-6076\", \"CVE-2018-6077\", \"CVE-2018-6078\", \"CVE-2018-6079\", \"CVE-2018-6080\", \"CVE-2018-6081\", \"CVE-2018-6082\", \"CVE-2018-6083\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/06/22\");\n\n script_name(english:\"FreeBSD : chromium -- vulnerability (555af074-22b9-11e8-9799-54ee754af08e)\");\n script_summary(english:\"Checks for updated package in pkg_info output\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote FreeBSD host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"Google Chrome Releases reports :\n\n45 security fixes in this release :\n\n- [758848] High CVE-2017-11215: Use after free in Flash. Reported by\nJieZeng of Tencent Zhanlu Lab on 2017-08-25\n\n- [758863] High CVE-2017-11225: Use after free in Flash. Reported by\nJieZeng of Tencent Zhanlu Lab on 2017-08-25\n\n- [780919] High CVE-2018-6060: Use after free in Blink. Reported by\nOmair on 2017-11-02\n\n- [794091] High CVE-2018-6061: Race condition in V8. Reported by Guang\nGong of Alpha Team, Qihoo 360 on 2017-12-12\n\n- [780104] High CVE-2018-6062: Heap buffer overflow in Skia. Reported\nby Anonymous on 2017-10-31\n\n- [789959] High CVE-2018-6057: Incorrect permissions on shared memory.\nReported by Gal Beniamini of Google Project Zero on 2017-11-30\n\n- [792900] High CVE-2018-6063: Incorrect permissions on shared memory.\nReported by Gal Beniamini of Google Project Zero on 2017-12-07\n\n- [798644] High CVE-2018-6064: Type confusion in V8. Reported by\nlokihardt of Google Project Zero on 2018-01-03\n\n- [808192] High CVE-2018-6065: Integer overflow in V8. Reported by\nMark Brand of Google Project Zero on 2018-02-01\n\n- [799477] Medium CVE-2018-6066: Same Origin Bypass via canvas.\nReported by Masato Kinugawa on 2018-01-05\n\n- [779428] Medium CVE-2018-6067: Buffer overflow in Skia. Reported by\nNed Williamson on 2017-10-30\n\n- [779428] Medium CVE-2018-6067: Buffer overflow in Skia. Reported by\nNed Williamson on 2017-10-30\n\n- [799918] Medium CVE-2018-6069: Stack buffer overflow in Skia.\nReported by Wanglu and Yangkang(@dnpushme) of Qihoo360 Qex Team on\n2018-01-08\n\n- [668645] Medium CVE-2018-6070: CSP bypass through extensions.\nReported by Rob Wu on 2016-11-25\n\n- [777318] Medium CVE-2018-6071: Heap bufffer overflow in Skia.\nReported by Anonymous on 2017-10-23\n\n- [791048] Medium CVE-2018-6072: Integer overflow in PDFium. Reported\nby Atte Kettunen of OUSPG on 2017-12-01\n\n- [804118] Medium CVE-2018-6073: Heap bufffer overflow in WebGL.\nReported by Omair on 2018-01-20\n\n- [809759] Medium CVE-2018-6074: Mark-of-the-Web bypass. Reported by\nAbdulrahman Alqabandi (@qab) on 2018-02-06\n\n- [608669] Medium CVE-2018-6075: Overly permissive cross origin\ndownloads. Reported by Inti De Ceukelaire (intigriti.com) on\n2016-05-03\n\n- [758523] Medium CVE-2018-6076: Incorrect handling of URL fragment\nidentifiers in Blink. Reported by Mateusz Krzeszowiec on 2017-08-24\n\n- [778506] Medium CVE-2018-6077: Timing attack using SVG filters.\nReported by Khalil Zhani on 2017-10-26\n\n- [793628] Medium CVE-2018-6078: URL Spoof in OmniBox. Reported by\nKhalil Zhani on 2017-12-10\n\n- [788448] Medium CVE-2018-6079: Information disclosure via texture\ndata in WebGL. Reported by Ivars Atteka on 2017-11-24\n\n- [792028] Medium CVE-2018-6080: Information disclosure in IPC call.\nReported by Gal Beniamini of Google Project Zero on 2017-12-05\n\n- [797525] Low CVE-2018-6081: XSS in interstitials. Reported by Rob Wu\non 2017-12-24\n\n- [767354] Low CVE-2018-6082: Circumvention of port blocking. Reported\nby WenXu Wu of Tencent's Xuanwu Lab on 2017-09-21\n\n- [771709] Low CVE-2018-6083: Incorrect processing of AppManifests.\nReported by Jun Kokatsu (@shhnjk) on 2017-10-04\"\n );\n # https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?68129919\"\n );\n # https://vuxml.freebsd.org/freebsd/555af074-22b9-11e8-9799-54ee754af08e.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?d451c55d\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2017-11225\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:chromium\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:freebsd:freebsd\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/05/03\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/03/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/03/09\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"FreeBSD Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/FreeBSD/release\", \"Host/FreeBSD/pkg_info\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"freebsd_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/FreeBSD/release\")) audit(AUDIT_OS_NOT, \"FreeBSD\");\nif (!get_kb_item(\"Host/FreeBSD/pkg_info\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (pkg_test(save_report:TRUE, pkg:\"chromium<65.0.3325.146\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:pkg_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T14:43:22", "description": "The version of Google Chrome installed on the remote host is prior to 65.0.3325.146. It is, therefore, affected by multiple unspecified vulnerabilities as noted in Chrome stable channel update release notes for March 6th, 2018. Please refer to the release notes for additional information.\n\nNote that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2018-03-08T00:00:00", "type": "nessus", "title": "Google Chrome < 65.0.3325.146 Multiple Vulnerabilities (macOS)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": true, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-11215", "CVE-2017-11225", "CVE-2018-6057", "CVE-2018-6060", "CVE-2018-6061", "CVE-2018-6062", "CVE-2018-6063", "CVE-2018-6064", "CVE-2018-6065", "CVE-2018-6066", "CVE-2018-6067", "CVE-2018-6068", "CVE-2018-6069", "CVE-2018-6070", "CVE-2018-6071", "CVE-2018-6072", "CVE-2018-6073", "CVE-2018-6074", "CVE-2018-6075", "CVE-2018-6076", "CVE-2018-6077", "CVE-2018-6078", "CVE-2018-6079", "CVE-2018-6080", "CVE-2018-6081", "CVE-2018-6082", "CVE-2018-6083"], "modified": "2022-06-08T00:00:00", "cpe": ["cpe:/a:google:chrome"], "id": "MACOSX_GOOGLE_CHROME_65_0_3325_107.NASL", "href": "https://www.tenable.com/plugins/nessus/107221", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(107221);\n script_version(\"1.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/06/08\");\n\n script_cve_id(\n \"CVE-2017-11215\",\n \"CVE-2017-11225\",\n \"CVE-2018-6057\",\n \"CVE-2018-6060\",\n \"CVE-2018-6061\",\n \"CVE-2018-6062\",\n \"CVE-2018-6063\",\n \"CVE-2018-6064\",\n \"CVE-2018-6065\",\n \"CVE-2018-6066\",\n \"CVE-2018-6067\",\n \"CVE-2018-6068\",\n \"CVE-2018-6069\",\n \"CVE-2018-6070\",\n \"CVE-2018-6071\",\n \"CVE-2018-6072\",\n \"CVE-2018-6073\",\n \"CVE-2018-6074\",\n \"CVE-2018-6075\",\n \"CVE-2018-6076\",\n \"CVE-2018-6077\",\n \"CVE-2018-6078\",\n \"CVE-2018-6079\",\n \"CVE-2018-6080\",\n \"CVE-2018-6081\",\n \"CVE-2018-6082\",\n \"CVE-2018-6083\"\n );\n script_bugtraq_id(101837);\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/06/22\");\n\n script_name(english:\"Google Chrome < 65.0.3325.146 Multiple Vulnerabilities (macOS)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"A web browser installed on the remote host is affected by\nmultiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of Google Chrome installed on the remote host is prior\nto 65.0.3325.146. It is, therefore, affected by multiple unspecified\nvulnerabilities as noted in Chrome stable channel update release notes\nfor March 6th, 2018. Please refer to the release notes for additional\ninformation.\n\nNote that Nessus has not attempted to exploit these issues but has\ninstead relied only on the application's self-reported version number.\");\n # https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?68129919\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to Google Chrome version 65.0.3325.146 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2017-11225\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/03/06\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/03/06\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/03/08\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:google:chrome\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"MacOS X Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2018-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"macosx_google_chrome_installed.nbin\");\n script_require_keys(\"MacOSX/Google Chrome/Installed\");\n\n exit(0);\n}\n\ninclude(\"google_chrome_version.inc\");\n\nget_kb_item_or_exit(\"MacOSX/Google Chrome/Installed\");\n\ngoogle_chrome_check_version(fix:'65.0.3325.146', severity:SECURITY_HOLE);\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T14:44:02", "description": "The version of Google Chrome installed on the remote Windows host is prior to 65.0.3325.146. It is, therefore, affected by a multiple unspecified vulnerabilities as noted in Chrome stable channel update release notes for March 6th, 2018. Please refer to the release notes for additional information.\n\nNote that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2018-03-08T00:00:00", "type": "nessus", "title": "Google Chrome < 65.0.3325.146 Multiple Vulnerabilities", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": true, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-11215", "CVE-2017-11225", "CVE-2018-6057", "CVE-2018-6060", "CVE-2018-6061", "CVE-2018-6062", "CVE-2018-6063", "CVE-2018-6064", "CVE-2018-6065", "CVE-2018-6066", "CVE-2018-6067", "CVE-2018-6068", "CVE-2018-6069", "CVE-2018-6070", "CVE-2018-6071", "CVE-2018-6072", "CVE-2018-6073", "CVE-2018-6074", "CVE-2018-6075", "CVE-2018-6076", "CVE-2018-6077", "CVE-2018-6078", "CVE-2018-6079", "CVE-2018-6080", "CVE-2018-6081", "CVE-2018-6082", "CVE-2018-6083"], "modified": "2022-06-08T00:00:00", "cpe": ["cpe:/a:google:chrome"], "id": "GOOGLE_CHROME_65_0_3325_107.NASL", "href": "https://www.tenable.com/plugins/nessus/107220", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(107220);\n script_version(\"1.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/06/08\");\n\n script_cve_id(\n \"CVE-2017-11215\",\n \"CVE-2017-11225\",\n \"CVE-2018-6057\",\n \"CVE-2018-6060\",\n \"CVE-2018-6061\",\n \"CVE-2018-6062\",\n \"CVE-2018-6063\",\n \"CVE-2018-6064\",\n \"CVE-2018-6065\",\n \"CVE-2018-6066\",\n \"CVE-2018-6067\",\n \"CVE-2018-6068\",\n \"CVE-2018-6069\",\n \"CVE-2018-6070\",\n \"CVE-2018-6071\",\n \"CVE-2018-6072\",\n \"CVE-2018-6073\",\n \"CVE-2018-6074\",\n \"CVE-2018-6075\",\n \"CVE-2018-6076\",\n \"CVE-2018-6077\",\n \"CVE-2018-6078\",\n \"CVE-2018-6079\",\n \"CVE-2018-6080\",\n \"CVE-2018-6081\",\n \"CVE-2018-6082\",\n \"CVE-2018-6083\"\n );\n script_bugtraq_id(101837);\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/06/22\");\n\n script_name(english:\"Google Chrome < 65.0.3325.146 Multiple Vulnerabilities\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"A web browser installed on the remote Windows host is affected by\nmultiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of Google Chrome installed on the remote Windows host is\nprior to 65.0.3325.146. It is, therefore, affected by a multiple\nunspecified vulnerabilities as noted in Chrome stable channel update\nrelease notes for March 6th, 2018. Please refer to the release notes\nfor additional information.\n\nNote that Nessus has not attempted to exploit these issues but has\ninstead relied only on the application's self-reported version number.\");\n # https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?68129919\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to Google Chrome version 65.0.3325.146 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2017-11225\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/03/06\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/03/06\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/03/08\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:google:chrome\");\n script_set_attribute(attribute:\"thorough_tests\", value:\"true\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows\");\n\n script_copyright(english:\"This script is Copyright (C) 2018-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"google_chrome_installed.nasl\");\n script_require_keys(\"SMB/Google_Chrome/Installed\");\n\n exit(0);\n}\n\ninclude(\"google_chrome_version.inc\");\n\nget_kb_item_or_exit(\"SMB/Google_Chrome/Installed\");\ninstalls = get_kb_list(\"SMB/Google_Chrome/*\");\n\ngoogle_chrome_check_version(installs:installs, fix:'65.0.3325.146', severity:SECURITY_HOLE);\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T14:43:24", "description": "This update for Chromium to version 65.0.3325.162 fixes the following issues :\n\n - CVE-2017-11215: Use after free in Flash\n\n - CVE-2017-11225: Use after free in Flash\n\n - CVE-2018-6060: Use after free in Blink\n\n - CVE-2018-6061: Race condition in V8\n\n - CVE-2018-6062: Heap buffer overflow in Skia\n\n - CVE-2018-6057: Incorrect permissions on shared memory\n\n - CVE-2018-6063: Incorrect permissions on shared memory\n\n - CVE-2018-6064: Type confusion in V8\n\n - CVE-2018-6065: Integer overflow in V8\n\n - CVE-2018-6066: Same Origin Bypass via canvas\n\n - CVE-2018-6067: Buffer overflow in Skia\n\n - CVE-2018-6068: Object lifecycle issues in Chrome Custom Tab\n\n - CVE-2018-6069: Stack-based buffer overflow in Skia\n\n - CVE-2018-6070: CSP bypass through extensions\n\n - CVE-2018-6071: Heap bufffer overflow in Skia\n\n - CVE-2018-6072: Integer overflow in PDFium\n\n - CVE-2018-6073: Heap bufffer overflow in WebGL\n\n - CVE-2018-6074: Mark-of-the-Web bypass\n\n - CVE-2018-6075: Overly permissive cross origin downloads\n\n - CVE-2018-6076: Incorrect handling of URL fragment identifiers in Blink\n\n - CVE-2018-6077: Timing attack using SVG filters\n\n - CVE-2018-6078: URL Spoof in OmniBox\n\n - CVE-2018-6079: Information disclosure via texture data in WebGL\n\n - CVE-2018-6080: Information disclosure in IPC call\n\n - CVE-2018-6081: XSS in interstitials\n\n - CVE-2018-6082: Circumvention of port blocking\n\n - CVE-2018-6083: Incorrect processing of AppManifests", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2018-03-19T00:00:00", "type": "nessus", "title": "openSUSE Security Update : Chromium (openSUSE-2018-264)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": true, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-11215", "CVE-2017-11225", "CVE-2018-6057", "CVE-2018-6060", "CVE-2018-6061", "CVE-2018-6062", "CVE-2018-6063", "CVE-2018-6064", "CVE-2018-6065", "CVE-2018-6066", "CVE-2018-6067", "CVE-2018-6068", "CVE-2018-6069", "CVE-2018-6070", "CVE-2018-6071", "CVE-2018-6072", "CVE-2018-6073", "CVE-2018-6074", "CVE-2018-6075", "CVE-2018-6076", "CVE-2018-6077", "CVE-2018-6078", "CVE-2018-6079", "CVE-2018-6080", "CVE-2018-6081", "CVE-2018-6082", "CVE-2018-6083"], "modified": "2022-06-08T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:chromedriver", "p-cpe:/a:novell:opensuse:chromedriver-debuginfo", "p-cpe:/a:novell:opensuse:chromium", "p-cpe:/a:novell:opensuse:chromium-debuginfo", "p-cpe:/a:novell:opensuse:chromium-debugsource", "cpe:/o:novell:opensuse:42.3"], "id": "OPENSUSE-2018-264.NASL", "href": "https://www.tenable.com/plugins/nessus/108436", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2018-264.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(108436);\n script_version(\"1.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/06/08\");\n\n script_cve_id(\n \"CVE-2017-11215\",\n \"CVE-2017-11225\",\n \"CVE-2018-6057\",\n \"CVE-2018-6060\",\n \"CVE-2018-6061\",\n \"CVE-2018-6062\",\n \"CVE-2018-6063\",\n \"CVE-2018-6064\",\n \"CVE-2018-6065\",\n \"CVE-2018-6066\",\n \"CVE-2018-6067\",\n \"CVE-2018-6068\",\n \"CVE-2018-6069\",\n \"CVE-2018-6070\",\n \"CVE-2018-6071\",\n \"CVE-2018-6072\",\n \"CVE-2018-6073\",\n \"CVE-2018-6074\",\n \"CVE-2018-6075\",\n \"CVE-2018-6076\",\n \"CVE-2018-6077\",\n \"CVE-2018-6078\",\n \"CVE-2018-6079\",\n \"CVE-2018-6080\",\n \"CVE-2018-6081\",\n \"CVE-2018-6082\",\n \"CVE-2018-6083\"\n );\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/06/22\");\n\n script_name(english:\"openSUSE Security Update : Chromium (openSUSE-2018-264)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote openSUSE host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"This update for Chromium to version 65.0.3325.162 fixes the following\nissues :\n\n - CVE-2017-11215: Use after free in Flash\n\n - CVE-2017-11225: Use after free in Flash\n\n - CVE-2018-6060: Use after free in Blink\n\n - CVE-2018-6061: Race condition in V8\n\n - CVE-2018-6062: Heap buffer overflow in Skia\n\n - CVE-2018-6057: Incorrect permissions on shared memory\n\n - CVE-2018-6063: Incorrect permissions on shared memory\n\n - CVE-2018-6064: Type confusion in V8\n\n - CVE-2018-6065: Integer overflow in V8\n\n - CVE-2018-6066: Same Origin Bypass via canvas\n\n - CVE-2018-6067: Buffer overflow in Skia\n\n - CVE-2018-6068: Object lifecycle issues in Chrome Custom\n Tab\n\n - CVE-2018-6069: Stack-based buffer overflow in Skia\n\n - CVE-2018-6070: CSP bypass through extensions\n\n - CVE-2018-6071: Heap bufffer overflow in Skia\n\n - CVE-2018-6072: Integer overflow in PDFium\n\n - CVE-2018-6073: Heap bufffer overflow in WebGL\n\n - CVE-2018-6074: Mark-of-the-Web bypass\n\n - CVE-2018-6075: Overly permissive cross origin downloads\n\n - CVE-2018-6076: Incorrect handling of URL fragment\n identifiers in Blink\n\n - CVE-2018-6077: Timing attack using SVG filters\n\n - CVE-2018-6078: URL Spoof in OmniBox\n\n - CVE-2018-6079: Information disclosure via texture data\n in WebGL\n\n - CVE-2018-6080: Information disclosure in IPC call\n\n - CVE-2018-6081: XSS in interstitials\n\n - CVE-2018-6082: Circumvention of port blocking\n\n - CVE-2018-6083: Incorrect processing of AppManifests\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1084296\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected Chromium packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/03/16\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/03/19\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:chromedriver\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:chromedriver-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:chromium\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:chromium-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:chromium-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:42.3\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"SuSE Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2018-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE42\\.3)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"42.3\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(x86_64)$\") audit(AUDIT_ARCH_NOT, \"x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE42.3\", reference:\"chromedriver-65.0.3325.162-146.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"chromedriver-debuginfo-65.0.3325.162-146.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"chromium-65.0.3325.162-146.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"chromium-debuginfo-65.0.3325.162-146.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"chromium-debugsource-65.0.3325.162-146.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"chromedriver / chromedriver-debuginfo / chromium / etc\");\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T14:42:34", "description": "A QtWebEngine security update backporting security fixes from Chromium 65 (up to 65.0.3325.146). (The backports have been forward-ported from QtWebEngine 5.9.5 LTS.)\n\nThis update fixes the following security issues :\n\n - CVE-2017-15429\n\n - CVE-2018-6033 (claimed fixed in 5.10.1, but the fix was incomplete and had no effect; this update adds the missing part to make the fix effective)\n\n - CVE-2018-6060\n\n - CVE-2018-6062\n\n - CVE-2018-6064\n\n - CVE-2018-6069\n\n - CVE-2018-6071\n\n - CVE-2018-6073\n\n - CVE-2018-6076\n\n - CVE-2018-6079\n\n - CVE-2018-6081\n\n - CVE-2018-6082\n\n - Chromium (security) Bug 770734\n\n - Chromium (security) Bug 774833\n\n - Chromium (security) Bug 798410\n\n - Chromium (security) Bug 789764\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-03-27T00:00:00", "type": "nessus", "title": "Fedora 27 : qt5-qtwebengine (2018-44e1c23700)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15429", "CVE-2018-6033", "CVE-2018-6060", "CVE-2018-6062", "CVE-2018-6064", "CVE-2018-6069", "CVE-2018-6071", "CVE-2018-6073", "CVE-2018-6076", "CVE-2018-6079", "CVE-2018-6081", "CVE-2018-6082"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:qt5-qtwebengine", "cpe:/o:fedoraproject:fedora:27"], "id": "FEDORA_2018-44E1C23700.NASL", "href": "https://www.tenable.com/plugins/nessus/108616", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2018-44e1c23700.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(108616);\n script_version(\"1.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2017-15429\", \"CVE-2018-6033\", \"CVE-2018-6060\", \"CVE-2018-6062\", \"CVE-2018-6064\", \"CVE-2018-6069\", \"CVE-2018-6071\", \"CVE-2018-6073\", \"CVE-2018-6076\", \"CVE-2018-6079\", \"CVE-2018-6081\", \"CVE-2018-6082\");\n script_xref(name:\"FEDORA\", value:\"2018-44e1c23700\");\n\n script_name(english:\"Fedora 27 : qt5-qtwebengine (2018-44e1c23700)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"A QtWebEngine security update backporting security fixes from Chromium\n65 (up to 65.0.3325.146). (The backports have been forward-ported from\nQtWebEngine 5.9.5 LTS.)\n\nThis update fixes the following security issues :\n\n - CVE-2017-15429\n\n - CVE-2018-6033 (claimed fixed in 5.10.1, but the fix was\n incomplete and had no effect; this update adds the\n missing part to make the fix effective)\n\n - CVE-2018-6060\n\n - CVE-2018-6062\n\n - CVE-2018-6064\n\n - CVE-2018-6069\n\n - CVE-2018-6071\n\n - CVE-2018-6073\n\n - CVE-2018-6076\n\n - CVE-2018-6079\n\n - CVE-2018-6081\n\n - CVE-2018-6082\n\n - Chromium (security) Bug 770734\n\n - Chromium (security) Bug 774833\n\n - Chromium (security) Bug 798410\n\n - Chromium (security) Bug 789764\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2018-44e1c23700\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected qt5-qtwebengine package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:qt5-qtwebengine\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:27\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/08/28\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/03/25\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/03/27\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^27([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 27\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"FC27\", reference:\"qt5-qtwebengine-5.10.1-4.fc27\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"qt5-qtwebengine\");\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-01-11T14:47:34", "description": "A QtWebEngine security update backporting security fixes from Chromium 65 (up to 65.0.3325.146). (The backports have been forward-ported from QtWebEngine 5.9.5 LTS.)\n\nThis update fixes the following security issues :\n\n - CVE-2017-15429\n\n - CVE-2018-6033 (claimed fixed in 5.10.1, but the fix was incomplete and had no effect; this update adds the missing part to make the fix effective)\n\n - CVE-2018-6060\n\n - CVE-2018-6062\n\n - CVE-2018-6064\n\n - CVE-2018-6069\n\n - CVE-2018-6071\n\n - CVE-2018-6073\n\n - CVE-2018-6076\n\n - CVE-2018-6079\n\n - CVE-2018-6081\n\n - CVE-2018-6082\n\n - Chromium (security) Bug 770734\n\n - Chromium (security) Bug 774833\n\n - Chromium (security) Bug 798410\n\n - Chromium (security) Bug 789764\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-01-03T00:00:00", "type": "nessus", "title": "Fedora 28 : qt5-qtwebengine (2018-b844991a97)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15429", "CVE-2018-6033", "CVE-2018-6060", "CVE-2018-6062", "CVE-2018-6064", "CVE-2018-6069", "CVE-2018-6071", "CVE-2018-6073", "CVE-2018-6076", "CVE-2018-6079", "CVE-2018-6081", "CVE-2018-6082"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:qt5-qtwebengine", "cpe:/o:fedoraproject:fedora:28"], "id": "FEDORA_2018-B844991A97.NASL", "href": "https://www.tenable.com/plugins/nessus/120733", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2018-b844991a97.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(120733);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2017-15429\", \"CVE-2018-6033\", \"CVE-2018-6060\", \"CVE-2018-6062\", \"CVE-2018-6064\", \"CVE-2018-6069\", \"CVE-2018-6071\", \"CVE-2018-6073\", \"CVE-2018-6076\", \"CVE-2018-6079\", \"CVE-2018-6081\", \"CVE-2018-6082\");\n script_xref(name:\"FEDORA\", value:\"2018-b844991a97\");\n\n script_name(english:\"Fedora 28 : qt5-qtwebengine (2018-b844991a97)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"A QtWebEngine security update backporting security fixes from Chromium\n65 (up to 65.0.3325.146). (The backports have been forward-ported from\nQtWebEngine 5.9.5 LTS.)\n\nThis update fixes the following security issues :\n\n - CVE-2017-15429\n\n - CVE-2018-6033 (claimed fixed in 5.10.1, but the fix was\n incomplete and had no effect; this update adds the\n missing part to make the fix effective)\n\n - CVE-2018-6060\n\n - CVE-2018-6062\n\n - CVE-2018-6064\n\n - CVE-2018-6069\n\n - CVE-2018-6071\n\n - CVE-2018-6073\n\n - CVE-2018-6076\n\n - CVE-2018-6079\n\n - CVE-2018-6081\n\n - CVE-2018-6082\n\n - Chromium (security) Bug 770734\n\n - Chromium (security) Bug 774833\n\n - Chromium (security) Bug 798410\n\n - Chromium (security) Bug 789764\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2018-b844991a97\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected qt5-qtwebengine package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:qt5-qtwebengine\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:28\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/08/28\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/03/26\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/01/03\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^28([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 28\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"FC28\", reference:\"qt5-qtwebengine-5.10.1-4.fc28\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"qt5-qtwebengine\");\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-01-11T14:42:19", "description": "A QtWebEngine security update backporting security fixes from Chromium 65 (up to 65.0.3325.146). (The backports have been forward-ported from QtWebEngine 5.9.5 LTS.)\n\nThis update fixes the following security issues :\n\n - CVE-2017-15429\n\n - CVE-2018-6033 (claimed fixed in 5.10.1, but the fix was incomplete and had no effect; this update adds the missing part to make the fix effective)\n\n - CVE-2018-6060\n\n - CVE-2018-6062\n\n - CVE-2018-6064\n\n - CVE-2018-6069\n\n - CVE-2018-6071\n\n - CVE-2018-6073\n\n - CVE-2018-6076\n\n - CVE-2018-6079\n\n - CVE-2018-6081\n\n - CVE-2018-6082\n\n - Chromium (security) Bug 770734\n\n - Chromium (security) Bug 774833\n\n - Chromium (security) Bug 798410\n\n - Chromium (security) Bug 789764\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-03-27T00:00:00", "type": "nessus", "title": "Fedora 26 : qt5-qtwebengine (2018-024afa2d48)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15429", "CVE-2018-6033", "CVE-2018-6060", "CVE-2018-6062", "CVE-2018-6064", "CVE-2018-6069", "CVE-2018-6071", "CVE-2018-6073", "CVE-2018-6076", "CVE-2018-6079", "CVE-2018-6081", "CVE-2018-6082"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:qt5-qtwebengine", "cpe:/o:fedoraproject:fedora:26"], "id": "FEDORA_2018-024AFA2D48.NASL", "href": "https://www.tenable.com/plugins/nessus/108612", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2018-024afa2d48.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(108612);\n script_version(\"1.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2017-15429\", \"CVE-2018-6033\", \"CVE-2018-6060\", \"CVE-2018-6062\", \"CVE-2018-6064\", \"CVE-2018-6069\", \"CVE-2018-6071\", \"CVE-2018-6073\", \"CVE-2018-6076\", \"CVE-2018-6079\", \"CVE-2018-6081\", \"CVE-2018-6082\");\n script_xref(name:\"FEDORA\", value:\"2018-024afa2d48\");\n\n script_name(english:\"Fedora 26 : qt5-qtwebengine (2018-024afa2d48)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"A QtWebEngine security update backporting security fixes from Chromium\n65 (up to 65.0.3325.146). (The backports have been forward-ported from\nQtWebEngine 5.9.5 LTS.)\n\nThis update fixes the following security issues :\n\n - CVE-2017-15429\n\n - CVE-2018-6033 (claimed fixed in 5.10.1, but the fix was\n incomplete and had no effect; this update adds the\n missing part to make the fix effective)\n\n - CVE-2018-6060\n\n - CVE-2018-6062\n\n - CVE-2018-6064\n\n - CVE-2018-6069\n\n - CVE-2018-6071\n\n - CVE-2018-6073\n\n - CVE-2018-6076\n\n - CVE-2018-6079\n\n - CVE-2018-6081\n\n - CVE-2018-6082\n\n - Chromium (security) Bug 770734\n\n - Chromium (security) Bug 774833\n\n - Chromium (security) Bug 798410\n\n - Chromium (security) Bug 789764\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2018-024afa2d48\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected qt5-qtwebengine package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:qt5-qtwebengine\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:26\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/08/28\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/03/25\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/03/27\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^26([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 26\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"FC26\", reference:\"qt5-qtwebengine-5.10.1-4.fc26\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"qt5-qtwebengine\");\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-01-11T14:38:30", "description": "Security fix for CVE-2017-15412 CVE-2017-15422 CVE-2017-15407 CVE-2017-15408 CVE-2017-15409 CVE-2017-15410 CVE-2017-15411 CVE-2017-15413 CVE-2017-15415 CVE-2017-15416 CVE-2017-15417 CVE-2017-15418 CVE-2017-15419 CVE-2017-15420 CVE-2017-15423 CVE-2017-15424 CVE-2017-15425 CVE-2017-15426 CVE-2017-15427 CVE-2017-15429\n\n----\n\nSecurity fix for CVE-2017-15398, CVE-2017-15399\n\n----\n\nSecurity fix for CVE-2017-15386 CVE-2017-15387 CVE-2017-15388 CVE-2017-15389 CVE-2017-15390 CVE-2017-15391 CVE-2017-15392 CVE-2017-15393 CVE-2017-15394 CVE-2017-15395 CVE-2017-5124 CVE-2017-5125 CVE-2017-5126 CVE-2017-5127.\n\nBuild switched to use gtk3.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2018-01-02T00:00:00", "type": "nessus", "title": "Fedora 26 : chromium (2017-ea44f172e3)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15386", "CVE-2017-15387", "CVE-2017-15388", "CVE-2017-15389", "CVE-2017-15390", "CVE-2017-15391", "CVE-2017-15392", "CVE-2017-15393", "CVE-2017-15394", "CVE-2017-15395", "CVE-2017-15398", "CVE-2017-15399", "CVE-2017-15407", "CVE-2017-15408", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15413", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15417", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15420", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426", "CVE-2017-15427", "CVE-2017-15429", "CVE-2017-5124", "CVE-2017-5125", "CVE-2017-5126", "CVE-2017-5127", "CVE-2017-5128", "CVE-2017-5129", "CVE-2017-5130", "CVE-2017-5131", "CVE-2017-5132", "CVE-2017-5133"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:chromium", "cpe:/o:fedoraproject:fedora:26"], "id": "FEDORA_2017-EA44F172E3.NASL", "href": "https://www.tenable.com/plugins/nessus/105501", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2017-ea44f172e3.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(105501);\n script_version(\"3.13\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2017-15386\", \"CVE-2017-15387\", \"CVE-2017-15388\", \"CVE-2017-15389\", \"CVE-2017-15390\", \"CVE-2017-15391\", \"CVE-2017-15392\", \"CVE-2017-15393\", \"CVE-2017-15394\", \"CVE-2017-15395\", \"CVE-2017-15398\", \"CVE-2017-15399\", \"CVE-2017-15407\", \"CVE-2017-15408\", \"CVE-2017-15409\", \"CVE-2017-15410\", \"CVE-2017-15411\", \"CVE-2017-15412\", \"CVE-2017-15413\", \"CVE-2017-15415\", \"CVE-2017-15416\", \"CVE-2017-15417\", \"CVE-2017-15418\", \"CVE-2017-15419\", \"CVE-2017-15420\", \"CVE-2017-15422\", \"CVE-2017-15423\", \"CVE-2017-15424\", \"CVE-2017-15425\", \"CVE-2017-15426\", \"CVE-2017-15427\", \"CVE-2017-15429\", \"CVE-2017-5124\", \"CVE-2017-5125\", \"CVE-2017-5126\", \"CVE-2017-5127\", \"CVE-2017-5128\", \"CVE-2017-5129\", \"CVE-2017-5130\", \"CVE-2017-5131\", \"CVE-2017-5132\", \"CVE-2017-5133\");\n script_xref(name:\"FEDORA\", value:\"2017-ea44f172e3\");\n\n script_name(english:\"Fedora 26 : chromium (2017-ea44f172e3)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Security fix for CVE-2017-15412 CVE-2017-15422 CVE-2017-15407\nCVE-2017-15408 CVE-2017-15409 CVE-2017-15410 CVE-2017-15411\nCVE-2017-15413 CVE-2017-15415 CVE-2017-15416 CVE-2017-15417\nCVE-2017-15418 CVE-2017-15419 CVE-2017-15420 CVE-2017-15423\nCVE-2017-15424 CVE-2017-15425 CVE-2017-15426 CVE-2017-15427\nCVE-2017-15429\n\n----\n\nSecurity fix for CVE-2017-15398, CVE-2017-15399\n\n----\n\nSecurity fix for CVE-2017-15386 CVE-2017-15387 CVE-2017-15388\nCVE-2017-15389 CVE-2017-15390 CVE-2017-15391 CVE-2017-15392\nCVE-2017-15393 CVE-2017-15394 CVE-2017-15395 CVE-2017-5124\nCVE-2017-5125 CVE-2017-5126 CVE-2017-5127.\n\nBuild switched to use gtk3.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2017-ea44f172e3\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected chromium package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:chromium\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:26\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/02/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/01/01\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/01/02\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^26([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 26\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"FC26\", reference:\"chromium-63.0.3239.108-1.fc26\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"chromium\");\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-01-11T14:39:49", "description": "This update updates QtWebEngine to the 5.10.1 bugfix and security release. QtWebEngine 5.10.1 is part of the Qt 5.10.1 release, but only the QtWebEngine component is included in this update.\n\nThis update includes :\n\n - Security fixes from Chromium up to version 64.0.3282.140. Including: CVE-2017-15407, CVE-2017-15409, CVE-2017-15410, CVE-2017-15411, CVE-2017-15415, CVE-2017-15416, CVE-2017-15418, CVE-2017-15419, CVE-2017-15422, CVE-2017-15423, CVE-2017-15424, CVE-2017-15425, CVE-2017-15426, CVE-2018-6031, CVE-2018-6033, CVE-2018-6034, CVE-2018-6036, CVE-2018-6037, CVE-2018-6038, CVE-2018-6040, CVE-2018-6041, CVE-2018-6042, CVE-2018-6047, CVE-2018-6048, CVE-2018-6050, CVE-2018-6051, CVE-2018-6052, CVE-2018-6053 and CVE-2018-6054.\n\n - Mitigations for SPECTRE: disabled shared-buffers, added cryptographic noise to precision timers\n\n - [QTBUG-47206] Fixed incorrect layouting due to bug in HTML5 viewport support.\n\n - [QTBUG-47945, QTBUG-65647] Fixed random crashes on exit\n\n - [QTBUG-57206] Fixed regression in viewport handling in embedded mode\n\n - [QTBUG-58400] Improved memory usage when printing\n\n - [QTBUG-63867] Fixed <canvas> elements when compiled without OpenGL\n\n - [QTBUG-63266, QTBUG-64436] Fixed that pointerType of Pointer Events was empty\n\n - [QTBUG-63606] Improved runtime disabling and clearing of HTTP cache\n\n - [QTBUG-64436] QtWebEngineWidgets: Fixed crash when exiting fullscreen mode using the context menu.\n\n - [QTBUG-64560] Fixed rendering glitches after renderProcessTerminated signal was emitted.\n\n - [QTBUG-64812] Fixed message bubble position in Hi-DPI mode\n\n - [QTBUG-64869, QTBUG-65004] Added testing for 32-bit host compiler when crossbuilding to 32-bit platforms\n\n - [QTBUG-64933] QtWebEngineWidgets: Fixed tooltips that did still show after mouse was moved away.\n\n - [QTBUG-65239] Fixed hanging of process if application is closed too fast after startup.\n\n - [QTBUG-65715] Fixed double margins when printing\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-02-28T00:00:00", "type": "nessus", "title": "Fedora 26 : qt5-qtwebengine (2018-c0d3db441f)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15407", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426", "CVE-2018-6031", "CVE-2018-6033", "CVE-2018-6034", "CVE-2018-6036", "CVE-2018-6037", "CVE-2018-6038", "CVE-2018-6040", "CVE-2018-6041", "CVE-2018-6042", "CVE-2018-6047", "CVE-2018-6048", "CVE-2018-6050", "CVE-2018-6051", "CVE-2018-6052", "CVE-2018-6053", "CVE-2018-6054"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:qt5-qtwebengine", "cpe:/o:fedoraproject:fedora:26"], "id": "FEDORA_2018-C0D3DB441F.NASL", "href": "https://www.tenable.com/plugins/nessus/107035", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2018-c0d3db441f.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(107035);\n script_version(\"3.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2017-15407\", \"CVE-2017-15409\", \"CVE-2017-15410\", \"CVE-2017-15411\", \"CVE-2017-15415\", \"CVE-2017-15416\", \"CVE-2017-15418\", \"CVE-2017-15419\", \"CVE-2017-15422\", \"CVE-2017-15423\", \"CVE-2017-15424\", \"CVE-2017-15425\", \"CVE-2017-15426\", \"CVE-2018-6031\", \"CVE-2018-6033\", \"CVE-2018-6034\", \"CVE-2018-6036\", \"CVE-2018-6037\", \"CVE-2018-6038\", \"CVE-2018-6040\", \"CVE-2018-6041\", \"CVE-2018-6042\", \"CVE-2018-6047\", \"CVE-2018-6048\", \"CVE-2018-6050\", \"CVE-2018-6051\", \"CVE-2018-6052\", \"CVE-2018-6053\", \"CVE-2018-6054\");\n script_xref(name:\"FEDORA\", value:\"2018-c0d3db441f\");\n\n script_name(english:\"Fedora 26 : qt5-qtwebengine (2018-c0d3db441f)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update updates QtWebEngine to the 5.10.1 bugfix and security\nrelease. QtWebEngine 5.10.1 is part of the Qt 5.10.1 release, but only\nthe QtWebEngine component is included in this update.\n\nThis update includes :\n\n - Security fixes from Chromium up to version\n 64.0.3282.140. Including: CVE-2017-15407,\n CVE-2017-15409, CVE-2017-15410, CVE-2017-15411,\n CVE-2017-15415, CVE-2017-15416, CVE-2017-15418,\n CVE-2017-15419, CVE-2017-15422, CVE-2017-15423,\n CVE-2017-15424, CVE-2017-15425, CVE-2017-15426,\n CVE-2018-6031, CVE-2018-6033, CVE-2018-6034,\n CVE-2018-6036, CVE-2018-6037, CVE-2018-6038,\n CVE-2018-6040, CVE-2018-6041, CVE-2018-6042,\n CVE-2018-6047, CVE-2018-6048, CVE-2018-6050,\n CVE-2018-6051, CVE-2018-6052, CVE-2018-6053 and\n CVE-2018-6054.\n\n - Mitigations for SPECTRE: disabled shared-buffers, added\n cryptographic noise to precision timers\n\n - [QTBUG-47206] Fixed incorrect layouting due to bug in\n HTML5 viewport support.\n\n - [QTBUG-47945, QTBUG-65647] Fixed random crashes on exit\n\n - [QTBUG-57206] Fixed regression in viewport handling in\n embedded mode\n\n - [QTBUG-58400] Improved memory usage when printing\n\n - [QTBUG-63867] Fixed <canvas> elements when compiled\n without OpenGL\n\n - [QTBUG-63266, QTBUG-64436] Fixed that pointerType of\n Pointer Events was empty\n\n - [QTBUG-63606] Improved runtime disabling and clearing of\n HTTP cache\n\n - [QTBUG-64436] QtWebEngineWidgets: Fixed crash when\n exiting fullscreen mode using the context menu.\n\n - [QTBUG-64560] Fixed rendering glitches after\n renderProcessTerminated signal was emitted.\n\n - [QTBUG-64812] Fixed message bubble position in Hi-DPI\n mode\n\n - [QTBUG-64869, QTBUG-65004] Added testing for 32-bit host\n compiler when crossbuilding to 32-bit platforms\n\n - [QTBUG-64933] QtWebEngineWidgets: Fixed tooltips that\n did still show after mouse was moved away.\n\n - [QTBUG-65239] Fixed hanging of process if application is\n closed too fast after startup.\n\n - [QTBUG-65715] Fixed double margins when printing\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2018-c0d3db441f\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected qt5-qtwebengine package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:qt5-qtwebengine\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:26\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/08/28\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/02/27\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/02/28\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^26([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 26\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"FC26\", reference:\"qt5-qtwebengine-5.10.1-1.fc26\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"qt5-qtwebengine\");\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-01-11T14:39:37", "description": "This update updates QtWebEngine to the 5.10.1 bugfix and security release. QtWebEngine 5.10.1 is part of the Qt 5.10.1 release, but only the QtWebEngine component is included in this update.\n\nThis update includes :\n\n - Security fixes from Chromium up to version 64.0.3282.140. Including: CVE-2017-15407, CVE-2017-15409, CVE-2017-15410, CVE-2017-15411, CVE-2017-15415, CVE-2017-15416, CVE-2017-15418, CVE-2017-15419, CVE-2017-15422, CVE-2017-15423, CVE-2017-15424, CVE-2017-15425, CVE-2017-15426, CVE-2018-6031, CVE-2018-6033, CVE-2018-6034, CVE-2018-6036, CVE-2018-6037, CVE-2018-6038, CVE-2018-6040, CVE-2018-6041, CVE-2018-6042, CVE-2018-6047, CVE-2018-6048, CVE-2018-6050, CVE-2018-6051, CVE-2018-6052, CVE-2018-6053 and CVE-2018-6054.\n\n - Mitigations for SPECTRE: disabled shared-buffers, added cryptographic noise to precision timers\n\n - [QTBUG-47206] Fixed incorrect layouting due to bug in HTML5 viewport support.\n\n - [QTBUG-47945, QTBUG-65647] Fixed random crashes on exit\n\n - [QTBUG-57206] Fixed regression in viewport handling in embedded mode\n\n - [QTBUG-58400] Improved memory usage when printing\n\n - [QTBUG-63867] Fixed <canvas> elements when compiled without OpenGL\n\n - [QTBUG-63266, QTBUG-64436] Fixed that pointerType of Pointer Events was empty\n\n - [QTBUG-63606] Improved runtime disabling and clearing of HTTP cache\n\n - [QTBUG-64436] QtWebEngineWidgets: Fixed crash when exiting fullscreen mode using the context menu.\n\n - [QTBUG-64560] Fixed rendering glitches after renderProcessTerminated signal was emitted.\n\n - [QTBUG-64812] Fixed message bubble position in Hi-DPI mode\n\n - [QTBUG-64869, QTBUG-65004] Added testing for 32-bit host compiler when crossbuilding to 32-bit platforms\n\n - [QTBUG-64933] QtWebEngineWidgets: Fixed tooltips that did still show after mouse was moved away.\n\n - [QTBUG-65239] Fixed hanging of process if application is closed too fast after startup.\n\n - [QTBUG-65715] Fixed double margins when printing\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-02-26T00:00:00", "type": "nessus", "title": "Fedora 27 : qt5-qtwebengine (2018-e08d828ed9)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15407", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426", "CVE-2018-6031", "CVE-2018-6033", "CVE-2018-6034", "CVE-2018-6036", "CVE-2018-6037", "CVE-2018-6038", "CVE-2018-6040", "CVE-2018-6041", "CVE-2018-6042", "CVE-2018-6047", "CVE-2018-6048", "CVE-2018-6050", "CVE-2018-6051", "CVE-2018-6052", "CVE-2018-6053", "CVE-2018-6054"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:qt5-qtwebengine", "cpe:/o:fedoraproject:fedora:27"], "id": "FEDORA_2018-E08D828ED9.NASL", "href": "https://www.tenable.com/plugins/nessus/106991", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2018-e08d828ed9.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(106991);\n script_version(\"3.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2017-15407\", \"CVE-2017-15409\", \"CVE-2017-15410\", \"CVE-2017-15411\", \"CVE-2017-15415\", \"CVE-2017-15416\", \"CVE-2017-15418\", \"CVE-2017-15419\", \"CVE-2017-15422\", \"CVE-2017-15423\", \"CVE-2017-15424\", \"CVE-2017-15425\", \"CVE-2017-15426\", \"CVE-2018-6031\", \"CVE-2018-6033\", \"CVE-2018-6034\", \"CVE-2018-6036\", \"CVE-2018-6037\", \"CVE-2018-6038\", \"CVE-2018-6040\", \"CVE-2018-6041\", \"CVE-2018-6042\", \"CVE-2018-6047\", \"CVE-2018-6048\", \"CVE-2018-6050\", \"CVE-2018-6051\", \"CVE-2018-6052\", \"CVE-2018-6053\", \"CVE-2018-6054\");\n script_xref(name:\"FEDORA\", value:\"2018-e08d828ed9\");\n\n script_name(english:\"Fedora 27 : qt5-qtwebengine (2018-e08d828ed9)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update updates QtWebEngine to the 5.10.1 bugfix and security\nrelease. QtWebEngine 5.10.1 is part of the Qt 5.10.1 release, but only\nthe QtWebEngine component is included in this update.\n\nThis update includes :\n\n - Security fixes from Chromium up to version\n 64.0.3282.140. Including: CVE-2017-15407,\n CVE-2017-15409, CVE-2017-15410, CVE-2017-15411,\n CVE-2017-15415, CVE-2017-15416, CVE-2017-15418,\n CVE-2017-15419, CVE-2017-15422, CVE-2017-15423,\n CVE-2017-15424, CVE-2017-15425, CVE-2017-15426,\n CVE-2018-6031, CVE-2018-6033, CVE-2018-6034,\n CVE-2018-6036, CVE-2018-6037, CVE-2018-6038,\n CVE-2018-6040, CVE-2018-6041, CVE-2018-6042,\n CVE-2018-6047, CVE-2018-6048, CVE-2018-6050,\n CVE-2018-6051, CVE-2018-6052, CVE-2018-6053 and\n CVE-2018-6054.\n\n - Mitigations for SPECTRE: disabled shared-buffers, added\n cryptographic noise to precision timers\n\n - [QTBUG-47206] Fixed incorrect layouting due to bug in\n HTML5 viewport support.\n\n - [QTBUG-47945, QTBUG-65647] Fixed random crashes on exit\n\n - [QTBUG-57206] Fixed regression in viewport handling in\n embedded mode\n\n - [QTBUG-58400] Improved memory usage when printing\n\n - [QTBUG-63867] Fixed <canvas> elements when compiled\n without OpenGL\n\n - [QTBUG-63266, QTBUG-64436] Fixed that pointerType of\n Pointer Events was empty\n\n - [QTBUG-63606] Improved runtime disabling and clearing of\n HTTP cache\n\n - [QTBUG-64436] QtWebEngineWidgets: Fixed crash when\n exiting fullscreen mode using the context menu.\n\n - [QTBUG-64560] Fixed rendering glitches after\n renderProcessTerminated signal was emitted.\n\n - [QTBUG-64812] Fixed message bubble position in Hi-DPI\n mode\n\n - [QTBUG-64869, QTBUG-65004] Added testing for 32-bit host\n compiler when crossbuilding to 32-bit platforms\n\n - [QTBUG-64933] QtWebEngineWidgets: Fixed tooltips that\n did still show after mouse was moved away.\n\n - [QTBUG-65239] Fixed hanging of process if application is\n closed too fast after startup.\n\n - [QTBUG-65715] Fixed double margins when printing\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2018-e08d828ed9\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected qt5-qtwebengine package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:qt5-qtwebengine\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:27\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/08/28\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/02/25\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/02/26\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^27([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 27\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"FC27\", reference:\"qt5-qtwebengine-5.10.1-1.fc27\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"qt5-qtwebengine\");\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-01-11T14:45:30", "description": "Several vulnerabilities have been discovered in the chromium web browser.\n\n - CVE-2018-6056 lokihardt discovered an error in the v8 JavaScript library.\n\n - CVE-2018-6057 Gal Beniamini discovered errors related to shared memory permissions.\n\n - CVE-2018-6060 Omair discovered a use-after-free issue in blink/webkit.\n\n - CVE-2018-6061 Guang Gong discovered a race condition in the v8 JavaScript library.\n\n - CVE-2018-6062 A heap overflow issue was discovered in the v8 JavaScript library.\n\n - CVE-2018-6063 Gal Beniamini discovered errors related to shared memory permissions.\n\n - CVE-2018-6064 lokihardt discovered a type confusion error in the v8 JavaScript library.\n\n - CVE-2018-6065 Mark Brand discovered an integer overflow issue in the v8 JavaScript library.\n\n - CVE-2018-6066 Masato Kinugawa discovered a way to bypass the Same Origin Policy.\n\n - CVE-2018-6067 Ned Williamson discovered a buffer overflow issue in the skia library.\n\n - CVE-2018-6068 Luan Herrera discovered object lifecycle issues.\n\n - CVE-2018-6069 Wanglu and Yangkang discovered a stack overflow issue in the skia library.\n\n - CVE-2018-6070 Rob Wu discovered a way to bypass the Content Security Policy.\n\n - CVE-2018-6071 A heap overflow issue was discovered in the skia library.\n\n - CVE-2018-6072 Atte Kettunen discovered an integer overflow issue in the pdfium library.\n\n - CVE-2018-6073 Omair discover a heap overflow issue in the WebGL implementation.\n\n - CVE-2018-6074 Abdulrahman Alqabandi discovered a way to cause a downloaded web page to not contain a Mark of the Web.\n\n - CVE-2018-6075 Inti De Ceukelaire discovered a way to bypass the Same Origin Policy.\n\n - CVE-2018-6076 Mateusz Krzeszowiec discovered that URL fragment identifiers could be handled incorrectly.\n\n - CVE-2018-6077 Khalil Zhani discovered a timing issue.\n\n - CVE-2018-6078 Khalil Zhani discovered a URL spoofing issue.\n\n - CVE-2018-6079 Ivars discovered an information disclosure issue.\n\n - CVE-2018-6080 Gal Beniamini discovered an information disclosure issue.\n\n - CVE-2018-6081 Rob Wu discovered a cross-site scripting issue.\n\n - CVE-2018-6082 WenXu Wu discovered a way to bypass blocked ports.\n\n - CVE-2018-6083 Jun Kokatsu discovered that AppManifests could be handled incorrectly.\n\n - CVE-2018-6085 Ned Williamson discovered a use-after-free issue.\n\n - CVE-2018-6086 Ned Williamson discovered a use-after-free issue.\n\n - CVE-2018-6087 A use-after-free issue was discovered in the WebAssembly implementation.\n\n - CVE-2018-6088 A use-after-free issue was discovered in the pdfium library.\n\n - CVE-2018-6089 Rob Wu discovered a way to bypass the Same Origin Policy.\n\n - CVE-2018-6090 ZhanJia Song discovered a heap overflow issue in the skia library.\n\n - CVE-2018-6091 Jun Kokatsu discovered that plugins could be handled incorrectly.\n\n - CVE-2018-6092 Natalie Silvanovich discovered an integer overflow issue in the WebAssembly implementation.\n\n - CVE-2018-6093 Jun Kokatsu discovered a way to bypass the Same Origin Policy.\n\n - CVE-2018-6094 Chris Rohlf discovered a regression in garbage collection hardening.\n\n - CVE-2018-6095 Abdulrahman Alqabandi discovered files could be uploaded without user interaction.\n\n - CVE-2018-6096 WenXu Wu discovered a user interface spoofing issue.\n\n - CVE-2018-6097 xisigr discovered a user interface spoofing issue.\n\n - CVE-2018-6098 Khalil Zhani discovered a URL spoofing issue.\n\n - CVE-2018-6099 Jun Kokatsu discovered a way to bypass the Cross Origin Resource Sharing mechanism.\n\n - CVE-2018-6100 Lnyas Zhang discovered a URL spoofing issue.\n\n - CVE-2018-6101 Rob Wu discovered an issue in the developer tools remote debugging protocol.\n\n - CVE-2018-6102 Khalil Zhani discovered a URL spoofing issue.\n\n - CVE-2018-6103 Khalil Zhani discovered a user interface spoofing issue.\n\n - CVE-2018-6104 Khalil Zhani discovered a URL spoofing issue.\n\n - CVE-2018-6105 Khalil Zhani discovered a URL spoofing issue.\n\n - CVE-2018-6106 lokihardt discovered that v8 promises could be handled incorrectly.\n\n - CVE-2018-6107 Khalil Zhani discovered a URL spoofing issue.\n\n - CVE-2018-6108 Khalil Zhani discovered a URL spoofing issue.\n\n - CVE-2018-6109 Dominik Weber discovered a way to misuse the FileAPI feature.\n\n - CVE-2018-6110 Wenxiang Qian discovered that local plain text files could be handled incorrectly.\n\n - CVE-2018-6111 Khalil Zhani discovered a use-after-free issue in the developer tools.\n\n - CVE-2018-6112 Khalil Zhani discovered incorrect handling of URLs in the developer tools.\n\n - CVE-2018-6113 Khalil Zhani discovered a URL spoofing issue.\n\n - CVE-2018-6114 Lnyas Zhang discovered a way to bypass the Content Security Policy.\n\n - CVE-2018-6116 Chengdu Security Response Center discovered an error when memory is low.\n\n - CVE-2018-6117 Spencer Dailey discovered an error in form autofill settings.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-04-30T00:00:00", "type": "nessus", "title": "Debian DSA-4182-1 : chromium-browser - security update", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6056", "CVE-2018-6057", "CVE-2018-6060", "CVE-2018-6061", "CVE-2018-6062", "CVE-2018-6063", "CVE-2018-6064", "CVE-2018-6065", "CVE-2018-6066", "CVE-2018-6067", "CVE-2018-6068", "CVE-2018-6069", "CVE-2018-6070", "CVE-2018-6071", "CVE-2018-6072", "CVE-2018-6073", "CVE-2018-6074", "CVE-2018-6075", "CVE-2018-6076", "CVE-2018-6077", "CVE-2018-6078", "CVE-2018-6079", "CVE-2018-6080", "CVE-2018-6081", "CVE-2018-6082", "CVE-2018-6083", "CVE-2018-6085", "CVE-2018-6086", "CVE-2018-6087", "CVE-2018-6088", "CVE-2018-6089", "CVE-2018-6090", "CVE-2018-6091", "CVE-2018-6092", "CVE-2018-6093", "CVE-2018-6094", "CVE-2018-6095", "CVE-2018-6096", "CVE-2018-6097", "CVE-2018-6098", "CVE-2018-6099", "CVE-2018-6100", "CVE-2018-6101", "CVE-2018-6102", "CVE-2018-6103", "CVE-2018-6104", "CVE-2018-6105", "CVE-2018-6106", "CVE-2018-6107", "CVE-2018-6108", "CVE-2018-6109", "CVE-2018-6110", "CVE-2018-6111", "CVE-2018-6112", "CVE-2018-6113", "CVE-2018-6114", "CVE-2018-6116", "CVE-2018-6117"], "modified": "2022-07-05T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:chromium-browser", "cpe:/o:debian:debian_linux:9.0"], "id": "DEBIAN_DSA-4182.NASL", "href": "https://www.tenable.com/plugins/nessus/109411", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-4182. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(109411);\n script_version(\"1.12\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/07/05\");\n\n script_cve_id(\"CVE-2018-6056\", \"CVE-2018-6057\", \"CVE-2018-6060\", \"CVE-2018-6061\", \"CVE-2018-6062\", \"CVE-2018-6063\", \"CVE-2018-6064\", \"CVE-2018-6065\", \"CVE-2018-6066\", \"CVE-2018-6067\", \"CVE-2018-6068\", \"CVE-2018-6069\", \"CVE-2018-6070\", \"CVE-2018-6071\", \"CVE-2018-6072\", \"CVE-2018-6073\", \"CVE-2018-6074\", \"CVE-2018-6075\", \"CVE-2018-6076\", \"CVE-2018-6077\", \"CVE-2018-6078\", \"CVE-2018-6079\", \"CVE-2018-6080\", \"CVE-2018-6081\", \"CVE-2018-6082\", \"CVE-2018-6083\", \"CVE-2018-6085\", \"CVE-2018-6086\", \"CVE-2018-6087\", \"CVE-2018-6088\", \"CVE-2018-6089\", \"CVE-2018-6090\", \"CVE-2018-6091\", \"CVE-2018-6092\", \"CVE-2018-6093\", \"CVE-2018-6094\", \"CVE-2018-6095\", \"CVE-2018-6096\", \"CVE-2018-6097\", \"CVE-2018-6098\", \"CVE-2018-6099\", \"CVE-2018-6100\", \"CVE-2018-6101\", \"CVE-2018-6102\", \"CVE-2018-6103\", \"CVE-2018-6104\", \"CVE-2018-6105\", \"CVE-2018-6106\", \"CVE-2018-6107\", \"CVE-2018-6108\", \"CVE-2018-6109\", \"CVE-2018-6110\", \"CVE-2018-6111\", \"CVE-2018-6112\", \"CVE-2018-6113\", \"CVE-2018-6114\", \"CVE-2018-6116\", \"CVE-2018-6117\");\n script_xref(name:\"DSA\", value:\"4182\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/06/22\");\n\n script_name(english:\"Debian DSA-4182-1 : chromium-browser - security update\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"Several vulnerabilities have been discovered in the chromium web\nbrowser.\n\n - CVE-2018-6056\n lokihardt discovered an error in the v8 JavaScript\n library.\n\n - CVE-2018-6057\n Gal Beniamini discovered errors related to shared memory\n permissions.\n\n - CVE-2018-6060\n Omair discovered a use-after-free issue in blink/webkit.\n\n - CVE-2018-6061\n Guang Gong discovered a race condition in the v8\n JavaScript library.\n\n - CVE-2018-6062\n A heap overflow issue was discovered in the v8\n JavaScript library.\n\n - CVE-2018-6063\n Gal Beniamini discovered errors related to shared memory\n permissions.\n\n - CVE-2018-6064\n lokihardt discovered a type confusion error in the v8\n JavaScript library.\n\n - CVE-2018-6065\n Mark Brand discovered an integer overflow issue in the\n v8 JavaScript library.\n\n - CVE-2018-6066\n Masato Kinugawa discovered a way to bypass the Same\n Origin Policy.\n\n - CVE-2018-6067\n Ned Williamson discovered a buffer overflow issue in the\n skia library.\n\n - CVE-2018-6068\n Luan Herrera discovered object lifecycle issues.\n\n - CVE-2018-6069\n Wanglu and Yangkang discovered a stack overflow issue in\n the skia library.\n\n - CVE-2018-6070\n Rob Wu discovered a way to bypass the Content Security\n Policy.\n\n - CVE-2018-6071\n A heap overflow issue was discovered in the skia\n library.\n\n - CVE-2018-6072\n Atte Kettunen discovered an integer overflow issue in\n the pdfium library.\n\n - CVE-2018-6073\n Omair discover a heap overflow issue in the WebGL\n implementation.\n\n - CVE-2018-6074\n Abdulrahman Alqabandi discovered a way to cause a\n downloaded web page to not contain a Mark of the Web.\n\n - CVE-2018-6075\n Inti De Ceukelaire discovered a way to bypass the Same\n Origin Policy.\n\n - CVE-2018-6076\n Mateusz Krzeszowiec discovered that URL fragment\n identifiers could be handled incorrectly.\n\n - CVE-2018-6077\n Khalil Zhani discovered a timing issue.\n\n - CVE-2018-6078\n Khalil Zhani discovered a URL spoofing issue.\n\n - CVE-2018-6079\n Ivars discovered an information disclosure issue.\n\n - CVE-2018-6080\n Gal Beniamini discovered an information disclosure\n issue.\n\n - CVE-2018-6081\n Rob Wu discovered a cross-site scripting issue.\n\n - CVE-2018-6082\n WenXu Wu discovered a way to bypass blocked ports.\n\n - CVE-2018-6083\n Jun Kokatsu discovered that AppManifests could be\n handled incorrectly.\n\n - CVE-2018-6085\n Ned Williamson discovered a use-after-free issue.\n\n - CVE-2018-6086\n Ned Williamson discovered a use-after-free issue.\n\n - CVE-2018-6087\n A use-after-free issue was discovered in the WebAssembly\n implementation.\n\n - CVE-2018-6088\n A use-after-free issue was discovered in the pdfium\n library.\n\n - CVE-2018-6089\n Rob Wu discovered a way to bypass the Same Origin\n Policy.\n\n - CVE-2018-6090\n ZhanJia Song discovered a heap overflow issue in the\n skia library.\n\n - CVE-2018-6091\n Jun Kokatsu discovered that plugins could be handled\n incorrectly.\n\n - CVE-2018-6092\n Natalie Silvanovich discovered an integer overflow issue\n in the WebAssembly implementation.\n\n - CVE-2018-6093\n Jun Kokatsu discovered a way to bypass the Same Origin\n Policy.\n\n - CVE-2018-6094\n Chris Rohlf discovered a regression in garbage\n collection hardening.\n\n - CVE-2018-6095\n Abdulrahman Alqabandi discovered files could be uploaded\n without user interaction.\n\n - CVE-2018-6096\n WenXu Wu discovered a user interface spoofing issue.\n\n - CVE-2018-6097\n xisigr discovered a user interface spoofing issue.\n\n - CVE-2018-6098\n Khalil Zhani discovered a URL spoofing issue.\n\n - CVE-2018-6099\n Jun Kokatsu discovered a way to bypass the Cross Origin\n Resource Sharing mechanism.\n\n - CVE-2018-6100\n Lnyas Zhang discovered a URL spoofing issue.\n\n - CVE-2018-6101\n Rob Wu discovered an issue in the developer tools remote\n debugging protocol.\n\n - CVE-2018-6102\n Khalil Zhani discovered a URL spoofing issue.\n\n - CVE-2018-6103\n Khalil Zhani discovered a user interface spoofing issue.\n\n - CVE-2018-6104\n Khalil Zhani discovered a URL spoofing issue.\n\n - CVE-2018-6105\n Khalil Zhani discovered a URL spoofing issue.\n\n - CVE-2018-6106\n lokihardt discovered that v8 promises could be handled\n incorrectly.\n\n - CVE-2018-6107\n Khalil Zhani discovered a URL spoofing issue.\n\n - CVE-2018-6108\n Khalil Zhani discovered a URL spoofing issue.\n\n - CVE-2018-6109\n Dominik Weber discovered a way to misuse the FileAPI\n feature.\n\n - CVE-2018-6110\n Wenxiang Qian discovered that local plain text files\n could be handled incorrectly.\n\n - CVE-2018-6111\n Khalil Zhani discovered a use-after-free issue in the\n developer tools.\n\n - CVE-2018-6112\n Khalil Zhani discovered incorrect handling of URLs in\n the developer tools.\n\n - CVE-2018-6113\n Khalil Zhani discovered a URL spoofing issue.\n\n - CVE-2018-6114\n Lnyas Zhang discovered a way to bypass the Content\n Security Policy.\n\n - CVE-2018-6116\n Chengdu Security Response Center discovered an error\n when memory is low.\n\n - CVE-2018-6117\n Spencer Dailey discovered an error in form autofill\n settings.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6056\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6057\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6060\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6061\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6062\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6063\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6064\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6065\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6066\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6067\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6068\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6069\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6070\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6071\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6072\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6073\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6074\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6075\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6076\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6077\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6078\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6079\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6080\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6081\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6082\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6083\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6085\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6086\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6087\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6088\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6089\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6090\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6091\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6092\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6093\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6094\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6095\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6096\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6097\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6098\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6099\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6100\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6101\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6102\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6103\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6104\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6105\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6106\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6107\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6108\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6109\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6110\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6111\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6112\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6113\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6114\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6116\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2018-6117\"\n );\n # https://security-tracker.debian.org/tracker/source-package/chromium-browser\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?e33901a2\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/stretch/chromium-browser\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2018/dsa-4182\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\n\"Upgrade the chromium-browser packages.\n\nFor the oldstable distribution (jessie), security support for chromium\nhas been discontinued.\n\nFor the stable distribution (stretch), these problems have been fixed\nin version 66.0.3359.117-1~deb9u1.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2018-6111\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:chromium-browser\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:9.0\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/11/14\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/04/28\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/04/30\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"9.0\", prefix:\"chromedriver\", reference:\"66.0.3359.117-1~deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"chromium\", reference:\"66.0.3359.117-1~deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"chromium-driver\", reference:\"66.0.3359.117-1~deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"chromium-l10n\", reference:\"66.0.3359.117-1~deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"chromium-shell\", reference:\"66.0.3359.117-1~deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"chromium-widevine\", reference:\"66.0.3359.117-1~deb9u1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "fedora": [{"lastseen": "2020-12-21T08:17:54", "description": "Chromium is an open-source web browser, powered by WebKit (Blink). ", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2018-03-27T20:18:19", "type": "fedora", "title": "[SECURITY] Fedora 27 Update: chromium-65.0.3325.181-1.fc27", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15396", "CVE-2017-15407", "CVE-2017-15408", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15413", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15417", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15420", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426", "CVE-2017-15427", "CVE-2018-6056", "CVE-2018-6057", "CVE-2018-6058", "CVE-2018-6059", "CVE-2018-6060", "CVE-2018-6061", "CVE-2018-6062", "CVE-2018-6063", "CVE-2018-6064", "CVE-2018-6065", "CVE-2018-6066", "CVE-2018-6067", "CVE-2018-6068", "CVE-2018-6069", "CVE-2018-6070", "CVE-2018-6071", "CVE-2018-6072", "CVE-2018-6073", "CVE-2018-6074", "CVE-2018-6075", "CVE-2018-6076", "CVE-2018-6077", "CVE-2018-6078", "CVE-2018-6079", "CVE-2018-6080", "CVE-2018-6081", "CVE-2018-6082", "CVE-2018-6083", "CVE-2018-6406"], "modified": "2018-03-27T20:18:19", "id": "FEDORA:0F54C60BE23D", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/XCBSSV5ZSWY3Q4NKEKL22B4MOSHCBKVN/", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-12-21T08:17:54", "description": "Chromium is an open-source web browser, powered by WebKit (Blink). ", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2018-03-30T13:40:00", "type": "fedora", "title": "[SECURITY] Fedora 28 Update: chromium-65.0.3325.181-1.fc28", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15396", "CVE-2017-15407", "CVE-2017-15408", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15413", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15417", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15420", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426", "CVE-2017-15427", "CVE-2018-6056", "CVE-2018-6057", "CVE-2018-6058", "CVE-2018-6059", "CVE-2018-6060", "CVE-2018-6061", "CVE-2018-6062", "CVE-2018-6063", "CVE-2018-6064", "CVE-2018-6065", "CVE-2018-6066", "CVE-2018-6067", "CVE-2018-6068", "CVE-2018-6069", "CVE-2018-6070", "CVE-2018-6071", "CVE-2018-6072", "CVE-2018-6073", "CVE-2018-6074", "CVE-2018-6075", "CVE-2018-6076", "CVE-2018-6077", "CVE-2018-6078", "CVE-2018-6079", "CVE-2018-6080", "CVE-2018-6081", "CVE-2018-6082", "CVE-2018-6083", "CVE-2018-6406"], "modified": "2018-03-30T13:40:00", "id": "FEDORA:855A9625F2AD", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/ZOWNVIEOYMNSUHRE2HFKDEWQD5CBMCB4/", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-12-21T08:17:54", "description": "Chromium is an open-source web browser, powered by WebKit (Blink). ", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2018-01-01T22:20:38", "type": "fedora", "title": "[SECURITY] Fedora 27 Update: chromium-63.0.3239.108-1.fc27", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15407", "CVE-2017-15408", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15413", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15417", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15420", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426", "CVE-2017-15427", "CVE-2017-15429"], "modified": "2018-01-01T22:20:38", "id": "FEDORA:2E8D96005552", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/UDKVCC2YPMOARJA2KQ3Y7FNIN2JW46EH/", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-12-21T08:17:54", "description": "Qt5 - QtWebEngine components. ", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2018-03-25T21:24:23", "type": "fedora", "title": "[SECURITY] Fedora 26 Update: qt5-qtwebengine-5.10.1-4.fc26", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15429", "CVE-2018-6033", "CVE-2018-6060", "CVE-2018-6062", "CVE-2018-6064", "CVE-2018-6069", "CVE-2018-6073", "CVE-2018-6076", "CVE-2018-6079", "CVE-2018-6081"], "modified": "2018-03-25T21:24:23", "id": "FEDORA:BD8776075EF7", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/36XZOQSLKLPBFKLG6D6YPO3YQIIWPTSU/", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-12-21T08:17:54", "description": "Qt5 - QtWebEngine components. ", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2018-03-25T21:49:26", "type": "fedora", "title": "[SECURITY] Fedora 27 Update: qt5-qtwebengine-5.10.1-4.fc27", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15429", "CVE-2018-6033", "CVE-2018-6060", "CVE-2018-6062", "CVE-2018-6064", "CVE-2018-6069", "CVE-2018-6073", "CVE-2018-6076", "CVE-2018-6079", "CVE-2018-6081"], "modified": "2018-03-25T21:49:26", "id": "FEDORA:CEA406042D4A", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/UH23YUKLEZNXH6IZWIPR24T3Q6OJLPSD/", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-12-21T08:17:54", "description": "Qt5 - QtWebEngine components. ", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2018-03-26T22:32:32", "type": "fedora", "title": "[SECURITY] Fedora 28 Update: qt5-qtwebengine-5.10.1-4.fc28", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15429", "CVE-2018-6033", "CVE-2018-6060", "CVE-2018-6062", "CVE-2018-6064", "CVE-2018-6069", "CVE-2018-6073", "CVE-2018-6076", "CVE-2018-6079", "CVE-2018-6081"], "modified": "2018-03-26T22:32:32", "id": "FEDORA:D5E9D604E466", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/MR4YTFAJQPJBIGHBX5JWITCX6GYR5RPQ/", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-12-21T08:17:54", "description": "Chromium is an open-source web browser, powered by WebKit (Blink). ", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2018-01-01T22:22:45", "type": "fedora", "title": "[SECURITY] Fedora 26 Update: chromium-63.0.3239.108-1.fc26", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15386", "CVE-2017-15387", "CVE-2017-15388", "CVE-2017-15389", "CVE-2017-15390", "CVE-2017-15391", "CVE-2017-15392", "CVE-2017-15393", "CVE-2017-15394", "CVE-2017-15395", "CVE-2017-15398", "CVE-2017-15399", "CVE-2017-15407", "CVE-2017-15408", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15413", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15417", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15420", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426", "CVE-2017-15427", "CVE-2017-15429", "CVE-2017-5124", "CVE-2017-5125", "CVE-2017-5126", "CVE-2017-5127", "CVE-2017-5128", "CVE-2017-5129", "CVE-2017-5130", "CVE-2017-5131", "CVE-2017-5132", "CVE-2017-5133"], "modified": "2018-01-01T22:22:45", "id": "FEDORA:EC7F86046254", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/TCX6RNONWP5H4F6S2D3GX2IVGKVND34L/", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-12-21T08:17:54", "description": "Qt5 - QtWebEngine components. ", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2018-02-27T16:58:43", "type": "fedora", "title": "[SECURITY] Fedora 26 Update: qt5-qtwebengine-5.10.1-1.fc26", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15407", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15415", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15425", "CVE-2017-15426", "CVE-2018-6031", "CVE-2018-6033", "CVE-2018-6034", "CVE-2018-6036", "CVE-2018-6037", "CVE-2018-6038", "CVE-2018-6040", "CVE-2018-6041", "CVE-2018-6042", "CVE-2018-6047", "CVE-2018-6048", "CVE-2018-6050", "CVE-2018-6051", "CVE-2018-6052", "CVE-2018-6053", "CVE-2018-6054"], "modified": "2018-02-27T16:58:43", "id": "FEDORA:5CFCF60A5875", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/TMXSXUQWLJLP4VC53CAE7HL3ZUFJZY6I/", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-12-21T08:17:54", "description": "Qt5 - QtWebEngine components. ", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2018-02-25T21:14:12", "type": "fedora", "title": "[SECURITY] Fedora 27 Update: qt5-qtwebengine-5.10.1-1.fc27", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15407", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15415", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15425", "CVE-2017-15426", "CVE-2018-6031", "CVE-2018-6033", "CVE-2018-6034", "CVE-2018-6036", "CVE-2018-6037", "CVE-2018-6038", "CVE-2018-6040", "CVE-2018-6041", "CVE-2018-6042", "CVE-2018-6047", "CVE-2018-6048", "CVE-2018-6050", "CVE-2018-6051", "CVE-2018-6052", "CVE-2018-6053", "CVE-2018-6054"], "modified": "2018-02-25T21:14:12", "id": "FEDORA:CAFF160478EB", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/LGDSXXPN73LMQRMWCOGQL5XQFGUWIC7D/", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "openvas": [{"lastseen": "2019-05-29T18:32:54", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2018-03-28T00:00:00", "type": "openvas", "title": "Fedora Update for chromium FEDORA-2018-faff5f661e", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2018-6069", "CVE-2018-6078", "CVE-2017-15417", "CVE-2018-6081", "CVE-2017-15409", "CVE-2018-6080", "CVE-2018-6083", "CVE-2017-15423", "CVE-2018-6082", "CVE-2018-6057", "CVE-2018-6070", "CVE-2018-6074", "CVE-2018-6059", "CVE-2017-15419", "CVE-2017-15425", "CVE-2018-6056", "CVE-2017-15410", "CVE-2018-6073", "CVE-2017-15422", "CVE-2017-15427", "CVE-2017-15407", "CVE-2018-6061", "CVE-2017-15418", "CVE-2017-15411", "CVE-2018-6072", "CVE-2017-15412", "CVE-2017-15415", "CVE-2018-6058", "CVE-2018-6068", "CVE-2018-6065", "CVE-2018-6062", "CVE-2018-6067", "CVE-2017-15426", "CVE-2017-15413", "CVE-2017-15408", "CVE-2018-6071", "CVE-2017-15396", "CVE-2018-6406", "CVE-2018-6066", "CVE-2018-6075", "CVE-2017-15416", "CVE-2017-15424", "CVE-2017-15420", "CVE-2018-6064", "CVE-2018-6077", "CVE-2018-6076", "CVE-2018-6079", "CVE-2018-6060", "CVE-2018-6063"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310874300", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310874300", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_fedora_2018_faff5f661e_chromium_fc27.nasl 14223 2019-03-15 13:49:35Z cfischer $\n#\n# Fedora Update for chromium FEDORA-2018-faff5f661e\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.874300\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2018-03-28 09:00:16 +0200 (Wed, 28 Mar 2018)\");\n script_cve_id(\"CVE-2017-15396\", \"CVE-2017-15407\", \"CVE-2017-15408\", \"CVE-2017-15409\",\n \"CVE-2017-15410\", \"CVE-2017-15411\", \"CVE-2017-15412\", \"CVE-2017-15413\",\n \"CVE-2017-15415\", \"CVE-2017-15416\", \"CVE-2017-15417\", \"CVE-2017-15418\",\n \"CVE-2017-15419\", \"CVE-2017-15420\", \"CVE-2017-15422\", \"CVE-2018-6056\",\n \"CVE-2018-6406\", \"CVE-2018-6057\", \"CVE-2018-6058\", \"CVE-2018-6059\",\n \"CVE-2018-6060\", \"CVE-2018-6061\", \"CVE-2018-6062\", \"CVE-2018-6063\",\n \"CVE-2018-6064\", \"CVE-2018-6065\", \"CVE-2018-6066\", \"CVE-2018-6067\",\n \"CVE-2018-6068\", \"CVE-2018-6069\", \"CVE-2018-6070\", \"CVE-2018-6071\",\n \"CVE-2018-6083\", \"CVE-2018-6082\", \"CVE-2018-6081\", \"CVE-2018-6080\",\n \"CVE-2018-6079\", \"CVE-2018-6078\", \"CVE-2018-6077\", \"CVE-2018-6076\",\n \"CVE-2018-6075\", \"CVE-2018-6074\", \"CVE-2018-6073\", \"CVE-2018-6072\",\n \"CVE-2017-15427\", \"CVE-2017-15426\", \"CVE-2017-15425\", \"CVE-2017-15424\",\n \"CVE-2017-15423\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for chromium FEDORA-2018-faff5f661e\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'chromium'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"chromium on Fedora 27\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_xref(name:\"FEDORA\", value:\"2018-faff5f661e\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XCBSSV5ZSWY3Q4NKEKL22B4MOSHCBKVN\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC27\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC27\")\n{\n\n if ((res = isrpmvuln(pkg:\"chromium\", rpm:\"chromium~65.0.3325.181~1.fc27\", rls:\"FC27\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-07-04T19:02:13", "description": "Several vulnerabilities have been discovered in the chromium web browser.\n\nCVE-2017-15407\nNed Williamson discovered an out-of-bounds write issue.\n\nCVE-2017-15408\nKe Liu discovered a heap overflow issue in the pdfium library.\n\nCVE-2017-15409\nAn out-of-bounds write issue was discovered in the skia library.\n\nCVE-2017-15410\nLuat Nguyen discovered a use-after-free issue in the pdfium library.\n\nCVE-2017-15411\nLuat Nguyen discovered a use-after-free issue in the pdfium library.\n\nCVE-2017-15413\nGaurav Dewan discovered a type confusion issue.\n\nCVE-2017-15415\nViktor Brange discovered an information disclosure issue.\n\nCVE-2017-15416\nNed Williamson discovered an out-of-bounds read issue.\n\nCVE-2017-15417\nMax May discovered an information disclosure issue in the skia\nlibrary.\n\nCVE-2017-15418\nKushal Arvind Shah discovered an uninitialized value in the skia\nlibrary.\n\nCVE-2017-15419\nJun Kokatsu discoved an information disclosure issue.\n\nCVE-2017-15420\nWenXu Wu discovered a URL spoofing issue.\n\nCVE-2017-15423\nGreg Hudson discovered an issue in the boringssl library.\n\nCVE-2017-15424\nKhalil Zhani discovered a URL spoofing issue.\n\nCVE-2017-15425\nxisigr discovered a URL spoofing issue.\n\nCVE-2017-15426\nWenXu Wu discovered a URL spoofing issue.\n\nCVE-2017-15427\nJunaid Farhan discovered an issue with the omnibox.", "cvss3": {}, "published": "2017-12-12T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 4064-1 (chromium-browser - security update)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2017-15417", "CVE-2017-15409", "CVE-2017-15423", "CVE-2017-15419", "CVE-2017-15425", "CVE-2017-15410", "CVE-2017-15427", "CVE-2017-15407", "CVE-2017-15418", "CVE-2017-15411", "CVE-2017-15415", "CVE-2017-15426", "CVE-2017-15413", "CVE-2017-15408", "CVE-2017-15416", "CVE-2017-15424", "CVE-2017-15420"], "modified": "2019-07-04T00:00:00", "id": "OPENVAS:1361412562310704064", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310704064", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Auto-generated from advisory DSA 4064-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2017 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License as published by\n# the Free Software Foundation; either version 2 of the License, or\n# (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.704064\");\n script_version(\"2019-07-04T09:25:28+0000\");\n script_cve_id(\"CVE-2017-15407\", \"CVE-2017-15408\", \"CVE-2017-15409\", \"CVE-2017-15410\", \"CVE-2017-15411\", \"CVE-2017-15413\", \"CVE-2017-15415\", \"CVE-2017-15416\", \"CVE-2017-15417\", \"CVE-2017-15418\", \"CVE-2017-15419\", \"CVE-2017-15420\", \"CVE-2017-15423\", \"CVE-2017-15424\", \"CVE-2017-15425\", \"CVE-2017-15426\", \"CVE-2017-15427\");\n script_name(\"Debian Security Advisory DSA 4064-1 (chromium-browser - security update)\");\n script_tag(name:\"last_modification\", value:\"2019-07-04 09:25:28 +0000 (Thu, 04 Jul 2019)\");\n script_tag(name:\"creation_date\", value:\"2017-12-12 00:00:00 +0100 (Tue, 12 Dec 2017)\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n script_xref(name:\"URL\", value:\"https://www.debian.org/security/2017/dsa-4064.html\");\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2017 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB9\");\n script_tag(name:\"affected\", value:\"chromium-browser on Debian Linux\");\n script_tag(name:\"solution\", value:\"For the stable distribution (stretch), these problems have been fixed in\nversion 63.0.3239.84-1~deb9u1.\n\nWe recommend that you upgrade your chromium-browser packages.\");\n\n script_xref(name:\"URL\", value:\"https://security-tracker.debian.org/tracker/chromium-browser\");\n script_tag(name:\"summary\", value:\"Several vulnerabilities have been discovered in the chromium web browser.\n\nCVE-2017-15407\nNed Williamson discovered an out-of-bounds write issue.\n\nCVE-2017-15408\nKe Liu discovered a heap overflow issue in the pdfium library.\n\nCVE-2017-15409\nAn out-of-bounds write issue was discovered in the skia library.\n\nCVE-2017-15410\nLuat Nguyen discovered a use-after-free issue in the pdfium library.\n\nCVE-2017-15411\nLuat Nguyen discovered a use-after-free issue in the pdfium library.\n\nCVE-2017-15413\nGaurav Dewan discovered a type confusion issue.\n\nCVE-2017-15415\nViktor Brange discovered an information disclosure issue.\n\nCVE-2017-15416\nNed Williamson discovered an out-of-bounds read issue.\n\nCVE-2017-15417\nMax May discovered an information disclosure issue in the skia\nlibrary.\n\nCVE-2017-15418\nKushal Arvind Shah discovered an uninitialized value in the skia\nlibrary.\n\nCVE-2017-15419\nJun Kokatsu discoved an information disclosure issue.\n\nCVE-2017-15420\nWenXu Wu discovered a URL spoofing issue.\n\nCVE-2017-15423\nGreg Hudson discovered an issue in the boringssl library.\n\nCVE-2017-15424\nKhalil Zhani discovered a URL spoofing issue.\n\nCVE-2017-15425\nxisigr discovered a URL spoofing issue.\n\nCVE-2017-15426\nWenXu Wu discovered a URL spoofing issue.\n\nCVE-2017-15427\nJunaid Farhan discovered an issue with the omnibox.\");\n script_tag(name:\"vuldetect\", value:\"This check tests the installed software version using the apt package manager.\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif(!isnull(res = isdpkgvuln(pkg:\"chromedriver\", ver:\"63.0.3239.84-1~deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"chromium\", ver:\"63.0.3239.84-1~deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"chromium-driver\", ver:\"63.0.3239.84-1~deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"chromium-l10n\", ver:\"63.0.3239.84-1~deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"chromium-shell\", ver:\"63.0.3239.84-1~deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"chromium-widevine\", ver:\"63.0.3239.84-1~deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if(__pkg_match) {\n exit(99);\n}", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-07-19T21:52:32", "description": "This host is installed with Google Chrome and is\n prone to multiple vulnerabilities.", "cvss3": {}, "published": "2018-03-07T00:00:00", "type": "openvas", "title": "Google Chrome Multiple Security Vulnerabilities Mar18 (Windows)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2018-6069", "CVE-2018-6078", "CVE-2018-6081", "CVE-2018-6080", "CVE-2018-6083", "CVE-2018-6082", "CVE-2018-6057", "CVE-2018-6070", "CVE-2018-6074", "CVE-2018-6059", "CVE-2018-6073", "CVE-2018-6061", "CVE-2018-6072", "CVE-2018-6058", "CVE-2018-6068", "CVE-2018-6065", "CVE-2018-6062", "CVE-2018-6067", "CVE-2018-6071", "CVE-2018-6066", "CVE-2018-6075", "CVE-2018-6064", "CVE-2018-6077", "CVE-2018-6076", "CVE-2018-6079", "CVE-2018-6060", "CVE-2018-6063"], "modified": "2019-07-17T00:00:00", "id": "OPENVAS:1361412562310812819", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310812819", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Google Chrome Multiple Security Vulnerabilities Mar18 (Windows)\n#\n# Authors:\n# Rajat Mishra <rajatm@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:google:chrome\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.812819\");\n script_version(\"2019-07-17T08:15:16+0000\");\n script_cve_id(\"CVE-2018-6057\", \"CVE-2018-6058\", \"CVE-2018-6059\", \"CVE-2018-6060\",\n \"CVE-2018-6061\", \"CVE-2018-6062\", \"CVE-2018-6063\", \"CVE-2018-6064\",\n \"CVE-2018-6065\", \"CVE-2018-6066\", \"CVE-2018-6067\", \"CVE-2018-6068\",\n \"CVE-2018-6069\", \"CVE-2018-6070\", \"CVE-2018-6071\", \"CVE-2018-6072\",\n \"CVE-2018-6073\", \"CVE-2018-6074\", \"CVE-2018-6075\", \"CVE-2018-6076\",\n \"CVE-2018-6077\", \"CVE-2018-6078\", \"CVE-2018-6079\", \"CVE-2018-6080\",\n \"CVE-2018-6081\", \"CVE-2018-6082\", \"CVE-2018-6083\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2019-07-17 08:15:16 +0000 (Wed, 17 Jul 2019)\");\n script_tag(name:\"creation_date\", value:\"2018-03-07 11:13:56 +0530 (Wed, 07 Mar 2018)\");\n script_name(\"Google Chrome Multiple Security Vulnerabilities Mar18 (Windows)\");\n\n script_tag(name:\"summary\", value:\"This host is installed with Google Chrome and is\n prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws are due to:\n\n - Multiple use after free errors in flash and Blink.\n\n - Race condition, type confusion and integer overflow errors in V8.\n\n - Buffer overflows errors in Skia, PDFium and WebGL.\n\n - Multiple incorrect permission errors on shared memory.\n\n - Same origin bypass error via canvas.\n\n - CSP bypass error through extensions.\n\n - Object lifecycle issues in Chrome custom.\n\n - Mark-of-the-Web bypass error.\n\n - Overly permissive cross origin download errors.\n\n - Timing attack error using SVG filters.\n\n - URL Spoof error in OmniBox.\n\n - Information disclosure error in IPC call.\n\n - XSS due to input validation error in interstitials.\n\n - Circumvention of port blocking error.\n\n - Incorrect processing error of AppManifests.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow attackers\n to cause a denial of service, manipulate shared memory, bypass the same origin\n policy, content-security-policy and mark-of-the-web, allow overly permissive\n cross origin downloads, spoof the URL, disclose sensitive information, perform\n cross site scripting or possibly have other unspecified impacts via crafted\n dimensions.\");\n\n script_tag(name:\"affected\", value:\"Google Chrome versions prior to 65.0.3325.146 on Windows.\");\n\n script_tag(name:\"solution\", value:\"Upgrade to Google Chrome version\n 65.0.3325.146 or later.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_tag(name:\"qod_type\", value:\"registry\");\n script_xref(name:\"URL\", value:\"https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html\");\n\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_category(ACT_GATHER_INFO);\n script_family(\"General\");\n script_dependencies(\"gb_google_chrome_detect_portable_win.nasl\");\n script_mandatory_keys(\"GoogleChrome/Win/Ver\");\n\n exit(0);\n}\n\ninclude(\"version_func.inc\");\ninclude(\"host_details.inc\");\n\nif(!infos = get_app_version_and_location(cpe:CPE, exit_no_version:TRUE )) exit(0);\nvers = infos['version'];\npath = infos['location'];\n\nif(version_is_less(version:vers, test_version:\"65.0.3325.146\"))\n{\n report = report_fixed_ver(installed_version:vers, fixed_version:\"65.0.3325.146\", install_path:path);\n security_message(data:report);\n exit(0);\n}\nexit(0);\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-07-17T14:07:35", "description": "This host is installed with Google Chrome and is\n prone to multiple vulnerabilities.", "cvss3": {}, "published": "2018-03-07T00:00:00", "type": "openvas", "title": "Google Chrome Multiple Security Vulnerabilities Mar18 (Mac OS X)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2018-6069", "CVE-2018-6078", "CVE-2018-6081", "CVE-2018-6080", "CVE-2018-6083", "CVE-2018-6082", "CVE-2018-6057", "CVE-2018-6070", "CVE-2018-6074", "CVE-2018-6059", "CVE-2018-6073", "CVE-2018-6061", "CVE-2018-6072", "CVE-2018-6058", "CVE-2018-6068", "CVE-2018-6065", "CVE-2018-6062", "CVE-2018-6067", "CVE-2018-6071", "CVE-2018-6066", "CVE-2018-6075", "CVE-2018-6064", "CVE-2018-6077", "CVE-2018-6076", "CVE-2018-6079", "CVE-2018-6060", "CVE-2018-6063"], "modified": "2019-07-16T00:00:00", "id": "OPENVAS:1361412562310812818", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310812818", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Google Chrome Multiple Security Vulnerabilities Mar18 (Mac OS X)\n#\n# Authors:\n# Rajat Mishra <rajatm@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:google:chrome\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.812818\");\n script_version(\"2019-07-16T15:57:25+0000\");\n script_cve_id(\"CVE-2018-6057\", \"CVE-2018-6058\", \"CVE-2018-6059\", \"CVE-2018-6060\",\n \"CVE-2018-6061\", \"CVE-2018-6062\", \"CVE-2018-6063\", \"CVE-2018-6064\",\n \"CVE-2018-6065\", \"CVE-2018-6066\", \"CVE-2018-6067\", \"CVE-2018-6068\",\n \"CVE-2018-6069\", \"CVE-2018-6070\", \"CVE-2018-6071\", \"CVE-2018-6072\",\n \"CVE-2018-6073\", \"CVE-2018-6074\", \"CVE-2018-6075\", \"CVE-2018-6076\",\n \"CVE-2018-6077\", \"CVE-2018-6078\", \"CVE-2018-6079\", \"CVE-2018-6080\",\n \"CVE-2018-6081\", \"CVE-2018-6082\", \"CVE-2018-6083\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2019-07-16 15:57:25 +0000 (Tue, 16 Jul 2019)\");\n script_tag(name:\"creation_date\", value:\"2018-03-07 17:41:21 +0530 (Wed, 07 Mar 2018)\");\n script_name(\"Google Chrome Multiple Security Vulnerabilities Mar18 (Mac OS X)\");\n\n script_tag(name:\"summary\", value:\"This host is installed with Google Chrome and is\n prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws are due to:\n\n - Multiple use after free errors in flash and Blink.\n\n - Race condition, type confusion and integer overflow errors in V8.\n\n - Buffer overflows errors in Skia, PDFium and WebGL.\n\n - Multiple incorrect permission errors on shared memory.\n\n - Same origin bypass error via canvas.\n\n - CSP bypass error through extensions.\n\n - Object lifecycle issues in Chrome custom.\n\n - Mark-of-the-Web bypass error.\n\n - Overly permissive cross origin download errors.\n\n - Timing attack error using SVG filters.\n\n - URL Spoof error in OmniBox.\n\n - Information disclosure error in IPC call.\n\n - XSS due to input validation error in interstitials.\n\n - Circumvention of port blocking error.\n\n - Incorrect processing error of AppManifests.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow attackers\n to cause a denial of service, manipulate shared memory, bypass the same origin\n policy, content-security-policy and mark-of-the-web, allow overly permissive\n cross origin downloads, spoof the URL, disclose sensitive information, perform\n cross site scripting or possibly have other unspecified impacts via crafted\n dimensions.\");\n\n script_tag(name:\"affected\", value:\"Google Chrome versions prior to\n 65.0.3325.146 on Mac OS X.\");\n\n script_tag(name:\"solution\", value:\"Upgrade to Google Chrome version\n 65.0.3325.146 or later.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_tag(name:\"qod_type\", value:\"executable_version\");\n script_xref(name:\"URL\", value:\"https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html\");\n\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_category(ACT_GATHER_INFO);\n script_family(\"General\");\n script_dependencies(\"gb_google_chrome_detect_macosx.nasl\");\n script_mandatory_keys(\"GoogleChrome/MacOSX/Version\");\n\n exit(0);\n}\n\ninclude(\"version_func.inc\");\ninclude(\"host_details.inc\");\n\nif(!infos = get_app_version_and_location(cpe:CPE, exit_no_version:TRUE))\n exit(0);\n\nvers = infos['version'];\npath = infos['location'];\n\nif(version_is_less(version:vers, test_version:\"65.0.3325.146\")) {\n report = report_fixed_ver(installed_version:vers, fixed_version:\"65.0.3325.146\", install_path:path);\n security_message(data:report);\n exit(0);\n}\n\nexit(99);", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-07-19T21:53:27", "description": "This host is installed with Google Chrome and is\n prone to multiple vulnerabilities.", "cvss3": {}, "published": "2018-03-07T00:00:00", "type": "openvas", "title": "Google Chrome Multiple Security Vulnerabilities Mar18 (Linux)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2018-6069", "CVE-2018-6078", "CVE-2018-6081", "CVE-2018-6080", "CVE-2018-6083", "CVE-2018-6082", "CVE-2018-6057", "CVE-2018-6070", "CVE-2018-6074", "CVE-2018-6059", "CVE-2018-6073", "CVE-2018-6061", "CVE-2018-6072", "CVE-2018-6058", "CVE-2018-6068", "CVE-2018-6065", "CVE-2018-6062", "CVE-2018-6067", "CVE-2018-6071", "CVE-2018-6066", "CVE-2018-6075", "CVE-2018-6064", "CVE-2018-6077", "CVE-2018-6076", "CVE-2018-6079", "CVE-2018-6060", "CVE-2018-6063"], "modified": "2019-07-17T00:00:00", "id": "OPENVAS:1361412562310812817", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310812817", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Google Chrome Multiple Security Vulnerabilities Mar18 (Linux)\n#\n# Authors:\n# Rajat Mishra <rajatm@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:google:chrome\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.812817\");\n script_version(\"2019-07-17T08:15:16+0000\");\n script_cve_id(\"CVE-2018-6057\", \"CVE-2018-6058\", \"CVE-2018-6059\", \"CVE-2018-6060\",\n \"CVE-2018-6061\", \"CVE-2018-6062\", \"CVE-2018-6063\", \"CVE-2018-6064\",\n \"CVE-2018-6065\", \"CVE-2018-6066\", \"CVE-2018-6067\", \"CVE-2018-6068\",\n \"CVE-2018-6069\", \"CVE-2018-6070\", \"CVE-2018-6071\", \"CVE-2018-6072\",\n \"CVE-2018-6073\", \"CVE-2018-6074\", \"CVE-2018-6075\", \"CVE-2018-6076\",\n \"CVE-2018-6077\", \"CVE-2018-6078\", \"CVE-2018-6079\", \"CVE-2018-6080\",\n \"CVE-2018-6081\", \"CVE-2018-6082\", \"CVE-2018-6083\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2019-07-17 08:15:16 +0000 (Wed, 17 Jul 2019)\");\n script_tag(name:\"creation_date\", value:\"2018-03-07 17:41:04 +0530 (Wed, 07 Mar 2018)\");\n script_name(\"Google Chrome Multiple Security Vulnerabilities Mar18 (Linux)\");\n\n script_tag(name:\"summary\", value:\"This host is installed with Google Chrome and is\n prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws are due to:\n\n - Multiple use after free errors in flash and Blink.\n\n - Race condition, type confusion and integer overflow errors in V8.\n\n - Buffer overflows errors in Skia, PDFium and WebGL.\n\n - Multiple incorrect permission errors on shared memory.\n\n - Same origin bypass error via canvas.\n\n - CSP bypass error through extensions.\n\n - Object lifecycle issues in Chrome custom.\n\n - Mark-of-the-Web bypass error.\n\n - Overly permissive cross origin download errors.\n\n - Timing attack error using SVG filters.\n\n - URL Spoof error in OmniBox.\n\n - Information disclosure error in IPC call.\n\n - XSS due to input validation error in interstitials.\n\n - Circumvention of port blocking error.\n\n - Incorrect processing error of AppManifests.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow attackers\n to cause a denial of service, manipulate shared memory, bypass the same origin\n policy, content-security-policy and mark-of-the-web, allow overly permissive\n cross origin downloads, spoof the URL, disclose sensitive information, perform\n cross site scripting or possibly have other unspecified impacts via crafted\n dimensions.\");\n\n script_tag(name:\"affected\", value:\"Google Chrome versions prior to 65.0.3325.146 on Linux.\");\n\n script_tag(name:\"solution\", value:\"Upgrade to Google Chrome version\n 65.0.3325.146 or later.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"executable_version\");\n script_xref(name:\"URL\", value:\"https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html\");\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_category(ACT_GATHER_INFO);\n script_family(\"General\");\n script_dependencies(\"gb_google_chrome_detect_lin.nasl\");\n script_mandatory_keys(\"Google-Chrome/Linux/Ver\");\n\n exit(0);\n}\n\ninclude(\"version_func.inc\");\ninclude(\"host_details.inc\");\n\nif(!infos = get_app_version_and_location(cpe:CPE, exit_no_version:TRUE )) exit(0);\nvers = infos['version'];\npath = infos['location'];\n\nif(version_is_less(version:vers, test_version:\"65.0.3325.146\"))\n{\n report = report_fixed_ver(installed_version:vers, fixed_version:\"65.0.3325.146\", install_path:path);\n security_message(data:report);\n exit(0);\n}\nexit(0);\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-01-31T18:27:08", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2017-12-09T00:00:00", "type": "openvas", "title": "openSUSE: Security Advisory for chromium (openSUSE-SU-2017:3244-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2017-15417", "CVE-2017-15409", "CVE-2017-15423", "CVE-2017-15419", "CVE-2017-15425", "CVE-2017-15410", "CVE-2017-15422", "CVE-2017-15427", "CVE-2017-15418", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15415", "CVE-2017-15426", "CVE-2017-15413", "CVE-2017-15408", "CVE-2017-15416", "CVE-2017-15424", "CVE-2017-15420"], "modified": "2020-01-31T00:00:00", "id": "OPENVAS:1361412562310851660", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310851660", "sourceData": "# Copyright (C) 2017 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) of their respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.851660\");\n script_version(\"2020-01-31T08:23:39+0000\");\n script_tag(name:\"last_modification\", value:\"2020-01-31 08:23:39 +0000 (Fri, 31 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2017-12-09 07:39:49 +0100 (Sat, 09 Dec 2017)\");\n script_cve_id(\"CVE-2017-15408\", \"CVE-2017-15409\", \"CVE-2017-15410\", \"CVE-2017-15411\",\n \"CVE-2017-15412\", \"CVE-2017-15413\", \"CVE-2017-15415\", \"CVE-2017-15416\",\n \"CVE-2017-15417\", \"CVE-2017-15418\", \"CVE-2017-15419\", \"CVE-2017-15420\",\n \"CVE-2017-15422\", \"CVE-2017-15423\", \"CVE-2017-15424\", \"CVE-2017-15425\",\n \"CVE-2017-15426\", \"CVE-2017-15427\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"openSUSE: Security Advisory for chromium (openSUSE-SU-2017:3244-1)\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'chromium'\n package(s) announced via the referenced advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"This update to Chromium 63.0.3239.84 fixes the following security issues:\n\n - CVE-2017-15408: Heap buffer overflow in PDFium\n\n - CVE-2017-15409: Out of bounds write in Skia\n\n - CVE-2017-15410: Use after free in PDFium\n\n - CVE-2017-15411: Use after free in PDFium\n\n - CVE-2017-15412: Use after free in libXML\n\n - CVE-2017-15413: Type confusion in WebAssembly\n\n - CVE-2017-15415: Pointer information disclosure in IPC call\n\n - CVE-2017-15416: Out of bounds read in Blink\n\n - CVE-2017-15417: Cross origin information disclosure in Skia\n\n - CVE-2017-15418: Use of uninitialized value in Skia\n\n - CVE-2017-15419: Cross origin leak of redirect URL in Blink\n\n - CVE-2017-15420: URL spoofing in Omnibox\n\n - CVE-2017-15422: Integer overflow in ICU\n\n - CVE-2017-15423: Issue with SPAKE implementation in BoringSSL\n\n - CVE-2017-15424: URL Spoof in Omnibox\n\n - CVE-2017-15425: URL Spoof in Omnibox\n\n - CVE-2017-15426: URL Spoof in Omnibox\n\n - CVE-2017-15427: Insufficient blocking of JavaScript in Omnibox\");\n\n script_tag(name:\"affected\", value:\"chromium on openSUSE Leap 42.3, openSUSE Leap 42.2\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_xref(name:\"openSUSE-SU\", value:\"2017:3244-1\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2017 Greenbone Networks GmbH\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse\", \"ssh/login/rpms\", re:\"ssh/login/release=(openSUSELeap42\\.2|openSUSELeap42\\.3)\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"openSUSELeap42.2\") {\n if(!isnull(res = isrpmvuln(pkg:\"chromedriver\", rpm:\"chromedriver~63.0.3239.84~104.41.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"chromedriver-debuginfo\", rpm:\"chromedriver-debuginfo~63.0.3239.84~104.41.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"chromium\", rpm:\"chromium~63.0.3239.84~104.41.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"chromium-debuginfo\", rpm:\"chromium-debuginfo~63.0.3239.84~104.41.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"chromium-debugsource\", rpm:\"chromium-debugsource~63.0.3239.84~104.41.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nif(release == \"openSUSELeap42.3\") {\n if(!isnull(res = isrpmvuln(pkg:\"chromedriver\", rpm:\"chromedriver~63.0.3239.84~127.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"chromedriver-debuginfo\", rpm:\"chromedriver-debuginfo~63.0.3239.84~127.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"chromium\", rpm:\"chromium~63.0.3239.84~127.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"chromium-debuginfo\", rpm:\"chromium-debuginfo~63.0.3239.84~127.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"chromium-debugsource\", rpm:\"chromium-debugsource~63.0.3239.84~127.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-07-19T22:09:53", "description": "The host is installed with Google Chrome\n and is prone to multiple vulnerabilities.", "cvss3": {}, "published": "2017-12-07T00:00:00", "type": "openvas", "title": "Google Chrome Security Updates(stable-channel-update-for-desktop-2017-12)-Linux", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2017-15417", "CVE-2017-15409", "CVE-2017-15423", "CVE-2017-15419", "CVE-2017-15425", "CVE-2017-15410", "CVE-2017-15422", "CVE-2017-15427", "CVE-2017-15407", "CVE-2017-15418", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15415", "CVE-2017-15426", "CVE-2017-15413", "CVE-2017-15408", "CVE-2017-15430", "CVE-2017-15416", "CVE-2017-15424", "CVE-2017-15420"], "modified": "2019-07-17T00:00:00", "id": "OPENVAS:1361412562310812236", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310812236", "sourceData": "##############################################################################\n# OpenVAS Vulnerability Test\n#\n# Google Chrome Security Updates(stable-channel-update-for-desktop-2017-12)-Linux\n#\n# Authors:\n# Rinu Kuriakose <krinu@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2017 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:google:chrome\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.812236\");\n script_version(\"2019-07-17T08:15:16+0000\");\n script_cve_id(\"CVE-2017-15407\", \"CVE-2017-15408\", \"CVE-2017-15409\", \"CVE-2017-15410\",\n \"CVE-2017-15411\", \"CVE-2017-15412\", \"CVE-2017-15413\", \"CVE-2017-15415\",\n \"CVE-2017-15416\", \"CVE-2017-15417\", \"CVE-2017-15418\", \"CVE-2017-15419\",\n \"CVE-2017-15420\", \"CVE-2017-15422\", \"CVE-2017-15423\", \"CVE-2017-15424\",\n \"CVE-2017-15425\", \"CVE-2017-15426\", \"CVE-2017-15427\", \"CVE-2017-15430\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"2019-07-17 08:15:16 +0000 (Wed, 17 Jul 2019)\");\n script_tag(name:\"creation_date\", value:\"2017-12-07 10:28:49 +0530 (Thu, 07 Dec 2017)\");\n script_name(\"Google Chrome Security Updates(stable-channel-update-for-desktop-2017-12)-Linux\");\n\n script_tag(name:\"summary\", value:\"The host is installed with Google Chrome\n and is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"The multiple flaws exists due to,\n\n - An out of bounds write error in in QUIC.\n\n - A heap buffer overflow error in PDFium.\n\n - An out of bounds write error in Skia.\n\n - An use after free error in PDFium.\n\n - An use after free error in libXML.\n\n - A type confusion error in WebAssembly.\n\n - Pointer information disclosure error in IPC call.\n\n - An out of bounds read error in Blink.\n\n - Cross origin information disclosure in Skia.\n\n - Use of uninitialized value in Skia.\n\n - Cross origin leak of redirect URL in Blink.\n\n - Multiple URL spoofing errors in Omnibox.\n\n - An integer overflow error in ICU.\n\n - An issue with SPAKE implementation in BoringSSL.\n\n - An insufficient blocking of JavaScript in Omnibox.\n\n - An unsafe navigation in Chromecast Plugin.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation of these\n vulnerabilities will allow remote attackers to execute arbitrary script,\n conduct spoofing attacks, data corruption or denial of service and\n information leak.\");\n\n script_tag(name:\"affected\", value:\"Google Chrome version prior to 63.0.3239.84 on Linux\");\n\n script_tag(name:\"solution\", value:\"Upgrade to Google Chrome version\n 63.0.3239.84 or later. Please see the references for more information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"executable_version\");\n script_xref(name:\"URL\", value:\"https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2017 Greenbone Networks GmbH\");\n script_family(\"General\");\n script_dependencies(\"gb_google_chrome_detect_lin.nasl\");\n script_mandatory_keys(\"Google-Chrome/Linux/Ver\");\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nif(!infos = get_app_version_and_location( cpe:CPE, exit_no_version:TRUE )) exit(0);\nvers = infos['version'];\npath = infos['location'];\n\nif(version_is_less(version:vers, test_version:\"63.0.3239.84\"))\n{\n report = report_fixed_ver( installed_version:vers, fixed_version:\"63.0.3239.84\", install_path:path );\n security_message(data:report);\n exit(0);\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T18:33:00", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2018-01-05T00:00:00", "type": "openvas", "title": "Fedora Update for chromium FEDORA-2017-c2645aa935", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2017-15417", "CVE-2017-15409", "CVE-2017-15423", "CVE-2017-15429", "CVE-2017-15419", "CVE-2017-15425", "CVE-2017-15410", "CVE-2017-15422", "CVE-2017-15427", "CVE-2017-15407", "CVE-2017-15418", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15415", "CVE-2017-15426", "CVE-2017-15413", "CVE-2017-15408", "CVE-2017-15416", "CVE-2017-15424", "CVE-2017-15420"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310873974", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310873974", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_fedora_2017_c2645aa935_chromium_fc27.nasl 14223 2019-03-15 13:49:35Z cfischer $\n#\n# Fedora Update for chromium FEDORA-2017-c2645aa935\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.873974\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2018-01-05 23:59:42 +0100 (Fri, 05 Jan 2018)\");\n script_cve_id(\"CVE-2017-15412\", \"CVE-2017-15422\", \"CVE-2017-15407\", \"CVE-2017-15408\",\n \"CVE-2017-15409\", \"CVE-2017-15410\", \"CVE-2017-15411\", \"CVE-2017-15413\",\n \"CVE-2017-15415\", \"CVE-2017-15416\", \"CVE-2017-15417\", \"CVE-2017-15418\",\n \"CVE-2017-15419\", \"CVE-2017-15420\", \"CVE-2017-15423\", \"CVE-2017-15424\",\n \"CVE-2017-15425\", \"CVE-2017-15426\", \"CVE-2017-15427\", \"CVE-2017-15429\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for chromium FEDORA-2017-c2645aa935\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'chromium'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"chromium on Fedora 27\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_xref(name:\"FEDORA\", value:\"2017-c2645aa935\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDKVCC2YPMOARJA2KQ3Y7FNIN2JW46EH\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC27\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC27\")\n{\n\n if ((res = isrpmvuln(pkg:\"chromium\", rpm:\"chromium~63.0.3239.108~1.fc27\", rls:\"FC27\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-07-19T22:09:48", "description": "The host is installed with Google Chrome\n and is prone to multiple vulnerabilities.", "cvss3": {}, "published": "2017-12-07T00:00:00", "type": "openvas", "title": "Google Chrome Security Updates(stable-channel-update-for-desktop-2017-12)-MAC OS X", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2017-15417", "CVE-2017-15409", "CVE-2017-15423", "CVE-2017-15419", "CVE-2017-15425", "CVE-2017-15410", "CVE-2017-15422", "CVE-2017-15427", "CVE-2017-15407", "CVE-2017-15418", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15415", "CVE-2017-15426", "CVE-2017-15413", "CVE-2017-15408", "CVE-2017-15430", "CVE-2017-15416", "CVE-2017-15424", "CVE-2017-15420"], "modified": "2019-07-17T00:00:00", "id": "OPENVAS:1361412562310812237", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310812237", "sourceData": "##############################################################################\n# OpenVAS Vulnerability Test\n#\n# Google Chrome Security Updates(stable-channel-update-for-desktop-2017-12)-MAC OS X\n#\n# Authors:\n# Rinu Kuriakose <krinu@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2017 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:google:chrome\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.812237\");\n script_version(\"2019-07-17T08:15:16+0000\");\n script_cve_id(\"CVE-2017-15407\", \"CVE-2017-15408\", \"CVE-2017-15409\", \"CVE-2017-15410\",\n \"CVE-2017-15411\", \"CVE-2017-15412\", \"CVE-2017-15413\", \"CVE-2017-15415\",\n \"CVE-2017-15416\", \"CVE-2017-15417\", \"CVE-2017-15418\", \"CVE-2017-15419\",\n \"CVE-2017-15420\", \"CVE-2017-15422\", \"CVE-2017-15423\", \"CVE-2017-15424\",\n \"CVE-2017-15425\", \"CVE-2017-15426\", \"CVE-2017-15427\", \"CVE-2017-15430\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"2019-07-17 08:15:16 +0000 (Wed, 17 Jul 2019)\");\n script_tag(name:\"creation_date\", value:\"2017-12-07 10:28:49 +0530 (Thu, 07 Dec 2017)\");\n script_name(\"Google Chrome Security Updates(stable-channel-update-for-desktop-2017-12)-MAC OS X\");\n\n script_tag(name:\"summary\", value:\"The host is installed with Google Chrome\n and is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"The multiple flaws exists due to,\n\n - An out of bounds write error in in QUIC.\n\n - A heap buffer overflow error in PDFium.\n\n - An out of bounds write error in Skia.\n\n - An use after free error in PDFium.\n\n - An use after free error in libXML.\n\n - A type confusion error in WebAssembly.\n\n - Pointer information disclosure error in IPC call.\n\n - An out of bounds read error in Blink.\n\n - Cross origin information disclosure in Skia.\n\n - Use of uninitialized value in Skia.\n\n - Cross origin leak of redirect URL in Blink.\n\n - Multiple URL spoofing errors in Omnibox.\n\n - An integer overflow error in ICU.\n\n - An issue with SPAKE implementation in BoringSSL.\n\n - An insufficient blocking of JavaScript in Omnibox.\n\n - An unsafe navigation in Chromecast Plugin.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation of these\n vulnerabilities will allow remote attackers to execute arbitrary script,\n conduct spoofing attacks, data corruption or denial of service an\n information leak.\");\n\n script_tag(name:\"affected\", value:\"Google Chrome version\n prior to 63.0.3239.84 on MAC OS X\");\n\n script_tag(name:\"solution\", value:\"Upgrade to Google Chrome version\n 63.0.3239.84 or later. Please see the references for more information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"executable_version\");\n script_xref(name:\"URL\", value:\"https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2017 Greenbone Networks GmbH\");\n script_family(\"General\");\n script_dependencies(\"gb_google_chrome_detect_macosx.nasl\");\n script_mandatory_keys(\"GoogleChrome/MacOSX/Version\");\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nif(!infos = get_app_version_and_location( cpe:CPE, exit_no_version:TRUE )) exit(0);\nvers = infos['version'];\npath = infos['location'];\n\nif(version_is_less(version:vers, test_version:\"63.0.3239.84\"))\n{\n report = report_fixed_ver( installed_version:vers, fixed_version:\"63.0.3239.84\", install_path:path );\n security_message(data:report);\n exit(0);\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-07-19T22:09:58", "description": "The host is installed with Google Chrome\n and is prone to multiple vulnerabilities.", "cvss3": {}, "published": "2017-12-07T00:00:00", "type": "openvas", "title": "Google Chrome Security Updates(stable-channel-update-for-desktop-2017-12)-Windows", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2017-15417", "CVE-2017-15409", "CVE-2017-15423", "CVE-2017-15419", "CVE-2017-15425", "CVE-2017-15410", "CVE-2017-15422", "CVE-2017-15427", "CVE-2017-15407", "CVE-2017-15418", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15415", "CVE-2017-15426", "CVE-2017-15413", "CVE-2017-15408", "CVE-2017-15430", "CVE-2017-15416", "CVE-2017-15424", "CVE-2017-15420"], "modified": "2019-07-17T00:00:00", "id": "OPENVAS:1361412562310812235", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310812235", "sourceData": "##############################################################################\n# OpenVAS Vulnerability Test\n#\n# Google Chrome Security Updates(stable-channel-update-for-desktop-2017-12)-Windows\n#\n# Authors:\n# Rinu Kuriakose <krinu@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2017 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:google:chrome\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.812235\");\n script_version(\"2019-07-17T08:15:16+0000\");\n script_cve_id(\"CVE-2017-15407\", \"CVE-2017-15408\", \"CVE-2017-15409\", \"CVE-2017-15410\",\n \"CVE-2017-15411\", \"CVE-2017-15412\", \"CVE-2017-15413\", \"CVE-2017-15415\",\n \"CVE-2017-15416\", \"CVE-2017-15417\", \"CVE-2017-15418\", \"CVE-2017-15419\",\n \"CVE-2017-15420\", \"CVE-2017-15422\", \"CVE-2017-15423\", \"CVE-2017-15424\",\n \"CVE-2017-15425\", \"CVE-2017-15426\", \"CVE-2017-15427\", \"CVE-2017-15430\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"2019-07-17 08:15:16 +0000 (Wed, 17 Jul 2019)\");\n script_tag(name:\"creation_date\", value:\"2017-12-07 10:28:49 +0530 (Thu, 07 Dec 2017)\");\n script_name(\"Google Chrome Security Updates(stable-channel-update-for-desktop-2017-12)-Windows\");\n\n script_tag(name:\"summary\", value:\"The host is installed with Google Chrome\n and is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"The multiple flaws exists due to,\n\n - An out of bounds write error in in QUIC.\n\n - A heap buffer overflow error in PDFium.\n\n - An out of bounds write error in Skia.\n\n - An use after free error in PDFium.\n\n - An use after free error in libXML.\n\n - A type confusion error in WebAssembly.\n\n - Pointer information disclosure error in IPC call.\n\n - An out of bounds read error in Blink.\n\n - Cross origin information disclosure in Skia.\n\n - Use of uninitialized value in Skia.\n\n - Cross origin leak of redirect URL in Blink.\n\n - Multiple URL spoofing errors in Omnibox.\n\n - An integer overflow error in ICU.\n\n - An issue with SPAKE implementation in BoringSSL.\n\n - An insufficient blocking of JavaScript in Omnibox.\n\n - An unsafe navigation in Chromecast Plugin.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation of these\n vulnerabilities will allow remote attackers to execute arbitrary script,\n conduct spoofing attacks, data corruption or denial of service and\n information leak.\");\n\n script_tag(name:\"affected\", value:\"Google Chrome version\n prior to 63.0.3239.84 on Windows\");\n\n script_tag(name:\"solution\", value:\"Upgrade to Google Chrome version\n 63.0.3239.84 or later. Please see the references for more information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"registry\");\n script_xref(name:\"URL\", value:\"https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2017 Greenbone Networks GmbH\");\n script_family(\"General\");\n script_dependencies(\"gb_google_chrome_detect_portable_win.nasl\");\n script_mandatory_keys(\"GoogleChrome/Win/Ver\");\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nif(!infos = get_app_version_and_location( cpe:CPE, exit_no_version:TRUE )) exit(0);\nvers = infos['version'];\npath = infos['location'];\n\nif(version_is_less(version:vers, test_version:\"63.0.3239.84\"))\n{\n report = report_fixed_ver( installed_version:vers, fixed_version:\"63.0.3239.84\", install_path:path );\n security_message(data:report);\n exit(0);\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-01-31T17:37:36", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2018-03-17T00:00:00", "type": "openvas", "title": "openSUSE: Security Advisory for Chromium (openSUSE-SU-2018:0704-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2018-6069", "CVE-2018-6078", "CVE-2018-6081", "CVE-2017-11215", "CVE-2018-6080", "CVE-2018-6083", "CVE-2018-6082", "CVE-2018-6057", "CVE-2018-6070", "CVE-2018-6074", "CVE-2018-6073", "CVE-2018-6061", "CVE-2018-6072", "CVE-2018-6068", "CVE-2018-6065", "CVE-2017-11225", "CVE-2018-6062", "CVE-2018-6067", "CVE-2018-6071", "CVE-2018-6066", "CVE-2018-6075", "CVE-2018-6064", "CVE-2018-6077", "CVE-2018-6076", "CVE-2018-6079", "CVE-2018-6060", "CVE-2018-6063"], "modified": "2020-01-31T00:00:00", "id": "OPENVAS:1361412562310851718", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310851718", "sourceData": "# Copyright (C) 2018 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) of their respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.851718\");\n script_version(\"2020-01-31T08:23:39+0000\");\n script_tag(name:\"last_modification\", value:\"2020-01-31 08:23:39 +0000 (Fri, 31 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2018-03-17 08:45:38 +0100 (Sat, 17 Mar 2018)\");\n script_cve_id(\"CVE-2017-11215\", \"CVE-2017-11225\", \"CVE-2018-6057\", \"CVE-2018-6060\",\n \"CVE-2018-6061\", \"CVE-2018-6062\", \"CVE-2018-6063\", \"CVE-2018-6064\",\n \"CVE-2018-6065\", \"CVE-2018-6066\", \"CVE-2018-6067\", \"CVE-2018-6068\",\n \"CVE-2018-6069\", \"CVE-2018-6070\", \"CVE-2018-6071\", \"CVE-2018-6072\",\n \"CVE-2018-6073\", \"CVE-2018-6074\", \"CVE-2018-6075\", \"CVE-2018-6076\",\n \"CVE-2018-6077\", \"CVE-2018-6078\", \"CVE-2018-6079\", \"CVE-2018-6080\",\n \"CVE-2018-6081\", \"CVE-2018-6082\", \"CVE-2018-6083\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"openSUSE: Security Advisory for Chromium (openSUSE-SU-2018:0704-1)\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'Chromium'\n package(s) announced via the referenced advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"This update for Chromium to version 65.0.3325.162 fixes the following\n issues:\n\n - CVE-2017-11215: Use after free in Flash\n\n - CVE-2017-11225: Use after free in Flash\n\n - CVE-2018-6060: Use after free in Blink\n\n - CVE-2018-6061: Race condition in V8\n\n - CVE-2018-6062: Heap buffer overflow in Skia\n\n - CVE-2018-6057: Incorrect permissions on shared memory\n\n - CVE-2018-6063: Incorrect permissions on shared memory\n\n - CVE-2018-6064: Type confusion in V8\n\n - CVE-2018-6065: Integer overflow in V8\n\n - CVE-2018-6066: Same Origin Bypass via canvas\n\n - CVE-2018-6067: Buffer overflow in Skia\n\n - CVE-2018-6068: Object lifecycle issues in Chrome Custom Tab\n\n - CVE-2018-6069: Stack buffer overflow in Skia\n\n - CVE-2018-6070: CSP bypass through extensions\n\n - CVE-2018-6071: Heap buffer overflow in Skia\n\n - CVE-2018-6072: Integer overflow in PDFium\n\n - CVE-2018-6073: Heap buffer overflow in WebGL\n\n - CVE-2018-6074: Mark-of-the-Web bypass\n\n - CVE-2018-6075: Overly permissive cross origin downloads\n\n - CVE-2018-6076: Incorrect handling of URL fragment identifiers in Blink\n\n - CVE-2018-6077: Timing attack using SVG filters\n\n - CVE-2018-6078: URL Spoof in OmniBox\n\n - CVE-2018-6079: Information disclosure via texture data in WebGL\n\n - CVE-2018-6080: Information disclosure in IPC call\n\n - CVE-2018-6081: XSS in interstitials\n\n - CVE-2018-6082: Circumvention of port blocking\n\n - CVE-2018-6083: Incorrect processing of AppManifests\");\n\n script_tag(name:\"affected\", value:\"Chromium on openSUSE Leap 42.3\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_xref(name:\"openSUSE-SU\", value:\"2018:0704-1\");\n script_xref(name:\"URL\", value:\"https://lists.opensuse.org/opensuse-security-announce/2018-03/msg00042.html\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse\", \"ssh/login/rpms\", re:\"ssh/login/release=openSUSELeap42\\.3\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"openSUSELeap42.3\") {\n if(!isnull(res = isrpmvuln(pkg:\"chromedriver\", rpm:\"chromedriver~65.0.3325.162~146.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"chromedriver-debuginfo\", rpm:\"chromedriver-debuginfo~65.0.3325.162~146.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"chromium\", rpm:\"chromium~65.0.3325.162~146.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"chromium-debuginfo\", rpm:\"chromium-debuginfo~65.0.3325.162~146.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"chromium-debugsource\", rpm:\"chromium-debugsource~65.0.3325.162~146.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:33:01", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2018-03-26T00:00:00", "type": "openvas", "title": "Fedora Update for qt5-qtwebengine FEDORA-2018-024afa2d48", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2018-6069", "CVE-2018-6081", "CVE-2018-6033", "CVE-2018-6082", "CVE-2017-15429", "CVE-2018-6073", "CVE-2018-6062", "CVE-2018-6071", "CVE-2018-6064", "CVE-2018-6076", "CVE-2018-6079", "CVE-2018-6060"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310874278", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310874278", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_fedora_2018_024afa2d48_qt5-qtwebengine_fc26.nasl 14223 2019-03-15 13:49:35Z cfischer $\n#\n# Fedora Update for qt5-qtwebengine FEDORA-2018-024afa2d48\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.874278\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2018-03-26 08:32:45 +0200 (Mon, 26 Mar 2018)\");\n script_cve_id(\"CVE-2017-15429\", \"CVE-2018-6033\", \"CVE-2018-6060\", \"CVE-2018-6062\",\n \"CVE-2018-6064\", \"CVE-2018-6069\", \"CVE-2018-6071\", \"CVE-2018-6073\",\n \"CVE-2018-6076\", \"CVE-2018-6079\", \"CVE-2018-6081\", \"CVE-2018-6082\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for qt5-qtwebengine FEDORA-2018-024afa2d48\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'qt5-qtwebengine'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"qt5-qtwebengine on Fedora 26\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_xref(name:\"FEDORA\", value:\"2018-024afa2d48\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36XZOQSLKLPBFKLG6D6YPO3YQIIWPTSU\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC26\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC26\")\n{\n\n if ((res = isrpmvuln(pkg:\"qt5-qtwebengine\", rpm:\"qt5-qtwebengine~5.10.1~4.fc26\", rls:\"FC26\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T18:32:56", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2018-03-26T00:00:00", "type": "openvas", "title": "Fedora Update for qt5-qtwebengine FEDORA-2018-44e1c23700", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2018-6069", "CVE-2018-6081", "CVE-2018-6033", "CVE-2018-6082", "CVE-2017-15429", "CVE-2018-6073", "CVE-2018-6062", "CVE-2018-6071", "CVE-2018-6064", "CVE-2018-6076", "CVE-2018-6079", "CVE-2018-6060"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310874280", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310874280", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_fedora_2018_44e1c23700_qt5-qtwebengine_fc27.nasl 14223 2019-03-15 13:49:35Z cfischer $\n#\n# Fedora Update for qt5-qtwebengine FEDORA-2018-44e1c23700\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.874280\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2018-03-26 08:33:29 +0200 (Mon, 26 Mar 2018)\");\n script_cve_id(\"CVE-2017-15429\", \"CVE-2018-6033\", \"CVE-2018-6060\", \"CVE-2018-6062\",\n \"CVE-2018-6064\", \"CVE-2018-6069\", \"CVE-2018-6071\", \"CVE-2018-6073\",\n \"CVE-2018-6076\", \"CVE-2018-6079\", \"CVE-2018-6081\", \"CVE-2018-6082\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for qt5-qtwebengine FEDORA-2018-44e1c23700\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'qt5-qtwebengine'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"qt5-qtwebengine on Fedora 27\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_xref(name:\"FEDORA\", value:\"2018-44e1c23700\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UH23YUKLEZNXH6IZWIPR24T3Q6OJLPSD\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC27\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC27\")\n{\n\n if ((res = isrpmvuln(pkg:\"qt5-qtwebengine\", rpm:\"qt5-qtwebengine~5.10.1~4.fc27\", rls:\"FC27\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T18:32:58", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2018-01-06T00:00:00", "type": "openvas", "title": "Fedora Update for chromium FEDORA-2017-ea44f172e3", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2017-5128", "CVE-2017-15417", "CVE-2017-5132", "CVE-2017-5131", "CVE-2017-15409", "CVE-2017-15423", "CVE-2017-15395", "CVE-2017-15390", "CVE-2017-15429", "CVE-2017-15391", "CVE-2017-5133", "CVE-2017-15419", "CVE-2017-15399", "CVE-2017-15392", "CVE-2017-15425", "CVE-2017-15410", "CVE-2017-5125", "CVE-2017-15389", "CVE-2017-15387", "CVE-2017-15422", "CVE-2017-15427", "CVE-2017-15407", "CVE-2017-15418", "CVE-2017-15411", "CVE-2017-5126", "CVE-2017-15412", "CVE-2017-15393", "CVE-2017-15415", "CVE-2017-5127", "CVE-2017-15398", "CVE-2017-15386", "CVE-2017-15426", "CVE-2017-15413", "CVE-2017-15408", "CVE-2017-15388", "CVE-2017-15416", "CVE-2017-15424", "CVE-2017-5129", "CVE-2017-15420", "CVE-2017-15394", "CVE-2017-5130", "CVE-2017-5124"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310873977", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310873977", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_fedora_2017_ea44f172e3_chromium_fc26.nasl 14223 2019-03-15 13:49:35Z cfischer $\n#\n# Fedora Update for chromium FEDORA-2017-ea44f172e3\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.873977\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2018-01-06 00:00:45 +0100 (Sat, 06 Jan 2018)\");\n script_cve_id(\"CVE-2017-15412\", \"CVE-2017-15422\", \"CVE-2017-15407\", \"CVE-2017-15408\",\n \"CVE-2017-15409\", \"CVE-2017-15410\", \"CVE-2017-15411\", \"CVE-2017-15413\",\n \"CVE-2017-15415\", \"CVE-2017-15416\", \"CVE-2017-15417\", \"CVE-2017-15418\",\n \"CVE-2017-15419\", \"CVE-2017-15420\", \"CVE-2017-15423\", \"CVE-2017-15424\",\n \"CVE-2017-15425\", \"CVE-2017-15426\", \"CVE-2017-15427\", \"CVE-2017-15429\",\n \"CVE-2017-15398\", \"CVE-2017-15399\", \"CVE-2017-15386\", \"CVE-2017-15387\",\n \"CVE-2017-15388\", \"CVE-2017-15389\", \"CVE-2017-15390\", \"CVE-2017-15391\",\n \"CVE-2017-15392\", \"CVE-2017-15393\", \"CVE-2017-15394\", \"CVE-2017-15395\",\n \"CVE-2017-5124\", \"CVE-2017-5125\", \"CVE-2017-5126\", \"CVE-2017-5127\",\n \"CVE-2017-5133\", \"CVE-2017-5131\", \"CVE-2017-5130\", \"CVE-2017-5132\",\n \"CVE-2017-5129\", \"CVE-2017-5128\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for chromium FEDORA-2017-ea44f172e3\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'chromium'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"chromium on Fedora 26\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_xref(name:\"FEDORA\", value:\"2017-ea44f172e3\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TCX6RNONWP5H4F6S2D3GX2IVGKVND34L\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC26\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC26\")\n{\n\n if ((res = isrpmvuln(pkg:\"chromium\", rpm:\"chromium~63.0.3239.108~1.fc26\", rls:\"FC26\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:32:57", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2018-02-28T00:00:00", "type": "openvas", "title": "Fedora Update for qt5-qtwebengine FEDORA-2018-c0d3db441f", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2018-6034", "CVE-2017-15409", "CVE-2018-6033", "CVE-2017-15423", "CVE-2018-6031", "CVE-2018-6053", "CVE-2017-15419", "CVE-2017-15425", "CVE-2017-15410", "CVE-2017-15422", "CVE-2018-6038", "CVE-2017-15407", "CVE-2018-6054", "CVE-2017-15418", "CVE-2017-15411", "CVE-2017-15415", "CVE-2018-6036", "CVE-2018-6037", "CVE-2018-6047", "CVE-2018-6041", "CVE-2018-6042", "CVE-2018-6040", "CVE-2017-15426", "CVE-2017-15416", "CVE-2017-15424", "CVE-2018-6050", "CVE-2018-6048", "CVE-2018-6052", "CVE-2018-6051"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310874155", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310874155", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_fedora_2018_c0d3db441f_qt5-qtwebengine_fc26.nasl 14223 2019-03-15 13:49:35Z cfischer $\n#\n# Fedora Update for qt5-qtwebengine FEDORA-2018-c0d3db441f\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.874155\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2018-02-28 08:38:39 +0100 (Wed, 28 Feb 2018)\");\n script_cve_id(\"CVE-2017-15407\", \"CVE-2017-15409\", \"CVE-2017-15410\", \"CVE-2017-15411\",\n \"CVE-2017-15415\", \"CVE-2017-15416\", \"CVE-2017-15418\", \"CVE-2017-15419\",\n \"CVE-2017-15422\", \"CVE-2017-15423\", \"CVE-2017-15424\", \"CVE-2017-15425\",\n \"CVE-2017-15426\", \"CVE-2018-6031\", \"CVE-2018-6033\", \"CVE-2018-6034\",\n \"CVE-2018-6036\", \"CVE-2018-6037\", \"CVE-2018-6038\", \"CVE-2018-6040\",\n \"CVE-2018-6041\", \"CVE-2018-6042\", \"CVE-2018-6047\", \"CVE-2018-6048\",\n \"CVE-2018-6050\", \"CVE-2018-6051\", \"CVE-2018-6052\", \"CVE-2018-6053\",\n \"CVE-2018-6054\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for qt5-qtwebengine FEDORA-2018-c0d3db441f\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'qt5-qtwebengine'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"qt5-qtwebengine on Fedora 26\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_xref(name:\"FEDORA\", value:\"2018-c0d3db441f\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TMXSXUQWLJLP4VC53CAE7HL3ZUFJZY6I\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC26\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC26\")\n{\n\n if ((res = isrpmvuln(pkg:\"qt5-qtwebengine\", rpm:\"qt5-qtwebengine~5.10.1~1.fc26\", rls:\"FC26\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T18:33:08", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2018-02-26T00:00:00", "type": "openvas", "title": "Fedora Update for qt5-qtwebengine FEDORA-2018-e08d828ed9", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2018-6034", "CVE-2017-15409", "CVE-2018-6033", "CVE-2017-15423", "CVE-2018-6031", "CVE-2018-6053", "CVE-2017-15419", "CVE-2017-15425", "CVE-2017-15410", "CVE-2017-15422", "CVE-2018-6038", "CVE-2017-15407", "CVE-2018-6054", "CVE-2017-15418", "CVE-2017-15411", "CVE-2017-15415", "CVE-2018-6036", "CVE-2018-6037", "CVE-2018-6047", "CVE-2018-6041", "CVE-2018-6042", "CVE-2018-6040", "CVE-2017-15426", "CVE-2017-15416", "CVE-2017-15424", "CVE-2018-6050", "CVE-2018-6048", "CVE-2018-6052", "CVE-2018-6051"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310874144", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310874144", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_fedora_2018_e08d828ed9_qt5-qtwebengine_fc27.nasl 14223 2019-03-15 13:49:35Z cfischer $\n#\n# Fedora Update for qt5-qtwebengine FEDORA-2018-e08d828ed9\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.874144\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2018-02-26 08:17:34 +0100 (Mon, 26 Feb 2018)\");\n script_cve_id(\"CVE-2017-15407\", \"CVE-2017-15409\", \"CVE-2017-15410\", \"CVE-2017-15411\",\n \"CVE-2017-15415\", \"CVE-2017-15416\", \"CVE-2017-15418\", \"CVE-2017-15419\",\n \"CVE-2017-15422\", \"CVE-2017-15423\", \"CVE-2017-15424\", \"CVE-2017-15425\",\n \"CVE-2017-15426\", \"CVE-2018-6031\", \"CVE-2018-6033\", \"CVE-2018-6034\",\n \"CVE-2018-6036\", \"CVE-2018-6037\", \"CVE-2018-6038\", \"CVE-2018-6040\",\n \"CVE-2018-6041\", \"CVE-2018-6042\", \"CVE-2018-6047\", \"CVE-2018-6048\",\n \"CVE-2018-6050\", \"CVE-2018-6051\", \"CVE-2018-6052\", \"CVE-2018-6053\",\n \"CVE-2018-6054\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for qt5-qtwebengine FEDORA-2018-e08d828ed9\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'qt5-qtwebengine'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"qt5-qtwebengine on Fedora 27\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_xref(name:\"FEDORA\", value:\"2018-e08d828ed9\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LGDSXXPN73LMQRMWCOGQL5XQFGUWIC7D\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC27\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC27\")\n{\n\n if ((res = isrpmvuln(pkg:\"qt5-qtwebengine\", rpm:\"qt5-qtwebengine~5.10.1~1.fc27\", rls:\"FC27\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-07-04T18:56:12", "description": "Several vulnerabilities have been discovered in the chromium web browser.\n\nCVE-2018-6056\nlokihardt discovered an error in the v8 javascript library.\n\nCVE-2018-6057\nGal Beniamini discovered errors related to shared memory permissions.\n\nCVE-2018-6060\nOmair discovered a use-after-free issue in blink/webkit.\n\nCVE-2018-6061\nGuang Gong discovered a race condition in the v8 javascript library.\n\nDescription truncated. Please see the references for more information.", "cvss3": {}, "published": "2018-04-28T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 4182-1 (chromium-browser - security update)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2018-6069", "CVE-2018-6078", "CVE-2018-6097", "CVE-2018-6103", "CVE-2018-6081", "CVE-2018-6099", "CVE-2018-6113", "CVE-2018-6080", "CVE-2018-6091", "CVE-2018-6104", "CVE-2018-6096", "CVE-2018-6083", "CVE-2018-6100", "CVE-2018-6082", "CVE-2018-6057", "CVE-2018-6070", "CVE-2018-6074", "CVE-2018-6098", "CVE-2018-6112", "CVE-2018-6110", "CVE-2018-6108", "CVE-2018-6102", "CVE-2018-6056", "CVE-2018-6114", "CVE-2018-6117", "CVE-2018-6109", "CVE-2018-6073", "CVE-2018-6095", "CVE-2018-6105", "CVE-2018-6093", "CVE-2018-6087", "CVE-2018-6061", "CVE-2018-6116", "CVE-2018-6106", "CVE-2018-6090", "CVE-2018-6072", "CVE-2018-6068", "CVE-2018-6088", "CVE-2018-6094", "CVE-2018-6065", "CVE-2018-6089", "CVE-2018-6062", "CVE-2018-6101", "CVE-2018-6107", "CVE-2018-6086", "CVE-2018-6067", "CVE-2018-6092", "CVE-2018-6071", "CVE-2018-6066", "CVE-2018-6075", "CVE-2018-6064", "CVE-2018-6077", "CVE-2018-6076", "CVE-2018-6111", "CVE-2018-6085", "CVE-2018-6079", "CVE-2018-6060", "CVE-2018-6063"], "modified": "2019-07-04T00:00:00", "id": "OPENVAS:1361412562310704182", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310704182", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Auto-generated from advisory DSA 4182-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2018 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License as published by\n# the Free Software Foundation; either version 2 of the License, or\n# (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.704182\");\n script_version(\"2019-07-04T09:25:28+0000\");\n script_cve_id(\"CVE-2018-6056\", \"CVE-2018-6057\", \"CVE-2018-6060\", \"CVE-2018-6061\", \"CVE-2018-6062\",\n \"CVE-2018-6063\", \"CVE-2018-6064\", \"CVE-2018-6065\", \"CVE-2018-6066\", \"CVE-2018-6067\",\n \"CVE-2018-6068\", \"CVE-2018-6069\", \"CVE-2018-6070\", \"CVE-2018-6071\", \"CVE-2018-6072\",\n \"CVE-2018-6073\", \"CVE-2018-6074\", \"CVE-2018-6075\", \"CVE-2018-6076\", \"CVE-2018-6077\",\n \"CVE-2018-6078\", \"CVE-2018-6079\", \"CVE-2018-6080\", \"CVE-2018-6081\", \"CVE-2018-6082\",\n \"CVE-2018-6083\", \"CVE-2018-6085\", \"CVE-2018-6086\", \"CVE-2018-6087\", \"CVE-2018-6088\",\n \"CVE-2018-6089\", \"CVE-2018-6090\", \"CVE-2018-6091\", \"CVE-2018-6092\", \"CVE-2018-6093\",\n \"CVE-2018-6094\", \"CVE-2018-6095\", \"CVE-2018-6096\", \"CVE-2018-6097\", \"CVE-2018-6098\",\n \"CVE-2018-6099\", \"CVE-2018-6100\", \"CVE-2018-6101\", \"CVE-2018-6102\", \"CVE-2018-6103\",\n \"CVE-2018-6104\", \"CVE-2018-6105\", \"CVE-2018-6106\", \"CVE-2018-6107\", \"CVE-2018-6108\",\n \"CVE-2018-6109\", \"CVE-2018-6110\", \"CVE-2018-6111\", \"CVE-2018-6112\", \"CVE-2018-6113\",\n \"CVE-2018-6114\", \"CVE-2018-6116\", \"CVE-2018-6117\");\n script_name(\"Debian Security Advisory DSA 4182-1 (chromium-browser - security update)\");\n script_tag(name:\"last_modification\", value:\"2019-07-04 09:25:28 +0000 (Thu, 04 Jul 2019)\");\n script_tag(name:\"creation_date\", value:\"2018-04-28 00:00:00 +0200 (Sat, 28 Apr 2018)\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n script_xref(name:\"URL\", value:\"https://www.debian.org/security/2018/dsa-4182.html\");\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2018 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB9\");\n script_tag(name:\"affected\", value:\"chromium-browser on Debian Linux\");\n script_tag(name:\"solution\", value:\"For the oldstable distribution (jessie), security support for chromium\nhas been discontinued.\n\nFor the stable distribution (stretch), these problems have been fixed in\nversion 66.0.3359.117-1~deb9u1.\n\nWe recommend that you upgrade your chromium-browser packages.\");\n\n script_xref(name:\"URL\", value:\"https://security-tracker.debian.org/tracker/chromium-browser\");\n script_tag(name:\"summary\", value:\"Several vulnerabilities have been discovered in the chromium web browser.\n\nCVE-2018-6056\nlokihardt discovered an error in the v8 javascript library.\n\nCVE-2018-6057\nGal Beniamini discovered errors related to shared memory permissions.\n\nCVE-2018-6060\nOmair discovered a use-after-free issue in blink/webkit.\n\nCVE-2018-6061\nGuang Gong discovered a race condition in the v8 javascript library.\n\nDescription truncated. Please see the references for more information.\");\n script_tag(name:\"vuldetect\", value:\"This check tests the installed software version using the apt package manager.\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif(!isnull(res = isdpkgvuln(pkg:\"chromedriver\", ver:\"66.0.3359.117-1~deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"chromium\", ver:\"66.0.3359.117-1~deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"chromium-driver\", ver:\"66.0.3359.117-1~deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"chromium-l10n\", ver:\"66.0.3359.117-1~deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"chromium-shell\", ver:\"66.0.3359.117-1~deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"chromium-widevine\", ver:\"66.0.3359.117-1~deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if(__pkg_match) {\n exit(99);\n}", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "redhat": [{"lastseen": "2021-10-19T20:36:02", "description": "Chromium is an open-source web browser, powered by WebKit (Blink).\n\nThis update upgrades Chromium to version 63.0.3239.84.\n\nSecurity Fix(es):\n\n* Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when visited by the victim. (CVE-2017-15407, CVE-2017-15408, CVE-2017-15409, CVE-2017-15410, CVE-2017-15411, CVE-2017-15412, CVE-2017-15413, CVE-2017-15415, CVE-2017-15416, CVE-2017-15417, CVE-2017-15418, CVE-2017-15419, CVE-2017-15420, CVE-2017-15422, CVE-2017-15423, CVE-2017-15424, CVE-2017-15425, CVE-2017-15426, CVE-2017-15427)", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2017-12-07T19:20:02", "type": "redhat", "title": "(RHSA-2017:3401) Critical: chromium-browser security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15407", "CVE-2017-15408", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15413", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15417", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15420", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426", "CVE-2017-15427"], "modified": "2018-06-07T14:21:49", "id": "RHSA-2017:3401", "href": "https://access.redhat.com/errata/RHSA-2017:3401", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-10-19T20:37:41", "description": "Chromium is an open-source web browser, powered by WebKit (Blink).\n\nThis update upgrades Chromium to version 65.0.3325.146.\n\nSecurity Fix(es):\n\n* chromium-browser: incorrect permissions on shared memory (CVE-2018-6057)\n\n* chromium-browser: use-after-free in blink (CVE-2018-6060)\n\n* chromium-browser: race condition in v8 (CVE-2018-6061)\n\n* chromium-browser: heap buffer overflow in skia (CVE-2018-6062)\n\n* chromium-browser: incorrect permissions on shared memory (CVE-2018-6063)\n\n* chromium-browser: type confusion in v8 (CVE-2018-6064)\n\n* chromium-browser: integer overflow in v8 (CVE-2018-6065)\n\n* chromium-browser: same origin bypass via canvas (CVE-2018-6066)\n\n* chromium-browser: buffer overflow in skia (CVE-2018-6067)\n\n* chromium-browser: stack buffer overflow in skia (CVE-2018-6069)\n\n* chromium-browser: csp bypass through extensions (CVE-2018-6070)\n\n* chromium-browser: heap bufffer overflow in skia (CVE-2018-6071)\n\n* chromium-browser: integer overflow in pdfium (CVE-2018-6072)\n\n* chromium-browser: heap bufffer overflow in webgl (CVE-2018-6073)\n\n* chromium-browser: mark-of-the-web bypass (CVE-2018-6074)\n\n* chromium-browser: overly permissive cross origin downloads (CVE-2018-6075)\n\n* chromium-browser: incorrect handling of url fragment identifiers in blink (CVE-2018-6076)\n\n* chromium-browser: timing attack using svg filters (CVE-2018-6077)\n\n* chromium-browser: url spoof in omnibox (CVE-2018-6078)\n\n* chromium-browser: information disclosure via texture data in webgl (CVE-2018-6079)\n\n* chromium-browser: information disclosure in ipc call (CVE-2018-6080)\n\n* chromium-browser: xss in interstitials (CVE-2018-6081)\n\n* chromium-browser: circumvention of port blocking (CVE-2018-6082)\n\n* chromium-browser: incorrect processing of appmanifests (CVE-2018-6083)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2018-03-12T17:29:32", "type": "redhat", "title": "(RHSA-2018:0484) Important: chromium-browser security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6057", "CVE-2018-6060", "CVE-2018-6061", "CVE-2018-6062", "CVE-2018-6063", "CVE-2018-6064", "CVE-2018-6065", "CVE-2018-6066", "CVE-2018-6067", "CVE-2018-6069", "CVE-2018-6070", "CVE-2018-6071", "CVE-2018-6072", "CVE-2018-6073", "CVE-2018-6074", "CVE-2018-6075", "CVE-2018-6076", "CVE-2018-6077", "CVE-2018-6078", "CVE-2018-6079", "CVE-2018-6080", "CVE-2018-6081", "CVE-2018-6082", "CVE-2018-6083"], "modified": "2018-06-07T14:21:53", "id": "RHSA-2018:0484", "href": "https://access.redhat.com/errata/RHSA-2018:0484", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "archlinux": [{"lastseen": "2021-07-28T14:34:05", "description": "Arch Linux Security Advisory ASA-201712-5\n=========================================\n\nSeverity: Critical\nDate : 2017-12-07\nCVE-ID : CVE-2017-15407 CVE-2017-15408 CVE-2017-15409 CVE-2017-15410\nCVE-2017-15411 CVE-2017-15412 CVE-2017-15413 CVE-2017-15415\nCVE-2017-15416 CVE-2017-15417 CVE-2017-15418 CVE-2017-15419\nCVE-2017-15420 CVE-2017-15422 CVE-2017-15423 CVE-2017-15424\nCVE-2017-15425 CVE-2017-15426 CVE-2017-15427\nPackage : chromium\nType : multiple issues\nRemote : Yes\nLink : https://security.archlinux.org/AVG-544\n\nSummary\n=======\n\nThe package chromium before version 63.0.3239.84-1 is vulnerable to\nmultiple issues including arbitrary code execution, content spoofing,\ninformation disclosure and access restriction bypass.\n\nResolution\n==========\n\nUpgrade to 63.0.3239.84-1.\n\n# pacman -Syu \"chromium>=63.0.3239.84-1\"\n\nThe problems have been fixed upstream in version 63.0.3239.84.\n\nWorkaround\n==========\n\nNone.\n\nDescription\n===========\n\n- CVE-2017-15407 (arbitrary code execution)\n\nAn out of bounds write has been found in the QUIC component of the\nChromium browser before 63.0.3239.84.\n\n- CVE-2017-15408 (arbitrary code execution)\n\nA heap-based buffer overflow has been found in the PDFium component of\nthe Chromium browser before 63.0.3239.84.\n\n- CVE-2017-15409 (arbitrary code execution)\n\nAn out of bounds write has been found in the Skia component of the\nChromium browser before 63.0.3239.84.\n\n- CVE-2017-15410 (arbitrary code execution)\n\nA use after free has been found in the PDFium component of the Chromium\nbrowser before 63.0.3239.84.\n\n- CVE-2017-15411 (arbitrary code execution)\n\nA use after free has been found in the PDFium component of the Chromium\nbrowser before 63.0.3239.84.\n\n- CVE-2017-15412 (arbitrary code execution)\n\nA use after free has been found in the libxml component of the Chromium\nbrowser before 63.0.3239.84.\n\n- CVE-2017-15413 (arbitrary code execution)\n\nA type confusion has been found in the WebAssembly component of the\nChromium browser before 63.0.3239.84.\n\n- CVE-2017-15415 (information disclosure)\n\nA pointer information disclosure has been found in the IPC call\ncomponent of the Chromium browser before 63.0.3239.84.\n\n- CVE-2017-15416 (information disclosure)\n\nAn out of bounds read has been found in the Blink component of the\nChromium browser before 63.0.3239.84.\n\n- CVE-2017-15417 (information disclosure)\n\nA cross-origin information disclosure has been found in the Skia\ncomponent of the Chromium browser before 63.0.3239.84.\n\n- CVE-2017-15418 (information disclosure)\n\nA use of uninitialized value has been found in the Skia component of\nthe Chromium browser before 63.0.3239.84.\n\n- CVE-2017-15419 (information disclosure)\n\nA cross-origin leak of redirect URL has been found in the Blink\ncomponent of the Chromium browser before 63.0.3239.84.\n\n- CVE-2017-15420 (content spoofing)\n\nA URL spoofing issue has been found in the Omnibox component of the\nChromium browser before 63.0.3239.84.\n\n- CVE-2017-15422 (arbitrary code execution)\n\nAn integer overflow has been found in the ICU component of the Chromium\nbrowser before 63.0.3239.84.\n\n- CVE-2017-15423 (information disclosure)\n\nAn information disclosure issue has been found in the SPAKE\nimplementation of the BoringSSL component of the Chromium browser\nbefore 63.0.3239.84.\n\n- CVE-2017-15424 (content spoofing)\n\nA URL spoofing issue has been found in the Omnibox component of the\nChromium browser before 63.0.3239.84.\n\n- CVE-2017-15425 (content spoofing)\n\nA URL spoofing issue has been found in the Omnibox component of the\nChromium browser before 63.0.3239.84.\n\n- CVE-2017-15426 (content spoofing)\n\nA URL spoofing issue has been found in the Omnibox component of the\nChromium browser before 63.0.3239.84.\n\n- CVE-2017-15427 (access restriction bypass)\n\nAn insufficient blocking of Javascript issue has been found in the\nOmnibox component of the Chromium browser before 63.0.3239.84.\n\nImpact\n======\n\nA remote attacker can execute arbitrary code on the affected host,\nspoof the URL, access sensitive information and bypass security\nmeasures.\n\nReferences\n==========\n\nhttps://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html\nhttps://crbug.com/778505\nhttps://crbug.com/762374\nhttps://crbug.com/763972\nhttps://crbug.com/765921\nhttps://crbug.com/770148\nhttps://crbug.com/727039\nhttps://crbug.com/766666\nhttps://crbug.com/765512\nhttps://crbug.com/779314\nhttps://crbug.com/699028\nhttps://crbug.com/765858\nhttps://crbug.com/780312\nhttps://crbug.com/777419\nhttps://crbug.com/774382\nhttps://github.com/google/boringssl/commit/696c13bd6ab78011adfe7b775519c8b7cc82b604\nhttps://crbug.com/778101\nhttps://crbug.com/756226\nhttps://crbug.com/756456\nhttps://crbug.com/756735\nhttps://crbug.com/768910\nhttps://security.archlinux.org/CVE-2017-15407\nhttps://security.archlinux.org/CVE-2017-15408\nhttps://security.archlinux.org/CVE-2017-15409\nhttps://security.archlinux.org/CVE-2017-15410\nhttps://security.archlinux.org/CVE-2017-15411\nhttps://security.archlinux.org/CVE-2017-15412\nhttps://security.archlinux.org/CVE-2017-15413\nhttps://security.archlinux.org/CVE-2017-15415\nhttps://security.archlinux.org/CVE-2017-15416\nhttps://security.archlinux.org/CVE-2017-15417\nhttps://security.archlinux.org/CVE-2017-15418\nhttps://security.archlinux.org/CVE-2017-15419\nhttps://security.archlinux.org/CVE-2017-15420\nhttps://security.archlinux.org/CVE-2017-15422\nhttps://security.archlinux.org/CVE-2017-15423\nhttps://security.archlinux.org/CVE-2017-15424\nhttps://security.archlinux.org/CVE-2017-15425\nhttps://security.archlinux.org/CVE-2017-15426\nhttps://security.archlinux.org/CVE-2017-15427", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2017-12-07T00:00:00", "type": "archlinux", "title": "[ASA-201712-5] chromium: multiple issues", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15407", "CVE-2017-15408", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15413", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15417", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15420", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426", "CVE-2017-15427"], "modified": "2017-12-07T00:00:00", "id": "ASA-201712-5", "href": "https://security.archlinux.org/ASA-201712-5", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-07-28T14:34:06", "description": "Arch Linux Security Advisory ASA-201710-31\n==========================================\n\nSeverity: Critical\nDate : 2017-10-27\nCVE-ID : CVE-2017-15396\nPackage : chromium\nType : arbitrary code execution\nRemote : Yes\nLink : https://security.archlinux.org/AVG-472\n\nSummary\n=======\n\nThe package chromium before version 62.0.3202.75-1 is vulnerable to\narbitrary code execution.\n\nResolution\n==========\n\nUpgrade to 62.0.3202.75-1.\n\n# pacman -Syu \"chromium>=62.0.3202.75-1\"\n\nThe problem has been fixed upstream in version 62.0.3202.75.\n\nWorkaround\n==========\n\nNone.\n\nDescription\n===========\n\nA stack overflow has been found in the V8 component of the chromium\nbrowser < 62.0.3202.75.\n\nImpact\n======\n\nA remote attacker can execute arbitrary code on the affected host.\n\nReferences\n==========\n\nhttps://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop_26.html\nhttps://crbug.com/770452\nhttps://security.archlinux.org/CVE-2017-15396", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "baseScore": 6.5, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 3.6}, "published": "2017-10-27T00:00:00", "type": "archlinux", "title": "[ASA-201710-31] chromium: arbitrary code execution", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15396"], "modified": "2017-10-27T00:00:00", "id": "ASA-201710-31", "href": "https://security.archlinux.org/ASA-201710-31", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}}], "kaspersky": [{"lastseen": "2021-08-18T11:15:42", "description": "### *Detect date*:\n12/07/2017\n\n### *Severity*:\nCritical\n\n### *Description*:\nMultiple serious vulnerabilities have been found in Google Chrome. Malicious users can exploit these vulnerabilities to cause denial of service, obtain sensitive information, spoof user interface, bypass security restrictions and possibly to execute arbitrary code.\n\n### *Affected products*:\nGoogle Chrome versions earlier than 63.0.3239.84\n\n### *Solution*:\nUpdate to the latest version. File with name old_chrome can be still detected after update. It caused by Google Chrome update policy which does not remove old versions when installing updates. Try to contact vendor for further delete instructions or ignore such kind of alerts at your own risk. \n[Download Google Chrome](<https://www.google.com/chrome/browser/desktop/>)\n\n### *Original advisories*:\n[Stable Channel Update for Desktop](<https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html>) \n\n\n### *Impacts*:\nACE \n\n### *Related products*:\n[Google Chrome](<https://threats.kaspersky.com/en/product/Google-Chrome/>)\n\n### *CVE-IDS*:\n[CVE-2017-15422](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15422>)4.3Warning \n[CVE-2017-15423](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15423>)5.0Critical \n[CVE-2017-15424](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15424>)4.3Warning \n[CVE-2017-15425](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15425>)4.3Warning \n[CVE-2017-15426](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15426>)4.3Warning \n[CVE-2017-15427](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15427>)4.3Warning \n[CVE-2017-15407](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15407>)6.8High \n[CVE-2017-15408](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15408>)6.8High \n[CVE-2017-15409](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15409>)6.8High \n[CVE-2017-15410](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15410>)6.8High \n[CVE-2017-15411](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15411>)6.8High \n[CVE-2017-15412](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15412>)6.8High \n[CVE-2017-15413](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15413>)6.8High \n[CVE-2017-15415](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15415>)4.3Warning \n[CVE-2017-15416](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15416>)4.3Warning \n[CVE-2017-15417](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15417>)2.6Warning \n[CVE-2017-15418](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15418>)4.3Warning \n[CVE-2017-15419](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15419>)4.3Warning \n[CVE-2017-15420](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15420>)4.3Warning", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2017-12-07T00:00:00", "type": "kaspersky", "title": "KLA11152 Multiple vulnerabilities in Google Chrome", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15407", "CVE-2017-15408", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15413", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15417", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15420", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426", "CVE-2017-15427"], "modified": "2020-06-03T00:00:00", "id": "KLA11152", "href": "https://threats.kaspersky.com/en/vulnerability/KLA11152/", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "debian": [{"lastseen": "2019-05-30T02:21:33", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-4064-1 security@debian.org\nhttps://www.debian.org/security/ Michael Gilbert\nDecember 12, 2017 https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : chromium-browser\nCVE ID : CVE-2017-15407 CVE-2017-15408 CVE-2017-15409 CVE-2017-15410\n CVE-2017-15411 CVE-2017-15413 CVE-2017-15415 CVE-2017-15416\n CVE-2017-15417 CVE-2017-15418 CVE-2017-15419 CVE-2017-15420\n CVE-2017-15423 CVE-2017-15424 CVE-2017-15425 CVE-2017-15426\n CVE-2017-15427\n\nSeveral vulnerabilities have been discovered in the chromium web browser.\n\nCVE-2017-15407\n\n Ned Williamson discovered an out-of-bounds write issue.\n\nCVE-2017-15408\n\n Ke Liu discovered a heap overflow issue in the pdfium library.\n\nCVE-2017-15409\n\n An out-of-bounds write issue was discovered in the skia library.\n\nCVE-2017-15410\n\n Luat Nguyen discovered a use-after-free issue in the pdfium library.\n\nCVE-2017-15411\n\n Luat Nguyen discovered a use-after-free issue in the pdfium library.\n\nCVE-2017-15413\n\n Gaurav Dewan discovered a type confusion issue.\n\nCVE-2017-15415\n\n Viktor Brange discovered an information disclosure issue.\n\nCVE-2017-15416\n\n Ned Williamson discovered an out-of-bounds read issue.\n\nCVE-2017-15417\n\n Max May discovered an information disclosure issue in the skia\n library.\n\nCVE-2017-15418\n\n Kushal Arvind Shah discovered an uninitialized value in the skia\n library.\n\nCVE-2017-15419\n\n Jun Kokatsu discoved an information disclosure issue.\n\nCVE-2017-15420\n\n WenXu Wu discovered a URL spoofing issue.\n\nCVE-2017-15423\n\n Greg Hudson discovered an issue in the boringssl library.\n\nCVE-2017-15424\n\n Khalil Zhani discovered a URL spoofing issue.\n\nCVE-2017-15425\n\n xisigr discovered a URL spoofing issue.\n\nCVE-2017-15426\n\n WenXu Wu discovered a URL spoofing issue.\n\nCVE-2017-15427\n\n Junaid Farhan discovered an issue with the omnibox.\n\nFor the stable distribution (stretch), these problems have been fixed in\nversion 63.0.3239.84-1~deb9u1.\n\nWe recommend that you upgrade your chromium-browser packages.\n\nFor the detailed security status of chromium-browser please refer to\nits security tracker page at:\nhttps://security-tracker.debian.org/tracker/chromium-browser\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2017-12-12T11:04:40", "type": "debian", "title": "[SECURITY] [DSA 4064-1] chromium-browser security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15417", "CVE-2017-15409", "CVE-2017-15423", "CVE-2017-15419", "CVE-2017-15425", "CVE-2017-15410", "CVE-2017-15427", "CVE-2017-15407", "CVE-2017-15418", "CVE-2017-15411", "CVE-2017-15415", "CVE-2017-15426", "CVE-2017-15413", "CVE-2017-15408", "CVE-2017-15416", "CVE-2017-15424", "CVE-2017-15420"], "modified": "2017-12-12T11:04:40", "id": "DEBIAN:DSA-4064-1:25480", "href": "https://lists.debian.org/debian-security-announce/debian-security-announce-2017/msg00327.html", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-10-21T19:01:52", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-4182-1 security@debian.org\nhttps://www.debian.org/security/ Michael Gilbert\nApril 28, 2018 https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : chromium-browser\nCVE ID : CVE-2018-6056 CVE-2018-6057 CVE-2018-6060 CVE-2018-6061\n CVE-2018-6062 CVE-2018-6063 CVE-2018-6064 CVE-2018-6065\n CVE-2018-6066 CVE-2018-6067 CVE-2018-6068 CVE-2018-6069\n CVE-2018-6070 CVE-2018-6071 CVE-2018-6072 CVE-2018-6073\n CVE-2018-6074 CVE-2018-6075 CVE-2018-6076 CVE-2018-6077\n CVE-2018-6078 CVE-2018-6079 CVE-2018-6080 CVE-2018-6081\n CVE-2018-6082 CVE-2018-6083 CVE-2018-6085 CVE-2018-6086\n CVE-2018-6087 CVE-2018-6088 CVE-2018-6089 CVE-2018-6090\n CVE-2018-6091 CVE-2018-6092 CVE-2018-6093 CVE-2018-6094\n CVE-2018-6095 CVE-2018-6096 CVE-2018-6097 CVE-2018-6098\n CVE-2018-6099 CVE-2018-6100 CVE-2018-6101 CVE-2018-6102\n CVE-2018-6103 CVE-2018-6104 CVE-2018-6105 CVE-2018-6106\n CVE-2018-6107 CVE-2018-6108 CVE-2018-6109 CVE-2018-6110\n CVE-2018-6111 CVE-2018-6112 CVE-2018-6113 CVE-2018-6114\n CVE-2018-6116 CVE-2018-6117\n\nSeveral vulnerabilities have been discovered in the chromium web browser.\n\nCVE-2018-6056\n\n lokihardt discovered an error in the v8 javascript library.\n\nCVE-2018-6057\n\n Gal Beniamini discovered errors related to shared memory permissions.\n\nCVE-2018-6060\n\n Omair discovered a use-after-free issue in blink/webkit.\n\nCVE-2018-6061\n\n Guang Gong discovered a race condition in the v8 javascript library.\n\nCVE-2018-6062\n\n A heap overflow issue was discovered in the v8 javascript library.\n\nCVE-2018-6063\n\n Gal Beniamini discovered errors related to shared memory permissions.\n\nCVE-2018-6064\n\n lokihardt discovered a type confusion error in the v8 javascript\n library.\n\nCVE-2018-6065\n\n Mark Brand discovered an integer overflow issue in the v8 javascript\n library.\n\nCVE-2018-6066\n\n Masato Kinugawa discovered a way to bypass the Same Origin Policy.\n\nCVE-2018-6067\n\n Ned Williamson discovered a buffer overflow issue in the skia library.\n\nCVE-2018-6068\n\n Luan Herrera discovered object lifecycle issues.\n\nCVE-2018-6069\n\n Wanglu and Yangkang discovered a stack overflow issue in the skia\n library.\n\nCVE-2018-6070\n\n Rob Wu discovered a way to bypass the Content Security Policy.\n\nCVE-2018-6071\n\n A heap overflow issue was discovered in the skia library.\n\nCVE-2018-6072\n\n Atte Kettunen discovered an integer overflow issue in the pdfium\n library.\n\nCVE-2018-6073\n\n Omair discover a heap overflow issue in the WebGL implementation.\n\nCVE-2018-6074\n\n Abdulrahman Alqabandi discovered a way to cause a downloaded web page\n to not contain a Mark of the Web.\n\nCVE-2018-6075\n\n Inti De Ceukelaire discovered a way to bypass the Same Origin Policy.\n\nCVE-2018-6076\n\n Mateusz Krzeszowiec discovered that URL fragment identifiers could be\n handled incorrectly.\n\nCVE-2018-6077\n\n Khalil Zhani discovered a timing issue.\n\nCVE-2018-6078\n\n Khalil Zhani discovered a URL spoofing issue.\n\nCVE-2018-6079\n\n Ivars discovered an information disclosure issue.\n\nCVE-2018-6080\n\n Gal Beniamini discovered an information disclosure issue.\n\nCVE-2018-6081\n\n Rob Wu discovered a cross-site scripting issue.\n\nCVE-2018-6082\n\n WenXu Wu discovered a way to bypass blocked ports.\n\nCVE-2018-6083\n\n Jun Kokatsu discovered that AppManifests could be handled incorrectly.\n\nCVE-2018-6085\n\n Ned Williamson discovered a use-after-free issue.\n\nCVE-2018-6086\n\n Ned Williamson discovered a use-after-free issue.\n\nCVE-2018-6087\n\n A use-after-free issue was discovered in the WebAssembly implementation.\n\nCVE-2018-6088\n\n A use-after-free issue was discovered in the pdfium library.\n\nCVE-2018-6089\n\n Rob Wu discovered a way to bypass the Same Origin Policy.\n\nCVE-2018-6090\n\n ZhanJia Song discovered a heap overflow issue in the skia library.\n\nCVE-2018-6091\n\n Jun Kokatsu discovered that plugins could be handled incorrectly.\n\nCVE-2018-6092\n\n Natalie Silvanovich discovered an integer overflow issue in the\n WebAssembly implementation.\n\nCVE-2018-6093\n\n Jun Kokatsu discovered a way to bypass the Same Origin Policy.\n\nCVE-2018-6094\n\n Chris Rohlf discovered a regression in garbage collection hardening.\n\nCVE-2018-6095\n\n Abdulrahman Alqabandi discovered files could be uploaded without user\n interaction.\n\nCVE-2018-6096\n\n WenXu Wu discovered a user interface spoofing issue.\n\nCVE-2018-6097\n\n xisigr discovered a user interface spoofing issue.\n\nCVE-2018-6098\n\n Khalil Zhani discovered a URL spoofing issue.\n\nCVE-2018-6099\n\n Jun Kokatsu discovered a way to bypass the Cross Origin Resource\n Sharing mechanism.\n\nCVE-2018-6100\n\n Lnyas Zhang dsicovered a URL spoofing issue.\n\nCVE-2018-6101\n\n Rob Wu discovered an issue in the developer tools remote debugging\n protocol.\n\nCVE-2018-6102\n\n Khalil Zhani discovered a URL spoofing issue.\n\nCVE-2018-6103\n\n Khalil Zhani discovered a user interface spoofing issue.\n\nCVE-2018-6104\n\n Khalil Zhani discovered a URL spoofing issue.\n\nCVE-2018-6105\n\n Khalil Zhani discovered a URL spoofing issue.\n\nCVE-2018-6106\n\n lokihardt discovered that v8 promises could be handled incorrectly.\n\nCVE-2018-6107\n\n Khalil Zhani discovered a URL spoofing issue.\n\nCVE-2018-6108\n\n Khalil Zhani discovered a URL spoofing issue.\n\nCVE-2018-6109\n\n Dominik Weber discovered a way to misuse the FileAPI feature.\n\nCVE-2018-6110\n\n Wenxiang Qian discovered that local plain text files could be handled\n incorrectly.\n\nCVE-2018-6111\n\n Khalil Zhani discovered a use-after-free issue in the developer tools.\n\nCVE-2018-6112\n\n Khalil Zhani discovered incorrect handling of URLs in the developer\n tools.\n\nCVE-2018-6113\n\n Khalil Zhani discovered a URL spoofing issue.\n\nCVE-2018-6114\n\n Lnyas Zhang discovered a way to bypass the Content Security Policy.\n\nCVE-2018-6116\n\n Chengdu Security Response Center discovered an error when memory\n is low.\n\nCVE-2018-6117\n\n Spencer Dailey discovered an error in form autofill settings.\n\nFor the oldstable distribution (jessie), security support for chromium\nhas been discontinued.\n\nFor the stable distribution (stretch), these problems have been fixed in\nversion 66.0.3359.117-1~deb9u1.\n\nWe recommend that you upgrade your chromium-browser packages.\n\nFor the detailed security status of chromium-browser please refer to\nits security tracker page at:\nhttps://security-tracker.debian.org/tracker/chromium-browser\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2018-04-28T05:30:48", "type": "debian", "title": "[SECURITY] [DSA 4182-1] chromium-browser security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6056", "CVE-2018-6057", "CVE-2018-6060", "CVE-2018-6061", "CVE-2018-6062", "CVE-2018-6063", "CVE-2018-6064", "CVE-2018-6065", "CVE-2018-6066", "CVE-2018-6067", "CVE-2018-6068", "CVE-2018-6069", "CVE-2018-6070", "CVE-2018-6071", "CVE-2018-6072", "CVE-2018-6073", "CVE-2018-6074", "CVE-2018-6075", "CVE-2018-6076", "CVE-2018-6077", "CVE-2018-6078", "CVE-2018-6079", "CVE-2018-6080", "CVE-2018-6081", "CVE-2018-6082", "CVE-2018-6083", "CVE-2018-6085", "CVE-2018-6086", "CVE-2018-6087", "CVE-2018-6088", "CVE-2018-6089", "CVE-2018-6090", "CVE-2018-6091", "CVE-2018-6092", "CVE-2018-6093", "CVE-2018-6094", "CVE-2018-6095", "CVE-2018-6096", "CVE-2018-6097", "CVE-2018-6098", "CVE-2018-6099", "CVE-2018-6100", "CVE-2018-6101", "CVE-2018-6102", "CVE-2018-6103", "CVE-2018-6104", "CVE-2018-6105", "CVE-2018-6106", "CVE-2018-6107", "CVE-2018-6108", "CVE-2018-6109", "CVE-2018-6110", "CVE-2018-6111", "CVE-2018-6112", "CVE-2018-6113", "CVE-2018-6114", "CVE-2018-6116", "CVE-2018-6117"], "modified": "2018-04-28T05:30:48", "id": "DEBIAN:DSA-4182-1:2D0C5", "href": "https://lists.debian.org/debian-security-announce/2018/msg00108.html", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-11-29T22:34:28", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-4182-1 security@debian.org\nhttps://www.debian.org/security/ Michael Gilbert\nApril 28, 2018 https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : chromium-browser\nCVE ID : CVE-2018-6056 CVE-2018-6057 CVE-2018-6060 CVE-2018-6061\n CVE-2018-6062 CVE-2018-6063 CVE-2018-6064 CVE-2018-6065\n CVE-2018-6066 CVE-2018-6067 CVE-2018-6068 CVE-2018-6069\n CVE-2018-6070 CVE-2018-6071 CVE-2018-6072 CVE-2018-6073\n CVE-2018-6074 CVE-2018-6075 CVE-2018-6076 CVE-2018-6077\n CVE-2018-6078 CVE-2018-6079 CVE-2018-6080 CVE-2018-6081\n CVE-2018-6082 CVE-2018-6083 CVE-2018-6085 CVE-2018-6086\n CVE-2018-6087 CVE-2018-6088 CVE-2018-6089 CVE-2018-6090\n CVE-2018-6091 CVE-2018-6092 CVE-2018-6093 CVE-2018-6094\n CVE-2018-6095 CVE-2018-6096 CVE-2018-6097 CVE-2018-6098\n CVE-2018-6099 CVE-2018-6100 CVE-2018-6101 CVE-2018-6102\n CVE-2018-6103 CVE-2018-6104 CVE-2018-6105 CVE-2018-6106\n CVE-2018-6107 CVE-2018-6108 CVE-2018-6109 CVE-2018-6110\n CVE-2018-6111 CVE-2018-6112 CVE-2018-6113 CVE-2018-6114\n CVE-2018-6116 CVE-2018-6117\n\nSeveral vulnerabilities have been discovered in the chromium web browser.\n\nCVE-2018-6056\n\n lokihardt discovered an error in the v8 javascript library.\n\nCVE-2018-6057\n\n Gal Beniamini discovered errors related to shared memory permissions.\n\nCVE-2018-6060\n\n Omair discovered a use-after-free issue in blink/webkit.\n\nCVE-2018-6061\n\n Guang Gong discovered a race condition in the v8 javascript library.\n\nCVE-2018-6062\n\n A heap overflow issue was discovered in the v8 javascript library.\n\nCVE-2018-6063\n\n Gal Beniamini discovered errors related to shared memory permissions.\n\nCVE-2018-6064\n\n lokihardt discovered a type confusion error in the v8 javascript\n library.\n\nCVE-2018-6065\n\n Mark Brand discovered an integer overflow issue in the v8 javascript\n library.\n\nCVE-2018-6066\n\n Masato Kinugawa discovered a way to bypass the Same Origin Policy.\n\nCVE-2018-6067\n\n Ned Williamson discovered a buffer overflow issue in the skia library.\n\nCVE-2018-6068\n\n Luan Herrera discovered object lifecycle issues.\n\nCVE-2018-6069\n\n Wanglu and Yangkang discovered a stack overflow issue in the skia\n library.\n\nCVE-2018-6070\n\n Rob Wu discovered a way to bypass the Content Security Policy.\n\nCVE-2018-6071\n\n A heap overflow issue was discovered in the skia library.\n\nCVE-2018-6072\n\n Atte Kettunen discovered an integer overflow issue in the pdfium\n library.\n\nCVE-2018-6073\n\n Omair discover a heap overflow issue in the WebGL implementation.\n\nCVE-2018-6074\n\n Abdulrahman Alqabandi discovered a way to cause a downloaded web page\n to not contain a Mark of the Web.\n\nCVE-2018-6075\n\n Inti De Ceukelaire discovered a way to bypass the Same Origin Policy.\n\nCVE-2018-6076\n\n Mateusz Krzeszowiec discovered that URL fragment identifiers could be\n handled incorrectly.\n\nCVE-2018-6077\n\n Khalil Zhani discovered a timing issue.\n\nCVE-2018-6078\n\n Khalil Zhani discovered a URL spoofing issue.\n\nCVE-2018-6079\n\n Ivars discovered an information disclosure issue.\n\nCVE-2018-6080\n\n Gal Beniamini discovered an information disclosure issue.\n\nCVE-2018-6081\n\n Rob Wu discovered a cross-site scripting issue.\n\nCVE-2018-6082\n\n WenXu Wu discovered a way to bypass blocked ports.\n\nCVE-2018-6083\n\n Jun Kokatsu discovered that AppManifests could be handled incorrectly.\n\nCVE-2018-6085\n\n Ned Williamson discovered a use-after-free issue.\n\nCVE-2018-6086\n\n Ned Williamson discovered a use-after-free issue.\n\nCVE-2018-6087\n\n A use-after-free issue was discovered in the WebAssembly implementation.\n\nCVE-2018-6088\n\n A use-after-free issue was discovered in the pdfium library.\n\nCVE-2018-6089\n\n Rob Wu discovered a way to bypass the Same Origin Policy.\n\nCVE-2018-6090\n\n ZhanJia Song discovered a heap overflow issue in the skia library.\n\nCVE-2018-6091\n\n Jun Kokatsu discovered that plugins could be handled incorrectly.\n\nCVE-2018-6092\n\n Natalie Silvanovich discovered an integer overflow issue in the\n WebAssembly implementation.\n\nCVE-2018-6093\n\n Jun Kokatsu discovered a way to bypass the Same Origin Policy.\n\nCVE-2018-6094\n\n Chris Rohlf discovered a regression in garbage collection hardening.\n\nCVE-2018-6095\n\n Abdulrahman Alqabandi discovered files could be uploaded without user\n interaction.\n\nCVE-2018-6096\n\n WenXu Wu discovered a user interface spoofing issue.\n\nCVE-2018-6097\n\n xisigr discovered a user interface spoofing issue.\n\nCVE-2018-6098\n\n Khalil Zhani discovered a URL spoofing issue.\n\nCVE-2018-6099\n\n Jun Kokatsu discovered a way to bypass the Cross Origin Resource\n Sharing mechanism.\n\nCVE-2018-6100\n\n Lnyas Zhang dsicovered a URL spoofing issue.\n\nCVE-2018-6101\n\n Rob Wu discovered an issue in the developer tools remote debugging\n protocol.\n\nCVE-2018-6102\n\n Khalil Zhani discovered a URL spoofing issue.\n\nCVE-2018-6103\n\n Khalil Zhani discovered a user interface spoofing issue.\n\nCVE-2018-6104\n\n Khalil Zhani discovered a URL spoofing issue.\n\nCVE-2018-6105\n\n Khalil Zhani discovered a URL spoofing issue.\n\nCVE-2018-6106\n\n lokihardt discovered that v8 promises could be handled incorrectly.\n\nCVE-2018-6107\n\n Khalil Zhani discovered a URL spoofing issue.\n\nCVE-2018-6108\n\n Khalil Zhani discovered a URL spoofing issue.\n\nCVE-2018-6109\n\n Dominik Weber discovered a way to misuse the FileAPI feature.\n\nCVE-2018-6110\n\n Wenxiang Qian discovered that local plain text files could be handled\n incorrectly.\n\nCVE-2018-6111\n\n Khalil Zhani discovered a use-after-free issue in the developer tools.\n\nCVE-2018-6112\n\n Khalil Zhani discovered incorrect handling of URLs in the developer\n tools.\n\nCVE-2018-6113\n\n Khalil Zhani discovered a URL spoofing issue.\n\nCVE-2018-6114\n\n Lnyas Zhang discovered a way to bypass the Content Security Policy.\n\nCVE-2018-6116\n\n Chengdu Security Response Center discovered an error when memory\n is low.\n\nCVE-2018-6117\n\n Spencer Dailey discovered an error in form autofill settings.\n\nFor the oldstable distribution (jessie), security support for chromium\nhas been discontinued.\n\nFor the stable distribution (stretch), these problems have been fixed in\nversion 66.0.3359.117-1~deb9u1.\n\nWe recommend that you upgrade your chromium-browser packages.\n\nFor the detailed security status of chromium-browser please refer to\nits security tracker page at:\nhttps://security-tracker.debian.org/tracker/chromium-browser\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2018-04-28T05:30:48", "type": "debian", "title": "[SECURITY] [DSA 4182-1] chromium-browser security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6056", "CVE-2018-6057", "CVE-2018-6060", "CVE-2018-6061", "CVE-2018-6062", "CVE-2018-6063", "CVE-2018-6064", "CVE-2018-6065", "CVE-2018-6066", "CVE-2018-6067", "CVE-2018-6068", "CVE-2018-6069", "CVE-2018-6070", "CVE-2018-6071", "CVE-2018-6072", "CVE-2018-6073", "CVE-2018-6074", "CVE-2018-6075", "CVE-2018-6076", "CVE-2018-6077", "CVE-2018-6078", "CVE-2018-6079", "CVE-2018-6080", "CVE-2018-6081", "CVE-2018-6082", "CVE-2018-6083", "CVE-2018-6085", "CVE-2018-6086", "CVE-2018-6087", "CVE-2018-6088", "CVE-2018-6089", "CVE-2018-6090", "CVE-2018-6091", "CVE-2018-6092", "CVE-2018-6093", "CVE-2018-6094", "CVE-2018-6095", "CVE-2018-6096", "CVE-2018-6097", "CVE-2018-6098", "CVE-2018-6099", "CVE-2018-6100", "CVE-2018-6101", "CVE-2018-6102", "CVE-2018-6103", "CVE-2018-6104", "CVE-2018-6105", "CVE-2018-6106", "CVE-2018-6107", "CVE-2018-6108", "CVE-2018-6109", "CVE-2018-6110", "CVE-2018-6111", "CVE-2018-6112", "CVE-2018-6113", "CVE-2018-6114", "CVE-2018-6116", "CVE-2018-6117"], "modified": "2018-04-28T05:30:48", "id": "DEBIAN:DSA-4182-1:617C4", "href": "https://lists.debian.org/debian-security-announce/2018/msg00108.html", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "gentoo": [{"lastseen": "2022-01-17T19:04:31", "description": "### Background\n\nChromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web. \n\nGoogle Chrome is one fast, simple, and secure browser for all your devices. \n\n### Description\n\nMultiple vulnerabilities have been discovered in Chromium and Google Chrome. Please review the referenced CVE identifiers and Google Chrome Releases for details. \n\n### Impact\n\nA remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, bypass content security controls, or conduct URL spoofing. \n\n### Workaround\n\nThere is no known workaround at this time.\n\n### Resolution\n\nAll Chromium users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose\n \">=www-client/chromium-65.0.3325.146\"\n \n\nAll Google Chrome users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose\n \">=www-client/google-chrome-65.0.3325.146\"", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2018-03-13T00:00:00", "type": "gentoo", "title": "Chromium, Google Chrome: Multiple vulnerabilities", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6057", "CVE-2018-6058", "CVE-2018-6059", "CVE-2018-6060", "CVE-2018-6061", "CVE-2018-6062", "CVE-2018-6063", "CVE-2018-6064", "CVE-2018-6065", "CVE-2018-6066", "CVE-2018-6067", "CVE-2018-6068", "CVE-2018-6069", "CVE-2018-6070", "CVE-2018-6071", "CVE-2018-6072", "CVE-2018-6073", "CVE-2018-6074", "CVE-2018-6075", "CVE-2018-6076", "CVE-2018-6077", "CVE-2018-6078", "CVE-2018-6079", "CVE-2018-6080", "CVE-2018-6081", "CVE-2018-6082", "CVE-2018-6083"], "modified": "2018-03-13T00:00:00", "id": "GLSA-201803-05", "href": "https://security.gentoo.org/glsa/201803-05", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2022-01-17T19:04:41", "description": "### Background\n\nChromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web. \n\nGoogle Chrome is one fast, simple, and secure browser for all your devices \n\n### Description\n\nMultiple vulnerabilities have been discovered in Chromium and Google Chrome. Please review the CVE identifiers referenced below for details. \n\n### Impact\n\nA remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, bypass content security controls, or conduct URL spoofing. \n\n### Workaround\n\nThere are no known workarounds at this time.\n\n### Resolution\n\nAll Chromium users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose\n \">=www-client/chromium-63.0.3239.108\"\n \n\nAll Google Chrome users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose\n \">=www-client/google-chrome-63.0.3239.108\"", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2018-01-07T00:00:00", "type": "gentoo", "title": "Chromium, Google Chrome: Multiple vulnerabilities ", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15407", "CVE-2017-15408", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15413", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15417", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15420", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426", "CVE-2017-15427", "CVE-2017-15429"], "modified": "2018-01-07T00:00:00", "id": "GLSA-201801-03", "href": "https://security.gentoo.org/glsa/201801-03", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "suse": [{"lastseen": "2017-12-08T15:45:31", "description": "This update to Chromium 63.0.3239.84 fixes the following security issues:\n\n - CVE-2017-15408: Heap buffer overflow in PDFium\n - CVE-2017-15409: Out of bounds write in Skia\n - CVE-2017-15410: Use after free in PDFium\n - CVE-2017-15411: Use after free in PDFium\n - CVE-2017-15412: Use after free in libXML\n - CVE-2017-15413: Type confusion in WebAssembly\n - CVE-2017-15415: Pointer information disclosure in IPC call\n - CVE-2017-15416: Out of bounds read in Blink\n - CVE-2017-15417: Cross origin information disclosure in Skia\n - CVE-2017-15418: Use of uninitialized value in Skia\n - CVE-2017-15419: Cross origin leak of redirect URL in Blink\n - CVE-2017-15420: URL spoofing in Omnibox\n - CVE-2017-15422: Integer overflow in ICU\n - CVE-2017-15423: Issue with SPAKE implementation in BoringSSL\n - CVE-2017-15424: URL Spoof in Omnibox\n - CVE-2017-15425: URL Spoof in Omnibox\n - CVE-2017-15426: URL Spoof in Omnibox\n - CVE-2017-15427: Insufficient blocking of JavaScript in Omnibox\n\n", "cvss3": {}, "published": "2017-12-08T12:15:33", "type": "suse", "title": "Security update for chromium (important)", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2017-15417", "CVE-2017-15409", "CVE-2017-15423", "CVE-2017-15419", "CVE-2017-15425", "CVE-2017-15410", "CVE-2017-15422", "CVE-2017-15427", "CVE-2017-15418", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15415", "CVE-2017-15426", "CVE-2017-15413", "CVE-2017-15408", "CVE-2017-15416", "CVE-2017-15424", "CVE-2017-15420"], "modified": "2017-12-08T12:15:33", "id": "OPENSUSE-SU-2017:3244-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-12/msg00021.html", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2018-03-16T14:35:52", "description": "This update for Chromium to version 65.0.3325.162 fixes the following\n issues:\n\n - CVE-2017-11215: Use after free in Flash\n - CVE-2017-11225: Use after free in Flash\n - CVE-2018-6060: Use after free in Blink\n - CVE-2018-6061: Race condition in V8\n - CVE-2018-6062: Heap buffer overflow in Skia\n - CVE-2018-6057: Incorrect permissions on shared memory\n - CVE-2018-6063: Incorrect permissions on shared memory\n - CVE-2018-6064: Type confusion in V8\n - CVE-2018-6065: Integer overflow in V8\n - CVE-2018-6066: Same Origin Bypass via canvas\n - CVE-2018-6067: Buffer overflow in Skia\n - CVE-2018-6068: Object lifecycle issues in Chrome Custom Tab\n - CVE-2018-6069: Stack buffer overflow in Skia\n - CVE-2018-6070: CSP bypass through extensions\n - CVE-2018-6071: Heap bufffer overflow in Skia\n - CVE-2018-6072: Integer overflow in PDFium\n - CVE-2018-6073: Heap bufffer overflow in WebGL\n - CVE-2018-6074: Mark-of-the-Web bypass\n - CVE-2018-6075: Overly permissive cross origin downloads\n - CVE-2018-6076: Incorrect handling of URL fragment identifiers in Blink\n - CVE-2018-6077: Timing attack using SVG filters\n - CVE-2018-6078: URL Spoof in OmniBox\n - CVE-2018-6079: Information disclosure via texture data in WebGL\n - CVE-2018-6080: Information disclosure in IPC call\n - CVE-2018-6081: XSS in interstitials\n - CVE-2018-6082: Circumvention of port blocking\n - CVE-2018-6083: Incorrect processing of AppManifests\n\n", "cvss3": {}, "published": "2018-03-16T12:07:04", "type": "suse", "title": "Security update for Chromium (important)", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2018-6069", "CVE-2018-6078", "CVE-2018-6081", "CVE-2017-11215", "CVE-2018-6080", "CVE-2018-6083", "CVE-2018-6082", "CVE-2018-6057", "CVE-2018-6070", "CVE-2018-6074", "CVE-2018-6073", "CVE-2018-6061", "CVE-2018-6072", "CVE-2018-6068", "CVE-2018-6065", "CVE-2017-11225", "CVE-2018-6062", "CVE-2018-6067", "CVE-2018-6071", "CVE-2018-6066", "CVE-2018-6075", "CVE-2018-6064", "CVE-2018-6077", "CVE-2018-6076", "CVE-2018-6079", "CVE-2018-6060", "CVE-2018-6063"], "modified": "2018-03-16T12:07:04", "id": "OPENSUSE-SU-2018:0704-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2018-03/msg00042.html", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-12-08T15:45:32", "description": "This update to Chromium 63.0.3239.84 fixes the following security issues:\n\n - CVE-2017-5124: UXSS with MHTML\n - CVE-2017-5125: Heap overflow in Skia\n - CVE-2017-5126: Use after free in PDFium\n - CVE-2017-5127: Use after free in PDFium\n - CVE-2017-5128: Heap overflow in WebGL\n - CVE-2017-5129: Use after free in WebAudio\n - CVE-2017-5132: Incorrect stack manipulation in WebAssembly.\n - CVE-2017-5130: Heap overflow in libxml2\n - CVE-2017-5131: Out of bounds write in Skia\n - CVE-2017-5133: Out of bounds write in Skia\n - CVE-2017-15386: UI spoofing in Blink\n - CVE-2017-15387: Content security bypass\n - CVE-2017-15388: Out of bounds read in Skia\n - CVE-2017-15389: URL spoofing in OmniBox\n - CVE-2017-15390: URL spoofing in OmniBox\n - CVE-2017-15391: Extension limitation bypass in Extensions.\n - CVE-2017-15392: Incorrect registry key handling in PlatformIntegration\n - CVE-2017-15393: Referrer leak in Devtools\n - CVE-2017-15394: URL spoofing in extensions UI\n - CVE-2017-15395: Null pointer dereference in ImageCapture\n - CVE-2017-15396: Stack overflow in V8\n - CVE-2017-15398: Stack buffer overflow in QUIC\n - CVE-2017-15399: Use after free in V8\n - CVE-2017-15408: Heap buffer overflow in PDFium\n - CVE-2017-15409: Out of bounds write in Skia\n - CVE-2017-15410: Use after free in PDFium\n - CVE-2017-15411: Use after free in PDFium\n - CVE-2017-15412: Use after free in libXML\n - CVE-2017-15413: Type confusion in WebAssembly\n - CVE-2017-15415: Pointer information disclosure in IPC call\n - CVE-2017-15416: Out of bounds read in Blink\n - CVE-2017-15417: Cross origin information disclosure in Skia\n - CVE-2017-15418: Use of uninitialized value in Skia\n - CVE-2017-15419: Cross origin leak of redirect URL in Blink\n - CVE-2017-15420: URL spoofing in Omnibox\n - CVE-2017-15422: Integer overflow in ICU\n - CVE-2017-15423: Issue with SPAKE implementation in BoringSSL\n - CVE-2017-15424: URL Spoof in Omnibox\n - CVE-2017-15425: URL Spoof in Omnibox\n - CVE-2017-15426: URL Spoof in Omnibox\n - CVE-2017-15427: Insufficient blocking of JavaScript in Omnibox\n\n The following tracked bug fixes are included:\n\n - sandbox crash fixes (bsc#1064298)\n\n", "cvss3": {}, "published": "2017-12-08T12:15:59", "type": "suse", "title": "Security update for chromium (important)", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2017-5128", "CVE-2017-15417", "CVE-2017-5132", "CVE-2017-5131", "CVE-2017-15409", "CVE-2017-15423", "CVE-2017-15395", "CVE-2017-15390", "CVE-2017-15391", "CVE-2017-5133", "CVE-2017-15419", "CVE-2017-15399", "CVE-2017-15392", "CVE-2017-15425", "CVE-2017-15410", "CVE-2017-5125", "CVE-2017-15389", "CVE-2017-15387", "CVE-2017-15422", "CVE-2017-15427", "CVE-2017-15418", "CVE-2017-15411", "CVE-2017-5126", "CVE-2017-15412", "CVE-2017-15393", "CVE-2017-15415", "CVE-2017-5127", "CVE-2017-15398", "CVE-2017-15386", "CVE-2017-15426", "CVE-2017-15413", "CVE-2017-15408", "CVE-2017-15396", "CVE-2017-15388", "CVE-2017-15416", "CVE-2017-15424", "CVE-2017-5129", "CVE-2017-15420", "CVE-2017-15394", "CVE-2017-5130", "CVE-2017-5124"], "modified": "2017-12-08T12:15:59", "id": "OPENSUSE-SU-2017:3245-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-12/msg00022.html", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2018-05-09T17:55:56", "description": "This update for Chromium to version 66.0.3359.139 fixes the following\n issues:\n\n - CVE-2018-6118: Use after free in Media Cache (bsc#1091288)\n - CVE-2018-6085: Use after free in Disk Cache\n - CVE-2018-6086: Use after free in Disk Cache\n - CVE-2018-6087: Use after free in WebAssembly\n - CVE-2018-6088: Use after free in PDFium\n - CVE-2018-6089: Same origin policy bypass in Service Worker\n - CVE-2018-6090: Heap buffer overflow in Skia\n - CVE-2018-6091: Incorrect handling of plug-ins by Service Worker\n - CVE-2018-6092: Integer overflow in WebAssembly\n - CVE-2018-6093: Same origin bypass in Service Worker\n - CVE-2018-6094: Exploit hardening regression in Oilpan\n - CVE-2018-6095: Lack of meaningful user interaction requirement before\n file upload\n - CVE-2018-6096: Fullscreen UI spoof\n - CVE-2018-6097: Fullscreen UI spoof\n - CVE-2018-6098: URL spoof in Omnibox\n - CVE-2018-6099: CORS bypass in ServiceWorker\n - CVE-2018-6100: URL spoof in Omnibox\n - CVE-2018-6101: Insufficient protection of remote debugging prototol in\n DevTools\n - CVE-2018-6102: URL spoof in Omnibox\n - CVE-2018-6103: UI spoof in Permissions\n - CVE-2018-6104: URL spoof in Omnibox\n - CVE-2018-6105: URL spoof in Omnibox\n - CVE-2018-6106: Incorrect handling of promises in V8\n - CVE-2018-6107: URL spoof in Omnibox\n - CVE-2018-6108: URL spoof in Omnibox\n - CVE-2018-6109: Incorrect handling of files by FileAPI\n - CVE-2018-6110: Incorrect handling of plaintext files via file://\n - CVE-2018-6111: Heap-use-after-free in DevTools\n - CVE-2018-6112: Incorrect URL handling in DevTools\n - CVE-2018-6113: URL spoof in Navigation\n - CVE-2018-6114: CSP bypass\n - CVE-2018-6115: SmartScreen bypass in downloads\n - CVE-2018-6116: Incorrect low memory handling in WebAssembly\n - CVE-2018-6117: Confusing autofill settings\n - CVE-2017-11215: Use after free in Flash\n - CVE-2017-11225: Use after free in Flash\n - CVE-2018-6060: Use after free in Blink\n - CVE-2018-6061: Race condition in V8\n - CVE-2018-6062: Heap buffer overflow in Skia\n - CVE-2018-6057: Incorrect permissions on shared memory\n - CVE-2018-6063: Incorrect permissions on shared memory\n - CVE-2018-6064: Type confusion in V8\n - CVE-2018-6065: Integer overflow in V8\n - CVE-2018-6066: Same Origin Bypass via canvas\n - CVE-2018-6067: Buffer overflow in Skia\n - CVE-2018-6068: Object lifecycle issues in Chrome Custom Tab\n - CVE-2018-6069: Stack buffer overflow in Skia\n - CVE-2018-6070: CSP bypass through extensions\n - CVE-2018-6071: Heap bufffer overflow in Skia\n - CVE-2018-6072: Integer overflow in PDFium\n - CVE-2018-6073: Heap bufffer overflow in WebGL\n - CVE-2018-6074: Mark-of-the-Web bypass\n - CVE-2018-6075: Overly permissive cross origin downloads\n - CVE-2018-6076: Incorrect handling of URL fragment identifiers in Blink\n - CVE-2018-6077: Timing attack using SVG filters\n - CVE-2018-6078: URL Spoof in OmniBox\n - CVE-2018-6079: Information disclosure via texture data in WebGL\n - CVE-2018-6080: Information disclosure in IPC call\n - CVE-2018-6081: XSS in interstitials\n - CVE-2018-6082: Circumvention of port blocking\n - CVE-2018-6083: Incorrect processing of AppManifests\n - bsc#1086124: Various fixes from internal audits, fuzzing and other\n initiatives\n\n This update also supports mitigation against the Spectre vulnerabilities:\n\n &quot;Strict site isolation&quot; is disabled for most users and can be turned on\n via: chrome://flags/#enable-site-per-process\n\n This feature is undergoing a small percentage trial. Out out of the trial\n is possible via: chrome://flags/#site-isolation-trial-opt-out\n\n", "cvss3": {}, "published": "2018-05-09T15:07:28", "type": "suse", "title": "Security update for Chromium (important)", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2018-6069", "CVE-2018-6078", "CVE-2018-6097", "CVE-2018-6103", "CVE-2018-6081", "CVE-2018-6099", "CVE-2017-11215", "CVE-2018-6113", "CVE-2018-6080", "CVE-2018-6091", "CVE-2018-6104", "CVE-2018-6096", "CVE-2018-6083", "CVE-2018-6100", "CVE-2018-6082", "CVE-2018-6057", "CVE-2018-6070", "CVE-2018-6074", "CVE-2018-6098", "CVE-2018-6112", "CVE-2018-6110", "CVE-2018-6108", "CVE-2018-6102", "CVE-2018-6114", "CVE-2018-6117", "CVE-2018-6118", "CVE-2018-6109", "CVE-2018-6073", "CVE-2018-6115", "CVE-2018-6095", "CVE-2018-6105", "CVE-2018-6093", "CVE-2018-6087", "CVE-2018-6061", "CVE-2018-6116", "CVE-2018-6106", "CVE-2018-6090", "CVE-2018-6072", "CVE-2018-6068", "CVE-2018-6088", "CVE-2018-6094", "CVE-2018-6065", "CVE-2018-6089", "CVE-2017-11225", "CVE-2018-6062", "CVE-2018-6101", "CVE-2018-6107", "CVE-2018-6086", "CVE-2018-6067", "CVE-2018-6092", "CVE-2018-6071", "CVE-2018-6066", "CVE-2018-6075", "CVE-2018-6064", "CVE-2018-6077", "CVE-2018-6076", "CVE-2018-6111", "CVE-2018-6085", "CVE-2018-6079", "CVE-2018-6060", "CVE-2018-6063"], "modified": "2018-05-09T15:07:28", "id": "OPENSUSE-SU-2018:1175-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2018-05/msg00009.html", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-05-28T01:40:25", "description": "This update for Chromium to version 66.0.3359.181 fixes the following\n issues:\n\n - CVE-2018-6118: Use after free in Media Cache (bsc#1091288)\n - CVE-2018-6085: Use after free in Disk Cache\n - CVE-2018-6086: Use after free in Disk Cache\n - CVE-2018-6087: Use after free in WebAssembly\n - CVE-2018-6088: Use after free in PDFium\n - CVE-2018-6089: Same origin policy bypass in Service Worker\n - CVE-2018-6090: Heap buffer overflow in Skia\n - CVE-2018-6091: Incorrect handling of plug-ins by Service Worker\n - CVE-2018-6092: Integer overflow in WebAssembly\n - CVE-2018-6093: Same origin bypass in Service Worker\n - CVE-2018-6094: Exploit hardening regression in Oilpan\n - CVE-2018-6095: Lack of meaningful user interaction requirement before\n file upload\n - CVE-2018-6096: Fullscreen UI spoof\n - CVE-2018-6097: Fullscreen UI spoof\n - CVE-2018-6098: URL spoof in Omnibox\n - CVE-2018-6099: CORS bypass in ServiceWorker\n - CVE-2018-6100: URL spoof in Omnibox\n - CVE-2018-6101: Insufficient protection of remote debugging prototol in\n DevTools\n - CVE-2018-6102: URL spoof in Omnibox\n - CVE-2018-6103: UI spoof in Permissions\n - CVE-2018-6104: URL spoof in Omnibox\n - CVE-2018-6105: URL spoof in Omnibox\n - CVE-2018-6106: Incorrect handling of promises in V8\n - CVE-2018-6107: URL spoof in Omnibox\n - CVE-2018-6108: URL spoof in Omnibox\n - CVE-2018-6109: Incorrect handling of files by FileAPI\n - CVE-2018-6110: Incorrect handling of plaintext files via file://\n - CVE-2018-6111: Heap-use-after-free in DevTools\n - CVE-2018-6112: Incorrect URL handling in DevTools\n - CVE-2018-6113: URL spoof in Navigation\n - CVE-2018-6114: CSP bypass\n - CVE-2018-6115: SmartScreen bypass in downloads\n - CVE-2018-6116: Incorrect low memory handling in WebAssembly\n - CVE-2018-6117: Confusing autofill settings\n - CVE-2017-11215: Use after free in Flash\n - CVE-2017-11225: Use after free in Flash\n - CVE-2018-6060: Use after free in Blink\n - CVE-2018-6061: Race condition in V8\n - CVE-2018-6062: Heap buffer overflow in Skia\n - CVE-2018-6057: Incorrect permissions on shared memory\n - CVE-2018-6063: Incorrect permissions on shared memory\n - CVE-2018-6064: Type confusion in V8\n - CVE-2018-6065: Integer overflow in V8\n - CVE-2018-6066: Same Origin Bypass via canvas\n - CVE-2018-6067: Buffer overflow in Skia\n - CVE-2018-6068: Object lifecycle issues in Chrome Custom Tab\n - CVE-2018-6069: Stack buffer overflow in Skia\n - CVE-2018-6070: CSP bypass through extensions\n - CVE-2018-6071: Heap bufffer overflow in Skia\n - CVE-2018-6072: Integer overflow in PDFium\n - CVE-2018-6073: Heap bufffer overflow in WebGL\n - CVE-2018-6074: Mark-of-the-Web bypass\n - CVE-2018-6075: Overly permissive cross origin downloads\n - CVE-2018-6076: Incorrect handling of URL fragment identifiers in Blink\n - CVE-2018-6077: Timing attack using SVG filters\n - CVE-2018-6078: URL Spoof in OmniBox\n - CVE-2018-6079: Information disclosure via texture data in WebGL\n - CVE-2018-6080: Information disclosure in IPC call\n - CVE-2018-6081: XSS in interstitials\n - CVE-2018-6082: Circumvention of port blocking\n - CVE-2018-6083: Incorrect processing of AppManifests\n - CVE-2018-6121: Privilege Escalation in extensions\n - CVE-2018-6122: Type confusion in V8\n - CVE-2018-6120: Heap buffer overflow in PDFium\n - bsc#1086124: Various fixes from internal audits, fuzzing and other\n initiatives\n\n This update also supports mitigation against the Spectre vulnerabilities:\n\n &quot;Strict site isolation&quot; is disabled for most users and can be turned on\n via: chrome://flags/#enable-site-per-process\n\n This feature is undergoing a small percentage trial. Out out of the trial\n is possible via: chrome://flags/#site-isolation-trial-opt-out\n\n\n The following tracked packaging bug were fixed:\n\n - Chromium could not be installed from SUSE PackageHub 12 without having\n the SDK enabled (bsc#1070421)\n - Chromium could not be installed when libminizip1 was not available\n (bsc#1093031)\n\n", "cvss3": {}, "published": "2018-05-27T18:06:43", "type": "suse", "title": "Security update for Chromium (important)", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2018-6069", "CVE-2018-6078", "CVE-2018-6097", "CVE-2018-6103", "CVE-2018-6081", "CVE-2018-6099", "CVE-2017-11215", "CVE-2018-6120", "CVE-2018-6113", "CVE-2018-6080", "CVE-2018-6091", "CVE-2018-6104", "CVE-2018-6096", "CVE-2018-6083", "CVE-2018-6100", "CVE-2018-6082", "CVE-2018-6057", "CVE-2018-6070", "CVE-2018-6074", "CVE-2018-6098", "CVE-2018-6112", "CVE-2018-6110", "CVE-2018-6108", "CVE-2018-6102", "CVE-2018-6114", "CVE-2018-6117", "CVE-2018-6118", "CVE-2018-6109", "CVE-2018-6073", "CVE-2018-6115", "CVE-2018-6122", "CVE-2018-6095", "CVE-2018-6105", "CVE-2018-6093", "CVE-2018-6087", "CVE-2018-6061", "CVE-2018-6116", "CVE-2018-6106", "CVE-2018-6090", "CVE-2018-6072", "CVE-2018-6068", "CVE-2018-6088", "CVE-2018-6094", "CVE-2018-6065", "CVE-2018-6089", "CVE-2017-11225", "CVE-2018-6062", "CVE-2018-6101", "CVE-2018-6107", "CVE-2018-6086", "CVE-2018-6067", "CVE-2018-6092", "CVE-2018-6071", "CVE-2018-6121", "CVE-2018-6066", "CVE-2018-6075", "CVE-2018-6064", "CVE-2018-6077", "CVE-2018-6076", "CVE-2018-6111", "CVE-2018-6085", "CVE-2018-6079", "CVE-2018-6060", "CVE-2018-6063"], "modified": "2018-05-27T18:06:43", "id": "OPENSUSE-SU-2018:1437-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2018-05/msg00105.html", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "chrome": [{"lastseen": "2021-12-30T22:33:05", "description": "The Chrome team is delighted to announce the promotion of Chrome 63 to the stable channel for Windows, Mac and Linux. This will roll out over the coming days/weeks.\n\n\n\n\n\nChrome 63.0.3239.84 contains a number of fixes and improvements -- a list of changes is available in the[ log](<https://chromium.googlesource.com/chromium/src/+log/62.0.3202.94..63.0.3239.84?pretty=fuller&n=10000>). Watch out for upcoming[ Chrome](<https://chrome.blogspot.com/>) and[ Chromium](<https://blog.chromium.org/>) blog posts about new features and big efforts delivered in 63.\n\n** \n** \n\n\n**Security Fixes and Rewards**\n\nNote: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven&#x27;t yet fixed.\n\n** \n** \n\n\nThis update includes [37](<https://bugs.chromium.org/p/chromium/issues/list?can=1&q=type%3Abug-security+os%3DAndroid%2Cios%2Clinux%2Cmac%2Cwindows%2Call+label%3ARelease-0-M63>) security fixes. Below, we highlight fixes that were contributed by external researchers. Please see the [Chrome Security Page](<http://sites.google.com/a/chromium.org/dev/Home/chromium-security>) for more information.\n\n** \n** \n\n\n[$10500][[778505](<https://crbug.com/778505>)] Critical CVE-2017-15407: Out of bounds write in QUIC. Reported by Ned Williamson on 2017-10-26\n\n[$6337][[762374](<https://crbug.com/762374>)] High CVE-2017-15408: Heap buffer overflow in PDFium. Reported by Ke Liu of Tencent's Xuanwu LAB on 2017-09-06\n\n[$5000][[763972](<https://crbug.com/763972>)] High CVE-2017-15409: Out of bounds write in Skia. Reported by Anonymous on 2017-09-11\n\n[$5000][[765921](<https://crbug.com/765921>)] High CVE-2017-15410: Use after free in PDFium. Reported by Lu\u1eadt Nguy\u1ec5n (@l4wio) of KeenLab, Tencent on 2017-09-16\n\n[$5000][[770148](<https://crbug.com/770148>)] High CVE-2017-15411: Use after free in PDFium. Reported by Lu\u1eadt Nguy\u1ec5n (@l4wio) of KeenLab, Tencent on 2017-09-29\n\n[$3500][[727039](<https://crbug.com/727039>)] High CVE-2017-15412: Use after free in libXML. Reported by Nick Wellnhofer on 2017-05-27\n\n[$500][[766666](<https://crbug.com/766666>)] High CVE-2017-15413: Type confusion in WebAssembly. Reported by Gaurav Dewan(@007gauravdewan) of Adobe Systems India Pvt. Ltd. on 2017-09-19\n\n[$3337][[765512](<https://crbug.com/765512>)] Medium CVE-2017-15415: Pointer information disclosure in IPC call. Reported by Viktor Brange of Microsoft Offensive Security Research Team on 2017-09-15\n\n[$2500][[779314](<https://crbug.com/779314>)] Medium CVE-2017-15416: Out of bounds read in Blink. Reported by Ned Williamson on 2017-10-28\n\n[$2000][[699028](<https://crbug.com/699028>)] Medium CVE-2017-15417: Cross origin information disclosure in Skia . Reported by Max May on 2017-03-07\n\n[$1000][[765858](<https://crbug.com/765858>)] Medium CVE-2017-15418: Use of uninitialized value in Skia. Reported by Kushal Arvind Shah of Fortinet's FortiGuard Labs on 2017-09-15\n\n[$1000][[780312](<https://crbug.com/780312>)] Medium CVE-2017-15419: Cross origin leak of redirect URL in Blink. Reported by Jun Kokatsu (@shhnjk) on 2017-10-31\n\n[$500][[777419](<https://crbug.com/777419>)] Medium CVE-2017-15420: URL spoofing in Omnibox. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-10-23\n\n[$TBD][[774382](<https://crbug.com/774382>)] Medium CVE-2017-15422: Integer overflow in ICU. Reported by Yuan Deng of Ant-financial Light-Year Security Lab on 2017-10-13 \n[$500][[780484](<https://crbug.com/780484>)] Medium** **CVE-2017-15430: Unsafe navigation in Chromecast Plugin. _Reported by jinmo123 on 11/1/2017_\n\n[$500][[778101](<https://crbug.com/778101>)] Low CVE-2017-15423: Issue with SPAKE implementation in BoringSSL. Reported by Greg Hudson on 2017-10-25\n\n[$N/A][[756226](<https://crbug.com/756226>)] Low CVE-2017-15424: URL Spoof in Omnibox. Reported by Khalil Zhani on 2017-08-16\n\n[$N/A][[756456](<https://crbug.com/756456>)] Low CVE-2017-15425: URL Spoof in Omnibox. Reported by xisigr of Tencent's Xuanwu Lab on 2017-08-17\n\n[$N/A][[756735](<https://crbug.com/756735>)] Low CVE-2017-15426: URL Spoof in Omnibox. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-08-18\n\n[$N/A][[768910](<https://crbug.com/768910>)] Low CVE-2017-15427: Insufficient blocking of JavaScript in Omnibox. Reported by Junaid Farhan (fb.me/junaid.farhan.54) on 2017-09-26\n\n** \n** \n\n\nWe would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel. \n\nAs usual, our ongoing internal security work was responsible for a wide range of fixes:\n\n * [[792099](<https://crbug.com/792099>)] Various fixes from internal audits, fuzzing and other initiatives\n\nMany of our security bugs are detected using [AddressSanitizer](<http://code.google.com/p/address-sanitizer/wiki/AddressSanitizer>), [MemorySanitizer](<https://code.google.com/p/memory-sanitizer/wiki/MemorySanitizer>), [UndefinedBehaviorSanitizer](<https://www.chromium.org/developers/testing/undefinedbehaviorsanitizer>), [Control Flow Integrity](<https://sites.google.com/a/chromium.org/dev/developers/testing/control-flow-integrity>), [libFuzzer](<https://sites.google.com/a/chromium.org/dev/developers/testing/libfuzzer>), or [AFL](<http://lcamtuf.coredump.cx/afl/>). \n\n\nA list of all changes is available in the [log](<https://chromium.googlesource.com/chromium/src/+log/62.0.3202.94..63.0.3239.84?pretty=fuller&n=10000>).Interested in switching release channels?[ Find out how](<https://www.chromium.org/getting-involved/dev-channel>). If you find a new issue, please let us know by[ filing a bug](<https://crbug.com/>). The [community help forum](<https://productforums.google.com/forum/#!forum/chrome>) is also a great place to reach out for help or learn about common issues.\n\n\n\n\n\n\n\nKrishna Govind\n\nGoogle Chrome", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2017-12-06T00:00:00", "type": "chrome", "title": "Stable Channel Update for Desktop", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15407", "CVE-2017-15408", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15413", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15417", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15420", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426", "CVE-2017-15427", "CVE-2017-15430"], "modified": "2017-12-06T00:00:00", "id": "GCSA-6993857189147290065", "href": "https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-12-30T22:32:47", "description": "The Chrome team is delighted to announce the promotion of Chrome 65 to the stable channel for Windows, Mac and Linux. This will roll out over the coming days/weeks. \n\nChrome 65.0.3325.146 contains a number of fixes and improvements -- a list of changes is available in the[ log](<https://chromium.googlesource.com/chromium/src/+log/64.0.3282.186..65.0.3325.146?pretty=fuller&n=10000>). Watch out for upcoming[ Chrome](<https://chrome.blogspot.com/>) and[ Chromium](<https://blog.chromium.org/>) blog posts about new features and big efforts delivered in 65. \n\n**Security Fixes and Rewards** \n\n\nNote: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven&#x27;t yet fixed.\n\n** \n** \n\n\nThis update includes [45](<https://bugs.chromium.org/p/chromium/issues/list?can=1&q=type%3Abug-security+os%3DAndroid%2Cios%2Clinux%2Cmac%2Cwindows%2Call+label%3ARelease-0-M65>) security fixes. Below, we highlight fixes that were contributed by external researchers. Please see the [Chrome Security Page](<http://sites.google.com/a/chromium.org/dev/Home/chromium-security>) for more information.\n\n** \n** \n\n\n[$5000][[758848](<https://crbug.com/758848>)] High CVE-2017-11215: Use after free in Flash. Reported by JieZeng of Tencent Zhanlu Lab on 2017-08-25\n\n[$5000][[758863](<https://crbug.com/758863>)] High CVE-2017-11225: Use after free in Flash. Reported by JieZeng of Tencent Zhanlu Lab on 2017-08-25\n\n[$3000][[780919](<https://crbug.com/780919>)] High CVE-2018-6060: Use after free in Blink. Reported by Omair on 2017-11-02\n\n[$3000][[794091](<https://crbug.com/794091>)] High CVE-2018-6061: Race condition in V8. Reported by Guang Gong of Alpha Team, Qihoo 360 on 2017-12-12\n\n[$1000][[780104](<https://crbug.com/780104>)] High CVE-2018-6062: Heap buffer overflow in Skia. Reported by Anonymous on 2017-10-31\n\n[$N/A][[789959](<https://crbug.com/789959>)] High CVE-2018-6057: Incorrect permissions on shared memory. Reported by Gal Beniamini of Google Project Zero on 2017-11-30\n\n[$N/A][[792900](<https://crbug.com/792900>)] High CVE-2018-6063: Incorrect permissions on shared memory. Reported by Gal Beniamini of Google Project Zero on 2017-12-07\n\n[$N/A][[798644](<https://crbug.com/798644>)] High CVE-2018-6064: Type confusion in V8. Reported by lokihardt of Google Project Zero on 2018-01-03\n\n[$N/A][[808192](<https://crbug.com/808192>)] High CVE-2018-6065: Integer overflow in V8. Reported by Mark Brand of Google Project Zero on 2018-02-01\n\n[$4000][[799477](<https://crbug.com/799477>)] Medium CVE-2018-6066: Same Origin Bypass via canvas. Reported by Masato Kinugawa on 2018-01-05\n\n[$2000][[779428](<https://crbug.com/779428>)] Medium CVE-2018-6067: Buffer overflow in Skia. Reported by Ned Williamson on 2017-10-30\n\n[$2000][[798933](<https://crbug.com/798933>)] Medium CVE-2018-6068: Object lifecycle issues in Chrome Custom Tab. Reported by Luan Herrera on 2018-01-04\n\n[$1500][[799918](<https://crbug.com/799918>)] Medium CVE-2018-6069: Stack buffer overflow in Skia. Reported by Wanglu &amp; Yangkang(@dnpushme) of Qihoo360 Qex Team on 2018-01-08\n\n[$1000][[668645](<https://crbug.com/668645>)] Medium CVE-2018-6070: CSP bypass through extensions. Reported by Rob Wu on 2016-11-25\n\n[$1000][[777318](<https://crbug.com/777318>)] Medium CVE-2018-6071: Heap bufffer overflow in Skia. Reported by Anonymous on 2017-10-23\n\n[$1000][[791048](<https://crbug.com/791048>)] Medium CVE-2018-6072: Integer overflow in PDFium. Reported by Atte Kettunen of OUSPG on 2017-12-01\n\n[$1000][[804118](<https://crbug.com/804118>)] Medium CVE-2018-6073: Heap bufffer overflow in WebGL. Reported by Omair on 2018-01-20\n\n[$1000][[809759](<https://crbug.com/809759>)] Medium CVE-2018-6074: Mark-of-the-Web bypass. Reported by Abdulrahman Alqabandi (@qab) on 2018-02-06\n\n[$500][[608669](<https://crbug.com/608669>)] Medium CVE-2018-6075: Overly permissive cross origin downloads. Reported by Inti De Ceukelaire (intigriti.com) on 2016-05-03, and by Bas Venis (@BugRoast)\n\n[$500][[758523](<https://crbug.com/758523>)] Medium CVE-2018-6076: Incorrect handling of URL fragment identifiers in Blink. Reported by Mateusz Krzeszowiec on 2017-08-24\n\n[$500][[778506](<https://crbug.com/778506>)] Medium CVE-2018-6077: Timing attack using SVG filters. Reported by Khalil Zhani on 2017-10-26\n\n[$500][[793628](<https://crbug.com/793628>)] Medium CVE-2018-6078: URL Spoof in OmniBox. Reported by Khalil Zhani on 2017-12-10\n\n[$TBD][[788448](<https://crbug.com/788448>)] Medium CVE-2018-6079: Information disclosure via texture data in WebGL. Reported by Ivars Atteka on 2017-11-24\n\n[$N/A][[792028](<https://crbug.com/792028>)] Medium CVE-2018-6080: Information disclosure in IPC call. Reported by Gal Beniamini of Google Project Zero on 2017-12-05\n\n[$1000][[797525](<https://crbug.com/797525>)] Low CVE-2018-6081: XSS in interstitials. Reported by Rob Wu on 2017-12-24\n\n[$N/A][[767354](<https://crbug.com/767354>)] Low CVE-2018-6082: Circumvention of port blocking. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-09-21\n\n[$N/A][[771709](<https://crbug.com/771709>)] Low CVE-2018-6083: Incorrect processing of AppManifests. Reported by Jun Kokatsu (@shhnjk) on 2017-10-04\n\n** \n** \n\n\nWe would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel. \n\n\n\nAs usual, our ongoing internal security work was responsible for a wide range of fixes: \nMany of our security bugs are detected using [AddressSanitizer](<http://code.google.com/p/address-sanitizer/wiki/AddressSanitizer>), [MemorySanitizer](<https://code.google.com/p/memory-sanitizer/wiki/MemorySanitizer>), [UndefinedBehaviorSanitizer](<https://www.chromium.org/developers/testing/undefinedbehaviorsanitizer>), [Control Flow Integrity](<https://sites.google.com/a/chromium.org/dev/developers/testing/control-flow-integrity>), [libFuzzer](<https://sites.google.com/a/chromium.org/dev/developers/testing/libfuzzer>), or [AFL](<http://lcamtuf.coredump.cx/afl/>). \n\n\n * [[819271](<https://crbug.com/819271>)] Various fixes from internal audits, fuzzing and other initiatives\nIf you're interested in Enterprise relevant information please look through the [Enterprise Release Notes for Chrome 65](<https://productforums.google.com/forum/#!topic/chrome-admins/ZCtleIroFYk>). \n\nThank you, \nKrishna Govind", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 9.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 5.9}, "published": "2018-03-06T00:00:00", "type": "chrome", "title": "Stable Channel Update for Desktop", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": true, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-11215", "CVE-2017-11225", "CVE-2018-6057", "CVE-2018-6060", "CVE-2018-6061", "CVE-2018-6062", "CVE-2018-6063", "CVE-2018-6064", "CVE-2018-6065", "CVE-2018-6066", "CVE-2018-6067", "CVE-2018-6068", "CVE-2018-6069", "CVE-2018-6070", "CVE-2018-6071", "CVE-2018-6072", "CVE-2018-6073", "CVE-2018-6074", "CVE-2018-6075", "CVE-2018-6076", "CVE-2018-6077", "CVE-2018-6078", "CVE-2018-6079", "CVE-2018-6080", "CVE-2018-6081", "CVE-2018-6082", "CVE-2018-6083"], "modified": "2018-03-06T00:00:00", "id": "GCSA-3542100121216698778", "href": "https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "freebsd": [{"lastseen": "2022-01-19T15:51:31", "description": "\n\nGoogle Chrome Releases reports:\n\n37 security fixes in this release, including:\n\n[778505] Critical CVE-2017-15407: Out of bounds write in QUIC. Reported by\n\t Ned Williamson on 2017-10-26\n[762374] High CVE-2017-15408: Heap buffer overflow in PDFium. Reported by\n\t Ke Liu of Tencent's Xuanwu LAB on 2017-09-06\n[763972] High CVE-2017-15409: Out of bounds write in Skia. Reported by\n\t Anonymous on 2017-09-11\n[765921] High CVE-2017-15410: Use after free in PDFium. Reported by\n\t Luat Nguyen of KeenLab, Tencent on 2017-09-16\n[770148] High CVE-2017-15411: Use after free in PDFium. Reported by\n\t Luat Nguyen of KeenLab, Tencent on 2017-09-29\n[727039] High CVE-2017-15412: Use after free in libXML. Reported by\n\t Nick Wellnhofer on 2017-05-27\n[766666] High CVE-2017-15413: Type confusion in WebAssembly. Reported by\n\t Gaurav Dewan of Adobe Systems India Pvt. Ltd. on 2017-09-19\n[765512] Medium CVE-2017-15415: Pointer information disclosure in IPC call.\n\t Reported by Viktor Brange of Microsoft Offensive Security Research Team on 2017-09-15\n[779314] Medium CVE-2017-15416: Out of bounds read in Blink. Reported by\n\t Ned Williamson on 2017-10-28\n[699028] Medium CVE-2017-15417: Cross origin information disclosure in Skia.\n\t Reported by Max May on 2017-03-07\n[765858] Medium CVE-2017-15418: Use of uninitialized value in Skia. Reported by\n\t Kushal Arvind Shah of Fortinet's FortiGuard Labs on 2017-09-15\n[780312] Medium CVE-2017-15419: Cross origin leak of redirect URL in Blink.\n\t Reported by Jun Kokatsu on 2017-10-31\n[777419] Medium CVE-2017-15420: URL spoofing in Omnibox. Reported by\n\t WenXu Wu of Tencent's Xuanwu Lab on 2017-10-23\n[774382] Medium CVE-2017-15422: Integer overflow in ICU. Reported by\n\t Yuan Deng of Ant-financial Light-Year Security Lab on 2017-10-13\n[780484] Medium CVE-2017-15430: Unsafe navigation in Chromecast Plugin.\n\t Reported by jinmo123 on 2017-01-11\n[778101] Low CVE-2017-15423: Issue with SPAKE implementation in BoringSSL.\n\t Reported by Greg Hudson on 2017-10-25\n[756226] Low CVE-2017-15424: URL Spoof in Omnibox. Reported by\n\t Khalil Zhani on 2017-08-16\n[756456] Low CVE-2017-15425: URL Spoof in Omnibox. Reported by\n\t xisigr of Tencent's Xuanwu Lab on 2017-08-17\n[757735] Low CVE-2017-15426: URL Spoof in Omnibox. Reported by\n\t WenXu Wu of Tencent's Xuanwu Lab on 2017-08-18\n[768910] Low CVE-2017-15427: Insufficient blocking of Javascript in Omnibox.\n\t Reported by Junaid Farhan on 2017-09-26\n[792099] Various fixes from internal audits, fuzzing and other initiatives\n\n\n\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2017-12-06T00:00:00", "type": "freebsd", "title": "chromium -- multiple vulnerabilities", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15407", "CVE-2017-15408", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15413", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15417", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15420", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426", "CVE-2017-15427", "CVE-2017-15430"], "modified": "2017-12-06T00:00:00", "id": "1D951E85-FFDB-11E7-8B91-E8E0B747A45A", "href": "https://vuxml.freebsd.org/freebsd/1d951e85-ffdb-11e7-8b91-e8e0b747a45a.html", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2022-01-19T15:51:31", "description": "\n\nGoogle Chrome Releases reports:\n\n45 security fixes in this release:\n\n[758848] High CVE-2017-11215: Use after free in Flash. Reported by JieZeng of Tencent Zhanlu Lab on 2017-08-25\n[758863] High CVE-2017-11225: Use after free in Flash. Reported by JieZeng of Tencent Zhanlu Lab on 2017-08-25\n[780919] High CVE-2018-6060: Use after free in Blink. Reported by Omair on 2017-11-02\n[794091] High CVE-2018-6061: Race condition in V8. Reported by Guang Gong of Alpha Team, Qihoo 360 on 2017-12-12\n[780104] High CVE-2018-6062: Heap buffer overflow in Skia. Reported by Anonymous on 2017-10-31\n[789959] High CVE-2018-6057: Incorrect permissions on shared memory. Reported by Gal Beniamini of Google Project Zero on 2017-11-30\n[792900] High CVE-2018-6063: Incorrect permissions on shared memory. Reported by Gal Beniamini of Google Project Zero on 2017-12-07\n[798644] High CVE-2018-6064: Type confusion in V8. Reported by lokihardt of Google Project Zero on 2018-01-03\n[808192] High CVE-2018-6065: Integer overflow in V8. Reported by Mark Brand of Google Project Zero on 2018-02-01\n[799477] Medium CVE-2018-6066: Same Origin Bypass via canvas. Reported by Masato Kinugawa on 2018-01-05\n[779428] Medium CVE-2018-6067: Buffer overflow in Skia. Reported by Ned Williamson on 2017-10-30\n[779428] Medium CVE-2018-6067: Buffer overflow in Skia. Reported by Ned Williamson on 2017-10-30\n[799918] Medium CVE-2018-6069: Stack buffer overflow in Skia. Reported by Wanglu and Yangkang(@dnpushme) of Qihoo360 Qex Team on 2018-01-08\n[668645] Medium CVE-2018-6070: CSP bypass through extensions. Reported by Rob Wu on 2016-11-25\n[777318] Medium CVE-2018-6071: Heap bufffer overflow in Skia. Reported by Anonymous on 2017-10-23\n[791048] Medium CVE-2018-6072: Integer overflow in PDFium. Reported by Atte Kettunen of OUSPG on 2017-12-01\n[804118] Medium CVE-2018-6073: Heap bufffer overflow in WebGL. Reported by Omair on 2018-01-20\n[809759] Medium CVE-2018-6074: Mark-of-the-Web bypass. Reported by Abdulrahman Alqabandi (@qab) on 2018-02-06\n[608669] Medium CVE-2018-6075: Overly permissive cross origin downloads. Reported by Inti De Ceukelaire (intigriti.com) on 2016-05-03\n[758523] Medium CVE-2018-6076: Incorrect handling of URL fragment identifiers in Blink. Reported by Mateusz Krzeszowiec on 2017-08-24\n[778506] Medium CVE-2018-6077: Timing attack using SVG filters. Reported by Khalil Zhani on 2017-10-26\n[793628] Medium CVE-2018-6078: URL Spoof in OmniBox. Reported by Khalil Zhani on 2017-12-10\n[788448] Medium CVE-2018-6079: Information disclosure via texture data in WebGL. Reported by Ivars Atteka on 2017-11-24\n[792028] Medium CVE-2018-6080: Information disclosure in IPC call. Reported by Gal Beniamini of Google Project Zero on 2017-12-05\n[797525] Low CVE-2018-6081: XSS in interstitials. Reported by Rob Wu on 2017-12-24\n[767354] Low CVE-2018-6082: Circumvention of port blocking. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-09-21\n[771709] Low CVE-2018-6083: Incorrect processing of AppManifests. Reported by Jun Kokatsu (@shhnjk) on 2017-10-04\n\n\n\n", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 9.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 5.9}, "published": "2016-05-03T00:00:00", "type": "freebsd", "title": "chromium -- vulnerability", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": true, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-11215", "CVE-2017-11225", "CVE-2018-6057", "CVE-2018-6060", "CVE-2018-6061", "CVE-2018-6062", "CVE-2018-6063", "CVE-2018-6064", "CVE-2018-6065", "CVE-2018-6066", "CVE-2018-6067", "CVE-2018-6069", "CVE-2018-6070", "CVE-2018-6071", "CVE-2018-6072", "CVE-2018-6073", "CVE-2018-6074", "CVE-2018-6075", "CVE-2018-6076", "CVE-2018-6077", "CVE-2018-6078", "CVE-2018-6079", "CVE-2018-6080", "CVE-2018-6081", "CVE-2018-6082", "CVE-2018-6083"], "modified": "2016-05-03T00:00:00", "id": "555AF074-22B9-11E8-9799-54EE754AF08E", "href": "https://vuxml.freebsd.org/freebsd/555af074-22b9-11e8-9799-54ee754af08e.html", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "osv": [{"lastseen": "2022-07-21T08:24:18", "description": "\nSeveral vulnerabilities have been discovered in the chromium web browser.\n\n\n* [CVE-2017-15407](https://security-tracker.debian.org/tracker/CVE-2017-15407)\nNed Williamson discovered an out-of-bounds write issue.\n* [CVE-2017-15408](https://security-tracker.debian.org/tracker/CVE-2017-15408)\nKe Liu discovered a heap overflow issue in the pdfium library.\n* [CVE-2017-15409](https://security-tracker.debian.org/tracker/CVE-2017-15409)\nAn out-of-bounds write issue was discovered in the skia library.\n* [CVE-2017-15410](https://security-tracker.debian.org/tracker/CVE-2017-15410)\nLuat Nguyen discovered a use-after-free issue in the pdfium library.\n* [CVE-2017-15411](https://security-tracker.debian.org/tracker/CVE-2017-15411)\nLuat Nguyen discovered a use-after-free issue in the pdfium library.\n* [CVE-2017-15413](https://security-tracker.debian.org/tracker/CVE-2017-15413)\nGaurav Dewan discovered a type confusion issue.\n* [CVE-2017-15415](https://security-tracker.debian.org/tracker/CVE-2017-15415)\nViktor Brange discovered an information disclosure issue.\n* [CVE-2017-15416](https://security-tracker.debian.org/tracker/CVE-2017-15416)\nNed Williamson discovered an out-of-bounds read issue.\n* [CVE-2017-15417](https://security-tracker.debian.org/tracker/CVE-2017-15417)\nMax May discovered an information disclosure issue in the skia\n library.\n* [CVE-2017-15418](https://security-tracker.debian.org/tracker/CVE-2017-15418)\nKushal Arvind Shah discovered an uninitialized value in the skia\n library.\n* [CVE-2017-15419](https://security-tracker.debian.org/tracker/CVE-2017-15419)\nJun Kokatsu discoved an information disclosure issue.\n* [CVE-2017-15420](https://security-tracker.debian.org/tracker/CVE-2017-15420)\nWenXu Wu discovered a URL spoofing issue.\n* [CVE-2017-15423](https://security-tracker.debian.org/tracker/CVE-2017-15423)\nGreg Hudson discovered an issue in the boringssl library.\n* [CVE-2017-15424](https://security-tracker.debian.org/tracker/CVE-2017-15424)\nKhalil Zhani discovered a URL spoofing issue.\n* [CVE-2017-15425](https://security-tracker.debian.org/tracker/CVE-2017-15425)\nxisigr discovered a URL spoofing issue.\n* [CVE-2017-15426](https://security-tracker.debian.org/tracker/CVE-2017-15426)\nWenXu Wu discovered a URL spoofing issue.\n* [CVE-2017-15427](https://security-tracker.debian.org/tracker/CVE-2017-15427)\nJunaid Farhan discovered an issue with the omnibox.\n\n\nFor the stable distribution (stretch), these problems have been fixed in\nversion 63.0.3239.84-1~deb9u1.\n\n\nWe recommend that you upgrade your chromium-browser packages.\n\n\nFor the detailed security status of chromium-browser please refer to\nits security tracker page at:\n[\\\nhttps://security-tracker.debian.org/tracker/chromium-browser](https://security-tracker.debian.org/tracker/chromium-browser)\n\n\n", "edition": 1, "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2017-12-12T00:00:00", "type": "osv", "title": "chromium-browser - security update", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15417", "CVE-2017-15409", "CVE-2017-15423", "CVE-2017-15419", "CVE-2017-15425", "CVE-2017-15410", "CVE-2017-15427", "CVE-2017-15407", "CVE-2017-15418", "CVE-2017-15411", "CVE-2017-15415", "CVE-2017-15428", "CVE-2017-15426", "CVE-2017-15413", "CVE-2017-15408", "CVE-2017-15416", "CVE-2017-15424", "CVE-2017-15420"], "modified": "2022-07-21T05:49:41", "id": "OSV:DSA-4064-1", "href": "https://osv.dev/vulnerability/DSA-4064-1", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2022-07-21T08:24:01", "description": "\nSeveral vulnerabilities have been discovered in the chromium web browser.\n\n\n* [CVE-2018-6056](https://security-tracker.debian.org/tracker/CVE-2018-6056)\nlokihardt discovered an error in the v8 javascript library.\n* [CVE-2018-6057](https://security-tracker.debian.org/tracker/CVE-2018-6057)\nGal Beniamini discovered errors related to shared memory permissions.\n* [CVE-2018-6060](https://security-tracker.debian.org/tracker/CVE-2018-6060)\nOmair discovered a use-after-free issue in blink/webkit.\n* [CVE-2018-6061](https://security-tracker.debian.org/tracker/CVE-2018-6061)\nGuang Gong discovered a race condition in the v8 javascript library.\n* [CVE-2018-6062](https://security-tracker.debian.org/tracker/CVE-2018-6062)\nA heap overflow issue was discovered in the v8 javascript library.\n* [CVE-2018-6063](https://security-tracker.debian.org/tracker/CVE-2018-6063)\nGal Beniamini discovered errors related to shared memory permissions.\n* [CVE-2018-6064](https://security-tracker.debian.org/tracker/CVE-2018-6064)\nlokihardt discovered a type confusion error in the v8 javascript\n library.\n* [CVE-2018-6065](https://security-tracker.debian.org/tracker/CVE-2018-6065)\nMark Brand discovered an integer overflow issue in the v8 javascript\n library.\n* [CVE-2018-6066](https://security-tracker.debian.org/tracker/CVE-2018-6066)\nMasato Kinugawa discovered a way to bypass the Same Origin Policy.\n* [CVE-2018-6067](https://security-tracker.debian.org/tracker/CVE-2018-6067)\nNed Williamson discovered a buffer overflow issue in the skia library.\n* [CVE-2018-6068](https://security-tracker.debian.org/tracker/CVE-2018-6068)\nLuan Herrera discovered object lifecycle issues.\n* [CVE-2018-6069](https://security-tracker.debian.org/tracker/CVE-2018-6069)\nWanglu and Yangkang discovered a stack overflow issue in the skia\n library.\n* [CVE-2018-6070](https://security-tracker.debian.org/tracker/CVE-2018-6070)\nRob Wu discovered a way to bypass the Content Security Policy.\n* [CVE-2018-6071](https://security-tracker.debian.org/tracker/CVE-2018-6071)\nA heap overflow issue was discovered in the skia library.\n* [CVE-2018-6072](https://security-tracker.debian.org/tracker/CVE-2018-6072)\nAtte Kettunen discovered an integer overflow issue in the pdfium\n library.\n* [CVE-2018-6073](https://security-tracker.debian.org/tracker/CVE-2018-6073)\nOmair discover a heap overflow issue in the WebGL implementation.\n* [CVE-2018-6074](https://security-tracker.debian.org/tracker/CVE-2018-6074)\nAbdulrahman Alqabandi discovered a way to cause a downloaded web page\n to not contain a Mark of the Web.\n* [CVE-2018-6075](https://security-tracker.debian.org/tracker/CVE-2018-6075)\nInti De Ceukelaire discovered a way to bypass the Same Origin Policy.\n* [CVE-2018-6076](https://security-tracker.debian.org/tracker/CVE-2018-6076)\nMateusz Krzeszowiec discovered that URL fragment identifiers could be\n handled incorrectly.\n* [CVE-2018-6077](https://security-tracker.debian.org/tracker/CVE-2018-6077)\nKhalil Zhani discovered a timing issue.\n* [CVE-2018-6078](https://security-tracker.debian.org/tracker/CVE-2018-6078)\nKhalil Zhani discovered a URL spoofing issue.\n* [CVE-2018-6079](https://security-tracker.debian.org/tracker/CVE-2018-6079)\nIvars discovered an information disclosure issue.\n* [CVE-2018-6080](https://security-tracker.debian.org/tracker/CVE-2018-6080)\nGal Beniamini discovered an information disclosure issue.\n* [CVE-2018-6081](https://security-tracker.debian.org/tracker/CVE-2018-6081)\nRob Wu discovered a cross-site scripting issue.\n* [CVE-2018-6082](https://security-tracker.debian.org/tracker/CVE-2018-6082)\nWenXu Wu discovered a way to bypass blocked ports.\n* [CVE-2018-6083](https://security-tracker.debian.org/tracker/CVE-2018-6083)\nJun Kokatsu discovered that AppManifests could be handled incorrectly.\n* [CVE-2018-6085](https://security-tracker.debian.org/tracker/CVE-2018-6085)\nNed Williamson discovered a use-after-free issue.\n* [CVE-2018-6086](https://security-tracker.debian.org/tracker/CVE-2018-6086)\nNed Williamson discovered a use-after-free issue.\n* [CVE-2018-6087](https://security-tracker.debian.org/tracker/CVE-2018-6087)\nA use-after-free issue was discovered in the WebAssembly implementation.\n* [CVE-2018-6088](https://security-tracker.debian.org/tracker/CVE-2018-6088)\nA use-after-free issue was discovered in the pdfium library.\n* [CVE-2018-6089](https://security-tracker.debian.org/tracker/CVE-2018-6089)\nRob Wu discovered a way to bypass the Same Origin Policy.\n* [CVE-2018-6090](https://security-tracker.debian.org/tracker/CVE-2018-6090)\nZhanJia Song discovered a heap overflow issue in the skia library.\n* [CVE-2018-6091](https://security-tracker.debian.org/tracker/CVE-2018-6091)\nJun Kokatsu discovered that plugins could be handled incorrectly.\n* [CVE-2018-6092](https://security-tracker.debian.org/tracker/CVE-2018-6092)\nNatalie Silvanovich discovered an integer overflow issue in the\n WebAssembly implementation.\n* [CVE-2018-6093](https://security-tracker.debian.org/tracker/CVE-2018-6093)\nJun Kokatsu discovered a way to bypass the Same Origin Policy.\n* [CVE-2018-6094](https://security-tracker.debian.org/tracker/CVE-2018-6094)\nChris Rohlf discovered a regression in garbage collection hardening.\n* [CVE-2018-6095](https://security-tracker.debian.org/tracker/CVE-2018-6095)\nAbdulrahman Alqabandi discovered files could be uploaded without user\n interaction.\n* [CVE-2018-6096](https://security-tracker.debian.org/tracker/CVE-2018-6096)\nWenXu Wu discovered a user interface spoofing issue.\n* [CVE-2018-6097](https://security-tracker.debian.org/tracker/CVE-2018-6097)\nxisigr discovered a user interface spoofing issue.\n* [CVE-2018-6098](https://security-tracker.debian.org/tracker/CVE-2018-6098)\nKhalil Zhani discovered a URL spoofing issue.\n* [CVE-2018-6099](https://security-tracker.debian.org/tracker/CVE-2018-6099)\nJun Kokatsu discovered a way to bypass the Cross Origin Resource\n Sharing mechanism.\n* [CVE-2018-6100](https://security-tracker.debian.org/tracker/CVE-2018-6100)\nLnyas Zhang discovered a URL spoofing issue.\n* [CVE-2018-6101](https://security-tracker.debian.org/tracker/CVE-2018-6101)\nRob Wu discovered an issue in the developer tools remote debugging\n protocol.\n* [CVE-2018-6102](https://security-tracker.debian.org/tracker/CVE-2018-6102)\nKhalil Zhani discovered a URL spoofing issue.\n* [CVE-2018-6103](https://security-tracker.debian.org/tracker/CVE-2018-6103)\nKhalil Zhani discovered a user interface spoofing issue.\n* [CVE-2018-6104](https://security-tracker.debian.org/tracker/CVE-2018-6104)\nKhalil Zhani discovered a URL spoofing issue.\n* [CVE-2018-6105](https://security-tracker.debian.org/tracker/CVE-2018-6105)\nKhalil Zhani discovered a URL spoofing issue.\n* [CVE-2018-6106](https://security-tracker.debian.org/tracker/CVE-2018-6106)\nlokihardt discovered that v8 promises could be handled incorrectly.\n* [CVE-2018-6107](https://security-tracker.debian.org/tracker/CVE-2018-6107)\nKhalil Zhani discovered a URL spoofing issue.\n* [CVE-2018-6108](https://security-tracker.debian.org/tracker/CVE-2018-6108)\nKhalil Zhani discovered a URL spoofing issue.\n* [CVE-2018-6109](https://security-tracker.debian.org/tracker/CVE-2018-6109)\nDominik Weber discovered a way to misuse the FileAPI feature.\n* [CVE-2018-6110](https://security-tracker.debian.org/tracker/CVE-2018-6110)\nWenxiang Qian discovered that local plain text files could be handled\n incorrectly.\n* [CVE-2018-6111](https://security-tracker.debian.org/tracker/CVE-2018-6111)\nKhalil Zhani discovered a use-after-free issue in the developer tools.\n* [CVE-2018-6112](https://security-tracker.debian.org/tracker/CVE-2018-6112)\nKhalil Zhani discovered incorrect handling of URLs in the developer\n tools.\n* [CVE-2018-6113](https://security-tracker.debian.org/tracker/CVE-2018-6113)\nKhalil Zhani discovered a URL spoofing issue.\n* [CVE-2018-6114](https://security-tracker.debian.org/tracker/CVE-2018-6114)\nLnyas Zhang discovered a way to bypass the Content Security Policy.\n* [CVE-2018-6116](https://security-tracker.debian.org/tracker/CVE-2018-6116)\nChengdu Security Response Center discovered an error when memory\n is low.\n* [CVE-2018-6117](https://security-tracker.debian.org/tracker/CVE-2018-6117)\nSpencer Dailey discovered an error in form autofill settings.\n\n\nFor the oldstable distribution (jessie), security support for chromium\nhas been discontinued.\n\n\nFor the stable distribution (stretch), these problems have been fixed in\nversion 66.0.3359.117-1~deb9u1.\n\n\nWe recommend that you upgrade your chromium-browser packages.\n\n\nFor the detailed security status of chromium-browser please refer to\nits security tracker page at:\n[\\\nhttps://security-tracker.debian.org/tracker/chromium-browser](https://security-tracker.debian.org/tracker/chromium-browser)\n\n\n", "edition": 1, "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-04-28T00:00:00", "type": "osv", "title": "chromium-browser - security update", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6069", "CVE-2018-6078", "CVE-2018-6097", "CVE-2018-6103", "CVE-2018-6081", "CVE-2018-6099", "CVE-2018-6113", "CVE-2018-6080", "CVE-2018-6091", "CVE-2018-6104", "CVE-2018-6096", "CVE-2018-6083", "CVE-2018-6100", "CVE-2018-6082", "CVE-2018-6057", "CVE-2018-6070", "CVE-2018-6074", "CVE-2018-6098", "CVE-2018-6112", "CVE-2018-6110", "CVE-2018-6108", "CVE-2018-6102", "CVE-2018-6056", "CVE-2018-6114", "CVE-2018-6117", "CVE-2018-6109", "CVE-2018-6073", "CVE-2018-6095", "CVE-2018-6105", "CVE-2018-6093", "CVE-2018-6087", "CVE-2018-6061", "CVE-2018-6116", "CVE-2018-6106", "CVE-2018-6090", "CVE-2018-6072", "CVE-2018-6068", "CVE-2018-6088", "CVE-2018-6094", "CVE-2018-6065", "CVE-2018-6089", "CVE-2018-6062", "CVE-2018-6101", "CVE-2018-6107", "CVE-2018-6086", "CVE-2018-6067", "CVE-2018-6092", "CVE-2018-6071", "CVE-2018-6066", "CVE-2018-6075", "CVE-2018-6064", "CVE-2018-6077", "CVE-2018-6076", "CVE-2018-6111", "CVE-2018-6085", "CVE-2018-6079", "CVE-2018-6060", "CVE-2018-6063"], "modified": "2022-07-21T05:49:50", "id": "OSV:DSA-4182-1", "href": "https://osv.dev/vulnerability/DSA-4182-1", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "mageia": [{"lastseen": "2022-04-18T11:19:34", "description": "This update provide an update the new Qt5 LTS version ( 5.9 ) \n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-05-11T20:13:13", "type": "mageia", "title": "Updated Qt5 packages fix security vulnerability\n", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15407", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426"], "modified": "2018-05-09T18:33:09", "id": "MGAA-2018-0067", "href": "https://advisories.mageia.org/MGAA-2018-0067.html", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2022-04-18T11:19:34", "description": "Chromium-browser 67.0.3396.62 fixes security issues: Multiple flaws were found in the way Chromium 64.0.3282.140 processes various types of web content, where loading a web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information. (CVE-2017-11215, CVE-2017-11225, CVE-2018-6056, CVE-2018-6057, CVE-2018-6060, CVE-2018-6061, CVE-2018-6062, CVE-2018-6063, CVE-2018-6064, CVE-2018-6065, CVE-2018-6066, CVE-2018-6067, CVE-2018-6068, CVE-2018-6069, CVE-2018-6070, CVE-2018-6071, CVE-2018-6072, CVE-2018-6073, CVE-2018-6074, CVE-2018-6075, CVE-2018-6076, CVE-2018-6077, CVE-2018-6078, CVE-2018-6079, CVE-2018-6080, CVE-2018-6081, CVE-2018-6082, CVE-2018-6083, CVE-2018-6084, CVE-2018-6085, CVE-2018-6086, CVE-2018-6087, CVE-2018-6088, CVE-2018-6089, CVE-2018-6090, CVE-2018-6091, CVE-2018-6092, CVE-2018-6093, CVE-2018-6094, CVE-2018-6095, CVE-2018-6096, CVE-2018-6097, CVE-2018-6098, CVE-2018-6099, CVE-2018-6100, CVE-2018-6101, CVE-2018-6102, CVE-2018-6103, CVE-2018-6104, CVE-2018-6105, CVE-2018-6106, CVE-2018-6107, CVE-2018-6108, CVE-2018-6109, CVE-2018-6110, CVE-2018-6111, CVE-2018-6112, CVE-2018-6113, CVE-2018-6114, CVE-2018-6115, CVE-2018-6116, CVE-2018-6117, CVE-2018-6118, CVE-2018-6120, CVE-2018-6121, CVE-2018-6122, CVE-2018-6123, CVE-2018-6124, CVE-2018-6126, CVE-2018-6127, CVE-2018-6128, CVE-2018-6129, CVE-2018-6130, CVE-2018-6131, CVE-2018-6132, CVE-2018-6133, CVE-2018-6134, CVE-2018-6135, CVE-2018-6136, CVE-2018-6137, CVE-2018-6138, CVE-2018-6139, CVE-2018-6140, CVE-2018-6141, CVE-2018-6142, CVE-2018-6143, CVE-2018-6144, CVE-2018-6145, CVE-2018-6147) \n", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2018-06-04T15:11:47", "type": "mageia", "title": "Updated chromium-browser-stable packages fix security vulnerabilities\n", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": true, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-11215", "CVE-2017-11225", "CVE-2018-6056", "CVE-2018-6057", "CVE-2018-6060", "CVE-2018-6061", "CVE-2018-6062", "CVE-2018-6063", "CVE-2018-6064", "CVE-2018-6065", "CVE-2018-6066", "CVE-2018-6067", "CVE-2018-6068", "CVE-2018-6069", "CVE-2018-6070", "CVE-2018-6071", "CVE-2018-6072", "CVE-2018-6073", "CVE-2018-6074", "CVE-2018-6075", "CVE-2018-6076", "CVE-2018-6077", "CVE-2018-6078", "CVE-2018-6079", "CVE-2018-6080", "CVE-2018-6081", "CVE-2018-6082", "CVE-2018-6083", "CVE-2018-6084", "CVE-2018-6085", "CVE-2018-6086", "CVE-2018-6087", "CVE-2018-6088", "CVE-2018-6089", "CVE-2018-6090", "CVE-2018-6091", "CVE-2018-6092", "CVE-2018-6093", "CVE-2018-6094", "CVE-2018-6095", "CVE-2018-6096", "CVE-2018-6097", "CVE-2018-6098", "CVE-2018-6099", "CVE-2018-6100", "CVE-2018-6101", "CVE-2018-6102", "CVE-2018-6103", "CVE-2018-6104", "CVE-2018-6105", "CVE-2018-6106", "CVE-2018-6107", "CVE-2018-6108", "CVE-2018-6109", "CVE-2018-6110", "CVE-2018-6111", "CVE-2018-6112", "CVE-2018-6113", "CVE-2018-6114", "CVE-2018-6115", "CVE-2018-6116", "CVE-2018-6117", "CVE-2018-6118", "CVE-2018-6120", "CVE-2018-6121", "CVE-2018-6122", "CVE-2018-6123", "CVE-2018-6124", "CVE-2018-6126", "CVE-2018-6127", "CVE-2018-6128", "CVE-2018-6129", "CVE-2018-6130", "CVE-2018-6131", "CVE-2018-6132", "CVE-2018-6133", "CVE-2018-6134", "CVE-2018-6135", "CVE-2018-6136", "CVE-2018-6137", "CVE-2018-6138", "CVE-2018-6139", "CVE-2018-6140", "CVE-2018-6141", "CVE-2018-6142", "CVE-2018-6143", "CVE-2018-6144", "CVE-2018-6145", "CVE-2018-6147"], "modified": "2018-06-04T15:11:47", "id": "MGASA-2018-0268", "href": "https://advisories.mageia.org/MGASA-2018-0268.html", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "debiancve": [{"lastseen": "2021-12-14T17:47:15", "description": "Type confusion in WebAssembly in V8 in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2018-08-28T19:29:00", "type": "debiancve", "title": "CVE-2017-15413", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15413"], "modified": "2018-08-28T19:29:00", "id": "DEBIANCVE:CVE-2017-15413", "href": "https://security-tracker.debian.org/tracker/CVE-2017-15413", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-12-14T17:47:15", "description": "Out-of-bounds Write in the QUIC networking stack in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to gain code execution via a malicious server.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2018-08-28T19:29:00", "type": "debiancve", "title": "CVE-2017-15407", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15407"], "modified": "2018-08-28T19:29:00", "id": "DEBIANCVE:CVE-2017-15407", "href": "https://security-tracker.debian.org/tracker/CVE-2017-15407", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-12-14T17:47:15", "description": "Inappropriate implementation in Skia canvas composite operations in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak cross-origin data via a crafted HTML page.", "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 5.3, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 3.6}, "published": "2018-08-28T19:29:00", "type": "debiancve", "title": "CVE-2017-15417", "bulletinFamily": "info", "cvss2": {"severity": "LOW", "exploitabilityScore": 4.9, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "HIGH", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 2.6, "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15417"], "modified": "2018-08-28T19:29:00", "id": "DEBIANCVE:CVE-2017-15417", "href": "https://security-tracker.debian.org/tracker/CVE-2017-15417", "cvss": {"score": 2.6, "vector": "AV:N/AC:H/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2021-12-14T17:47:15", "description": "Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a socially engineered user to XSS themselves by dragging and dropping a javascript: URL into the URL bar.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "baseScore": 6.1, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 2.7}, "published": "2018-08-28T19:29:00", "type": "debiancve", "title": "CVE-2017-15427", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15427"], "modified": "2018-08-28T19:29:00", "id": "DEBIANCVE:CVE-2017-15427", "href": "https://security-tracker.debian.org/tracker/CVE-2017-15427", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2021-12-14T17:47:15", "description": "Heap buffer overflow in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file that is mishandled by PDFium.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2018-08-28T19:29:00", "type": "debiancve", "title": "CVE-2017-15408", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15408"], "modified": "2018-08-28T19:29:00", "id": "DEBIANCVE:CVE-2017-15408", "href": "https://security-tracker.debian.org/tracker/CVE-2017-15408", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-12-14T17:47:15", "description": "Heap buffer overflow in Blob API in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page, aka a Blink out-of-bounds read.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 6.5, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 3.6}, "published": "2018-08-28T19:29:00", "type": "debiancve", "title": "CVE-2017-15416", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15416"], "modified": "2018-08-28T19:29:00", "id": "DEBIANCVE:CVE-2017-15416", "href": "https://security-tracker.debian.org/tracker/CVE-2017-15416", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2021-12-14T17:47:15", "description": "Heap buffer overflow in Skia in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2018-08-28T19:29:00", "type": "debiancve", "title": "CVE-2017-15409", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15409"], "modified": "2018-08-28T19:29:00", "id": "DEBIANCVE:CVE-2017-15409", "href": "https://security-tracker.debian.org/tracker/CVE-2017-15409", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-12-14T17:47:15", "description": "Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "baseScore": 6.5, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 3.6}, "published": "2018-08-28T19:29:00", "type": "debiancve", "title": "CVE-2017-15424", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15424"], "modified": "2018-08-28T19:29:00", "id": "DEBIANCVE:CVE-2017-15424", "href": "https://security-tracker.debian.org/tracker/CVE-2017-15424", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2021-12-14T17:47:15", "description": "Use after free in PDFium in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2018-08-28T19:29:00", "type": "debiancve", "title": "CVE-2017-15411", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15411"], "modified": "2018-08-28T19:29:00", "id": "DEBIANCVE:CVE-2017-15411", "href": "https://security-tracker.debian.org/tracker/CVE-2017-15411", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-12-14T17:47:15", "description": "Use after free in PDFium in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2018-08-28T19:29:00", "type": "debiancve", "title": "CVE-2017-15410", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15410"], "modified": "2018-08-28T19:29:00", "id": "DEBIANCVE:CVE-2017-15410", "href": "https://security-tracker.debian.org/tracker/CVE-2017-15410", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-12-14T17:47:15", "description": "Insufficient policy enforcement in Resource Timing API in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to infer browsing history by triggering a leaked cross-origin URL via a crafted HTML page.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 6.5, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 3.6}, "published": "2018-08-28T19:29:00", "type": "debiancve", "title": "CVE-2017-15419", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15419"], "modified": "2018-08-28T19:29:00", "id": "DEBIANCVE:CVE-2017-15419", "href": "https://security-tracker.debian.org/tracker/CVE-2017-15419", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2021-12-14T17:47:15", "description": "Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "baseScore": 6.5, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 3.6}, "published": "2018-08-28T19:29:00", "type": "debiancve", "title": "CVE-2017-15425", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15425"], "modified": "2018-08-28T19:29:00", "id": "DEBIANCVE:CVE-2017-15425", "href": "https://security-tracker.debian.org/tracker/CVE-2017-15425", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2021-12-14T17:47:15", "description": "Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "baseScore": 6.5, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 3.6}, "published": "2018-08-28T19:29:00", "type": "debiancve", "title": "CVE-2017-15426", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15426"], "modified": "2018-08-28T19:29:00", "id": "DEBIANCVE:CVE-2017-15426", "href": "https://security-tracker.debian.org/tracker/CVE-2017-15426", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2021-12-14T17:47:15", "description": "Use of uninitialized memory in Skia in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 1.4}, "published": "2018-08-28T19:29:00", "type": "debiancve", "title": "CVE-2017-15418", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15418"], "modified": "2018-08-28T19:29:00", "id": "DEBIANCVE:CVE-2017-15418", "href": "https://security-tracker.debian.org/tracker/CVE-2017-15418", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2021-12-14T17:47:15", "description": "Incorrect serialization in IPC in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak the value of a pointer via a crafted HTML page.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 6.5, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 3.6}, "published": "2018-08-28T19:29:00", "type": "debiancve", "title": "CVE-2017-15415", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15415"], "modified": "2018-08-28T19:29:00", "id": "DEBIANCVE:CVE-2017-15415", "href": "https://security-tracker.debian.org/tracker/CVE-2017-15415", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2021-12-14T17:47:15", "description": "Inappropriate implementation in BoringSSL SPAKE2 in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak the low-order bits of SHA512(password) by inspecting protocol traffic.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 5.3, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 1.4}, "published": "2018-08-28T19:29:00", "type": "debiancve", "title": "CVE-2017-15423", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15423"], "modified": "2018-08-28T19:29:00", "id": "DEBIANCVE:CVE-2017-15423", "href": "https://security-tracker.debian.org/tracker/CVE-2017-15423", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2021-12-14T17:47:16", "description": "Integer overflow in computing the required allocation size when instantiating a new javascript object in V8 in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2018-11-14T15:29:00", "type": "debiancve", "title": "CVE-2018-6065", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6065"], "modified": "2018-11-14T15:29:00", "id": "DEBIANCVE:CVE-2018-6065", "href": "https://security-tracker.debian.org/tracker/CVE-2018-6065", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-12-14T17:47:15", "description": "Incorrect handling of back navigations in error pages in Navigation in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "baseScore": 6.5, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 3.6}, "published": "2018-08-28T19:29:00", "type": "debiancve", "title": "CVE-2017-15420", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15420"], "modified": "2018-08-28T19:29:00", "id": "DEBIANCVE:CVE-2017-15420", "href": "https://security-tracker.debian.org/tracker/CVE-2017-15420", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2021-12-14T17:47:16", "description": "Object lifecycle issue in Chrome Custom Tab in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "baseScore": 4.3, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 1.4}, "published": "2018-11-14T15:29:00", "type": "debiancve", "title": "CVE-2018-6068", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6068"], "modified": "2018-11-14T15:29:00", "id": "DEBIANCVE:CVE-2018-6068", "href": "https://security-tracker.debian.org/tracker/CVE-2018-6068", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2021-12-14T17:47:16", "description": "Stack buffer overflow in Skia in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 6.5, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 3.6}, "published": "2018-11-14T15:29:00", "type": "debiancve", "title": "CVE-2018-6069", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6069"], "modified": "2018-11-14T15:29:00", "id": "DEBIANCVE:CVE-2018-6069", "href": "https://security-tracker.debian.org/tracker/CVE-2018-6069", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2021-12-14T17:47:16", "description": "Lack of special casing of Android ashmem in Google Chrome prior to 65.0.3325.146 allowed a remote attacker who had compromised the renderer process to bypass inter-process read only guarantees via a crafted HTML page.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2018-11-14T15:29:00", "type": "debiancve", "title": "CVE-2018-6057", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6057"], "modified": "2018-11-14T15:29:00", "id": "DEBIANCVE:CVE-2018-6057", "href": "https://security-tracker.debian.org/tracker/CVE-2018-6057", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-12-14T17:47:16", "description": "Failure to disallow PWA installation from CSP sandboxed pages in AppManifest in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to access privileged APIs via a crafted HTML page.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2018-11-14T15:29:00", "type": "debiancve", "title": "CVE-2018-6083", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6083"], "modified": "2018-11-14T15:29:00", "id": "DEBIANCVE:CVE-2018-6083", "href": "https://security-tracker.debian.org/tracker/CVE-2018-6083", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-12-14T17:47:15", "description": "A stack buffer overflow in NumberingSystem in International Components for Unicode (ICU) for C/C++ before 60.2, as used in V8 in Google Chrome prior to 62.0.3202.75 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "baseScore": 6.5, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 3.6}, "published": "2018-08-28T20:29:00", "type": "debiancve", "title": "CVE-2017-15396", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15396"], "modified": "2018-08-28T20:29:00", "id": "DEBIANCVE:CVE-2017-15396", "href": "https://security-tracker.debian.org/tracker/CVE-2017-15396", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2021-12-14T17:47:16", "description": "Lack of CORS checking by ResourceFetcher/ResourceLoader in Blink in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data via a crafted HTML page.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 6.5, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 3.6}, "published": "2018-11-14T15:29:00", "type": "debiancve", "title": "CVE-2018-6066", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6066"], "modified": "2018-11-14T15:29:00", "id": "DEBIANCVE:CVE-2018-6066", "href": "https://security-tracker.debian.org/tracker/CVE-2018-6066", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2021-12-14T17:47:16", "description": "Type Confusion in the implementation of __defineGetter__ in V8 in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2018-11-14T15:29:00", "type": "debiancve", "title": "CVE-2018-6064", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6064"], "modified": "2018-11-14T15:29:00", "id": "DEBIANCVE:CVE-2018-6064", "href": "https://security-tracker.debian.org/tracker/CVE-2018-6064", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-12-14T17:47:16", "description": "Incorrect handling of confusable characters in Omnibox in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "baseScore": 4.3, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 1.4}, "published": "2018-11-14T15:29:00", "type": "debiancve", "title": "CVE-2018-6078", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6078"], "modified": "2018-11-14T15:29:00", "id": "DEBIANCVE:CVE-2018-6078", "href": "https://security-tracker.debian.org/tracker/CVE-2018-6078", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2021-12-14T17:47:16", "description": "Lack of CSP enforcement on WebUI pages in Bink in Google Chrome prior to 65.0.3325.146 allowed an attacker who convinced a user to install a malicious extension to bypass content security policy via a crafted Chrome Extension.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "baseScore": 6.1, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 2.7}, "published": "2018-11-14T15:29:00", "type": "debiancve", "title": "CVE-2018-6070", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6070"], "modified": "2018-11-14T15:29:00", "id": "DEBIANCVE:CVE-2018-6070", "href": "https://security-tracker.debian.org/tracker/CVE-2018-6070", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2021-12-14T17:47:16", "description": "A heap buffer overflow in WebGL in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2018-11-14T15:29:00", "type": "debiancve", "title": "CVE-2018-6073", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6073"], "modified": "2018-11-14T15:29:00", "id": "DEBIANCVE:CVE-2018-6073", "href": "https://security-tracker.debian.org/tracker/CVE-2018-6073", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-12-14T17:47:16", "description": "An integer overflow leading to use after free in PDFium in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2018-11-14T15:29:00", "type": "debiancve", "title": "CVE-2018-6072", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6072"], "modified": "2018-11-14T15:29:00", "id": "DEBIANCVE:CVE-2018-6072", "href": "https://security-tracker.debian.org/tracker/CVE-2018-6072", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "ubuntucve": [{"lastseen": "2022-08-04T13:46:55", "description": "Type confusion in WebAssembly in V8 in Google Chrome prior to 63.0.3239.84\nallowed a remote attacker to potentially exploit heap corruption via a\ncrafted HTML page.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-08-28T00:00:00", "type": "ubuntucve", "title": "CVE-2017-15413", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15413"], "modified": "2018-08-28T00:00:00", "id": "UB:CVE-2017-15413", "href": "https://ubuntu.com/security/CVE-2017-15413", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2022-08-04T13:46:56", "description": "Out-of-bounds Write in the QUIC networking stack in Google Chrome prior to\n63.0.3239.84 allowed a remote attacker to gain code execution via a\nmalicious server.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-08-28T00:00:00", "type": "ubuntucve", "title": "CVE-2017-15407", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15407"], "modified": "2018-08-28T00:00:00", "id": "UB:CVE-2017-15407", "href": "https://ubuntu.com/security/CVE-2017-15407", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2022-08-04T13:46:55", "description": "Inappropriate implementation in Skia canvas composite operations in Google\nChrome prior to 63.0.3239.84 allowed a remote attacker to leak cross-origin\ndata via a crafted HTML page.", "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 5.3, "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2018-08-28T00:00:00", "type": "ubuntucve", "title": "CVE-2017-15417", "bulletinFamily": "info", "cvss2": {"severity": "LOW", "exploitabilityScore": 4.9, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "HIGH", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 2.6, "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15417"], "modified": "2018-08-28T00:00:00", "id": "UB:CVE-2017-15417", "href": "https://ubuntu.com/security/CVE-2017-15417", "cvss": {"score": 2.6, "vector": "AV:N/AC:H/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2022-08-04T13:46:54", "description": "Insufficient policy enforcement in Omnibox in Google Chrome prior to\n63.0.3239.84 allowed a socially engineered user to XSS themselves by\ndragging and dropping a javascript: URL into the URL bar.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2018-08-28T00:00:00", "type": "ubuntucve", "title": "CVE-2017-15427", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15427"], "modified": "2018-08-28T00:00:00", "id": "UB:CVE-2017-15427", "href": "https://ubuntu.com/security/CVE-2017-15427", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2022-08-04T13:46:54", "description": "Heap buffer overflow in Blob API in Google Chrome prior to 63.0.3239.84\nallowed a remote attacker to potentially exploit heap corruption via a\ncrafted HTML page, aka a Blink out-of-bounds read.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 6.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2018-08-28T00:00:00", "type": "ubuntucve", "title": "CVE-2017-15416", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15416"], "modified": "2018-08-28T00:00:00", "id": "UB:CVE-2017-15416", "href": "https://ubuntu.com/security/CVE-2017-15416", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2022-08-04T13:46:55", "description": "Heap buffer overflow in Omnibox in Google Chrome prior to 63.0.3239.84\nallowed a remote attacker to potentially exploit heap corruption via a\ncrafted PDF file that is mishandled by PDFium.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-08-28T00:00:00", "type": "ubuntucve", "title": "CVE-2017-15408", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15408"], "modified": "2018-08-28T00:00:00", "id": "UB:CVE-2017-15408", "href": "https://ubuntu.com/security/CVE-2017-15408", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2022-08-04T13:46:56", "description": "Heap buffer overflow in Skia in Google Chrome prior to 63.0.3239.84 allowed\na remote attacker to potentially exploit heap corruption via a crafted HTML\npage.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-08-28T00:00:00", "type": "ubuntucve", "title": "CVE-2017-15409", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15409"], "modified": "2018-08-28T00:00:00", "id": "UB:CVE-2017-15409", "href": "https://ubuntu.com/security/CVE-2017-15409", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2022-08-04T13:46:56", "description": "Use after free in PDFium in Google Chrome prior to 63.0.3239.84 allowed a\nremote attacker to potentially exploit heap corruption via a crafted PDF\nfile.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-08-28T00:00:00", "type": "ubuntucve", "title": "CVE-2017-15410", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15410"], "modified": "2018-08-28T00:00:00", "id": "UB:CVE-2017-15410", "href": "https://ubuntu.com/security/CVE-2017-15410", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2022-08-04T13:46:53", "description": "Insufficient policy enforcement in Omnibox in Google Chrome prior to\n63.0.3239.84 allowed a remote attacker to perform domain spoofing via IDN\nhomographs in a crafted domain name.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 6.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2018-08-28T00:00:00", "type": "ubuntucve", "title": "CVE-2017-15424", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15424"], "modified": "2018-08-28T00:00:00", "id": "UB:CVE-2017-15424", "href": "https://ubuntu.com/security/CVE-2017-15424", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2022-08-04T13:46:55", "description": "Use after free in PDFium in Google Chrome prior to 63.0.3239.84 allowed a\nremote attacker to potentially exploit heap corruption via a crafted PDF\nfile.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-08-28T00:00:00", "type": "ubuntucve", "title": "CVE-2017-15411", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15411"], "modified": "2018-08-28T00:00:00", "id": "UB:CVE-2017-15411", "href": "https://ubuntu.com/security/CVE-2017-15411", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2022-08-04T13:46:54", "description": "Insufficient policy enforcement in Resource Timing API in Google Chrome\nprior to 63.0.3239.84 allowed a remote attacker to infer browsing history\nby triggering a leaked cross-origin URL via a crafted HTML page.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 6.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2018-08-28T00:00:00", "type": "ubuntucve", "title": "CVE-2017-15419", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15419"], "modified": "2018-08-28T00:00:00", "id": "UB:CVE-2017-15419", "href": "https://ubuntu.com/security/CVE-2017-15419", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2022-08-04T13:46:54", "description": "Insufficient policy enforcement in Omnibox in Google Chrome prior to\n63.0.3239.84 allowed a remote attacker to perform domain spoofing via IDN\nhomographs in a crafted domain name.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 6.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2018-08-28T00:00:00", "type": "ubuntucve", "title": "CVE-2017-15425", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15425"], "modified": "2018-08-28T00:00:00", "id": "UB:CVE-2017-15425", "href": "https://ubuntu.com/security/CVE-2017-15425", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2022-08-04T13:46:53", "description": "Insufficient policy enforcement in Omnibox in Google Chrome prior to\n63.0.3239.84 allowed a remote attacker to perform domain spoofing via IDN\nhomographs in a crafted domain name.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 6.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2018-08-28T00:00:00", "type": "ubuntucve", "title": "CVE-2017-15426", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15426"], "modified": "2018-08-28T00:00:00", "id": "UB:CVE-2017-15426", "href": "https://ubuntu.com/security/CVE-2017-15426", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2022-08-04T13:46:54", "description": "Use of uninitialized memory in Skia in Google Chrome prior to 63.0.3239.84\nallowed a remote attacker to obtain potentially sensitive information from\nprocess memory via a crafted HTML page.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 4.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 1.4}, "published": "2018-08-28T00:00:00", "type": "ubuntucve", "title": "CVE-2017-15418", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15418"], "modified": "2018-08-28T00:00:00", "id": "UB:CVE-2017-15418", "href": "https://ubuntu.com/security/CVE-2017-15418", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2022-08-04T13:46:54", "description": "Inappropriate implementation in BoringSSL SPAKE2 in Google Chrome prior to\n63.0.3239.84 allowed a remote attacker to leak the low-order bits of\nSHA512(password) by inspecting protocol traffic.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 5.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 1.4}, "published": "2018-08-28T00:00:00", "type": "ubuntucve", "title": "CVE-2017-15423", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15423"], "modified": "2018-08-28T00:00:00", "id": "UB:CVE-2017-15423", "href": "https://ubuntu.com/security/CVE-2017-15423", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2022-08-04T13:46:56", "description": "Incorrect serialization in IPC in Google Chrome prior to 63.0.3239.84\nallowed a remote attacker to leak the value of a pointer via a crafted HTML\npage.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 6.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2018-08-28T00:00:00", "type": "ubuntucve", "title": "CVE-2017-15415", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15415"], "modified": "2018-08-28T00:00:00", "id": "UB:CVE-2017-15415", "href": "https://ubuntu.com/security/CVE-2017-15415", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2022-08-04T13:45:07", "description": "Integer overflow in computing the required allocation size when\ninstantiating a new javascript object in V8 in Google Chrome prior to\n65.0.3325.146 allowed a remote attacker to potentially exploit heap\ncorruption via a crafted HTML page.\n\n#### Bugs\n\n * <https://crbug.com/808192>\n\n\n#### Notes\n\nAuthor| Note \n---|--- \n[mikesalvatore](<https://launchpad.net/~mikesalvatore>) | The Ubuntu Security Team does not support libv8\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-11-14T00:00:00", "type": "ubuntucve", "title": "CVE-2018-6065", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6065"], "modified": "2018-11-14T00:00:00", "id": "UB:CVE-2018-6065", "href": "https://ubuntu.com/security/CVE-2018-6065", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2022-08-04T13:46:54", "description": "Incorrect handling of back navigations in error pages in Navigation in\nGoogle Chrome prior to 63.0.3239.84 allowed a remote attacker to spoof the\ncontents of the Omnibox (URL bar) via a crafted HTML page.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 6.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2018-08-28T00:00:00", "type": "ubuntucve", "title": "CVE-2017-15420", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15420"], "modified": "2018-08-28T00:00:00", "id": "UB:CVE-2017-15420", "href": "https://ubuntu.com/security/CVE-2017-15420", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2022-08-04T13:45:07", "description": "Object lifecycle issue in Chrome Custom Tab in Google Chrome prior to\n65.0.3325.146 allowed a remote attacker to spoof the contents of the\nOmnibox (URL bar) via a crafted HTML page.\n\n#### Bugs\n\n * <https://crbug.com/798933>\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 4.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 1.4}, "published": "2018-11-14T00:00:00", "type": "ubuntucve", "title": "CVE-2018-6068", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6068"], "modified": "2018-11-14T00:00:00", "id": "UB:CVE-2018-6068", "href": "https://ubuntu.com/security/CVE-2018-6068", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2022-08-04T13:45:05", "description": "Stack buffer overflow in Skia in Google Chrome prior to 65.0.3325.146\nallowed a remote attacker to perform an out of bounds memory read via a\ncrafted HTML page.\n\n#### Bugs\n\n * <https://crbug.com/799918>\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 6.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2018-11-14T00:00:00", "type": "ubuntucve", "title": "CVE-2018-6069", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6069"], "modified": "2018-11-14T00:00:00", "id": "UB:CVE-2018-6069", "href": "https://ubuntu.com/security/CVE-2018-6069", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2022-08-04T13:45:07", "description": "Lack of special casing of Android ashmem in Google Chrome prior to\n65.0.3325.146 allowed a remote attacker who had compromised the renderer\nprocess to bypass inter-process read only guarantees via a crafted HTML\npage.\n\n#### Bugs\n\n * <https://crbug.com/789959>\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-11-14T00:00:00", "type": "ubuntucve", "title": "CVE-2018-6057", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6057"], "modified": "2018-11-14T00:00:00", "id": "UB:CVE-2018-6057", "href": "https://ubuntu.com/security/CVE-2018-6057", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2022-08-04T13:45:04", "description": "Failure to disallow PWA installation from CSP sandboxed pages in\nAppManifest in Google Chrome prior to 65.0.3325.146 allowed a remote\nattacker to access privileged APIs via a crafted HTML page.\n\n#### Bugs\n\n * <https://crbug.com/771709>\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-11-14T00:00:00", "type": "ubuntucve", "title": "CVE-2018-6083", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6083"], "modified": "2018-11-14T00:00:00", "id": "UB:CVE-2018-6083", "href": "https://ubuntu.com/security/CVE-2018-6083", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2022-08-04T13:46:52", "description": "A stack buffer overflow in NumberingSystem in International Components for\nUnicode (ICU) for C/C++ before 60.2, as used in V8 in Google Chrome prior\nto 62.0.3202.75 and other products, allowed a remote attacker to\npotentially exploit heap corruption via a crafted HTML page.\n\n#### Notes\n\nAuthor| Note \n---|--- \n[mikesalvatore](<https://launchpad.net/~mikesalvatore>) | The Ubuntu Security Team does not support libv8\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 6.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2018-08-28T00:00:00", "type": "ubuntucve", "title": "CVE-2017-15396", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15396"], "modified": "2018-08-28T00:00:00", "id": "UB:CVE-2017-15396", "href": "https://ubuntu.com/security/CVE-2017-15396", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2022-08-04T13:45:07", "description": "Lack of CORS checking by ResourceFetcher/ResourceLoader in Blink in Google\nChrome prior to 65.0.3325.146 allowed a remote attacker to leak\ncross-origin data via a crafted HTML page.\n\n#### Bugs\n\n * <https://crbug.com/799477>\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 6.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2018-11-14T00:00:00", "type": "ubuntucve", "title": "CVE-2018-6066", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6066"], "modified": "2018-11-14T00:00:00", "id": "UB:CVE-2018-6066", "href": "https://ubuntu.com/security/CVE-2018-6066", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2022-08-04T13:45:07", "description": "Type Confusion in the implementation of __defineGetter__ in V8 in Google\nChrome prior to 65.0.3325.146 allowed a remote attacker to potentially\nexploit heap corruption via a crafted HTML page.\n\n#### Bugs\n\n * <https://crbug.com/798644>\n\n\n#### Notes\n\nAuthor| Note \n---|--- \n[mikesalvatore](<https://launchpad.net/~mikesalvatore>) | The Ubuntu Security Team does not support libv8\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-11-14T00:00:00", "type": "ubuntucve", "title": "CVE-2018-6064", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6064"], "modified": "2018-11-14T00:00:00", "id": "UB:CVE-2018-6064", "href": "https://ubuntu.com/security/CVE-2018-6064", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2022-08-04T13:45:05", "description": "Incorrect handling of confusable characters in Omnibox in Google Chrome\nprior to 65.0.3325.146 allowed a remote attacker to spoof the contents of\nthe Omnibox (URL bar) via a crafted domain name.\n\n#### Bugs\n\n * <https://crbug.com/793628>\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 4.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 1.4}, "published": "2018-11-14T00:00:00", "type": "ubuntucve", "title": "CVE-2018-6078", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6078"], "modified": "2018-11-14T00:00:00", "id": "UB:CVE-2018-6078", "href": "https://ubuntu.com/security/CVE-2018-6078", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2022-08-04T13:45:05", "description": "Lack of CSP enforcement on WebUI pages in Bink in Google Chrome prior to\n65.0.3325.146 allowed an attacker who convinced a user to install a\nmalicious extension to bypass content security policy via a crafted Chrome\nExtension.\n\n#### Bugs\n\n * <https://crbug.com/668645>\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2018-11-14T00:00:00", "type": "ubuntucve", "title": "CVE-2018-6070", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6070"], "modified": "2018-11-14T00:00:00", "id": "UB:CVE-2018-6070", "href": "https://ubuntu.com/security/CVE-2018-6070", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2022-08-04T13:45:05", "description": "A heap buffer overflow in WebGL in Google Chrome prior to 65.0.3325.146\nallowed a remote attacker to perform an out of bounds memory write via a\ncrafted HTML page.\n\n#### Bugs\n\n * <https://crbug.com/804118>\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-11-14T00:00:00", "type": "ubuntucve", "title": "CVE-2018-6073", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6073"], "modified": "2018-11-14T00:00:00", "id": "UB:CVE-2018-6073", "href": "https://ubuntu.com/security/CVE-2018-6073", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2022-08-04T13:45:06", "description": "An integer overflow leading to use after free in PDFium in Google Chrome\nprior to 65.0.3325.146 allowed a remote attacker to potentially exploit\nheap corruption via a crafted PDF file.\n\n#### Bugs\n\n * <https://crbug.com/791048>\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-11-14T00:00:00", "type": "ubuntucve", "title": "CVE-2018-6072", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6072"], "modified": "2018-11-14T00:00:00", "id": "UB:CVE-2018-6072", "href": "https://ubuntu.com/security/CVE-2018-6072", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2022-08-04T13:45:06", "description": "An integer overflow in Skia in Google Chrome prior to 65.0.3325.146 allowed\na remote attacker to perform an out of bounds memory read via a crafted\nHTML page.\n\n#### Bugs\n\n * <https://crbug.com/777318>\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-11-14T00:00:00", "type": "ubuntucve", "title": "CVE-2018-6071", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6071"], "modified": "2018-11-14T00:00:00", "id": "UB:CVE-2018-6071", "href": "https://ubuntu.com/security/CVE-2018-6071", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "redhatcve": [{"lastseen": "2022-07-09T16:40:27", "description": "Type confusion in WebAssembly in V8 in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2017-12-07T10:20:51", "type": "redhatcve", "title": "CVE-2017-15413", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15413"], "modified": "2022-07-09T15:50:06", "id": "RH:CVE-2017-15413", "href": "https://access.redhat.com/security/cve/cve-2017-15413", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2022-07-09T16:40:25", "description": "Out-of-bounds Write in the QUIC networking stack in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to gain code execution via a malicious server.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2017-12-07T10:23:25", "type": "redhatcve", "title": "CVE-2017-15407", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15407"], "modified": "2022-07-09T15:49:58", "id": "RH:CVE-2017-15407", "href": "https://access.redhat.com/security/cve/cve-2017-15407", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2022-07-09T16:40:24", "description": "Inappropriate implementation in Skia canvas composite operations in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak cross-origin data via a crafted HTML page.\n", "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 5.3, "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2017-12-07T10:22:04", "type": "redhatcve", "title": "CVE-2017-15417", "bulletinFamily": "info", "cvss2": {"severity": "LOW", "exploitabilityScore": 4.9, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "HIGH", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 2.6, "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15417"], "modified": "2022-07-09T15:50:12", "id": "RH:CVE-2017-15417", "href": "https://access.redhat.com/security/cve/cve-2017-15417", "cvss": {"score": 2.6, "vector": "AV:N/AC:H/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2022-07-09T16:40:24", "description": "Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a socially engineered user to XSS themselves by dragging and dropping a javascript: URL into the URL bar.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2017-12-07T10:20:34", "type": "redhatcve", "title": "CVE-2017-15427", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15427"], "modified": "2022-07-09T15:50:25", "id": "RH:CVE-2017-15427", "href": "https://access.redhat.com/security/cve/cve-2017-15427", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2022-07-09T16:40:23", "description": "Heap buffer overflow in Blob API in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page, aka a Blink out-of-bounds read.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 6.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2017-12-07T10:22:19", "type": "redhatcve", "title": "CVE-2017-15416", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15416"], "modified": "2022-07-09T15:50:11", "id": "RH:CVE-2017-15416", "href": "https://access.redhat.com/security/cve/cve-2017-15416", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2022-07-09T16:40:27", "description": "Heap buffer overflow in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file that is mishandled by PDFium.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2017-12-07T10:24:20", "type": "redhatcve", "title": "CVE-2017-15408", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15408"], "modified": "2022-07-09T15:49:59", "id": "RH:CVE-2017-15408", "href": "https://access.redhat.com/security/cve/cve-2017-15408", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2022-07-09T16:40:23", "description": "Heap buffer overflow in Skia in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2017-12-07T10:24:35", "type": "redhatcve", "title": "CVE-2017-15409", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15409"], "modified": "2022-07-09T15:50:01", "id": "RH:CVE-2017-15409", "href": "https://access.redhat.com/security/cve/cve-2017-15409", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2022-07-09T16:40:25", "description": "Use after free in PDFium in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2017-12-07T10:21:48", "type": "redhatcve", "title": "CVE-2017-15410", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15410"], "modified": "2022-07-09T15:50:01", "id": "RH:CVE-2017-15410", "href": "https://access.redhat.com/security/cve/cve-2017-15410", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2022-07-09T16:40:25", "description": "Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 6.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2017-12-07T10:24:50", "type": "redhatcve", "title": "CVE-2017-15424", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15424"], "modified": "2022-07-09T15:50:21", "id": "RH:CVE-2017-15424", "href": "https://access.redhat.com/security/cve/cve-2017-15424", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2022-07-09T16:40:24", "description": "Use after free in PDFium in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2017-12-07T10:21:27", "type": "redhatcve", "title": "CVE-2017-15411", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15411"], "modified": "2022-07-09T15:50:05", "id": "RH:CVE-2017-15411", "href": "https://access.redhat.com/security/cve/cve-2017-15411", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2022-07-09T16:40:27", "description": "Insufficient policy enforcement in Resource Timing API in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to infer browsing history by triggering a leaked cross-origin URL via a crafted HTML page.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 6.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2017-12-07T10:22:49", "type": "redhatcve", "title": "CVE-2017-15419", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15419"], "modified": "2022-07-09T15:50:15", "id": "RH:CVE-2017-15419", "href": "https://access.redhat.com/security/cve/cve-2017-15419", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2022-07-09T16:40:25", "description": "Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 6.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2017-12-07T10:25:06", "type": "redhatcve", "title": "CVE-2017-15425", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15425"], "modified": "2022-07-09T15:50:22", "id": "RH:CVE-2017-15425", "href": "https://access.redhat.com/security/cve/cve-2017-15425", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2022-07-09T16:40:24", "description": "Use of uninitialized memory in Skia in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 4.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 1.4}, "published": "2017-12-07T10:23:08", "type": "redhatcve", "title": "CVE-2017-15418", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15418"], "modified": "2022-07-09T15:50:12", "id": "RH:CVE-2017-15418", "href": "https://access.redhat.com/security/cve/cve-2017-15418", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2022-07-09T16:40:22", "description": "Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 6.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2017-12-07T10:20:14", "type": "redhatcve", "title": "CVE-2017-15426", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15426"], "modified": "2022-07-09T15:50:22", "id": "RH:CVE-2017-15426", "href": "https://access.redhat.com/security/cve/cve-2017-15426", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2022-07-09T16:40:22", "description": "Incorrect serialization in IPC in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak the value of a pointer via a crafted HTML page.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 6.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2017-12-07T10:22:34", "type": "redhatcve", "title": "CVE-2017-15415", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15415"], "modified": "2022-07-09T15:50:10", "id": "RH:CVE-2017-15415", "href": "https://access.redhat.com/security/cve/cve-2017-15415", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2022-07-09T16:40:25", "description": "Inappropriate implementation in BoringSSL SPAKE2 in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak the low-order bits of SHA512(password) by inspecting protocol traffic.\n", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 5.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 1.4}, "published": "2017-12-07T10:23:53", "type": "redhatcve", "title": "CVE-2017-15423", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15423"], "modified": "2022-07-09T15:50:20", "id": "RH:CVE-2017-15423", "href": "https://access.redhat.com/security/cve/cve-2017-15423", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2022-07-09T16:38:37", "description": "Integer overflow in computing the required allocation size when instantiating a new javascript object in V8 in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-03-07T08:53:30", "type": "redhatcve", "title": "CVE-2018-6065", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6065"], "modified": "2022-07-09T15:59:12", "id": "RH:CVE-2018-6065", "href": "https://access.redhat.com/security/cve/cve-2018-6065", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2022-07-09T16:40:27", "description": "Incorrect handling of back navigations in error pages in Navigation in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 6.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2017-12-07T10:24:06", "type": "redhatcve", "title": "CVE-2017-15420", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15420"], "modified": "2022-07-09T15:50:16", "id": "RH:CVE-2017-15420", "href": "https://access.redhat.com/security/cve/cve-2017-15420", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2022-12-19T21:11:55", "description": "Object lifecycle issue in Chrome Custom Tab in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 4.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 1.4}, "published": "2018-03-07T08:52:50", "type": "redhatcve", "title": "CVE-2018-6068", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6068"], "modified": "2022-12-19T17:53:08", "id": "RH:CVE-2018-6068", "href": "https://access.redhat.com/security/cve/cve-2018-6068", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2022-07-09T16:38:35", "description": "Stack buffer overflow in Skia in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 6.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2019-10-09T03:52:01", "type": "redhatcve", "title": "CVE-2018-6069", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6069"], "modified": "2022-07-09T15:59:17", "id": "RH:CVE-2018-6069", "href": "https://access.redhat.com/security/cve/cve-2018-6069", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2022-07-09T16:38:33", "description": "Lack of special casing of Android ashmem in Google Chrome prior to 65.0.3325.146 allowed a remote attacker who had compromised the renderer process to bypass inter-process read only guarantees via a crafted HTML page.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-03-07T08:50:27", "type": "redhatcve", "title": "CVE-2018-6057", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6057"], "modified": "2022-07-09T15:59:01", "id": "RH:CVE-2018-6057", "href": "https://access.redhat.com/security/cve/cve-2018-6057", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2022-07-09T16:38:34", "description": "Failure to disallow PWA installation from CSP sandboxed pages in AppManifest in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to access privileged APIs via a crafted HTML page.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-10-11T09:45:19", "type": "redhatcve", "title": "CVE-2018-6083", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6083"], "modified": "2022-07-09T15:59:39", "id": "RH:CVE-2018-6083", "href": "https://access.redhat.com/security/cve/cve-2018-6083", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2022-07-09T16:38:42", "description": "Lack of CORS checking by ResourceFetcher/ResourceLoader in Blink in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data via a crafted HTML page.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 6.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2018-03-07T08:53:44", "type": "redhatcve", "title": "CVE-2018-6066", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6066"], "modified": "2022-07-09T15:59:13", "id": "RH:CVE-2018-6066", "href": "https://access.redhat.com/security/cve/cve-2018-6066", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2022-07-09T16:38:36", "description": "Type Confusion in the implementation of __defineGetter__ in V8 in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-10-12T02:31:58", "type": "redhatcve", "title": "CVE-2018-6064", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6064"], "modified": "2022-07-09T15:59:09", "id": "RH:CVE-2018-6064", "href": "https://access.redhat.com/security/cve/cve-2018-6064", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2022-07-09T16:38:35", "description": "Incorrect handling of confusable characters in Omnibox in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 4.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 1.4}, "published": "2018-03-07T08:52:07", "type": "redhatcve", "title": "CVE-2018-6078", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6078"], "modified": "2022-07-09T15:59:32", "id": "RH:CVE-2018-6078", "href": "https://access.redhat.com/security/cve/cve-2018-6078", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2022-07-09T16:38:33", "description": "Lack of CSP enforcement on WebUI pages in Bink in Google Chrome prior to 65.0.3325.146 allowed an attacker who convinced a user to install a malicious extension to bypass content security policy via a crafted Chrome Extension.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2018-03-07T08:50:40", "type": "redhatcve", "title": "CVE-2018-6070", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6070"], "modified": "2022-07-09T15:59:16", "id": "RH:CVE-2018-6070", "href": "https://access.redhat.com/security/cve/cve-2018-6070", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2022-07-09T16:38:36", "description": "A heap buffer overflow in WebGL in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-03-07T08:50:02", "type": "redhatcve", "title": "CVE-2018-6073", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6073"], "modified": "2022-07-09T15:59:23", "id": "RH:CVE-2018-6073", "href": "https://access.redhat.com/security/cve/cve-2018-6073", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2022-07-09T16:38:32", "description": "An integer overflow leading to use after free in PDFium in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-03-07T08:50:15", "type": "redhatcve", "title": "CVE-2018-6072", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6072"], "modified": "2022-07-09T15:59:21", "id": "RH:CVE-2018-6072", "href": "https://access.redhat.com/security/cve/cve-2018-6072", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2022-07-09T16:38:33", "description": "An integer overflow in Skia in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-03-07T08:48:52", "type": "redhatcve", "title": "CVE-2018-6071", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6071"], "modified": "2022-07-09T15:59:19", "id": "RH:CVE-2018-6071", "href": "https://access.redhat.com/security/cve/cve-2018-6071", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "cve": [{"lastseen": "2022-03-23T14:10:54", "description": "Type confusion in WebAssembly in V8 in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-08-28T19:29:00", "type": "cve", "title": "CVE-2017-15413", "cwe": ["CWE-704"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15413"], "modified": "2018-10-25T01:59:00", "cpe": ["cpe:/o:redhat:enterprise_linux_workstation:6.0", "cpe:/o:redhat:enterprise_linux_desktop:6.0", "cpe:/o:debian:debian_linux:9.0", "cpe:/o:redhat:enterprise_linux_server:6.0"], "id": "CVE-2017-15413", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-15413", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T14:10:42", "description": "Out-of-bounds Write in the QUIC networking stack in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to gain code execution via a malicious server.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-08-28T19:29:00", "type": "cve", "title": "CVE-2017-15407", "cwe": ["CWE-787"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15407"], "modified": "2018-11-20T18:13:00", "cpe": ["cpe:/o:redhat:enterprise_linux_workstation:6.0", "cpe:/o:redhat:enterprise_linux_desktop:6.0", "cpe:/o:debian:debian_linux:9.0", "cpe:/o:redhat:enterprise_linux_server:6.0"], "id": "CVE-2017-15407", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-15407", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T14:10:59", "description": "Inappropriate implementation in Skia canvas composite operations in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak cross-origin data via a crafted HTML page.", "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 5.3, "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2018-08-28T19:29:00", "type": "cve", "title": "CVE-2017-15417", "cwe": ["CWE-119"], "bulletinFamily": "NVD", "cvss2": {"severity": "LOW", "exploitabilityScore": 4.9, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "HIGH", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 2.6, "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15417"], "modified": "2018-11-07T18:01:00", "cpe": ["cpe:/o:redhat:enterprise_linux_workstation:6.0", "cpe:/o:redhat:enterprise_linux_desktop:6.0", "cpe:/o:debian:debian_linux:9.0", "cpe:/o:redhat:enterprise_linux_server:6.0"], "id": "CVE-2017-15417", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-15417", "cvss": {"score": 2.6, "vector": "AV:N/AC:H/Au:N/C:P/I:N/A:N"}, "cpe23": ["cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T14:11:13", "description": "Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a socially engineered user to XSS themselves by dragging and dropping a javascript: URL into the URL bar.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2018-08-28T19:29:00", "type": "cve", "title": "CVE-2017-15427", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15427"], "modified": "2018-11-02T17:34:00", "cpe": ["cpe:/o:redhat:enterprise_linux_workstation:6.0", "cpe:/o:redhat:enterprise_linux_desktop:6.0", "cpe:/o:debian:debian_linux:9.0", "cpe:/o:redhat:enterprise_linux_server:6.0"], "id": "CVE-2017-15427", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-15427", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "cpe23": ["cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T14:10:43", "description": "Heap buffer overflow in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file that is mishandled by PDFium.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-08-28T19:29:00", "type": "cve", "title": "CVE-2017-15408", "cwe": ["CWE-119"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15408"], "modified": "2018-10-31T16:00:00", "cpe": ["cpe:/o:redhat:enterprise_linux_workstation:6.0", "cpe:/o:redhat:enterprise_linux_desktop:6.0", "cpe:/o:debian:debian_linux:9.0", "cpe:/o:redhat:enterprise_linux_server:6.0"], "id": "CVE-2017-15408", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-15408", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T14:10:57", "description": "Heap buffer overflow in Blob API in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page, aka a Blink out-of-bounds read.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 6.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2018-08-28T19:29:00", "type": "cve", "title": "CVE-2017-15416", "cwe": ["CWE-119"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15416"], "modified": "2018-11-07T17:51:00", "cpe": ["cpe:/o:redhat:enterprise_linux_workstation:6.0", "cpe:/o:redhat:enterprise_linux_desktop:6.0", "cpe:/o:debian:debian_linux:9.0", "cpe:/o:redhat:enterprise_linux_server:6.0"], "id": "CVE-2017-15416", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-15416", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cpe23": ["cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T14:10:47", "description": "Heap buffer overflow in Skia in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-08-28T19:29:00", "type": "cve", "title": "CVE-2017-15409", "cwe": ["CWE-119"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15409"], "modified": "2018-10-31T15:59:00", "cpe": ["cpe:/o:redhat:enterprise_linux_workstation:6.0", "cpe:/o:redhat:enterprise_linux_desktop:6.0", "cpe:/o:debian:debian_linux:9.0", "cpe:/o:redhat:enterprise_linux_server:6.0"], "id": "CVE-2017-15409", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-15409", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T14:10:52", "description": "Use after free in PDFium in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-08-28T19:29:00", "type": "cve", "title": "CVE-2017-15411", "cwe": ["CWE-416"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15411"], "modified": "2018-10-30T16:48:00", "cpe": ["cpe:/o:redhat:enterprise_linux_workstation:6.0", "cpe:/o:redhat:enterprise_linux_desktop:6.0", "cpe:/o:debian:debian_linux:9.0", "cpe:/o:redhat:enterprise_linux_server:6.0"], "id": "CVE-2017-15411", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-15411", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T14:11:07", "description": "Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 6.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2018-08-28T19:29:00", "type": "cve", "title": "CVE-2017-15424", "cwe": ["CWE-20"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15424"], "modified": "2018-10-30T16:47:00", "cpe": ["cpe:/o:redhat:enterprise_linux_workstation:6.0", "cpe:/o:redhat:enterprise_linux_desktop:6.0", "cpe:/o:debian:debian_linux:9.0", "cpe:/o:redhat:enterprise_linux_server:6.0"], "id": "CVE-2017-15424", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-15424", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "cpe23": ["cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T14:10:49", "description": "Use after free in PDFium in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-08-28T19:29:00", "type": "cve", "title": "CVE-2017-15410", "cwe": ["CWE-416"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15410"], "modified": "2018-10-30T16:48:00", "cpe": ["cpe:/o:redhat:enterprise_linux_workstation:6.0", "cpe:/o:redhat:enterprise_linux_desktop:6.0", "cpe:/o:debian:debian_linux:9.0", "cpe:/o:redhat:enterprise_linux_server:6.0"], "id": "CVE-2017-15410", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-15410", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T14:11:12", "description": "Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 6.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2018-08-28T19:29:00", "type": "cve", "title": "CVE-2017-15425", "cwe": ["CWE-20"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15425"], "modified": "2018-10-30T16:47:00", "cpe": ["cpe:/o:redhat:enterprise_linux_workstation:6.0", "cpe:/o:redhat:enterprise_linux_desktop:6.0", "cpe:/o:debian:debian_linux:9.0", "cpe:/o:redhat:enterprise_linux_server:6.0"], "id": "CVE-2017-15425", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-15425", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "cpe23": ["cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T14:11:03", "description": "Insufficient policy enforcement in Resource Timing API in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to infer browsing history by triggering a leaked cross-origin URL via a crafted HTML page.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 6.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2018-08-28T19:29:00", "type": "cve", "title": "CVE-2017-15419", "cwe": ["CWE-601"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15419"], "modified": "2018-11-07T14:55:00", "cpe": ["cpe:/o:redhat:enterprise_linux_workstation:6.0", "cpe:/o:redhat:enterprise_linux_desktop:6.0", "cpe:/o:debian:debian_linux:9.0", "cpe:/o:redhat:enterprise_linux_server:6.0"], "id": "CVE-2017-15419", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-15419", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cpe23": ["cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T14:11:10", "description": "Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 6.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2018-08-28T19:29:00", "type": "cve", "title": "CVE-2017-15426", "cwe": ["CWE-20"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15426"], "modified": "2018-10-30T16:47:00", "cpe": ["cpe:/o:redhat:enterprise_linux_workstation:6.0", "cpe:/o:redhat:enterprise_linux_desktop:6.0", "cpe:/o:debian:debian_linux:9.0", "cpe:/o:redhat:enterprise_linux_server:6.0"], "id": "CVE-2017-15426", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-15426", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "cpe23": ["cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T14:10:59", "description": "Use of uninitialized memory in Skia in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 4.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 1.4}, "published": "2018-08-28T19:29:00", "type": "cve", "title": "CVE-2017-15418", "cwe": ["CWE-119"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15418"], "modified": "2018-10-24T14:30:00", "cpe": ["cpe:/o:redhat:enterprise_linux_workstation:6.0", "cpe:/o:redhat:enterprise_linux_desktop:6.0", "cpe:/o:debian:debian_linux:9.0", "cpe:/o:redhat:enterprise_linux_server:6.0"], "id": "CVE-2017-15418", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-15418", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cpe23": ["cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T14:10:56", "description": "Incorrect serialization in IPC in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak the value of a pointer via a crafted HTML page.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 6.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2018-08-28T19:29:00", "type": "cve", "title": "CVE-2017-15415", "cwe": ["CWE-119"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15415"], "modified": "2019-10-03T00:03:00", "cpe": ["cpe:/o:redhat:enterprise_linux_workstation:6.0", "cpe:/o:redhat:enterprise_linux_desktop:6.0", "cpe:/o:debian:debian_linux:9.0", "cpe:/o:redhat:enterprise_linux_server:6.0"], "id": "CVE-2017-15415", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-15415", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cpe23": ["cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T14:11:05", "description": "Inappropriate implementation in BoringSSL SPAKE2 in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak the low-order bits of SHA512(password) by inspecting protocol traffic.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 5.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 1.4}, "published": "2018-08-28T19:29:00", "type": "cve", "title": "CVE-2017-15423", "cwe": ["CWE-310"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15423"], "modified": "2018-11-02T17:37:00", "cpe": ["cpe:/o:redhat:enterprise_linux_workstation:6.0", "cpe:/o:redhat:enterprise_linux_desktop:6.0", "cpe:/o:debian:debian_linux:9.0", "cpe:/o:redhat:enterprise_linux_server:6.0"], "id": "CVE-2017-15423", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-15423", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, "cpe23": ["cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T18:03:01", "description": "Integer overflow in computing the required allocation size when instantiating a new javascript object in V8 in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-11-14T15:29:00", "type": "cve", "title": "CVE-2018-6065", "cwe": ["CWE-190", "CWE-787"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6065"], "modified": "2020-08-24T17:37:00", "cpe": ["cpe:/o:redhat:enterprise_linux_desktop:6.0", "cpe:/o:redhat:enterprise_linux_workstation:6.0", "cpe:/a:mi:mi6_browser:-", "cpe:/o:debian:debian_linux:9.0", "cpe:/o:redhat:enterprise_linux_server:6.0"], "id": "CVE-2018-6065", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-6065", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*", "cpe:2.3:a:mi:mi6_browser:-:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T14:11:02", "description": "Incorrect handling of back navigations in error pages in Navigation in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 6.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2018-08-28T19:29:00", "type": "cve", "title": "CVE-2017-15420", "cwe": ["CWE-20"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15420"], "modified": "2019-01-09T19:29:00", "cpe": ["cpe:/o:redhat:enterprise_linux_workstation:6.0", "cpe:/o:debian:debian_linux:9.0", "cpe:/o:debian:debian_linux:8.0", "cpe:/o:redhat:enterprise_linux_desktop:6.0", "cpe:/o:redhat:enterprise_linux_server:6.0"], "id": "CVE-2017-15420", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-15420", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "cpe23": ["cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T18:03:05", "description": "Object lifecycle issue in Chrome Custom Tab in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 4.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 1.4}, "published": "2018-11-14T15:29:00", "type": "cve", "title": "CVE-2018-6068", "cwe": ["CWE-20"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6068"], "modified": "2018-12-19T18:14:00", "cpe": ["cpe:/o:redhat:linux_server:6.0", "cpe:/o:debian:debian_linux:9.0", "cpe:/o:redhat:linux_desktop:6.0", "cpe:/o:redhat:linux_workstation:6.0"], "id": "CVE-2018-6068", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-6068", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "cpe23": ["cpe:2.3:o:redhat:linux_workstation:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:linux_desktop:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:linux_server:6.0:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T18:03:07", "description": "Stack buffer overflow in Skia in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 6.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2018-11-14T15:29:00", "type": "cve", "title": "CVE-2018-6069", "cwe": ["CWE-787", "CWE-125"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6069"], "modified": "2020-08-24T17:37:00", "cpe": ["cpe:/o:redhat:linux_server:6.0", "cpe:/o:debian:debian_linux:9.0", "cpe:/o:redhat:linux_desktop:6.0", "cpe:/o:redhat:linux_workstation:6.0"], "id": "CVE-2018-6069", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-6069", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cpe23": ["cpe:2.3:o:redhat:linux_desktop:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:linux_workstation:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:linux_server:6.0:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T18:02:53", "description": "Lack of special casing of Android ashmem in Google Chrome prior to 65.0.3325.146 allowed a remote attacker who had compromised the renderer process to bypass inter-process read only guarantees via a crafted HTML page.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-11-14T15:29:00", "type": "cve", "title": "CVE-2018-6057", "cwe": ["CWE-732"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6057"], "modified": "2019-10-03T00:03:00", "cpe": ["cpe:/o:redhat:enterprise_linux_server:6.0", "cpe:/o:redhat:enterprise_linux_desktop:6.0", "cpe:/o:debian:debian_linux:9.0", "cpe:/o:redhat:enterprise_linux_workstation:6.0"], "id": "CVE-2018-6057", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-6057", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T18:03:27", "description": "Failure to disallow PWA installation from CSP sandboxed pages in AppManifest in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to access privileged APIs via a crafted HTML page.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-11-14T15:29:00", "type": "cve", "title": "CVE-2018-6083", "cwe": ["NVD-CWE-noinfo"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-6083"], "modified": "2019-10-03T00:03:00", "cpe": ["cpe:/o:redhat:enterprise_linux_server:6.0", "cpe:/o:redhat:enterprise_linux_desktop:6.0", "cpe:/o:debian:debian_linux:9.0", "cpe:/o:redhat:enterprise_linux_workstation:6.0"], "id": "CVE-2018-6083", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-6083", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T14:10:24", "description": "A stack buffer overflow in NumberingSystem in International Components for Unicode (ICU) for C/C++ before 60.2, as used in V8 in Google Chrome prior to 62.0.3202.75 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 6.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2018-08-28T20:29:00", "type": "cve", "title": "CVE-2017-15396", "cwe": ["CWE-119"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", &q