DATABASE RESOURCES PRICING ABOUT US

{"id": "RH:CVE-2017-15409", "vendorId": null, "type": "redhatcve", "bulletinFamily": "info", "title": "CVE-2017-15409", "description": "Heap buffer overflow in Skia in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.\n", "published": "2017-12-07T10:24:35", "modified": "2022-07-09T15:50:01", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cvss2": {"cvssV2": {"version": "2.0", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "accessVector": "NETWORK", "accessComplexity": "MEDIUM", "authentication": "NONE", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "baseScore": 6.8}, "severity": "MEDIUM", "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}, "cvss3": {"cvssV3": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}, "href": "https://access.redhat.com/security/cve/cve-2017-15409", "reporter": "redhat.com", "references": ["https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html", "https://bugzilla.redhat.com/show_bug.cgi?id=1523125"], "cvelist": ["CVE-2017-15409"], "immutableFields": [], "lastseen": "2022-07-09T16:40:23", "viewCount": 5, "enchantments": {"dependencies": {"references": [{"type": "archlinux", "idList": ["ASA-201712-5"]}, {"type": "chrome", "idList": ["GCSA-6993857189147290065"]}, {"type": "cve", "idList": ["CVE-2017-15409"]}, {"type": "debian", "idList": ["DEBIAN:DSA-4064-1:25480"]}, {"type": "debiancve", "idList": ["DEBIANCVE:CVE-2017-15409"]}, {"type": "fedora", "idList": ["FEDORA:0F54C60BE23D", "FEDORA:2E8D96005552", "FEDORA:5CFCF60A5875", "FEDORA:855A9625F2AD", "FEDORA:CAFF160478EB", "FEDORA:EC7F86046254"]}, {"type": "freebsd", "idList": ["1D951E85-FFDB-11E7-8B91-E8E0B747A45A"]}, {"type": "gentoo", "idList": ["GLSA-201801-03"]}, {"type": "kaspersky", "idList": ["KLA11152"]}, {"type": "mageia", "idList": ["MGAA-2018-0067"]}, {"type": "nessus", "idList": ["700351.PASL", "DEBIAN_DSA-4064.NASL", "FEDORA_2017-C2645AA935.NASL", "FEDORA_2017-EA44F172E3.NASL", "FEDORA_2018-AAFDBB5554.NASL", "FEDORA_2018-C0D3DB441F.NASL", "FEDORA_2018-E08D828ED9.NASL", "FEDORA_2018-FAFF5F661E.NASL", "FREEBSD_PKG_1D951E85FFDB11E78B91E8E0B747A45A.NASL", "GENTOO_GLSA-201801-03.NASL", "GOOGLE_CHROME_63_0_3239_84.NASL", "MACOSX_GOOGLE_CHROME_63_0_3239_84.NASL", "OPENSUSE-2017-1349.NASL", "REDHAT-RHSA-2017-3401.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310704064", "OPENVAS:1361412562310812235", "OPENVAS:1361412562310812236", "OPENVAS:1361412562310812237", "OPENVAS:1361412562310851660", "OPENVAS:1361412562310873974", "OPENVAS:1361412562310873977", "OPENVAS:1361412562310874144", "OPENVAS:1361412562310874155", "OPENVAS:1361412562310874300"]}, {"type": "osv", "idList": ["OSV:DSA-4064-1"]}, {"type": "redhat", "idList": ["RHSA-2017:3401"]}, {"type": "suse", "idList": ["OPENSUSE-SU-2017:3244-1", "OPENSUSE-SU-2017:3245-1"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2017-15409"]}]}, "score": {"value": 3.2, "vector": "NONE"}, "backreferences": {"references": [{"type": "archlinux", "idList": ["ASA-201712-5"]}, {"type": "chrome", "idList": ["GCSA-6993857189147290065"]}, {"type": "cve", "idList": ["CVE-2017-15409"]}, {"type": "debian", "idList": ["DEBIAN:DSA-4064-1:25480"]}, {"type": "debiancve", "idList": ["DEBIANCVE:CVE-2017-15409"]}, {"type": "fedora", "idList": ["FEDORA:0F54C60BE23D", "FEDORA:2E8D96005552", "FEDORA:5CFCF60A5875", "FEDORA:855A9625F2AD", "FEDORA:CAFF160478EB", "FEDORA:EC7F86046254"]}, {"type": "freebsd", "idList": ["1D951E85-FFDB-11E7-8B91-E8E0B747A45A"]}, {"type": "gentoo", "idList": ["GLSA-201801-03"]}, {"type": "kaspersky", "idList": ["KLA11152"]}, {"type": "metasploit", "idList": ["MSF:ILITIES/GOOGLE-CHROME-CVE-2017-15409/"]}, {"type": "nessus", "idList": ["DEBIAN_DSA-4064.NASL", "FEDORA_2017-C2645AA935.NASL", "FREEBSD_PKG_1D951E85FFDB11E78B91E8E0B747A45A.NASL", "GENTOO_GLSA-201801-03.NASL", "GOOGLE_CHROME_63_0_3239_84.NASL", "MACOSX_GOOGLE_CHROME_63_0_3239_84.NASL", "OPENSUSE-2017-1349.NASL", "REDHAT-RHSA-2017-3401.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310704064", "OPENVAS:1361412562310812235", "OPENVAS:1361412562310812236", "OPENVAS:1361412562310812237", "OPENVAS:1361412562310851660", "OPENVAS:1361412562310873974", "OPENVAS:1361412562310873977"]}, {"type": "redhat", "idList": ["RHSA-2017:3401"]}, {"type": "suse", "idList": ["OPENSUSE-SU-2017:3244-1", "OPENSUSE-SU-2017:3245-1"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2017-15409"]}]}, "exploitation": null, "epss": [{"cve": "CVE-2017-15409", "epss": "0.018540000", "percentile": "0.865040000", "modified": "2023-03-16"}], "vulnersScore": 3.2}, "_state": {"dependencies": 1659998956, "score": 1659899666, "epss": 1679070268}, "_internal": {"score_hash": "e3c69300732164e7ba6cfc538cccdf01"}, "vendorCvss": {"score": "8.8", "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}}

{"debiancve": [{"lastseen": "2021-12-14T17:47:15", "description": "Heap buffer overflow in Skia in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2018-08-28T19:29:00", "type": "debiancve", "title": "CVE-2017-15409", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15409"], "modified": "2018-08-28T19:29:00", "id": "DEBIANCVE:CVE-2017-15409", "href": "https://security-tracker.debian.org/tracker/CVE-2017-15409", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "ubuntucve": [{"lastseen": "2022-08-04T13:46:56", "description": "Heap buffer overflow in Skia in Google Chrome prior to 63.0.3239.84 allowed\na remote attacker to potentially exploit heap corruption via a crafted HTML\npage.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-08-28T00:00:00", "type": "ubuntucve", "title": "CVE-2017-15409", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15409"], "modified": "2018-08-28T00:00:00", "id": "UB:CVE-2017-15409", "href": "https://ubuntu.com/security/CVE-2017-15409", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "cve": [{"lastseen": "2023-02-08T15:52:56", "description": "Heap buffer overflow in Skia in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-08-28T19:29:00", "type": "cve", "title": "CVE-2017-15409", "cwe": ["CWE-119"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15409"], "modified": "2018-10-31T15:59:00", "cpe": ["cpe:/o:debian:debian_linux:9.0", "cpe:/o:redhat:enterprise_linux_desktop:6.0", "cpe:/o:redhat:enterprise_linux_server:6.0", "cpe:/o:redhat:enterprise_linux_workstation:6.0"], "id": "CVE-2017-15409", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-15409", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*"]}], "mageia": [{"lastseen": "2022-04-18T11:19:34", "description": "This update provide an update the new Qt5 LTS version ( 5.9 ) \n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-05-11T20:13:13", "type": "mageia", "title": "Updated Qt5 packages fix security vulnerability\n", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15407", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426"], "modified": "2018-05-09T18:33:09", "id": "MGAA-2018-0067", "href": "https://advisories.mageia.org/MGAA-2018-0067.html", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "nessus": [{"lastseen": "2023-02-04T14:53:19", "description": "Several vulnerabilities have been discovered in the chromium web browser.\n\n - CVE-2017-15407 Ned Williamson discovered an out-of-bounds write issue.\n\n - CVE-2017-15408 Ke Liu discovered a heap overflow issue in the pdfium library.\n\n - CVE-2017-15409 An out-of-bounds write issue was discovered in the skia library.\n\n - CVE-2017-15410 Luat Nguyen discovered a use-after-free issue in the pdfium library.\n\n - CVE-2017-15411 Luat Nguyen discovered a use-after-free issue in the pdfium library.\n\n - CVE-2017-15413 Gaurav Dewan discovered a type confusion issue.\n\n - CVE-2017-15415 Viktor Brange discovered an information disclosure issue.\n\n - CVE-2017-15416 Ned Williamson discovered an out-of-bounds read issue.\n\n - CVE-2017-15417 Max May discovered an information disclosure issue in the skia library.\n\n - CVE-2017-15418 Kushal Arvind Shah discovered an uninitialized value in the skia library.\n\n - CVE-2017-15419 Jun Kokatsu discoved an information disclosure issue.\n\n - CVE-2017-15420 WenXu Wu discovered a URL spoofing issue.\n\n - CVE-2017-15423 Greg Hudson discovered an issue in the boringssl library.\n\n - CVE-2017-15424 Khalil Zhani discovered a URL spoofing issue.\n\n - CVE-2017-15425 xisigr discovered a URL spoofing issue.\n\n - CVE-2017-15426 WenXu Wu discovered a URL spoofing issue.\n\n - CVE-2017-15427 Junaid Farhan discovered an issue with the omnibox.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2017-12-13T00:00:00", "type": "nessus", "title": "Debian DSA-4064-1 : chromium-browser - security update", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15407", "CVE-2017-15408", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15413", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15417", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15420", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426", "CVE-2017-15427"], "modified": "2021-01-04T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:chromium-browser", "cpe:/o:debian:debian_linux:9.0"], "id": "DEBIAN_DSA-4064.NASL", "href": "https://www.tenable.com/plugins/nessus/105195", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-4064. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(105195);\n script_version(\"3.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/04\");\n\n script_cve_id(\"CVE-2017-15407\", \"CVE-2017-15408\", \"CVE-2017-15409\", \"CVE-2017-15410\", \"CVE-2017-15411\", \"CVE-2017-15413\", \"CVE-2017-15415\", \"CVE-2017-15416\", \"CVE-2017-15417\", \"CVE-2017-15418\", \"CVE-2017-15419\", \"CVE-2017-15420\", \"CVE-2017-15423\", \"CVE-2017-15424\", \"CVE-2017-15425\", \"CVE-2017-15426\", \"CVE-2017-15427\");\n script_xref(name:\"DSA\", value:\"4064\");\n\n script_name(english:\"Debian DSA-4064-1 : chromium-browser - security update\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Several vulnerabilities have been discovered in the chromium web\nbrowser.\n\n - CVE-2017-15407\n Ned Williamson discovered an out-of-bounds write issue.\n\n - CVE-2017-15408\n Ke Liu discovered a heap overflow issue in the pdfium\n library.\n\n - CVE-2017-15409\n An out-of-bounds write issue was discovered in the skia\n library.\n\n - CVE-2017-15410\n Luat Nguyen discovered a use-after-free issue in the\n pdfium library.\n\n - CVE-2017-15411\n Luat Nguyen discovered a use-after-free issue in the\n pdfium library.\n\n - CVE-2017-15413\n Gaurav Dewan discovered a type confusion issue.\n\n - CVE-2017-15415\n Viktor Brange discovered an information disclosure\n issue.\n\n - CVE-2017-15416\n Ned Williamson discovered an out-of-bounds read issue.\n\n - CVE-2017-15417\n Max May discovered an information disclosure issue in\n the skia library.\n\n - CVE-2017-15418\n Kushal Arvind Shah discovered an uninitialized value in\n the skia library.\n\n - CVE-2017-15419\n Jun Kokatsu discoved an information disclosure issue.\n\n - CVE-2017-15420\n WenXu Wu discovered a URL spoofing issue.\n\n - CVE-2017-15423\n Greg Hudson discovered an issue in the boringssl\n library.\n\n - CVE-2017-15424\n Khalil Zhani discovered a URL spoofing issue.\n\n - CVE-2017-15425\n xisigr discovered a URL spoofing issue.\n\n - CVE-2017-15426\n WenXu Wu discovered a URL spoofing issue.\n\n - CVE-2017-15427\n Junaid Farhan discovered an issue with the omnibox.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2017-15407\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2017-15408\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2017-15409\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2017-15410\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2017-15411\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2017-15413\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2017-15415\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2017-15416\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2017-15417\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2017-15418\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2017-15419\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2017-15420\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2017-15423\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2017-15424\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2017-15425\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2017-15426\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2017-15427\"\n );\n # https://security-tracker.debian.org/tracker/source-package/chromium-browser\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?e33901a2\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/stretch/chromium-browser\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2017/dsa-4064\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the chromium-browser packages.\n\nFor the stable distribution (stretch), these problems have been fixed\nin version 63.0.3239.84-1~deb9u1.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:chromium-browser\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:9.0\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/08/28\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/12/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/12/13\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"9.0\", prefix:\"chromedriver\", reference:\"63.0.3239.84-1~deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"chromium\", reference:\"63.0.3239.84-1~deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"chromium-driver\", reference:\"63.0.3239.84-1~deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"chromium-l10n\", reference:\"63.0.3239.84-1~deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"chromium-shell\", reference:\"63.0.3239.84-1~deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"chromium-widevine\", reference:\"63.0.3239.84-1~deb9u1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-02-04T14:53:18", "description": "This update to Chromium 63.0.3239.84 fixes the following security issues :\n\n - CVE-2017-15408: Heap buffer overflow in PDFium\n\n - CVE-2017-15409: Out of bounds write in Skia\n\n - CVE-2017-15410: Use after free in PDFium\n\n - CVE-2017-15411: Use after free in PDFium\n\n - CVE-2017-15412: Use after free in libXML\n\n - CVE-2017-15413: Type confusion in WebAssembly\n\n - CVE-2017-15415: Pointer information disclosure in IPC call\n\n - CVE-2017-15416: Out of bounds read in Blink\n\n - CVE-2017-15417: Cross origin information disclosure in Skia\n\n - CVE-2017-15418: Use of uninitialized value in Skia\n\n - CVE-2017-15419: Cross origin leak of redirect URL in Blink\n\n - CVE-2017-15420: URL spoofing in Omnibox\n\n - CVE-2017-15422: Integer overflow in ICU\n\n - CVE-2017-15423: Issue with SPAKE implementation in BoringSSL\n\n - CVE-2017-15424: URL Spoof in Omnibox\n\n - CVE-2017-15425: URL Spoof in Omnibox\n\n - CVE-2017-15426: URL Spoof in Omnibox\n\n - CVE-2017-15427: Insufficient blocking of JavaScript in Omnibox", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2017-12-14T00:00:00", "type": "nessus", "title": "openSUSE Security Update : chromium (openSUSE-2017-1349)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15408", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15413", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15417", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15420", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426", "CVE-2017-15427"], "modified": "2021-01-19T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:chromedriver", "p-cpe:/a:novell:opensuse:chromedriver-debuginfo", "p-cpe:/a:novell:opensuse:chromium", "p-cpe:/a:novell:opensuse:chromium-debuginfo", "p-cpe:/a:novell:opensuse:chromium-debugsource", "cpe:/o:novell:opensuse:42.2", "cpe:/o:novell:opensuse:42.3"], "id": "OPENSUSE-2017-1349.NASL", "href": "https://www.tenable.com/plugins/nessus/105235", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2017-1349.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(105235);\n script_version(\"3.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2017-15408\", \"CVE-2017-15409\", \"CVE-2017-15410\", \"CVE-2017-15411\", \"CVE-2017-15412\", \"CVE-2017-15413\", \"CVE-2017-15415\", \"CVE-2017-15416\", \"CVE-2017-15417\", \"CVE-2017-15418\", \"CVE-2017-15419\", \"CVE-2017-15420\", \"CVE-2017-15422\", \"CVE-2017-15423\", \"CVE-2017-15424\", \"CVE-2017-15425\", \"CVE-2017-15426\", \"CVE-2017-15427\");\n\n script_name(english:\"openSUSE Security Update : chromium (openSUSE-2017-1349)\");\n script_summary(english:\"Check for the openSUSE-2017-1349 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update to Chromium 63.0.3239.84 fixes the following security\nissues :\n\n - CVE-2017-15408: Heap buffer overflow in PDFium\n\n - CVE-2017-15409: Out of bounds write in Skia\n\n - CVE-2017-15410: Use after free in PDFium\n\n - CVE-2017-15411: Use after free in PDFium\n\n - CVE-2017-15412: Use after free in libXML\n\n - CVE-2017-15413: Type confusion in WebAssembly\n\n - CVE-2017-15415: Pointer information disclosure in IPC\n call\n\n - CVE-2017-15416: Out of bounds read in Blink\n\n - CVE-2017-15417: Cross origin information disclosure in\n Skia\n\n - CVE-2017-15418: Use of uninitialized value in Skia\n\n - CVE-2017-15419: Cross origin leak of redirect URL in\n Blink\n\n - CVE-2017-15420: URL spoofing in Omnibox\n\n - CVE-2017-15422: Integer overflow in ICU\n\n - CVE-2017-15423: Issue with SPAKE implementation in\n BoringSSL\n\n - CVE-2017-15424: URL Spoof in Omnibox\n\n - CVE-2017-15425: URL Spoof in Omnibox\n\n - CVE-2017-15426: URL Spoof in Omnibox\n\n - CVE-2017-15427: Insufficient blocking of JavaScript in\n Omnibox\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1071691\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected chromium packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:chromedriver\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:chromedriver-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:chromium\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:chromium-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:chromium-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:42.2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:42.3\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/12/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/12/14\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE42\\.2|SUSE42\\.3)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"42.2 / 42.3\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(x86_64)$\") audit(AUDIT_ARCH_NOT, \"x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE42.2\", reference:\"chromedriver-63.0.3239.84-104.41.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"chromedriver-debuginfo-63.0.3239.84-104.41.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"chromium-63.0.3239.84-104.41.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"chromium-debuginfo-63.0.3239.84-104.41.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"chromium-debugsource-63.0.3239.84-104.41.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"chromedriver-63.0.3239.84-127.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"chromedriver-debuginfo-63.0.3239.84-127.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"chromium-63.0.3239.84-127.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"chromium-debuginfo-63.0.3239.84-127.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"chromium-debugsource-63.0.3239.84-127.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"chromedriver / chromedriver-debuginfo / chromium / etc\");\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-02-04T14:52:24", "description": "An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.\n\nChromium is an open source web browser, powered by WebKit (Blink).\n\nThis update upgrades Chromium to version 63.0.3239.84.\n\nSecurity Fix(es) :\n\n* Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when visited by the victim. (CVE-2017-15407, CVE-2017-15408, CVE-2017-15409, CVE-2017-15410, CVE-2017-15411, CVE-2017-15412, CVE-2017-15413, CVE-2017-15415, CVE-2017-15416, CVE-2017-15417, CVE-2017-15418, CVE-2017-15419, CVE-2017-15420, CVE-2017-15422, CVE-2017-15423, CVE-2017-15424, CVE-2017-15425, CVE-2017-15426, CVE-2017-15427)", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2017-12-08T00:00:00", "type": "nessus", "title": "RHEL 6 : chromium-browser (RHSA-2017:3401)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15407", "CVE-2017-15408", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15413", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15417", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15420", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426", "CVE-2017-15427"], "modified": "2020-05-29T00:00:00", "cpe": ["p-cpe:/a:redhat:enterprise_linux:chromium-browser", "p-cpe:/a:redhat:enterprise_linux:chromium-browser-debuginfo", "cpe:/o:redhat:enterprise_linux:6"], "id": "REDHAT-RHSA-2017-3401.NASL", "href": "https://www.tenable.com/plugins/nessus/105091", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2017:3401. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(105091);\n script_version(\"3.12\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/05/29\");\n\n script_cve_id(\"CVE-2017-15407\", \"CVE-2017-15408\", \"CVE-2017-15409\", \"CVE-2017-15410\", \"CVE-2017-15411\", \"CVE-2017-15412\", \"CVE-2017-15413\", \"CVE-2017-15415\", \"CVE-2017-15416\", \"CVE-2017-15417\", \"CVE-2017-15418\", \"CVE-2017-15419\", \"CVE-2017-15420\", \"CVE-2017-15422\", \"CVE-2017-15423\", \"CVE-2017-15424\", \"CVE-2017-15425\", \"CVE-2017-15426\", \"CVE-2017-15427\");\n script_xref(name:\"RHSA\", value:\"2017:3401\");\n\n script_name(english:\"RHEL 6 : chromium-browser (RHSA-2017:3401)\");\n script_summary(english:\"Checks the rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote Red Hat host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"An update for chromium-browser is now available for Red Hat Enterprise\nLinux 6 Supplementary.\n\nRed Hat Product Security has rated this update as having a security\nimpact of Critical. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available for each\nvulnerability from the CVE link(s) in the References section.\n\nChromium is an open source web browser, powered by WebKit (Blink).\n\nThis update upgrades Chromium to version 63.0.3239.84.\n\nSecurity Fix(es) :\n\n* Multiple flaws were found in the processing of malformed web\ncontent. A web page containing malicious content could cause Chromium\nto crash, execute arbitrary code, or disclose sensitive information\nwhen visited by the victim. (CVE-2017-15407, CVE-2017-15408,\nCVE-2017-15409, CVE-2017-15410, CVE-2017-15411, CVE-2017-15412,\nCVE-2017-15413, CVE-2017-15415, CVE-2017-15416, CVE-2017-15417,\nCVE-2017-15418, CVE-2017-15419, CVE-2017-15420, CVE-2017-15422,\nCVE-2017-15423, CVE-2017-15424, CVE-2017-15425, CVE-2017-15426,\nCVE-2017-15427)\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://chromereleases.googleblog.com/2017/12/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2017:3401\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2017-15407\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2017-15408\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2017-15409\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2017-15410\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2017-15411\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2017-15412\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2017-15413\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2017-15415\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2017-15416\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2017-15417\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2017-15418\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2017-15419\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2017-15420\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2017-15422\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2017-15423\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2017-15424\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2017-15425\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2017-15426\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2017-15427\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\n\"Update the affected chromium-browser and / or\nchromium-browser-debuginfo packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:chromium-browser\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:chromium-browser-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:6\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/08/28\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/12/07\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/12/08\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^6([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 6.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2017:3401\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"chromium-browser-63.0.3239.84-1.el6_9\", allowmaj:TRUE)) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"chromium-browser-63.0.3239.84-1.el6_9\", allowmaj:TRUE)) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"chromium-browser-debuginfo-63.0.3239.84-1.el6_9\", allowmaj:TRUE)) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"chromium-browser-debuginfo-63.0.3239.84-1.el6_9\", allowmaj:TRUE)) flag++;\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"chromium-browser / chromium-browser-debuginfo\");\n }\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-02-04T14:39:06", "description": "Security fix for CVE-2017-15412 CVE-2017-15422 CVE-2017-15407 CVE-2017-15408 CVE-2017-15409 CVE-2017-15410 CVE-2017-15411 CVE-2017-15413 CVE-2017-15415 CVE-2017-15416 CVE-2017-15417 CVE-2017-15418 CVE-2017-15419 CVE-2017-15420 CVE-2017-15423 CVE-2017-15424 CVE-2017-15425 CVE-2017-15426 CVE-2017-15427 CVE-2017-15429\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-01-15T00:00:00", "type": "nessus", "title": "Fedora 27 : chromium (2017-c2645aa935)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15407", "CVE-2017-15408", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15413", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15417", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15420", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426", "CVE-2017-15427", "CVE-2017-15429"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:chromium", "cpe:/o:fedoraproject:fedora:27"], "id": "FEDORA_2017-C2645AA935.NASL", "href": "https://www.tenable.com/plugins/nessus/105968", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2017-c2645aa935.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(105968);\n script_version(\"1.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2017-15407\", \"CVE-2017-15408\", \"CVE-2017-15409\", \"CVE-2017-15410\", \"CVE-2017-15411\", \"CVE-2017-15412\", \"CVE-2017-15413\", \"CVE-2017-15415\", \"CVE-2017-15416\", \"CVE-2017-15417\", \"CVE-2017-15418\", \"CVE-2017-15419\", \"CVE-2017-15420\", \"CVE-2017-15422\", \"CVE-2017-15423\", \"CVE-2017-15424\", \"CVE-2017-15425\", \"CVE-2017-15426\", \"CVE-2017-15427\", \"CVE-2017-15429\");\n script_xref(name:\"FEDORA\", value:\"2017-c2645aa935\");\n\n script_name(english:\"Fedora 27 : chromium (2017-c2645aa935)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Security fix for CVE-2017-15412 CVE-2017-15422 CVE-2017-15407\nCVE-2017-15408 CVE-2017-15409 CVE-2017-15410 CVE-2017-15411\nCVE-2017-15413 CVE-2017-15415 CVE-2017-15416 CVE-2017-15417\nCVE-2017-15418 CVE-2017-15419 CVE-2017-15420 CVE-2017-15423\nCVE-2017-15424 CVE-2017-15425 CVE-2017-15426 CVE-2017-15427\nCVE-2017-15429\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2017-c2645aa935\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected chromium package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:chromium\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:27\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/08/28\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/01/01\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/01/15\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^27([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 27\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"FC27\", reference:\"chromium-63.0.3239.108-1.fc27\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"chromium\");\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-02-03T14:30:03", "description": "Google Chrome Releases reports :\n\n37 security fixes in this release, including :\n\n- [778505] Critical CVE-2017-15407: Out of bounds write in QUIC.\nReported by Ned Williamson on 2017-10-26\n\n- [762374] High CVE-2017-15408: Heap buffer overflow in PDFium.\nReported by Ke Liu of Tencent's Xuanwu LAB on 2017-09-06\n\n- [763972] High CVE-2017-15409: Out of bounds write in Skia. Reported by Anonymous on 2017-09-11\n\n- [765921] High CVE-2017-15410: Use after free in PDFium. Reported by Luat Nguyen of KeenLab, Tencent on 2017-09-16\n\n- [770148] High CVE-2017-15411: Use after free in PDFium. Reported by Luat Nguyen of KeenLab, Tencent on 2017-09-29\n\n- [727039] High CVE-2017-15412: Use after free in libXML. Reported by Nick Wellnhofer on 2017-05-27\n\n- [766666] High CVE-2017-15413: Type confusion in WebAssembly.\nReported by Gaurav Dewan of Adobe Systems India Pvt. Ltd. on 2017-09-19\n\n- [765512] Medium CVE-2017-15415: Pointer information disclosure in IPC call. Reported by Viktor Brange of Microsoft Offensive Security Research Team on 2017-09-15\n\n- [779314] Medium CVE-2017-15416: Out of bounds read in Blink.\nReported by Ned Williamson on 2017-10-28\n\n- [699028] Medium CVE-2017-15417: Cross origin information disclosure in Skia. Reported by Max May on 2017-03-07\n\n- [765858] Medium CVE-2017-15418: Use of uninitialized value in Skia.\nReported by Kushal Arvind Shah of Fortinet's FortiGuard Labs on 2017-09-15\n\n- [780312] Medium CVE-2017-15419: Cross origin leak of redirect URL in Blink. Reported by Jun Kokatsu on 2017-10-31\n\n- [777419] Medium CVE-2017-15420: URL spoofing in Omnibox. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-10-23\n\n- [774382] Medium CVE-2017-15422: Integer overflow in ICU. Reported by Yuan Deng of Ant-financial Light-Year Security Lab on 2017-10-13\n\n- [780484] Medium CVE-2017-15430: Unsafe navigation in Chromecast Plugin. Reported by jinmo123 on 2017-01-11\n\n- [778101] Low CVE-2017-15423: Issue with SPAKE implementation in BoringSSL. Reported by Greg Hudson on 2017-10-25\n\n- [756226] Low CVE-2017-15424: URL Spoof in Omnibox. Reported by Khalil Zhani on 2017-08-16\n\n- [756456] Low CVE-2017-15425: URL Spoof in Omnibox. Reported by xisigr of Tencent's Xuanwu Lab on 2017-08-17\n\n- [757735] Low CVE-2017-15426: URL Spoof in Omnibox. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-08-18\n\n- [768910] Low CVE-2017-15427: Insufficient blocking of JavaScript in Omnibox. Reported by Junaid Farhan on 2017-09-26\n\n- [792099] Various fixes from internal audits, fuzzing and other initiatives", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-01-23T00:00:00", "type": "nessus", "title": "FreeBSD : chromium -- multiple vulnerabilities (1d951e85-ffdb-11e7-8b91-e8e0b747a45a)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15407", "CVE-2017-15408", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15413", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15417", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15420", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426", "CVE-2017-15427", "CVE-2017-15430"], "modified": "2019-07-10T00:00:00", "cpe": ["p-cpe:/a:freebsd:freebsd:chromium", "cpe:/o:freebsd:freebsd"], "id": "FREEBSD_PKG_1D951E85FFDB11E78B91E8E0B747A45A.NASL", "href": "https://www.tenable.com/plugins/nessus/106236", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the FreeBSD VuXML database :\n#\n# Copyright 2003-2019 Jacques Vidrine and contributors\n#\n# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,\n# HTML, PDF, PostScript, RTF and so forth) with or without modification,\n# are permitted provided that the following conditions are met:\n# 1. Redistributions of source code (VuXML) must retain the above\n# copyright notice, this list of conditions and the following\n# disclaimer as the first lines of this file unmodified.\n# 2. Redistributions in compiled form (transformed to other DTDs,\n# published online in any format, converted to PDF, PostScript,\n# RTF and other formats) must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer\n# in the documentation and/or other materials provided with the\n# distribution.\n# \n# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \"AS IS\"\n# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,\n# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS\n# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,\n# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\n# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\n# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\n# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,\n# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(106236);\n script_version(\"3.6\");\n script_cvs_date(\"Date: 2019/07/10 16:04:13\");\n\n script_cve_id(\"CVE-2017-15407\", \"CVE-2017-15408\", \"CVE-2017-15409\", \"CVE-2017-15410\", \"CVE-2017-15411\", \"CVE-2017-15412\", \"CVE-2017-15413\", \"CVE-2017-15415\", \"CVE-2017-15416\", \"CVE-2017-15417\", \"CVE-2017-15418\", \"CVE-2017-15419\", \"CVE-2017-15420\", \"CVE-2017-15422\", \"CVE-2017-15423\", \"CVE-2017-15424\", \"CVE-2017-15425\", \"CVE-2017-15426\", \"CVE-2017-15427\", \"CVE-2017-15430\");\n\n script_name(english:\"FreeBSD : chromium -- multiple vulnerabilities (1d951e85-ffdb-11e7-8b91-e8e0b747a45a)\");\n script_summary(english:\"Checks for updated package in pkg_info output\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote FreeBSD host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Google Chrome Releases reports :\n\n37 security fixes in this release, including :\n\n- [778505] Critical CVE-2017-15407: Out of bounds write in QUIC.\nReported by Ned Williamson on 2017-10-26\n\n- [762374] High CVE-2017-15408: Heap buffer overflow in PDFium.\nReported by Ke Liu of Tencent's Xuanwu LAB on 2017-09-06\n\n- [763972] High CVE-2017-15409: Out of bounds write in Skia. Reported\nby Anonymous on 2017-09-11\n\n- [765921] High CVE-2017-15410: Use after free in PDFium. Reported by\nLuat Nguyen of KeenLab, Tencent on 2017-09-16\n\n- [770148] High CVE-2017-15411: Use after free in PDFium. Reported by\nLuat Nguyen of KeenLab, Tencent on 2017-09-29\n\n- [727039] High CVE-2017-15412: Use after free in libXML. Reported by\nNick Wellnhofer on 2017-05-27\n\n- [766666] High CVE-2017-15413: Type confusion in WebAssembly.\nReported by Gaurav Dewan of Adobe Systems India Pvt. Ltd. on\n2017-09-19\n\n- [765512] Medium CVE-2017-15415: Pointer information disclosure in\nIPC call. Reported by Viktor Brange of Microsoft Offensive Security\nResearch Team on 2017-09-15\n\n- [779314] Medium CVE-2017-15416: Out of bounds read in Blink.\nReported by Ned Williamson on 2017-10-28\n\n- [699028] Medium CVE-2017-15417: Cross origin information disclosure\nin Skia. Reported by Max May on 2017-03-07\n\n- [765858] Medium CVE-2017-15418: Use of uninitialized value in Skia.\nReported by Kushal Arvind Shah of Fortinet's FortiGuard Labs on\n2017-09-15\n\n- [780312] Medium CVE-2017-15419: Cross origin leak of redirect URL in\nBlink. Reported by Jun Kokatsu on 2017-10-31\n\n- [777419] Medium CVE-2017-15420: URL spoofing in Omnibox. Reported by\nWenXu Wu of Tencent's Xuanwu Lab on 2017-10-23\n\n- [774382] Medium CVE-2017-15422: Integer overflow in ICU. Reported by\nYuan Deng of Ant-financial Light-Year Security Lab on 2017-10-13\n\n- [780484] Medium CVE-2017-15430: Unsafe navigation in Chromecast\nPlugin. Reported by jinmo123 on 2017-01-11\n\n- [778101] Low CVE-2017-15423: Issue with SPAKE implementation in\nBoringSSL. Reported by Greg Hudson on 2017-10-25\n\n- [756226] Low CVE-2017-15424: URL Spoof in Omnibox. Reported by\nKhalil Zhani on 2017-08-16\n\n- [756456] Low CVE-2017-15425: URL Spoof in Omnibox. Reported by\nxisigr of Tencent's Xuanwu Lab on 2017-08-17\n\n- [757735] Low CVE-2017-15426: URL Spoof in Omnibox. Reported by WenXu\nWu of Tencent's Xuanwu Lab on 2017-08-18\n\n- [768910] Low CVE-2017-15427: Insufficient blocking of JavaScript in\nOmnibox. Reported by Junaid Farhan on 2017-09-26\n\n- [792099] Various fixes from internal audits, fuzzing and other\ninitiatives\"\n );\n # https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?98a7b4bd\"\n );\n # https://vuxml.freebsd.org/freebsd/1d951e85-ffdb-11e7-8b91-e8e0b747a45a.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?5706b5c2\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:chromium\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:freebsd:freebsd\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/12/06\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/01/23\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/01/23\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"FreeBSD Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/FreeBSD/release\", \"Host/FreeBSD/pkg_info\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"freebsd_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/FreeBSD/release\")) audit(AUDIT_OS_NOT, \"FreeBSD\");\nif (!get_kb_item(\"Host/FreeBSD/pkg_info\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (pkg_test(save_report:TRUE, pkg:\"chromium<63.0.3239.84\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-02-04T14:52:23", "description": "The version of Google Chrome installed on the remote macOS or Mac OS X host is prior to 63.0.3239.84. It is, therefore, affected by multiple vulnerabilities as noted in Chrome stable channel update release notes for Wednesday, December 6, 2017. Please refer to the release notes for additional information.\n\nNote that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2017-12-11T00:00:00", "type": "nessus", "title": "Google Chrome < 63.0.3239.84 Multiple Vulnerabilities (macOS)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15407", "CVE-2017-15408", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15413", "CVE-2017-15414", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15417", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15420", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426", "CVE-2017-15427"], "modified": "2019-11-12T00:00:00", "cpe": ["cpe:/a:google:chrome"], "id": "MACOSX_GOOGLE_CHROME_63_0_3239_84.NASL", "href": "https://www.tenable.com/plugins/nessus/105153", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(105153);\n script_version(\"1.7\");\n script_cvs_date(\"Date: 2019/11/12\");\n\n script_cve_id(\n \"CVE-2017-15407\",\n \"CVE-2017-15408\",\n \"CVE-2017-15409\",\n \"CVE-2017-15410\",\n \"CVE-2017-15411\",\n \"CVE-2017-15412\",\n \"CVE-2017-15413\",\n \"CVE-2017-15414\",\n \"CVE-2017-15415\",\n \"CVE-2017-15416\",\n \"CVE-2017-15417\",\n \"CVE-2017-15418\",\n \"CVE-2017-15419\",\n \"CVE-2017-15420\",\n \"CVE-2017-15422\",\n \"CVE-2017-15423\",\n \"CVE-2017-15424\",\n \"CVE-2017-15425\",\n \"CVE-2017-15426\",\n \"CVE-2017-15427\"\n );\n\n script_name(english:\"Google Chrome < 63.0.3239.84 Multiple Vulnerabilities (macOS)\");\n script_summary(english:\"Checks the version of Google Chrome.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"A web browser installed on the remote macOS or Mac OS X host is\naffected by multiple unspecified vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of Google Chrome installed on the remote macOS or Mac OS X\nhost is prior to 63.0.3239.84. It is, therefore, affected by multiple\nvulnerabilities as noted in Chrome stable channel update release notes\nfor Wednesday, December 6, 2017. Please refer to the release notes for\nadditional information.\n\nNote that Nessus has not attempted to exploit these issues but has\ninstead relied only on the application's self-reported version number.\");\n # https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?98a7b4bd\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to Google Chrome version 63.0.3239.84 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2017-15413\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/12/06\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/12/06\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/12/11\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:google:chrome\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"MacOS X Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"macosx_google_chrome_installed.nbin\");\n script_require_keys(\"MacOSX/Google Chrome/Installed\");\n\n exit(0);\n}\n\ninclude(\"google_chrome_version.inc\");\n\nget_kb_item_or_exit(\"MacOSX/Google Chrome/Installed\");\n\ngoogle_chrome_check_version(fix:'63.0.3239.84', severity:SECURITY_WARNING);\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-02-04T14:52:24", "description": "The version of Google Chrome installed on the remote Windows host is prior to 63.0.3239.84. It is, therefore, affected by multiple vulnerabilities as noted in Chrome stable channel update release notes for Wednesday, December 6, 2017. Please refer to the release notes for additional information.\n\nNote that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2017-12-11T00:00:00", "type": "nessus", "title": "Google Chrome < 63.0.3239.84 Multiple Vulnerabilities", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15407", "CVE-2017-15408", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15413", "CVE-2017-15414", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15417", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15420", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426", "CVE-2017-15427"], "modified": "2022-04-11T00:00:00", "cpe": ["cpe:/a:google:chrome"], "id": "GOOGLE_CHROME_63_0_3239_84.NASL", "href": "https://www.tenable.com/plugins/nessus/105152", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(105152);\n script_version(\"1.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/04/11\");\n\n script_cve_id(\n \"CVE-2017-15407\",\n \"CVE-2017-15408\",\n \"CVE-2017-15409\",\n \"CVE-2017-15410\",\n \"CVE-2017-15411\",\n \"CVE-2017-15412\",\n \"CVE-2017-15413\",\n \"CVE-2017-15414\",\n \"CVE-2017-15415\",\n \"CVE-2017-15416\",\n \"CVE-2017-15417\",\n \"CVE-2017-15418\",\n \"CVE-2017-15419\",\n \"CVE-2017-15420\",\n \"CVE-2017-15422\",\n \"CVE-2017-15423\",\n \"CVE-2017-15424\",\n \"CVE-2017-15425\",\n \"CVE-2017-15426\",\n \"CVE-2017-15427\"\n );\n\n script_name(english:\"Google Chrome < 63.0.3239.84 Multiple Vulnerabilities\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"A web browser installed on the remote Windows host is affected by\nmultiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of Google Chrome installed on the remote Windows host is\nprior to 63.0.3239.84. It is, therefore, affected by multiple\nvulnerabilities as noted in Chrome stable channel update release\nnotes for Wednesday, December 6, 2017. Please refer to the release\nnotes for additional information.\n\nNote that Nessus has not attempted to exploit these issues but has\ninstead relied only on the application's self-reported version number.\");\n # https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?98a7b4bd\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to Google Chrome version 63.0.3239.84 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2017-15413\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/12/06\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/12/06\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/12/11\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:google:chrome\");\n script_set_attribute(attribute:\"thorough_tests\", value:\"true\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows\");\n\n script_copyright(english:\"This script is Copyright (C) 2017-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"google_chrome_installed.nasl\");\n script_require_keys(\"SMB/Google_Chrome/Installed\");\n\n exit(0);\n}\n\ninclude(\"google_chrome_version.inc\");\n\nget_kb_item_or_exit(\"SMB/Google_Chrome/Installed\");\ninstalls = get_kb_list(\"SMB/Google_Chrome/*\");\n\ngoogle_chrome_check_version(installs:installs, fix:'63.0.3239.84', severity:SECURITY_WARNING);\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-02-04T14:40:47", "description": "The remote host is affected by the vulnerability described in GLSA-201801-03 (Chromium, Google Chrome: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been discovered in Chromium and Google Chrome. Please review the CVE identifiers referenced below for details.\n Impact :\n\n A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, bypass content security controls, or conduct URL spoofing.\n Workaround :\n\n There are no known workarounds at this time.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-01-08T00:00:00", "type": "nessus", "title": "GLSA-201801-03 : Chromium, Google Chrome: Multiple vulnerabilities", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15407", "CVE-2017-15408", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15413", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15417", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15420", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426", "CVE-2017-15427", "CVE-2017-15429"], "modified": "2018-10-25T00:00:00", "cpe": ["p-cpe:/a:gentoo:linux:chromium", "p-cpe:/a:gentoo:linux:google-chrome", "cpe:/o:gentoo:linux"], "id": "GENTOO_GLSA-201801-03.NASL", "href": "https://www.tenable.com/plugins/nessus/105629", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Gentoo Linux Security Advisory GLSA 201801-03.\n#\n# The advisory text is Copyright (C) 2001-2018 Gentoo Foundation, Inc.\n# and licensed under the Creative Commons - Attribution / Share Alike \n# license. See http://creativecommons.org/licenses/by-sa/3.0/\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(105629);\n script_version(\"3.6\");\n script_cvs_date(\"Date: 2018/10/25 11:32:02\");\n\n script_cve_id(\"CVE-2017-15407\", \"CVE-2017-15408\", \"CVE-2017-15409\", \"CVE-2017-15410\", \"CVE-2017-15411\", \"CVE-2017-15412\", \"CVE-2017-15413\", \"CVE-2017-15415\", \"CVE-2017-15416\", \"CVE-2017-15417\", \"CVE-2017-15418\", \"CVE-2017-15419\", \"CVE-2017-15420\", \"CVE-2017-15422\", \"CVE-2017-15423\", \"CVE-2017-15424\", \"CVE-2017-15425\", \"CVE-2017-15426\", \"CVE-2017-15427\", \"CVE-2017-15429\");\n script_xref(name:\"GLSA\", value:\"201801-03\");\n\n script_name(english:\"GLSA-201801-03 : Chromium, Google Chrome: Multiple vulnerabilities\");\n script_summary(english:\"Checks for updated package(s) in /var/db/pkg\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Gentoo host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote host is affected by the vulnerability described in GLSA-201801-03\n(Chromium, Google Chrome: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been discovered in Chromium and Google\n Chrome. Please review the CVE identifiers referenced below for details.\n \nImpact :\n\n A remote attacker could possibly execute arbitrary code with the\n privileges of the process, cause a Denial of Service condition, bypass\n content security controls, or conduct URL spoofing.\n \nWorkaround :\n\n There are no known workarounds at this time.\"\n );\n # https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?98a7b4bd\"\n );\n # https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop_14.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?125c6f30\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security.gentoo.org/glsa/201801-03\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"All Chromium users should upgrade to the latest version:\n # emerge --sync\n # emerge --ask --oneshot --verbose\n '>=www-client/chromium-63.0.3239.108'\n All Google Chrome users should upgrade to the latest version:\n # emerge --sync\n # emerge --ask --oneshot --verbose\n '>=www-client/google-chrome-63.0.3239.108'\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:chromium\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:google-chrome\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:gentoo:linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/01/07\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/01/08\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Gentoo Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Gentoo/release\", \"Host/Gentoo/qpkg-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"qpkg.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Gentoo/release\")) audit(AUDIT_OS_NOT, \"Gentoo\");\nif (!get_kb_item(\"Host/Gentoo/qpkg-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (qpkg_check(package:\"www-client/chromium\", unaffected:make_list(\"ge 63.0.3239.108\"), vulnerable:make_list(\"lt 63.0.3239.108\"))) flag++;\nif (qpkg_check(package:\"www-client/google-chrome\", unaffected:make_list(\"ge 63.0.3239.108\"), vulnerable:make_list(\"lt 63.0.3239.108\"))) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:qpkg_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = qpkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"Chromium / Google Chrome\");\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-02-04T14:40:03", "description": "This update updates QtWebEngine to the 5.10.1 bugfix and security release. QtWebEngine 5.10.1 is part of the Qt 5.10.1 release, but only the QtWebEngine component is included in this update.\n\nThis update includes :\n\n - Security fixes from Chromium up to version 64.0.3282.140. Including: CVE-2017-15407, CVE-2017-15409, CVE-2017-15410, CVE-2017-15411, CVE-2017-15415, CVE-2017-15416, CVE-2017-15418, CVE-2017-15419, CVE-2017-15422, CVE-2017-15423, CVE-2017-15424, CVE-2017-15425, CVE-2017-15426, CVE-2018-6031, CVE-2018-6033, CVE-2018-6034, CVE-2018-6036, CVE-2018-6037, CVE-2018-6038, CVE-2018-6040, CVE-2018-6041, CVE-2018-6042, CVE-2018-6047, CVE-2018-6048, CVE-2018-6050, CVE-2018-6051, CVE-2018-6052, CVE-2018-6053 and CVE-2018-6054.\n\n - Mitigations for SPECTRE: disabled shared-buffers, added cryptographic noise to precision timers\n\n - [QTBUG-47206] Fixed incorrect layouting due to bug in HTML5 viewport support.\n\n - [QTBUG-47945, QTBUG-65647] Fixed random crashes on exit\n\n - [QTBUG-57206] Fixed regression in viewport handling in embedded mode\n\n - [QTBUG-58400] Improved memory usage when printing\n\n - [QTBUG-63867] Fixed <canvas> elements when compiled without OpenGL\n\n - [QTBUG-63266, QTBUG-64436] Fixed that pointerType of Pointer Events was empty\n\n - [QTBUG-63606] Improved runtime disabling and clearing of HTTP cache\n\n - [QTBUG-64436] QtWebEngineWidgets: Fixed crash when exiting fullscreen mode using the context menu.\n\n - [QTBUG-64560] Fixed rendering glitches after renderProcessTerminated signal was emitted.\n\n - [QTBUG-64812] Fixed message bubble position in Hi-DPI mode\n\n - [QTBUG-64869, QTBUG-65004] Added testing for 32-bit host compiler when crossbuilding to 32-bit platforms\n\n - [QTBUG-64933] QtWebEngineWidgets: Fixed tooltips that did still show after mouse was moved away.\n\n - [QTBUG-65239] Fixed hanging of process if application is closed too fast after startup.\n\n - [QTBUG-65715] Fixed double margins when printing\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-02-26T00:00:00", "type": "nessus", "title": "Fedora 27 : qt5-qtwebengine (2018-e08d828ed9)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15407", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426", "CVE-2018-6031", "CVE-2018-6033", "CVE-2018-6034", "CVE-2018-6036", "CVE-2018-6037", "CVE-2018-6038", "CVE-2018-6040", "CVE-2018-6041", "CVE-2018-6042", "CVE-2018-6047", "CVE-2018-6048", "CVE-2018-6050", "CVE-2018-6051", "CVE-2018-6052", "CVE-2018-6053", "CVE-2018-6054"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:qt5-qtwebengine", "cpe:/o:fedoraproject:fedora:27"], "id": "FEDORA_2018-E08D828ED9.NASL", "href": "https://www.tenable.com/plugins/nessus/106991", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2018-e08d828ed9.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(106991);\n script_version(\"3.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2017-15407\", \"CVE-2017-15409\", \"CVE-2017-15410\", \"CVE-2017-15411\", \"CVE-2017-15415\", \"CVE-2017-15416\", \"CVE-2017-15418\", \"CVE-2017-15419\", \"CVE-2017-15422\", \"CVE-2017-15423\", \"CVE-2017-15424\", \"CVE-2017-15425\", \"CVE-2017-15426\", \"CVE-2018-6031\", \"CVE-2018-6033\", \"CVE-2018-6034\", \"CVE-2018-6036\", \"CVE-2018-6037\", \"CVE-2018-6038\", \"CVE-2018-6040\", \"CVE-2018-6041\", \"CVE-2018-6042\", \"CVE-2018-6047\", \"CVE-2018-6048\", \"CVE-2018-6050\", \"CVE-2018-6051\", \"CVE-2018-6052\", \"CVE-2018-6053\", \"CVE-2018-6054\");\n script_xref(name:\"FEDORA\", value:\"2018-e08d828ed9\");\n\n script_name(english:\"Fedora 27 : qt5-qtwebengine (2018-e08d828ed9)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update updates QtWebEngine to the 5.10.1 bugfix and security\nrelease. QtWebEngine 5.10.1 is part of the Qt 5.10.1 release, but only\nthe QtWebEngine component is included in this update.\n\nThis update includes :\n\n - Security fixes from Chromium up to version\n 64.0.3282.140. Including: CVE-2017-15407,\n CVE-2017-15409, CVE-2017-15410, CVE-2017-15411,\n CVE-2017-15415, CVE-2017-15416, CVE-2017-15418,\n CVE-2017-15419, CVE-2017-15422, CVE-2017-15423,\n CVE-2017-15424, CVE-2017-15425, CVE-2017-15426,\n CVE-2018-6031, CVE-2018-6033, CVE-2018-6034,\n CVE-2018-6036, CVE-2018-6037, CVE-2018-6038,\n CVE-2018-6040, CVE-2018-6041, CVE-2018-6042,\n CVE-2018-6047, CVE-2018-6048, CVE-2018-6050,\n CVE-2018-6051, CVE-2018-6052, CVE-2018-6053 and\n CVE-2018-6054.\n\n - Mitigations for SPECTRE: disabled shared-buffers, added\n cryptographic noise to precision timers\n\n - [QTBUG-47206] Fixed incorrect layouting due to bug in\n HTML5 viewport support.\n\n - [QTBUG-47945, QTBUG-65647] Fixed random crashes on exit\n\n - [QTBUG-57206] Fixed regression in viewport handling in\n embedded mode\n\n - [QTBUG-58400] Improved memory usage when printing\n\n - [QTBUG-63867] Fixed <canvas> elements when compiled\n without OpenGL\n\n - [QTBUG-63266, QTBUG-64436] Fixed that pointerType of\n Pointer Events was empty\n\n - [QTBUG-63606] Improved runtime disabling and clearing of\n HTTP cache\n\n - [QTBUG-64436] QtWebEngineWidgets: Fixed crash when\n exiting fullscreen mode using the context menu.\n\n - [QTBUG-64560] Fixed rendering glitches after\n renderProcessTerminated signal was emitted.\n\n - [QTBUG-64812] Fixed message bubble position in Hi-DPI\n mode\n\n - [QTBUG-64869, QTBUG-65004] Added testing for 32-bit host\n compiler when crossbuilding to 32-bit platforms\n\n - [QTBUG-64933] QtWebEngineWidgets: Fixed tooltips that\n did still show after mouse was moved away.\n\n - [QTBUG-65239] Fixed hanging of process if application is\n closed too fast after startup.\n\n - [QTBUG-65715] Fixed double margins when printing\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2018-e08d828ed9\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected qt5-qtwebengine package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:qt5-qtwebengine\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:27\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/08/28\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/02/25\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/02/26\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^27([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 27\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"FC27\", reference:\"qt5-qtwebengine-5.10.1-1.fc27\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"qt5-qtwebengine\");\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-02-05T14:16:54", "description": "This update updates QtWebEngine to the 5.10.1 bugfix and security release. QtWebEngine 5.10.1 is part of the Qt 5.10.1 release, but only the QtWebEngine component is included in this update.\n\nThis update includes :\n\n - Security fixes from Chromium up to version 64.0.3282.140. Including: CVE-2017-15407, CVE-2017-15409, CVE-2017-15410, CVE-2017-15411, CVE-2017-15415, CVE-2017-15416, CVE-2017-15418, CVE-2017-15419, CVE-2017-15422, CVE-2017-15423, CVE-2017-15424, CVE-2017-15425, CVE-2017-15426, CVE-2018-6031, CVE-2018-6033, CVE-2018-6034, CVE-2018-6036, CVE-2018-6037, CVE-2018-6038, CVE-2018-6040, CVE-2018-6041, CVE-2018-6042, CVE-2018-6047, CVE-2018-6048, CVE-2018-6050, CVE-2018-6051, CVE-2018-6052, CVE-2018-6053 and CVE-2018-6054.\n\n - Mitigations for SPECTRE: disabled shared-buffers, added cryptographic noise to precision timers\n\n - [QTBUG-47206] Fixed incorrect layouting due to bug in HTML5 viewport support.\n\n - [QTBUG-47945, QTBUG-65647] Fixed random crashes on exit\n\n - [QTBUG-57206] Fixed regression in viewport handling in embedded mode\n\n - [QTBUG-58400] Improved memory usage when printing\n\n - [QTBUG-63867] Fixed <canvas> elements when compiled without OpenGL\n\n - [QTBUG-63266, QTBUG-64436] Fixed that pointerType of Pointer Events was empty\n\n - [QTBUG-63606] Improved runtime disabling and clearing of HTTP cache\n\n - [QTBUG-64436] QtWebEngineWidgets: Fixed crash when exiting fullscreen mode using the context menu.\n\n - [QTBUG-64560] Fixed rendering glitches after renderProcessTerminated signal was emitted.\n\n - [QTBUG-64812] Fixed message bubble position in Hi-DPI mode\n\n - [QTBUG-64869, QTBUG-65004] Added testing for 32-bit host compiler when crossbuilding to 32-bit platforms\n\n - [QTBUG-64933] QtWebEngineWidgets: Fixed tooltips that did still show after mouse was moved away.\n\n - [QTBUG-65239] Fixed hanging of process if application is closed too fast after startup.\n\n - [QTBUG-65715] Fixed double margins when printing\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-02-28T00:00:00", "type": "nessus", "title": "Fedora 26 : qt5-qtwebengine (2018-c0d3db441f)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15407", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426", "CVE-2018-6031", "CVE-2018-6033", "CVE-2018-6034", "CVE-2018-6036", "CVE-2018-6037", "CVE-2018-6038", "CVE-2018-6040", "CVE-2018-6041", "CVE-2018-6042", "CVE-2018-6047", "CVE-2018-6048", "CVE-2018-6050", "CVE-2018-6051", "CVE-2018-6052", "CVE-2018-6053", "CVE-2018-6054"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:qt5-qtwebengine", "cpe:/o:fedoraproject:fedora:26"], "id": "FEDORA_2018-C0D3DB441F.NASL", "href": "https://www.tenable.com/plugins/nessus/107035", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2018-c0d3db441f.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(107035);\n script_version(\"3.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2017-15407\", \"CVE-2017-15409\", \"CVE-2017-15410\", \"CVE-2017-15411\", \"CVE-2017-15415\", \"CVE-2017-15416\", \"CVE-2017-15418\", \"CVE-2017-15419\", \"CVE-2017-15422\", \"CVE-2017-15423\", \"CVE-2017-15424\", \"CVE-2017-15425\", \"CVE-2017-15426\", \"CVE-2018-6031\", \"CVE-2018-6033\", \"CVE-2018-6034\", \"CVE-2018-6036\", \"CVE-2018-6037\", \"CVE-2018-6038\", \"CVE-2018-6040\", \"CVE-2018-6041\", \"CVE-2018-6042\", \"CVE-2018-6047\", \"CVE-2018-6048\", \"CVE-2018-6050\", \"CVE-2018-6051\", \"CVE-2018-6052\", \"CVE-2018-6053\", \"CVE-2018-6054\");\n script_xref(name:\"FEDORA\", value:\"2018-c0d3db441f\");\n\n script_name(english:\"Fedora 26 : qt5-qtwebengine (2018-c0d3db441f)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update updates QtWebEngine to the 5.10.1 bugfix and security\nrelease. QtWebEngine 5.10.1 is part of the Qt 5.10.1 release, but only\nthe QtWebEngine component is included in this update.\n\nThis update includes :\n\n - Security fixes from Chromium up to version\n 64.0.3282.140. Including: CVE-2017-15407,\n CVE-2017-15409, CVE-2017-15410, CVE-2017-15411,\n CVE-2017-15415, CVE-2017-15416, CVE-2017-15418,\n CVE-2017-15419, CVE-2017-15422, CVE-2017-15423,\n CVE-2017-15424, CVE-2017-15425, CVE-2017-15426,\n CVE-2018-6031, CVE-2018-6033, CVE-2018-6034,\n CVE-2018-6036, CVE-2018-6037, CVE-2018-6038,\n CVE-2018-6040, CVE-2018-6041, CVE-2018-6042,\n CVE-2018-6047, CVE-2018-6048, CVE-2018-6050,\n CVE-2018-6051, CVE-2018-6052, CVE-2018-6053 and\n CVE-2018-6054.\n\n - Mitigations for SPECTRE: disabled shared-buffers, added\n cryptographic noise to precision timers\n\n - [QTBUG-47206] Fixed incorrect layouting due to bug in\n HTML5 viewport support.\n\n - [QTBUG-47945, QTBUG-65647] Fixed random crashes on exit\n\n - [QTBUG-57206] Fixed regression in viewport handling in\n embedded mode\n\n - [QTBUG-58400] Improved memory usage when printing\n\n - [QTBUG-63867] Fixed <canvas> elements when compiled\n without OpenGL\n\n - [QTBUG-63266, QTBUG-64436] Fixed that pointerType of\n Pointer Events was empty\n\n - [QTBUG-63606] Improved runtime disabling and clearing of\n HTTP cache\n\n - [QTBUG-64436] QtWebEngineWidgets: Fixed crash when\n exiting fullscreen mode using the context menu.\n\n - [QTBUG-64560] Fixed rendering glitches after\n renderProcessTerminated signal was emitted.\n\n - [QTBUG-64812] Fixed message bubble position in Hi-DPI\n mode\n\n - [QTBUG-64869, QTBUG-65004] Added testing for 32-bit host\n compiler when crossbuilding to 32-bit platforms\n\n - [QTBUG-64933] QtWebEngineWidgets: Fixed tooltips that\n did still show after mouse was moved away.\n\n - [QTBUG-65239] Fixed hanging of process if application is\n closed too fast after startup.\n\n - [QTBUG-65715] Fixed double margins when printing\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2018-c0d3db441f\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected qt5-qtwebengine package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:qt5-qtwebengine\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:26\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/08/28\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/02/27\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/02/28\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^26([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 26\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"FC26\", reference:\"qt5-qtwebengine-5.10.1-1.fc26\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"qt5-qtwebengine\");\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-02-04T14:38:20", "description": "Security fix for CVE-2017-15412 CVE-2017-15422 CVE-2017-15407 CVE-2017-15408 CVE-2017-15409 CVE-2017-15410 CVE-2017-15411 CVE-2017-15413 CVE-2017-15415 CVE-2017-15416 CVE-2017-15417 CVE-2017-15418 CVE-2017-15419 CVE-2017-15420 CVE-2017-15423 CVE-2017-15424 CVE-2017-15425 CVE-2017-15426 CVE-2017-15427 CVE-2017-15429\n\n----\n\nSecurity fix for CVE-2017-15398, CVE-2017-15399\n\n----\n\nSecurity fix for CVE-2017-15386 CVE-2017-15387 CVE-2017-15388 CVE-2017-15389 CVE-2017-15390 CVE-2017-15391 CVE-2017-15392 CVE-2017-15393 CVE-2017-15394 CVE-2017-15395 CVE-2017-5124 CVE-2017-5125 CVE-2017-5126 CVE-2017-5127.\n\nBuild switched to use gtk3.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2018-01-02T00:00:00", "type": "nessus", "title": "Fedora 26 : chromium (2017-ea44f172e3)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15386", "CVE-2017-15387", "CVE-2017-15388", "CVE-2017-15389", "CVE-2017-15390", "CVE-2017-15391", "CVE-2017-15392", "CVE-2017-15393", "CVE-2017-15394", "CVE-2017-15395", "CVE-2017-15398", "CVE-2017-15399", "CVE-2017-15407", "CVE-2017-15408", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15413", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15417", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15420", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426", "CVE-2017-15427", "CVE-2017-15429", "CVE-2017-5124", "CVE-2017-5125", "CVE-2017-5126", "CVE-2017-5127", "CVE-2017-5128", "CVE-2017-5129", "CVE-2017-5130", "CVE-2017-5131", "CVE-2017-5132", "CVE-2017-5133"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:chromium", "cpe:/o:fedoraproject:fedora:26"], "id": "FEDORA_2017-EA44F172E3.NASL", "href": "https://www.tenable.com/plugins/nessus/105501", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2017-ea44f172e3.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(105501);\n script_version(\"3.13\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2017-15386\", \"CVE-2017-15387\", \"CVE-2017-15388\", \"CVE-2017-15389\", \"CVE-2017-15390\", \"CVE-2017-15391\", \"CVE-2017-15392\", \"CVE-2017-15393\", \"CVE-2017-15394\", \"CVE-2017-15395\", \"CVE-2017-15398\", \"CVE-2017-15399\", \"CVE-2017-15407\", \"CVE-2017-15408\", \"CVE-2017-15409\", \"CVE-2017-15410\", \"CVE-2017-15411\", \"CVE-2017-15412\", \"CVE-2017-15413\", \"CVE-2017-15415\", \"CVE-2017-15416\", \"CVE-2017-15417\", \"CVE-2017-15418\", \"CVE-2017-15419\", \"CVE-2017-15420\", \"CVE-2017-15422\", \"CVE-2017-15423\", \"CVE-2017-15424\", \"CVE-2017-15425\", \"CVE-2017-15426\", \"CVE-2017-15427\", \"CVE-2017-15429\", \"CVE-2017-5124\", \"CVE-2017-5125\", \"CVE-2017-5126\", \"CVE-2017-5127\", \"CVE-2017-5128\", \"CVE-2017-5129\", \"CVE-2017-5130\", \"CVE-2017-5131\", \"CVE-2017-5132\", \"CVE-2017-5133\");\n script_xref(name:\"FEDORA\", value:\"2017-ea44f172e3\");\n\n script_name(english:\"Fedora 26 : chromium (2017-ea44f172e3)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Security fix for CVE-2017-15412 CVE-2017-15422 CVE-2017-15407\nCVE-2017-15408 CVE-2017-15409 CVE-2017-15410 CVE-2017-15411\nCVE-2017-15413 CVE-2017-15415 CVE-2017-15416 CVE-2017-15417\nCVE-2017-15418 CVE-2017-15419 CVE-2017-15420 CVE-2017-15423\nCVE-2017-15424 CVE-2017-15425 CVE-2017-15426 CVE-2017-15427\nCVE-2017-15429\n\n----\n\nSecurity fix for CVE-2017-15398, CVE-2017-15399\n\n----\n\nSecurity fix for CVE-2017-15386 CVE-2017-15387 CVE-2017-15388\nCVE-2017-15389 CVE-2017-15390 CVE-2017-15391 CVE-2017-15392\nCVE-2017-15393 CVE-2017-15394 CVE-2017-15395 CVE-2017-5124\nCVE-2017-5125 CVE-2017-5126 CVE-2017-5127.\n\nBuild switched to use gtk3.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2017-ea44f172e3\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected chromium package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:chromium\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:26\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/02/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/01/01\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/01/02\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^26([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 26\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"FC26\", reference:\"chromium-63.0.3239.108-1.fc26\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"chromium\");\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-02-03T14:34:33", "description": "Update to Chromium 65. For EPEL7, it has been a long time since a successful build has been possible, so this will fix a LOT of CVEs.\n\nCVE-2017-15396 CVE-2017-15407 CVE-2017-15408 CVE-2017-15409 CVE-2017-15410 CVE-2017-15411 CVE-2017-15412 CVE-2017-15413 CVE-2017-15415 CVE-2017-15416 CVE-2017-15417 CVE-2017-15418 CVE-2017-15419 CVE-2017-15420 CVE-2017-15422 CVE-2018-6056 CVE-2018-6406 CVE-2018-6057 CVE-2018-6058 CVE-2018-6059 CVE-2018-6060 CVE-2018-6061 CVE-2018-6062 CVE-2018-6063 CVE-2018-6064 CVE-2018-6065 CVE-2018-6066 CVE-2018-6067 CVE-2018-6068 CVE-2018-6069 CVE-2018-6070 CVE-2018-6071\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-03-28T00:00:00", "type": "nessus", "title": "Fedora 27 : chromium (2018-faff5f661e)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15396", "CVE-2017-15407", "CVE-2017-15408", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15413", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15417", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15420", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426", "CVE-2017-15427", "CVE-2018-6056", "CVE-2018-6057", "CVE-2018-6058", "CVE-2018-6059", "CVE-2018-6060", "CVE-2018-6061", "CVE-2018-6062", "CVE-2018-6063", "CVE-2018-6064", "CVE-2018-6065", "CVE-2018-6066", "CVE-2018-6067", "CVE-2018-6068", "CVE-2018-6069", "CVE-2018-6070", "CVE-2018-6071", "CVE-2018-6072", "CVE-2018-6073", "CVE-2018-6074", "CVE-2018-6075", "CVE-2018-6076", "CVE-2018-6077", "CVE-2018-6078", "CVE-2018-6079", "CVE-2018-6080", "CVE-2018-6081", "CVE-2018-6082", "CVE-2018-6083", "CVE-2018-6406"], "modified": "2022-06-08T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:chromium", "cpe:/o:fedoraproject:fedora:27"], "id": "FEDORA_2018-FAFF5F661E.NASL", "href": "https://www.tenable.com/plugins/nessus/108679", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2018-faff5f661e.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(108679);\n script_version(\"1.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/06/08\");\n\n script_cve_id(\n \"CVE-2017-15396\",\n \"CVE-2017-15407\",\n \"CVE-2017-15408\",\n \"CVE-2017-15409\",\n \"CVE-2017-15410\",\n \"CVE-2017-15411\",\n \"CVE-2017-15412\",\n \"CVE-2017-15413\",\n \"CVE-2017-15415\",\n \"CVE-2017-15416\",\n \"CVE-2017-15417\",\n \"CVE-2017-15418\",\n \"CVE-2017-15419\",\n \"CVE-2017-15420\",\n \"CVE-2017-15422\",\n \"CVE-2017-15423\",\n \"CVE-2017-15424\",\n \"CVE-2017-15425\",\n \"CVE-2017-15426\",\n \"CVE-2017-15427\",\n \"CVE-2018-6056\",\n \"CVE-2018-6057\",\n \"CVE-2018-6058\",\n \"CVE-2018-6059\",\n \"CVE-2018-6060\",\n \"CVE-2018-6061\",\n \"CVE-2018-6062\",\n \"CVE-2018-6063\",\n \"CVE-2018-6064\",\n \"CVE-2018-6065\",\n \"CVE-2018-6066\",\n \"CVE-2018-6067\",\n \"CVE-2018-6068\",\n \"CVE-2018-6069\",\n \"CVE-2018-6070\",\n \"CVE-2018-6071\",\n \"CVE-2018-6072\",\n \"CVE-2018-6073\",\n \"CVE-2018-6074\",\n \"CVE-2018-6075\",\n \"CVE-2018-6076\",\n \"CVE-2018-6077\",\n \"CVE-2018-6078\",\n \"CVE-2018-6079\",\n \"CVE-2018-6080\",\n \"CVE-2018-6081\",\n \"CVE-2018-6082\",\n \"CVE-2018-6083\",\n \"CVE-2018-6406\"\n );\n script_xref(name:\"FEDORA\", value:\"2018-faff5f661e\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/06/22\");\n\n script_name(english:\"Fedora 27 : chromium (2018-faff5f661e)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Fedora host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"Update to Chromium 65. For EPEL7, it has been a long time since a\nsuccessful build has been possible, so this will fix a LOT of CVEs.\n\nCVE-2017-15396 CVE-2017-15407 CVE-2017-15408 CVE-2017-15409\nCVE-2017-15410 CVE-2017-15411 CVE-2017-15412 CVE-2017-15413\nCVE-2017-15415 CVE-2017-15416 CVE-2017-15417 CVE-2017-15418\nCVE-2017-15419 CVE-2017-15420 CVE-2017-15422 CVE-2018-6056\nCVE-2018-6406 CVE-2018-6057 CVE-2018-6058 CVE-2018-6059 CVE-2018-6060\nCVE-2018-6061 CVE-2018-6062 CVE-2018-6063 CVE-2018-6064 CVE-2018-6065\nCVE-2018-6066 CVE-2018-6067 CVE-2018-6068 CVE-2018-6069 CVE-2018-6070\nCVE-2018-6071\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2018-faff5f661e\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected chromium package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/01/30\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/03/27\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/03/28\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:chromium\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:27\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Fedora Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2018-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^27([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 27\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"FC27\", reference:\"chromium-65.0.3325.181-1.fc27\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"chromium\");\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-02-03T14:45:24", "description": "Update to Chromium 65. For EPEL7, it has been a long time since a successful build has been possible, so this will fix a LOT of CVEs.\n\nCVE-2017-15396 CVE-2017-15407 CVE-2017-15408 CVE-2017-15409 CVE-2017-15410 CVE-2017-15411 CVE-2017-15412 CVE-2017-15413 CVE-2017-15415 CVE-2017-15416 CVE-2017-15417 CVE-2017-15418 CVE-2017-15419 CVE-2017-15420 CVE-2017-15422 CVE-2018-6056 CVE-2018-6406 CVE-2018-6057 CVE-2018-6058 CVE-2018-6059 CVE-2018-6060 CVE-2018-6061 CVE-2018-6062 CVE-2018-6063 CVE-2018-6064 CVE-2018-6065 CVE-2018-6066 CVE-2018-6067 CVE-2018-6068 CVE-2018-6069 CVE-2018-6070 CVE-2018-6071\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-01-03T00:00:00", "type": "nessus", "title": "Fedora 28 : chromium (2018-aafdbb5554)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15396", "CVE-2017-15407", "CVE-2017-15408", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15413", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15417", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15420", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426", "CVE-2017-15427", "CVE-2018-6056", "CVE-2018-6057", "CVE-2018-6058", "CVE-2018-6059", "CVE-2018-6060", "CVE-2018-6061", "CVE-2018-6062", "CVE-2018-6063", "CVE-2018-6064", "CVE-2018-6065", "CVE-2018-6066", "CVE-2018-6067", "CVE-2018-6068", "CVE-2018-6069", "CVE-2018-6070", "CVE-2018-6071", "CVE-2018-6072", "CVE-2018-6073", "CVE-2018-6074", "CVE-2018-6075", "CVE-2018-6076", "CVE-2018-6077", "CVE-2018-6078", "CVE-2018-6079", "CVE-2018-6080", "CVE-2018-6081", "CVE-2018-6082", "CVE-2018-6083", "CVE-2018-6406"], "modified": "2022-06-08T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:chromium", "cpe:/o:fedoraproject:fedora:28"], "id": "FEDORA_2018-AAFDBB5554.NASL", "href": "https://www.tenable.com/plugins/nessus/120695", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2018-aafdbb5554.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(120695);\n script_version(\"1.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/06/08\");\n\n script_cve_id(\n \"CVE-2017-15396\",\n \"CVE-2017-15407\",\n \"CVE-2017-15408\",\n \"CVE-2017-15409\",\n \"CVE-2017-15410\",\n \"CVE-2017-15411\",\n \"CVE-2017-15412\",\n \"CVE-2017-15413\",\n \"CVE-2017-15415\",\n \"CVE-2017-15416\",\n \"CVE-2017-15417\",\n \"CVE-2017-15418\",\n \"CVE-2017-15419\",\n \"CVE-2017-15420\",\n \"CVE-2017-15422\",\n \"CVE-2017-15423\",\n \"CVE-2017-15424\",\n \"CVE-2017-15425\",\n \"CVE-2017-15426\",\n \"CVE-2017-15427\",\n \"CVE-2018-6056\",\n \"CVE-2018-6057\",\n \"CVE-2018-6058\",\n \"CVE-2018-6059\",\n \"CVE-2018-6060\",\n \"CVE-2018-6061\",\n \"CVE-2018-6062\",\n \"CVE-2018-6063\",\n \"CVE-2018-6064\",\n \"CVE-2018-6065\",\n \"CVE-2018-6066\",\n \"CVE-2018-6067\",\n \"CVE-2018-6068\",\n \"CVE-2018-6069\",\n \"CVE-2018-6070\",\n \"CVE-2018-6071\",\n \"CVE-2018-6072\",\n \"CVE-2018-6073\",\n \"CVE-2018-6074\",\n \"CVE-2018-6075\",\n \"CVE-2018-6076\",\n \"CVE-2018-6077\",\n \"CVE-2018-6078\",\n \"CVE-2018-6079\",\n \"CVE-2018-6080\",\n \"CVE-2018-6081\",\n \"CVE-2018-6082\",\n \"CVE-2018-6083\",\n \"CVE-2018-6406\"\n );\n script_xref(name:\"FEDORA\", value:\"2018-aafdbb5554\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/06/22\");\n\n script_name(english:\"Fedora 28 : chromium (2018-aafdbb5554)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Fedora host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"Update to Chromium 65. For EPEL7, it has been a long time since a\nsuccessful build has been possible, so this will fix a LOT of CVEs.\n\nCVE-2017-15396 CVE-2017-15407 CVE-2017-15408 CVE-2017-15409\nCVE-2017-15410 CVE-2017-15411 CVE-2017-15412 CVE-2017-15413\nCVE-2017-15415 CVE-2017-15416 CVE-2017-15417 CVE-2017-15418\nCVE-2017-15419 CVE-2017-15420 CVE-2017-15422 CVE-2018-6056\nCVE-2018-6406 CVE-2018-6057 CVE-2018-6058 CVE-2018-6059 CVE-2018-6060\nCVE-2018-6061 CVE-2018-6062 CVE-2018-6063 CVE-2018-6064 CVE-2018-6065\nCVE-2018-6066 CVE-2018-6067 CVE-2018-6068 CVE-2018-6069 CVE-2018-6070\nCVE-2018-6071\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2018-aafdbb5554\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected chromium package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/01/30\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/03/30\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/01/03\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:chromium\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:28\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Fedora Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2019-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^28([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 28\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"FC28\", reference:\"chromium-65.0.3325.181-1.fc28\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"chromium\");\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "openvas": [{"lastseen": "2019-07-04T19:02:13", "description": "Several vulnerabilities have been discovered in the chromium web browser.\n\nCVE-2017-15407\nNed Williamson discovered an out-of-bounds write issue.\n\nCVE-2017-15408\nKe Liu discovered a heap overflow issue in the pdfium library.\n\nCVE-2017-15409\nAn out-of-bounds write issue was discovered in the skia library.\n\nCVE-2017-15410\nLuat Nguyen discovered a use-after-free issue in the pdfium library.\n\nCVE-2017-15411\nLuat Nguyen discovered a use-after-free issue in the pdfium library.\n\nCVE-2017-15413\nGaurav Dewan discovered a type confusion issue.\n\nCVE-2017-15415\nViktor Brange discovered an information disclosure issue.\n\nCVE-2017-15416\nNed Williamson discovered an out-of-bounds read issue.\n\nCVE-2017-15417\nMax May discovered an information disclosure issue in the skia\nlibrary.\n\nCVE-2017-15418\nKushal Arvind Shah discovered an uninitialized value in the skia\nlibrary.\n\nCVE-2017-15419\nJun Kokatsu discoved an information disclosure issue.\n\nCVE-2017-15420\nWenXu Wu discovered a URL spoofing issue.\n\nCVE-2017-15423\nGreg Hudson discovered an issue in the boringssl library.\n\nCVE-2017-15424\nKhalil Zhani discovered a URL spoofing issue.\n\nCVE-2017-15425\nxisigr discovered a URL spoofing issue.\n\nCVE-2017-15426\nWenXu Wu discovered a URL spoofing issue.\n\nCVE-2017-15427\nJunaid Farhan discovered an issue with the omnibox.", "cvss3": {}, "published": "2017-12-12T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 4064-1 (chromium-browser - security update)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2017-15417", "CVE-2017-15409", "CVE-2017-15423", "CVE-2017-15419", "CVE-2017-15425", "CVE-2017-15410", "CVE-2017-15427", "CVE-2017-15407", "CVE-2017-15418", "CVE-2017-15411", "CVE-2017-15415", "CVE-2017-15426", "CVE-2017-15413", "CVE-2017-15408", "CVE-2017-15416", "CVE-2017-15424", "CVE-2017-15420"], "modified": "2019-07-04T00:00:00", "id": "OPENVAS:1361412562310704064", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310704064", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Auto-generated from advisory DSA 4064-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2017 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License as published by\n# the Free Software Foundation; either version 2 of the License, or\n# (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.704064\");\n script_version(\"2019-07-04T09:25:28+0000\");\n script_cve_id(\"CVE-2017-15407\", \"CVE-2017-15408\", \"CVE-2017-15409\", \"CVE-2017-15410\", \"CVE-2017-15411\", \"CVE-2017-15413\", \"CVE-2017-15415\", \"CVE-2017-15416\", \"CVE-2017-15417\", \"CVE-2017-15418\", \"CVE-2017-15419\", \"CVE-2017-15420\", \"CVE-2017-15423\", \"CVE-2017-15424\", \"CVE-2017-15425\", \"CVE-2017-15426\", \"CVE-2017-15427\");\n script_name(\"Debian Security Advisory DSA 4064-1 (chromium-browser - security update)\");\n script_tag(name:\"last_modification\", value:\"2019-07-04 09:25:28 +0000 (Thu, 04 Jul 2019)\");\n script_tag(name:\"creation_date\", value:\"2017-12-12 00:00:00 +0100 (Tue, 12 Dec 2017)\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n script_xref(name:\"URL\", value:\"https://www.debian.org/security/2017/dsa-4064.html\");\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2017 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB9\");\n script_tag(name:\"affected\", value:\"chromium-browser on Debian Linux\");\n script_tag(name:\"solution\", value:\"For the stable distribution (stretch), these problems have been fixed in\nversion 63.0.3239.84-1~deb9u1.\n\nWe recommend that you upgrade your chromium-browser packages.\");\n\n script_xref(name:\"URL\", value:\"https://security-tracker.debian.org/tracker/chromium-browser\");\n script_tag(name:\"summary\", value:\"Several vulnerabilities have been discovered in the chromium web browser.\n\nCVE-2017-15407\nNed Williamson discovered an out-of-bounds write issue.\n\nCVE-2017-15408\nKe Liu discovered a heap overflow issue in the pdfium library.\n\nCVE-2017-15409\nAn out-of-bounds write issue was discovered in the skia library.\n\nCVE-2017-15410\nLuat Nguyen discovered a use-after-free issue in the pdfium library.\n\nCVE-2017-15411\nLuat Nguyen discovered a use-after-free issue in the pdfium library.\n\nCVE-2017-15413\nGaurav Dewan discovered a type confusion issue.\n\nCVE-2017-15415\nViktor Brange discovered an information disclosure issue.\n\nCVE-2017-15416\nNed Williamson discovered an out-of-bounds read issue.\n\nCVE-2017-15417\nMax May discovered an information disclosure issue in the skia\nlibrary.\n\nCVE-2017-15418\nKushal Arvind Shah discovered an uninitialized value in the skia\nlibrary.\n\nCVE-2017-15419\nJun Kokatsu discoved an information disclosure issue.\n\nCVE-2017-15420\nWenXu Wu discovered a URL spoofing issue.\n\nCVE-2017-15423\nGreg Hudson discovered an issue in the boringssl library.\n\nCVE-2017-15424\nKhalil Zhani discovered a URL spoofing issue.\n\nCVE-2017-15425\nxisigr discovered a URL spoofing issue.\n\nCVE-2017-15426\nWenXu Wu discovered a URL spoofing issue.\n\nCVE-2017-15427\nJunaid Farhan discovered an issue with the omnibox.\");\n script_tag(name:\"vuldetect\", value:\"This check tests the installed software version using the apt package manager.\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif(!isnull(res = isdpkgvuln(pkg:\"chromedriver\", ver:\"63.0.3239.84-1~deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"chromium\", ver:\"63.0.3239.84-1~deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"chromium-driver\", ver:\"63.0.3239.84-1~deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"chromium-l10n\", ver:\"63.0.3239.84-1~deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"chromium-shell\", ver:\"63.0.3239.84-1~deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"chromium-widevine\", ver:\"63.0.3239.84-1~deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if(__pkg_match) {\n exit(99);\n}", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-01-31T18:27:08", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2017-12-09T00:00:00", "type": "openvas", "title": "openSUSE: Security Advisory for chromium (openSUSE-SU-2017:3244-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2017-15417", "CVE-2017-15409", "CVE-2017-15423", "CVE-2017-15419", "CVE-2017-15425", "CVE-2017-15410", "CVE-2017-15422", "CVE-2017-15427", "CVE-2017-15418", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15415", "CVE-2017-15426", "CVE-2017-15413", "CVE-2017-15408", "CVE-2017-15416", "CVE-2017-15424", "CVE-2017-15420"], "modified": "2020-01-31T00:00:00", "id": "OPENVAS:1361412562310851660", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310851660", "sourceData": "# Copyright (C) 2017 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) of their respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.851660\");\n script_version(\"2020-01-31T08:23:39+0000\");\n script_tag(name:\"last_modification\", value:\"2020-01-31 08:23:39 +0000 (Fri, 31 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2017-12-09 07:39:49 +0100 (Sat, 09 Dec 2017)\");\n script_cve_id(\"CVE-2017-15408\", \"CVE-2017-15409\", \"CVE-2017-15410\", \"CVE-2017-15411\",\n \"CVE-2017-15412\", \"CVE-2017-15413\", \"CVE-2017-15415\", \"CVE-2017-15416\",\n \"CVE-2017-15417\", \"CVE-2017-15418\", \"CVE-2017-15419\", \"CVE-2017-15420\",\n \"CVE-2017-15422\", \"CVE-2017-15423\", \"CVE-2017-15424\", \"CVE-2017-15425\",\n \"CVE-2017-15426\", \"CVE-2017-15427\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"openSUSE: Security Advisory for chromium (openSUSE-SU-2017:3244-1)\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'chromium'\n package(s) announced via the referenced advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"This update to Chromium 63.0.3239.84 fixes the following security issues:\n\n - CVE-2017-15408: Heap buffer overflow in PDFium\n\n - CVE-2017-15409: Out of bounds write in Skia\n\n - CVE-2017-15410: Use after free in PDFium\n\n - CVE-2017-15411: Use after free in PDFium\n\n - CVE-2017-15412: Use after free in libXML\n\n - CVE-2017-15413: Type confusion in WebAssembly\n\n - CVE-2017-15415: Pointer information disclosure in IPC call\n\n - CVE-2017-15416: Out of bounds read in Blink\n\n - CVE-2017-15417: Cross origin information disclosure in Skia\n\n - CVE-2017-15418: Use of uninitialized value in Skia\n\n - CVE-2017-15419: Cross origin leak of redirect URL in Blink\n\n - CVE-2017-15420: URL spoofing in Omnibox\n\n - CVE-2017-15422: Integer overflow in ICU\n\n - CVE-2017-15423: Issue with SPAKE implementation in BoringSSL\n\n - CVE-2017-15424: URL Spoof in Omnibox\n\n - CVE-2017-15425: URL Spoof in Omnibox\n\n - CVE-2017-15426: URL Spoof in Omnibox\n\n - CVE-2017-15427: Insufficient blocking of JavaScript in Omnibox\");\n\n script_tag(name:\"affected\", value:\"chromium on openSUSE Leap 42.3, openSUSE Leap 42.2\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_xref(name:\"openSUSE-SU\", value:\"2017:3244-1\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2017 Greenbone Networks GmbH\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse\", \"ssh/login/rpms\", re:\"ssh/login/release=(openSUSELeap42\\.2|openSUSELeap42\\.3)\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"openSUSELeap42.2\") {\n if(!isnull(res = isrpmvuln(pkg:\"chromedriver\", rpm:\"chromedriver~63.0.3239.84~104.41.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"chromedriver-debuginfo\", rpm:\"chromedriver-debuginfo~63.0.3239.84~104.41.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"chromium\", rpm:\"chromium~63.0.3239.84~104.41.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"chromium-debuginfo\", rpm:\"chromium-debuginfo~63.0.3239.84~104.41.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"chromium-debugsource\", rpm:\"chromium-debugsource~63.0.3239.84~104.41.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nif(release == \"openSUSELeap42.3\") {\n if(!isnull(res = isrpmvuln(pkg:\"chromedriver\", rpm:\"chromedriver~63.0.3239.84~127.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"chromedriver-debuginfo\", rpm:\"chromedriver-debuginfo~63.0.3239.84~127.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"chromium\", rpm:\"chromium~63.0.3239.84~127.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"chromium-debuginfo\", rpm:\"chromium-debuginfo~63.0.3239.84~127.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"chromium-debugsource\", rpm:\"chromium-debugsource~63.0.3239.84~127.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-07-19T22:09:48", "description": "The host is installed with Google Chrome\n and is prone to multiple vulnerabilities.", "cvss3": {}, "published": "2017-12-07T00:00:00", "type": "openvas", "title": "Google Chrome Security Updates(stable-channel-update-for-desktop-2017-12)-MAC OS X", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2017-15417", "CVE-2017-15409", "CVE-2017-15423", "CVE-2017-15419", "CVE-2017-15425", "CVE-2017-15410", "CVE-2017-15422", "CVE-2017-15427", "CVE-2017-15407", "CVE-2017-15418", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15415", "CVE-2017-15426", "CVE-2017-15413", "CVE-2017-15408", "CVE-2017-15430", "CVE-2017-15416", "CVE-2017-15424", "CVE-2017-15420"], "modified": "2019-07-17T00:00:00", "id": "OPENVAS:1361412562310812237", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310812237", "sourceData": "##############################################################################\n# OpenVAS Vulnerability Test\n#\n# Google Chrome Security Updates(stable-channel-update-for-desktop-2017-12)-MAC OS X\n#\n# Authors:\n# Rinu Kuriakose <krinu@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2017 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:google:chrome\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.812237\");\n script_version(\"2019-07-17T08:15:16+0000\");\n script_cve_id(\"CVE-2017-15407\", \"CVE-2017-15408\", \"CVE-2017-15409\", \"CVE-2017-15410\",\n \"CVE-2017-15411\", \"CVE-2017-15412\", \"CVE-2017-15413\", \"CVE-2017-15415\",\n \"CVE-2017-15416\", \"CVE-2017-15417\", \"CVE-2017-15418\", \"CVE-2017-15419\",\n \"CVE-2017-15420\", \"CVE-2017-15422\", \"CVE-2017-15423\", \"CVE-2017-15424\",\n \"CVE-2017-15425\", \"CVE-2017-15426\", \"CVE-2017-15427\", \"CVE-2017-15430\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"2019-07-17 08:15:16 +0000 (Wed, 17 Jul 2019)\");\n script_tag(name:\"creation_date\", value:\"2017-12-07 10:28:49 +0530 (Thu, 07 Dec 2017)\");\n script_name(\"Google Chrome Security Updates(stable-channel-update-for-desktop-2017-12)-MAC OS X\");\n\n script_tag(name:\"summary\", value:\"The host is installed with Google Chrome\n and is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"The multiple flaws exists due to,\n\n - An out of bounds write error in in QUIC.\n\n - A heap buffer overflow error in PDFium.\n\n - An out of bounds write error in Skia.\n\n - An use after free error in PDFium.\n\n - An use after free error in libXML.\n\n - A type confusion error in WebAssembly.\n\n - Pointer information disclosure error in IPC call.\n\n - An out of bounds read error in Blink.\n\n - Cross origin information disclosure in Skia.\n\n - Use of uninitialized value in Skia.\n\n - Cross origin leak of redirect URL in Blink.\n\n - Multiple URL spoofing errors in Omnibox.\n\n - An integer overflow error in ICU.\n\n - An issue with SPAKE implementation in BoringSSL.\n\n - An insufficient blocking of JavaScript in Omnibox.\n\n - An unsafe navigation in Chromecast Plugin.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation of these\n vulnerabilities will allow remote attackers to execute arbitrary script,\n conduct spoofing attacks, data corruption or denial of service an\n information leak.\");\n\n script_tag(name:\"affected\", value:\"Google Chrome version\n prior to 63.0.3239.84 on MAC OS X\");\n\n script_tag(name:\"solution\", value:\"Upgrade to Google Chrome version\n 63.0.3239.84 or later. Please see the references for more information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"executable_version\");\n script_xref(name:\"URL\", value:\"https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2017 Greenbone Networks GmbH\");\n script_family(\"General\");\n script_dependencies(\"gb_google_chrome_detect_macosx.nasl\");\n script_mandatory_keys(\"GoogleChrome/MacOSX/Version\");\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nif(!infos = get_app_version_and_location( cpe:CPE, exit_no_version:TRUE )) exit(0);\nvers = infos['version'];\npath = infos['location'];\n\nif(version_is_less(version:vers, test_version:\"63.0.3239.84\"))\n{\n report = report_fixed_ver( installed_version:vers, fixed_version:\"63.0.3239.84\", install_path:path );\n security_message(data:report);\n exit(0);\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T18:33:00", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2018-01-05T00:00:00", "type": "openvas", "title": "Fedora Update for chromium FEDORA-2017-c2645aa935", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2017-15417", "CVE-2017-15409", "CVE-2017-15423", "CVE-2017-15429", "CVE-2017-15419", "CVE-2017-15425", "CVE-2017-15410", "CVE-2017-15422", "CVE-2017-15427", "CVE-2017-15407", "CVE-2017-15418", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15415", "CVE-2017-15426", "CVE-2017-15413", "CVE-2017-15408", "CVE-2017-15416", "CVE-2017-15424", "CVE-2017-15420"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310873974", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310873974", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_fedora_2017_c2645aa935_chromium_fc27.nasl 14223 2019-03-15 13:49:35Z cfischer $\n#\n# Fedora Update for chromium FEDORA-2017-c2645aa935\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.873974\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2018-01-05 23:59:42 +0100 (Fri, 05 Jan 2018)\");\n script_cve_id(\"CVE-2017-15412\", \"CVE-2017-15422\", \"CVE-2017-15407\", \"CVE-2017-15408\",\n \"CVE-2017-15409\", \"CVE-2017-15410\", \"CVE-2017-15411\", \"CVE-2017-15413\",\n \"CVE-2017-15415\", \"CVE-2017-15416\", \"CVE-2017-15417\", \"CVE-2017-15418\",\n \"CVE-2017-15419\", \"CVE-2017-15420\", \"CVE-2017-15423\", \"CVE-2017-15424\",\n \"CVE-2017-15425\", \"CVE-2017-15426\", \"CVE-2017-15427\", \"CVE-2017-15429\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for chromium FEDORA-2017-c2645aa935\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'chromium'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"chromium on Fedora 27\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_xref(name:\"FEDORA\", value:\"2017-c2645aa935\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDKVCC2YPMOARJA2KQ3Y7FNIN2JW46EH\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC27\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC27\")\n{\n\n if ((res = isrpmvuln(pkg:\"chromium\", rpm:\"chromium~63.0.3239.108~1.fc27\", rls:\"FC27\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-07-19T22:09:58", "description": "The host is installed with Google Chrome\n and is prone to multiple vulnerabilities.", "cvss3": {}, "published": "2017-12-07T00:00:00", "type": "openvas", "title": "Google Chrome Security Updates(stable-channel-update-for-desktop-2017-12)-Windows", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2017-15417", "CVE-2017-15409", "CVE-2017-15423", "CVE-2017-15419", "CVE-2017-15425", "CVE-2017-15410", "CVE-2017-15422", "CVE-2017-15427", "CVE-2017-15407", "CVE-2017-15418", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15415", "CVE-2017-15426", "CVE-2017-15413", "CVE-2017-15408", "CVE-2017-15430", "CVE-2017-15416", "CVE-2017-15424", "CVE-2017-15420"], "modified": "2019-07-17T00:00:00", "id": "OPENVAS:1361412562310812235", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310812235", "sourceData": "##############################################################################\n# OpenVAS Vulnerability Test\n#\n# Google Chrome Security Updates(stable-channel-update-for-desktop-2017-12)-Windows\n#\n# Authors:\n# Rinu Kuriakose <krinu@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2017 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:google:chrome\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.812235\");\n script_version(\"2019-07-17T08:15:16+0000\");\n script_cve_id(\"CVE-2017-15407\", \"CVE-2017-15408\", \"CVE-2017-15409\", \"CVE-2017-15410\",\n \"CVE-2017-15411\", \"CVE-2017-15412\", \"CVE-2017-15413\", \"CVE-2017-15415\",\n \"CVE-2017-15416\", \"CVE-2017-15417\", \"CVE-2017-15418\", \"CVE-2017-15419\",\n \"CVE-2017-15420\", \"CVE-2017-15422\", \"CVE-2017-15423\", \"CVE-2017-15424\",\n \"CVE-2017-15425\", \"CVE-2017-15426\", \"CVE-2017-15427\", \"CVE-2017-15430\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"2019-07-17 08:15:16 +0000 (Wed, 17 Jul 2019)\");\n script_tag(name:\"creation_date\", value:\"2017-12-07 10:28:49 +0530 (Thu, 07 Dec 2017)\");\n script_name(\"Google Chrome Security Updates(stable-channel-update-for-desktop-2017-12)-Windows\");\n\n script_tag(name:\"summary\", value:\"The host is installed with Google Chrome\n and is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"The multiple flaws exists due to,\n\n - An out of bounds write error in in QUIC.\n\n - A heap buffer overflow error in PDFium.\n\n - An out of bounds write error in Skia.\n\n - An use after free error in PDFium.\n\n - An use after free error in libXML.\n\n - A type confusion error in WebAssembly.\n\n - Pointer information disclosure error in IPC call.\n\n - An out of bounds read error in Blink.\n\n - Cross origin information disclosure in Skia.\n\n - Use of uninitialized value in Skia.\n\n - Cross origin leak of redirect URL in Blink.\n\n - Multiple URL spoofing errors in Omnibox.\n\n - An integer overflow error in ICU.\n\n - An issue with SPAKE implementation in BoringSSL.\n\n - An insufficient blocking of JavaScript in Omnibox.\n\n - An unsafe navigation in Chromecast Plugin.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation of these\n vulnerabilities will allow remote attackers to execute arbitrary script,\n conduct spoofing attacks, data corruption or denial of service and\n information leak.\");\n\n script_tag(name:\"affected\", value:\"Google Chrome version\n prior to 63.0.3239.84 on Windows\");\n\n script_tag(name:\"solution\", value:\"Upgrade to Google Chrome version\n 63.0.3239.84 or later. Please see the references for more information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"registry\");\n script_xref(name:\"URL\", value:\"https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2017 Greenbone Networks GmbH\");\n script_family(\"General\");\n script_dependencies(\"gb_google_chrome_detect_portable_win.nasl\");\n script_mandatory_keys(\"GoogleChrome/Win/Ver\");\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nif(!infos = get_app_version_and_location( cpe:CPE, exit_no_version:TRUE )) exit(0);\nvers = infos['version'];\npath = infos['location'];\n\nif(version_is_less(version:vers, test_version:\"63.0.3239.84\"))\n{\n report = report_fixed_ver( installed_version:vers, fixed_version:\"63.0.3239.84\", install_path:path );\n security_message(data:report);\n exit(0);\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-07-19T22:09:53", "description": "The host is installed with Google Chrome\n and is prone to multiple vulnerabilities.", "cvss3": {}, "published": "2017-12-07T00:00:00", "type": "openvas", "title": "Google Chrome Security Updates(stable-channel-update-for-desktop-2017-12)-Linux", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2017-15417", "CVE-2017-15409", "CVE-2017-15423", "CVE-2017-15419", "CVE-2017-15425", "CVE-2017-15410", "CVE-2017-15422", "CVE-2017-15427", "CVE-2017-15407", "CVE-2017-15418", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15415", "CVE-2017-15426", "CVE-2017-15413", "CVE-2017-15408", "CVE-2017-15430", "CVE-2017-15416", "CVE-2017-15424", "CVE-2017-15420"], "modified": "2019-07-17T00:00:00", "id": "OPENVAS:1361412562310812236", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310812236", "sourceData": "##############################################################################\n# OpenVAS Vulnerability Test\n#\n# Google Chrome Security Updates(stable-channel-update-for-desktop-2017-12)-Linux\n#\n# Authors:\n# Rinu Kuriakose <krinu@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2017 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:google:chrome\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.812236\");\n script_version(\"2019-07-17T08:15:16+0000\");\n script_cve_id(\"CVE-2017-15407\", \"CVE-2017-15408\", \"CVE-2017-15409\", \"CVE-2017-15410\",\n \"CVE-2017-15411\", \"CVE-2017-15412\", \"CVE-2017-15413\", \"CVE-2017-15415\",\n \"CVE-2017-15416\", \"CVE-2017-15417\", \"CVE-2017-15418\", \"CVE-2017-15419\",\n \"CVE-2017-15420\", \"CVE-2017-15422\", \"CVE-2017-15423\", \"CVE-2017-15424\",\n \"CVE-2017-15425\", \"CVE-2017-15426\", \"CVE-2017-15427\", \"CVE-2017-15430\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"2019-07-17 08:15:16 +0000 (Wed, 17 Jul 2019)\");\n script_tag(name:\"creation_date\", value:\"2017-12-07 10:28:49 +0530 (Thu, 07 Dec 2017)\");\n script_name(\"Google Chrome Security Updates(stable-channel-update-for-desktop-2017-12)-Linux\");\n\n script_tag(name:\"summary\", value:\"The host is installed with Google Chrome\n and is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"The multiple flaws exists due to,\n\n - An out of bounds write error in in QUIC.\n\n - A heap buffer overflow error in PDFium.\n\n - An out of bounds write error in Skia.\n\n - An use after free error in PDFium.\n\n - An use after free error in libXML.\n\n - A type confusion error in WebAssembly.\n\n - Pointer information disclosure error in IPC call.\n\n - An out of bounds read error in Blink.\n\n - Cross origin information disclosure in Skia.\n\n - Use of uninitialized value in Skia.\n\n - Cross origin leak of redirect URL in Blink.\n\n - Multiple URL spoofing errors in Omnibox.\n\n - An integer overflow error in ICU.\n\n - An issue with SPAKE implementation in BoringSSL.\n\n - An insufficient blocking of JavaScript in Omnibox.\n\n - An unsafe navigation in Chromecast Plugin.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation of these\n vulnerabilities will allow remote attackers to execute arbitrary script,\n conduct spoofing attacks, data corruption or denial of service and\n information leak.\");\n\n script_tag(name:\"affected\", value:\"Google Chrome version prior to 63.0.3239.84 on Linux\");\n\n script_tag(name:\"solution\", value:\"Upgrade to Google Chrome version\n 63.0.3239.84 or later. Please see the references for more information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"executable_version\");\n script_xref(name:\"URL\", value:\"https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2017 Greenbone Networks GmbH\");\n script_family(\"General\");\n script_dependencies(\"gb_google_chrome_detect_lin.nasl\");\n script_mandatory_keys(\"Google-Chrome/Linux/Ver\");\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nif(!infos = get_app_version_and_location( cpe:CPE, exit_no_version:TRUE )) exit(0);\nvers = infos['version'];\npath = infos['location'];\n\nif(version_is_less(version:vers, test_version:\"63.0.3239.84\"))\n{\n report = report_fixed_ver( installed_version:vers, fixed_version:\"63.0.3239.84\", install_path:path );\n security_message(data:report);\n exit(0);\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T18:33:08", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2018-02-26T00:00:00", "type": "openvas", "title": "Fedora Update for qt5-qtwebengine FEDORA-2018-e08d828ed9", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2018-6034", "CVE-2017-15409", "CVE-2018-6033", "CVE-2017-15423", "CVE-2018-6031", "CVE-2018-6053", "CVE-2017-15419", "CVE-2017-15425", "CVE-2017-15410", "CVE-2017-15422", "CVE-2018-6038", "CVE-2017-15407", "CVE-2018-6054", "CVE-2017-15418", "CVE-2017-15411", "CVE-2017-15415", "CVE-2018-6036", "CVE-2018-6037", "CVE-2018-6047", "CVE-2018-6041", "CVE-2018-6042", "CVE-2018-6040", "CVE-2017-15426", "CVE-2017-15416", "CVE-2017-15424", "CVE-2018-6050", "CVE-2018-6048", "CVE-2018-6052", "CVE-2018-6051"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310874144", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310874144", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_fedora_2018_e08d828ed9_qt5-qtwebengine_fc27.nasl 14223 2019-03-15 13:49:35Z cfischer $\n#\n# Fedora Update for qt5-qtwebengine FEDORA-2018-e08d828ed9\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.874144\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2018-02-26 08:17:34 +0100 (Mon, 26 Feb 2018)\");\n script_cve_id(\"CVE-2017-15407\", \"CVE-2017-15409\", \"CVE-2017-15410\", \"CVE-2017-15411\",\n \"CVE-2017-15415\", \"CVE-2017-15416\", \"CVE-2017-15418\", \"CVE-2017-15419\",\n \"CVE-2017-15422\", \"CVE-2017-15423\", \"CVE-2017-15424\", \"CVE-2017-15425\",\n \"CVE-2017-15426\", \"CVE-2018-6031\", \"CVE-2018-6033\", \"CVE-2018-6034\",\n \"CVE-2018-6036\", \"CVE-2018-6037\", \"CVE-2018-6038\", \"CVE-2018-6040\",\n \"CVE-2018-6041\", \"CVE-2018-6042\", \"CVE-2018-6047\", \"CVE-2018-6048\",\n \"CVE-2018-6050\", \"CVE-2018-6051\", \"CVE-2018-6052\", \"CVE-2018-6053\",\n \"CVE-2018-6054\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for qt5-qtwebengine FEDORA-2018-e08d828ed9\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'qt5-qtwebengine'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"qt5-qtwebengine on Fedora 27\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_xref(name:\"FEDORA\", value:\"2018-e08d828ed9\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LGDSXXPN73LMQRMWCOGQL5XQFGUWIC7D\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC27\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC27\")\n{\n\n if ((res = isrpmvuln(pkg:\"qt5-qtwebengine\", rpm:\"qt5-qtwebengine~5.10.1~1.fc27\", rls:\"FC27\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T18:32:57", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2018-02-28T00:00:00", "type": "openvas", "title": "Fedora Update for qt5-qtwebengine FEDORA-2018-c0d3db441f", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2018-6034", "CVE-2017-15409", "CVE-2018-6033", "CVE-2017-15423", "CVE-2018-6031", "CVE-2018-6053", "CVE-2017-15419", "CVE-2017-15425", "CVE-2017-15410", "CVE-2017-15422", "CVE-2018-6038", "CVE-2017-15407", "CVE-2018-6054", "CVE-2017-15418", "CVE-2017-15411", "CVE-2017-15415", "CVE-2018-6036", "CVE-2018-6037", "CVE-2018-6047", "CVE-2018-6041", "CVE-2018-6042", "CVE-2018-6040", "CVE-2017-15426", "CVE-2017-15416", "CVE-2017-15424", "CVE-2018-6050", "CVE-2018-6048", "CVE-2018-6052", "CVE-2018-6051"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310874155", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310874155", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_fedora_2018_c0d3db441f_qt5-qtwebengine_fc26.nasl 14223 2019-03-15 13:49:35Z cfischer $\n#\n# Fedora Update for qt5-qtwebengine FEDORA-2018-c0d3db441f\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.874155\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2018-02-28 08:38:39 +0100 (Wed, 28 Feb 2018)\");\n script_cve_id(\"CVE-2017-15407\", \"CVE-2017-15409\", \"CVE-2017-15410\", \"CVE-2017-15411\",\n \"CVE-2017-15415\", \"CVE-2017-15416\", \"CVE-2017-15418\", \"CVE-2017-15419\",\n \"CVE-2017-15422\", \"CVE-2017-15423\", \"CVE-2017-15424\", \"CVE-2017-15425\",\n \"CVE-2017-15426\", \"CVE-2018-6031\", \"CVE-2018-6033\", \"CVE-2018-6034\",\n \"CVE-2018-6036\", \"CVE-2018-6037\", \"CVE-2018-6038\", \"CVE-2018-6040\",\n \"CVE-2018-6041\", \"CVE-2018-6042\", \"CVE-2018-6047\", \"CVE-2018-6048\",\n \"CVE-2018-6050\", \"CVE-2018-6051\", \"CVE-2018-6052\", \"CVE-2018-6053\",\n \"CVE-2018-6054\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for qt5-qtwebengine FEDORA-2018-c0d3db441f\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'qt5-qtwebengine'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"qt5-qtwebengine on Fedora 26\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_xref(name:\"FEDORA\", value:\"2018-c0d3db441f\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TMXSXUQWLJLP4VC53CAE7HL3ZUFJZY6I\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC26\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC26\")\n{\n\n if ((res = isrpmvuln(pkg:\"qt5-qtwebengine\", rpm:\"qt5-qtwebengine~5.10.1~1.fc26\", rls:\"FC26\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T18:32:58", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2018-01-06T00:00:00", "type": "openvas", "title": "Fedora Update for chromium FEDORA-2017-ea44f172e3", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2017-5128", "CVE-2017-15417", "CVE-2017-5132", "CVE-2017-5131", "CVE-2017-15409", "CVE-2017-15423", "CVE-2017-15395", "CVE-2017-15390", "CVE-2017-15429", "CVE-2017-15391", "CVE-2017-5133", "CVE-2017-15419", "CVE-2017-15399", "CVE-2017-15392", "CVE-2017-15425", "CVE-2017-15410", "CVE-2017-5125", "CVE-2017-15389", "CVE-2017-15387", "CVE-2017-15422", "CVE-2017-15427", "CVE-2017-15407", "CVE-2017-15418", "CVE-2017-15411", "CVE-2017-5126", "CVE-2017-15412", "CVE-2017-15393", "CVE-2017-15415", "CVE-2017-5127", "CVE-2017-15398", "CVE-2017-15386", "CVE-2017-15426", "CVE-2017-15413", "CVE-2017-15408", "CVE-2017-15388", "CVE-2017-15416", "CVE-2017-15424", "CVE-2017-5129", "CVE-2017-15420", "CVE-2017-15394", "CVE-2017-5130", "CVE-2017-5124"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310873977", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310873977", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_fedora_2017_ea44f172e3_chromium_fc26.nasl 14223 2019-03-15 13:49:35Z cfischer $\n#\n# Fedora Update for chromium FEDORA-2017-ea44f172e3\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.873977\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2018-01-06 00:00:45 +0100 (Sat, 06 Jan 2018)\");\n script_cve_id(\"CVE-2017-15412\", \"CVE-2017-15422\", \"CVE-2017-15407\", \"CVE-2017-15408\",\n \"CVE-2017-15409\", \"CVE-2017-15410\", \"CVE-2017-15411\", \"CVE-2017-15413\",\n \"CVE-2017-15415\", \"CVE-2017-15416\", \"CVE-2017-15417\", \"CVE-2017-15418\",\n \"CVE-2017-15419\", \"CVE-2017-15420\", \"CVE-2017-15423\", \"CVE-2017-15424\",\n \"CVE-2017-15425\", \"CVE-2017-15426\", \"CVE-2017-15427\", \"CVE-2017-15429\",\n \"CVE-2017-15398\", \"CVE-2017-15399\", \"CVE-2017-15386\", \"CVE-2017-15387\",\n \"CVE-2017-15388\", \"CVE-2017-15389\", \"CVE-2017-15390\", \"CVE-2017-15391\",\n \"CVE-2017-15392\", \"CVE-2017-15393\", \"CVE-2017-15394\", \"CVE-2017-15395\",\n \"CVE-2017-5124\", \"CVE-2017-5125\", \"CVE-2017-5126\", \"CVE-2017-5127\",\n \"CVE-2017-5133\", \"CVE-2017-5131\", \"CVE-2017-5130\", \"CVE-2017-5132\",\n \"CVE-2017-5129\", \"CVE-2017-5128\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for chromium FEDORA-2017-ea44f172e3\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'chromium'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"chromium on Fedora 26\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_xref(name:\"FEDORA\", value:\"2017-ea44f172e3\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TCX6RNONWP5H4F6S2D3GX2IVGKVND34L\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC26\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC26\")\n{\n\n if ((res = isrpmvuln(pkg:\"chromium\", rpm:\"chromium~63.0.3239.108~1.fc26\", rls:\"FC26\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:32:54", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2018-03-28T00:00:00", "type": "openvas", "title": "Fedora Update for chromium FEDORA-2018-faff5f661e", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2018-6069", "CVE-2018-6078", "CVE-2017-15417", "CVE-2018-6081", "CVE-2017-15409", "CVE-2018-6080", "CVE-2018-6083", "CVE-2017-15423", "CVE-2018-6082", "CVE-2018-6057", "CVE-2018-6070", "CVE-2018-6074", "CVE-2018-6059", "CVE-2017-15419", "CVE-2017-15425", "CVE-2018-6056", "CVE-2017-15410", "CVE-2018-6073", "CVE-2017-15422", "CVE-2017-15427", "CVE-2017-15407", "CVE-2018-6061", "CVE-2017-15418", "CVE-2017-15411", "CVE-2018-6072", "CVE-2017-15412", "CVE-2017-15415", "CVE-2018-6058", "CVE-2018-6068", "CVE-2018-6065", "CVE-2018-6062", "CVE-2018-6067", "CVE-2017-15426", "CVE-2017-15413", "CVE-2017-15408", "CVE-2018-6071", "CVE-2017-15396", "CVE-2018-6406", "CVE-2018-6066", "CVE-2018-6075", "CVE-2017-15416", "CVE-2017-15424", "CVE-2017-15420", "CVE-2018-6064", "CVE-2018-6077", "CVE-2018-6076", "CVE-2018-6079", "CVE-2018-6060", "CVE-2018-6063"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310874300", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310874300", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_fedora_2018_faff5f661e_chromium_fc27.nasl 14223 2019-03-15 13:49:35Z cfischer $\n#\n# Fedora Update for chromium FEDORA-2018-faff5f661e\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.874300\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2018-03-28 09:00:16 +0200 (Wed, 28 Mar 2018)\");\n script_cve_id(\"CVE-2017-15396\", \"CVE-2017-15407\", \"CVE-2017-15408\", \"CVE-2017-15409\",\n \"CVE-2017-15410\", \"CVE-2017-15411\", \"CVE-2017-15412\", \"CVE-2017-15413\",\n \"CVE-2017-15415\", \"CVE-2017-15416\", \"CVE-2017-15417\", \"CVE-2017-15418\",\n \"CVE-2017-15419\", \"CVE-2017-15420\", \"CVE-2017-15422\", \"CVE-2018-6056\",\n \"CVE-2018-6406\", \"CVE-2018-6057\", \"CVE-2018-6058\", \"CVE-2018-6059\",\n \"CVE-2018-6060\", \"CVE-2018-6061\", \"CVE-2018-6062\", \"CVE-2018-6063\",\n \"CVE-2018-6064\", \"CVE-2018-6065\", \"CVE-2018-6066\", \"CVE-2018-6067\",\n \"CVE-2018-6068\", \"CVE-2018-6069\", \"CVE-2018-6070\", \"CVE-2018-6071\",\n \"CVE-2018-6083\", \"CVE-2018-6082\", \"CVE-2018-6081\", \"CVE-2018-6080\",\n \"CVE-2018-6079\", \"CVE-2018-6078\", \"CVE-2018-6077\", \"CVE-2018-6076\",\n \"CVE-2018-6075\", \"CVE-2018-6074\", \"CVE-2018-6073\", \"CVE-2018-6072\",\n \"CVE-2017-15427\", \"CVE-2017-15426\", \"CVE-2017-15425\", \"CVE-2017-15424\",\n \"CVE-2017-15423\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for chromium FEDORA-2018-faff5f661e\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'chromium'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"chromium on Fedora 27\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_xref(name:\"FEDORA\", value:\"2018-faff5f661e\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XCBSSV5ZSWY3Q4NKEKL22B4MOSHCBKVN\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC27\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC27\")\n{\n\n if ((res = isrpmvuln(pkg:\"chromium\", rpm:\"chromium~65.0.3325.181~1.fc27\", rls:\"FC27\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "debian": [{"lastseen": "2019-05-30T02:21:33", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-4064-1 security@debian.org\nhttps://www.debian.org/security/ Michael Gilbert\nDecember 12, 2017 https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : chromium-browser\nCVE ID : CVE-2017-15407 CVE-2017-15408 CVE-2017-15409 CVE-2017-15410\n CVE-2017-15411 CVE-2017-15413 CVE-2017-15415 CVE-2017-15416\n CVE-2017-15417 CVE-2017-15418 CVE-2017-15419 CVE-2017-15420\n CVE-2017-15423 CVE-2017-15424 CVE-2017-15425 CVE-2017-15426\n CVE-2017-15427\n\nSeveral vulnerabilities have been discovered in the chromium web browser.\n\nCVE-2017-15407\n\n Ned Williamson discovered an out-of-bounds write issue.\n\nCVE-2017-15408\n\n Ke Liu discovered a heap overflow issue in the pdfium library.\n\nCVE-2017-15409\n\n An out-of-bounds write issue was discovered in the skia library.\n\nCVE-2017-15410\n\n Luat Nguyen discovered a use-after-free issue in the pdfium library.\n\nCVE-2017-15411\n\n Luat Nguyen discovered a use-after-free issue in the pdfium library.\n\nCVE-2017-15413\n\n Gaurav Dewan discovered a type confusion issue.\n\nCVE-2017-15415\n\n Viktor Brange discovered an information disclosure issue.\n\nCVE-2017-15416\n\n Ned Williamson discovered an out-of-bounds read issue.\n\nCVE-2017-15417\n\n Max May discovered an information disclosure issue in the skia\n library.\n\nCVE-2017-15418\n\n Kushal Arvind Shah discovered an uninitialized value in the skia\n library.\n\nCVE-2017-15419\n\n Jun Kokatsu discoved an information disclosure issue.\n\nCVE-2017-15420\n\n WenXu Wu discovered a URL spoofing issue.\n\nCVE-2017-15423\n\n Greg Hudson discovered an issue in the boringssl library.\n\nCVE-2017-15424\n\n Khalil Zhani discovered a URL spoofing issue.\n\nCVE-2017-15425\n\n xisigr discovered a URL spoofing issue.\n\nCVE-2017-15426\n\n WenXu Wu discovered a URL spoofing issue.\n\nCVE-2017-15427\n\n Junaid Farhan discovered an issue with the omnibox.\n\nFor the stable distribution (stretch), these problems have been fixed in\nversion 63.0.3239.84-1~deb9u1.\n\nWe recommend that you upgrade your chromium-browser packages.\n\nFor the detailed security status of chromium-browser please refer to\nits security tracker page at:\nhttps://security-tracker.debian.org/tracker/chromium-browser\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2017-12-12T11:04:40", "type": "debian", "title": "[SECURITY] [DSA 4064-1] chromium-browser security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15417", "CVE-2017-15409", "CVE-2017-15423", "CVE-2017-15419", "CVE-2017-15425", "CVE-2017-15410", "CVE-2017-15427", "CVE-2017-15407", "CVE-2017-15418", "CVE-2017-15411", "CVE-2017-15415", "CVE-2017-15426", "CVE-2017-15413", "CVE-2017-15408", "CVE-2017-15416", "CVE-2017-15424", "CVE-2017-15420"], "modified": "2017-12-12T11:04:40", "id": "DEBIAN:DSA-4064-1:25480", "href": "https://lists.debian.org/debian-security-announce/debian-security-announce-2017/msg00327.html", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "suse": [{"lastseen": "2017-12-08T15:45:31", "description": "This update to Chromium 63.0.3239.84 fixes the following security issues:\n\n - CVE-2017-15408: Heap buffer overflow in PDFium\n - CVE-2017-15409: Out of bounds write in Skia\n - CVE-2017-15410: Use after free in PDFium\n - CVE-2017-15411: Use after free in PDFium\n - CVE-2017-15412: Use after free in libXML\n - CVE-2017-15413: Type confusion in WebAssembly\n - CVE-2017-15415: Pointer information disclosure in IPC call\n - CVE-2017-15416: Out of bounds read in Blink\n - CVE-2017-15417: Cross origin information disclosure in Skia\n - CVE-2017-15418: Use of uninitialized value in Skia\n - CVE-2017-15419: Cross origin leak of redirect URL in Blink\n - CVE-2017-15420: URL spoofing in Omnibox\n - CVE-2017-15422: Integer overflow in ICU\n - CVE-2017-15423: Issue with SPAKE implementation in BoringSSL\n - CVE-2017-15424: URL Spoof in Omnibox\n - CVE-2017-15425: URL Spoof in Omnibox\n - CVE-2017-15426: URL Spoof in Omnibox\n - CVE-2017-15427: Insufficient blocking of JavaScript in Omnibox\n\n", "cvss3": {}, "published": "2017-12-08T12:15:33", "type": "suse", "title": "Security update for chromium (important)", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2017-15417", "CVE-2017-15409", "CVE-2017-15423", "CVE-2017-15419", "CVE-2017-15425", "CVE-2017-15410", "CVE-2017-15422", "CVE-2017-15427", "CVE-2017-15418", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15415", "CVE-2017-15426", "CVE-2017-15413", "CVE-2017-15408", "CVE-2017-15416", "CVE-2017-15424", "CVE-2017-15420"], "modified": "2017-12-08T12:15:33", "id": "OPENSUSE-SU-2017:3244-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-12/msg00021.html", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2017-12-08T15:45:32", "description": "This update to Chromium 63.0.3239.84 fixes the following security issues:\n\n - CVE-2017-5124: UXSS with MHTML\n - CVE-2017-5125: Heap overflow in Skia\n - CVE-2017-5126: Use after free in PDFium\n - CVE-2017-5127: Use after free in PDFium\n - CVE-2017-5128: Heap overflow in WebGL\n - CVE-2017-5129: Use after free in WebAudio\n - CVE-2017-5132: Incorrect stack manipulation in WebAssembly.\n - CVE-2017-5130: Heap overflow in libxml2\n - CVE-2017-5131: Out of bounds write in Skia\n - CVE-2017-5133: Out of bounds write in Skia\n - CVE-2017-15386: UI spoofing in Blink\n - CVE-2017-15387: Content security bypass\n - CVE-2017-15388: Out of bounds read in Skia\n - CVE-2017-15389: URL spoofing in OmniBox\n - CVE-2017-15390: URL spoofing in OmniBox\n - CVE-2017-15391: Extension limitation bypass in Extensions.\n - CVE-2017-15392: Incorrect registry key handling in PlatformIntegration\n - CVE-2017-15393: Referrer leak in Devtools\n - CVE-2017-15394: URL spoofing in extensions UI\n - CVE-2017-15395: Null pointer dereference in ImageCapture\n - CVE-2017-15396: Stack overflow in V8\n - CVE-2017-15398: Stack buffer overflow in QUIC\n - CVE-2017-15399: Use after free in V8\n - CVE-2017-15408: Heap buffer overflow in PDFium\n - CVE-2017-15409: Out of bounds write in Skia\n - CVE-2017-15410: Use after free in PDFium\n - CVE-2017-15411: Use after free in PDFium\n - CVE-2017-15412: Use after free in libXML\n - CVE-2017-15413: Type confusion in WebAssembly\n - CVE-2017-15415: Pointer information disclosure in IPC call\n - CVE-2017-15416: Out of bounds read in Blink\n - CVE-2017-15417: Cross origin information disclosure in Skia\n - CVE-2017-15418: Use of uninitialized value in Skia\n - CVE-2017-15419: Cross origin leak of redirect URL in Blink\n - CVE-2017-15420: URL spoofing in Omnibox\n - CVE-2017-15422: Integer overflow in ICU\n - CVE-2017-15423: Issue with SPAKE implementation in BoringSSL\n - CVE-2017-15424: URL Spoof in Omnibox\n - CVE-2017-15425: URL Spoof in Omnibox\n - CVE-2017-15426: URL Spoof in Omnibox\n - CVE-2017-15427: Insufficient blocking of JavaScript in Omnibox\n\n The following tracked bug fixes are included:\n\n - sandbox crash fixes (bsc#1064298)\n\n", "cvss3": {}, "published": "2017-12-08T12:15:59", "type": "suse", "title": "Security update for chromium (important)", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2017-5128", "CVE-2017-15417", "CVE-2017-5132", "CVE-2017-5131", "CVE-2017-15409", "CVE-2017-15423", "CVE-2017-15395", "CVE-2017-15390", "CVE-2017-15391", "CVE-2017-5133", "CVE-2017-15419", "CVE-2017-15399", "CVE-2017-15392", "CVE-2017-15425", "CVE-2017-15410", "CVE-2017-5125", "CVE-2017-15389", "CVE-2017-15387", "CVE-2017-15422", "CVE-2017-15427", "CVE-2017-15418", "CVE-2017-15411", "CVE-2017-5126", "CVE-2017-15412", "CVE-2017-15393", "CVE-2017-15415", "CVE-2017-5127", "CVE-2017-15398", "CVE-2017-15386", "CVE-2017-15426", "CVE-2017-15413", "CVE-2017-15408", "CVE-2017-15396", "CVE-2017-15388", "CVE-2017-15416", "CVE-2017-15424", "CVE-2017-5129", "CVE-2017-15420", "CVE-2017-15394", "CVE-2017-5130", "CVE-2017-5124"], "modified": "2017-12-08T12:15:59", "id": "OPENSUSE-SU-2017:3245-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-12/msg00022.html", "cvss": {"score": 0.0, "vector": "NONE"}}], "osv": [{"lastseen": "2022-07-21T08:24:18", "description": "\nSeveral vulnerabilities have been discovered in the chromium web browser.\n\n\n* [CVE-2017-15407](https://security-tracker.debian.org/tracker/CVE-2017-15407)\nNed Williamson discovered an out-of-bounds write issue.\n* [CVE-2017-15408](https://security-tracker.debian.org/tracker/CVE-2017-15408)\nKe Liu discovered a heap overflow issue in the pdfium library.\n* [CVE-2017-15409](https://security-tracker.debian.org/tracker/CVE-2017-15409)\nAn out-of-bounds write issue was discovered in the skia library.\n* [CVE-2017-15410](https://security-tracker.debian.org/tracker/CVE-2017-15410)\nLuat Nguyen discovered a use-after-free issue in the pdfium library.\n* [CVE-2017-15411](https://security-tracker.debian.org/tracker/CVE-2017-15411)\nLuat Nguyen discovered a use-after-free issue in the pdfium library.\n* [CVE-2017-15413](https://security-tracker.debian.org/tracker/CVE-2017-15413)\nGaurav Dewan discovered a type confusion issue.\n* [CVE-2017-15415](https://security-tracker.debian.org/tracker/CVE-2017-15415)\nViktor Brange discovered an information disclosure issue.\n* [CVE-2017-15416](https://security-tracker.debian.org/tracker/CVE-2017-15416)\nNed Williamson discovered an out-of-bounds read issue.\n* [CVE-2017-15417](https://security-tracker.debian.org/tracker/CVE-2017-15417)\nMax May discovered an information disclosure issue in the skia\n library.\n* [CVE-2017-15418](https://security-tracker.debian.org/tracker/CVE-2017-15418)\nKushal Arvind Shah discovered an uninitialized value in the skia\n library.\n* [CVE-2017-15419](https://security-tracker.debian.org/tracker/CVE-2017-15419)\nJun Kokatsu discoved an information disclosure issue.\n* [CVE-2017-15420](https://security-tracker.debian.org/tracker/CVE-2017-15420)\nWenXu Wu discovered a URL spoofing issue.\n* [CVE-2017-15423](https://security-tracker.debian.org/tracker/CVE-2017-15423)\nGreg Hudson discovered an issue in the boringssl library.\n* [CVE-2017-15424](https://security-tracker.debian.org/tracker/CVE-2017-15424)\nKhalil Zhani discovered a URL spoofing issue.\n* [CVE-2017-15425](https://security-tracker.debian.org/tracker/CVE-2017-15425)\nxisigr discovered a URL spoofing issue.\n* [CVE-2017-15426](https://security-tracker.debian.org/tracker/CVE-2017-15426)\nWenXu Wu discovered a URL spoofing issue.\n* [CVE-2017-15427](https://security-tracker.debian.org/tracker/CVE-2017-15427)\nJunaid Farhan discovered an issue with the omnibox.\n\n\nFor the stable distribution (stretch), these problems have been fixed in\nversion 63.0.3239.84-1~deb9u1.\n\n\nWe recommend that you upgrade your chromium-browser packages.\n\n\nFor the detailed security status of chromium-browser please refer to\nits security tracker page at:\n[\\\nhttps://security-tracker.debian.org/tracker/chromium-browser](https://security-tracker.debian.org/tracker/chromium-browser)\n\n\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2017-12-12T00:00:00", "type": "osv", "title": "chromium-browser - security update", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15417", "CVE-2017-15409", "CVE-2017-15423", "CVE-2017-15419", "CVE-2017-15425", "CVE-2017-15410", "CVE-2017-15427", "CVE-2017-15407", "CVE-2017-15418", "CVE-2017-15411", "CVE-2017-15415", "CVE-2017-15428", "CVE-2017-15426", "CVE-2017-15413", "CVE-2017-15408", "CVE-2017-15416", "CVE-2017-15424", "CVE-2017-15420"], "modified": "2022-07-21T05:49:41", "id": "OSV:DSA-4064-1", "href": "https://osv.dev/vulnerability/DSA-4064-1", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "archlinux": [{"lastseen": "2021-07-28T14:34:05", "description": "Arch Linux Security Advisory ASA-201712-5\n=========================================\n\nSeverity: Critical\nDate : 2017-12-07\nCVE-ID : CVE-2017-15407 CVE-2017-15408 CVE-2017-15409 CVE-2017-15410\nCVE-2017-15411 CVE-2017-15412 CVE-2017-15413 CVE-2017-15415\nCVE-2017-15416 CVE-2017-15417 CVE-2017-15418 CVE-2017-15419\nCVE-2017-15420 CVE-2017-15422 CVE-2017-15423 CVE-2017-15424\nCVE-2017-15425 CVE-2017-15426 CVE-2017-15427\nPackage : chromium\nType : multiple issues\nRemote : Yes\nLink : https://security.archlinux.org/AVG-544\n\nSummary\n=======\n\nThe package chromium before version 63.0.3239.84-1 is vulnerable to\nmultiple issues including arbitrary code execution, content spoofing,\ninformation disclosure and access restriction bypass.\n\nResolution\n==========\n\nUpgrade to 63.0.3239.84-1.\n\n# pacman -Syu \"chromium>=63.0.3239.84-1\"\n\nThe problems have been fixed upstream in version 63.0.3239.84.\n\nWorkaround\n==========\n\nNone.\n\nDescription\n===========\n\n- CVE-2017-15407 (arbitrary code execution)\n\nAn out of bounds write has been found in the QUIC component of the\nChromium browser before 63.0.3239.84.\n\n- CVE-2017-15408 (arbitrary code execution)\n\nA heap-based buffer overflow has been found in the PDFium component of\nthe Chromium browser before 63.0.3239.84.\n\n- CVE-2017-15409 (arbitrary code execution)\n\nAn out of bounds write has been found in the Skia component of the\nChromium browser before 63.0.3239.84.\n\n- CVE-2017-15410 (arbitrary code execution)\n\nA use after free has been found in the PDFium component of the Chromium\nbrowser before 63.0.3239.84.\n\n- CVE-2017-15411 (arbitrary code execution)\n\nA use after free has been found in the PDFium component of the Chromium\nbrowser before 63.0.3239.84.\n\n- CVE-2017-15412 (arbitrary code execution)\n\nA use after free has been found in the libxml component of the Chromium\nbrowser before 63.0.3239.84.\n\n- CVE-2017-15413 (arbitrary code execution)\n\nA type confusion has been found in the WebAssembly component of the\nChromium browser before 63.0.3239.84.\n\n- CVE-2017-15415 (information disclosure)\n\nA pointer information disclosure has been found in the IPC call\ncomponent of the Chromium browser before 63.0.3239.84.\n\n- CVE-2017-15416 (information disclosure)\n\nAn out of bounds read has been found in the Blink component of the\nChromium browser before 63.0.3239.84.\n\n- CVE-2017-15417 (information disclosure)\n\nA cross-origin information disclosure has been found in the Skia\ncomponent of the Chromium browser before 63.0.3239.84.\n\n- CVE-2017-15418 (information disclosure)\n\nA use of uninitialized value has been found in the Skia component of\nthe Chromium browser before 63.0.3239.84.\n\n- CVE-2017-15419 (information disclosure)\n\nA cross-origin leak of redirect URL has been found in the Blink\ncomponent of the Chromium browser before 63.0.3239.84.\n\n- CVE-2017-15420 (content spoofing)\n\nA URL spoofing issue has been found in the Omnibox component of the\nChromium browser before 63.0.3239.84.\n\n- CVE-2017-15422 (arbitrary code execution)\n\nAn integer overflow has been found in the ICU component of the Chromium\nbrowser before 63.0.3239.84.\n\n- CVE-2017-15423 (information disclosure)\n\nAn information disclosure issue has been found in the SPAKE\nimplementation of the BoringSSL component of the Chromium browser\nbefore 63.0.3239.84.\n\n- CVE-2017-15424 (content spoofing)\n\nA URL spoofing issue has been found in the Omnibox component of the\nChromium browser before 63.0.3239.84.\n\n- CVE-2017-15425 (content spoofing)\n\nA URL spoofing issue has been found in the Omnibox component of the\nChromium browser before 63.0.3239.84.\n\n- CVE-2017-15426 (content spoofing)\n\nA URL spoofing issue has been found in the Omnibox component of the\nChromium browser before 63.0.3239.84.\n\n- CVE-2017-15427 (access restriction bypass)\n\nAn insufficient blocking of Javascript issue has been found in the\nOmnibox component of the Chromium browser before 63.0.3239.84.\n\nImpact\n======\n\nA remote attacker can execute arbitrary code on the affected host,\nspoof the URL, access sensitive information and bypass security\nmeasures.\n\nReferences\n==========\n\nhttps://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html\nhttps://crbug.com/778505\nhttps://crbug.com/762374\nhttps://crbug.com/763972\nhttps://crbug.com/765921\nhttps://crbug.com/770148\nhttps://crbug.com/727039\nhttps://crbug.com/766666\nhttps://crbug.com/765512\nhttps://crbug.com/779314\nhttps://crbug.com/699028\nhttps://crbug.com/765858\nhttps://crbug.com/780312\nhttps://crbug.com/777419\nhttps://crbug.com/774382\nhttps://github.com/google/boringssl/commit/696c13bd6ab78011adfe7b775519c8b7cc82b604\nhttps://crbug.com/778101\nhttps://crbug.com/756226\nhttps://crbug.com/756456\nhttps://crbug.com/756735\nhttps://crbug.com/768910\nhttps://security.archlinux.org/CVE-2017-15407\nhttps://security.archlinux.org/CVE-2017-15408\nhttps://security.archlinux.org/CVE-2017-15409\nhttps://security.archlinux.org/CVE-2017-15410\nhttps://security.archlinux.org/CVE-2017-15411\nhttps://security.archlinux.org/CVE-2017-15412\nhttps://security.archlinux.org/CVE-2017-15413\nhttps://security.archlinux.org/CVE-2017-15415\nhttps://security.archlinux.org/CVE-2017-15416\nhttps://security.archlinux.org/CVE-2017-15417\nhttps://security.archlinux.org/CVE-2017-15418\nhttps://security.archlinux.org/CVE-2017-15419\nhttps://security.archlinux.org/CVE-2017-15420\nhttps://security.archlinux.org/CVE-2017-15422\nhttps://security.archlinux.org/CVE-2017-15423\nhttps://security.archlinux.org/CVE-2017-15424\nhttps://security.archlinux.org/CVE-2017-15425\nhttps://security.archlinux.org/CVE-2017-15426\nhttps://security.archlinux.org/CVE-2017-15427", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2017-12-07T00:00:00", "type": "archlinux", "title": "[ASA-201712-5] chromium: multiple issues", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15407", "CVE-2017-15408", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15413", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15417", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15420", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426", "CVE-2017-15427"], "modified": "2017-12-07T00:00:00", "id": "ASA-201712-5", "href": "https://security.archlinux.org/ASA-201712-5", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "kaspersky": [{"lastseen": "2023-02-08T16:05:08", "description": "### *Detect date*:\n12/07/2017\n\n### *Severity*:\nCritical\n\n### *Description*:\nMultiple serious vulnerabilities have been found in Google Chrome. Malicious users can exploit these vulnerabilities to cause denial of service, obtain sensitive information, spoof user interface, bypass security restrictions and possibly to execute arbitrary code.\n\n### *Affected products*:\nGoogle Chrome versions earlier than 63.0.3239.84\n\n### *Solution*:\nUpdate to the latest version. File with name old_chrome can be still detected after update. It caused by Google Chrome update policy which does not remove old versions when installing updates. Try to contact vendor for further delete instructions or ignore such kind of alerts at your own risk. \n[Download Google Chrome](<https://www.google.com/chrome/browser/desktop/>)\n\n### *Original advisories*:\n[Stable Channel Update for Desktop](<https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html>) \n\n\n### *Impacts*:\nACE \n\n### *Related products*:\n[Google Chrome](<https://threats.kaspersky.com/en/product/Google-Chrome/>)\n\n### *CVE-IDS*:\n[CVE-2017-15422](<https://vulners.com/cve/CVE-2017-15422>)4.3Warning \n[CVE-2017-15423](<https://vulners.com/cve/CVE-2017-15423>)5.0Critical \n[CVE-2017-15424](<https://vulners.com/cve/CVE-2017-15424>)4.3Warning \n[CVE-2017-15425](<https://vulners.com/cve/CVE-2017-15425>)4.3Warning \n[CVE-2017-15426](<https://vulners.com/cve/CVE-2017-15426>)4.3Warning \n[CVE-2017-15427](<https://vulners.com/cve/CVE-2017-15427>)4.3Warning \n[CVE-2017-15407](<https://vulners.com/cve/CVE-2017-15407>)6.8High \n[CVE-2017-15408](<https://vulners.com/cve/CVE-2017-15408>)6.8High \n[CVE-2017-15409](<https://vulners.com/cve/CVE-2017-15409>)6.8High \n[CVE-2017-15410](<https://vulners.com/cve/CVE-2017-15410>)6.8High \n[CVE-2017-15411](<https://vulners.com/cve/CVE-2017-15411>)6.8High \n[CVE-2017-15412](<https://vulners.com/cve/CVE-2017-15412>)6.8High \n[CVE-2017-15413](<https://vulners.com/cve/CVE-2017-15413>)6.8High \n[CVE-2017-15415](<https://vulners.com/cve/CVE-2017-15415>)4.3Warning \n[CVE-2017-15416](<https://vulners.com/cve/CVE-2017-15416>)4.3Warning \n[CVE-2017-15417](<https://vulners.com/cve/CVE-2017-15417>)2.6Warning \n[CVE-2017-15418](<https://vulners.com/cve/CVE-2017-15418>)4.3Warning \n[CVE-2017-15419](<https://vulners.com/cve/CVE-2017-15419>)4.3Warning \n[CVE-2017-15420](<https://vulners.com/cve/CVE-2017-15420>)4.3Warning", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2017-12-07T00:00:00", "type": "kaspersky", "title": "KLA11152 Multiple vulnerabilities in Google Chrome", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15407", "CVE-2017-15408", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15413", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15417", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15420", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426", "CVE-2017-15427"], "modified": "2020-06-03T00:00:00", "id": "KLA11152", "href": "https://threats.kaspersky.com/en/vulnerability/KLA11152/", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "redhat": [{"lastseen": "2021-10-19T20:36:02", "description": "Chromium is an open-source web browser, powered by WebKit (Blink).\n\nThis update upgrades Chromium to version 63.0.3239.84.\n\nSecurity Fix(es):\n\n* Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when visited by the victim. (CVE-2017-15407, CVE-2017-15408, CVE-2017-15409, CVE-2017-15410, CVE-2017-15411, CVE-2017-15412, CVE-2017-15413, CVE-2017-15415, CVE-2017-15416, CVE-2017-15417, CVE-2017-15418, CVE-2017-15419, CVE-2017-15420, CVE-2017-15422, CVE-2017-15423, CVE-2017-15424, CVE-2017-15425, CVE-2017-15426, CVE-2017-15427)", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2017-12-07T19:20:02", "type": "redhat", "title": "(RHSA-2017:3401) Critical: chromium-browser security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15407", "CVE-2017-15408", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15413", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15417", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15420", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426", "CVE-2017-15427"], "modified": "2018-06-07T14:21:49", "id": "RHSA-2017:3401", "href": "https://access.redhat.com/errata/RHSA-2017:3401", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "fedora": [{"lastseen": "2020-12-21T08:17:54", "description": "Chromium is an open-source web browser, powered by WebKit (Blink). ", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2018-01-01T22:20:38", "type": "fedora", "title": "[SECURITY] Fedora 27 Update: chromium-63.0.3239.108-1.fc27", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15407", "CVE-2017-15408", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15413", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15417", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15420", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426", "CVE-2017-15427", "CVE-2017-15429"], "modified": "2018-01-01T22:20:38", "id": "FEDORA:2E8D96005552", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/UDKVCC2YPMOARJA2KQ3Y7FNIN2JW46EH/", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-12-21T08:17:54", "description": "Qt5 - QtWebEngine components. ", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2018-02-25T21:14:12", "type": "fedora", "title": "[SECURITY] Fedora 27 Update: qt5-qtwebengine-5.10.1-1.fc27", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15407", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15415", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15425", "CVE-2017-15426", "CVE-2018-6031", "CVE-2018-6033", "CVE-2018-6034", "CVE-2018-6036", "CVE-2018-6037", "CVE-2018-6038", "CVE-2018-6040", "CVE-2018-6041", "CVE-2018-6042", "CVE-2018-6047", "CVE-2018-6048", "CVE-2018-6050", "CVE-2018-6051", "CVE-2018-6052", "CVE-2018-6053", "CVE-2018-6054"], "modified": "2018-02-25T21:14:12", "id": "FEDORA:CAFF160478EB", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/LGDSXXPN73LMQRMWCOGQL5XQFGUWIC7D/", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-12-21T08:17:54", "description": "Qt5 - QtWebEngine components. ", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2018-02-27T16:58:43", "type": "fedora", "title": "[SECURITY] Fedora 26 Update: qt5-qtwebengine-5.10.1-1.fc26", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15407", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15415", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15425", "CVE-2017-15426", "CVE-2018-6031", "CVE-2018-6033", "CVE-2018-6034", "CVE-2018-6036", "CVE-2018-6037", "CVE-2018-6038", "CVE-2018-6040", "CVE-2018-6041", "CVE-2018-6042", "CVE-2018-6047", "CVE-2018-6048", "CVE-2018-6050", "CVE-2018-6051", "CVE-2018-6052", "CVE-2018-6053", "CVE-2018-6054"], "modified": "2018-02-27T16:58:43", "id": "FEDORA:5CFCF60A5875", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/TMXSXUQWLJLP4VC53CAE7HL3ZUFJZY6I/", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-12-21T08:17:54", "description": "Chromium is an open-source web browser, powered by WebKit (Blink). ", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2018-01-01T22:22:45", "type": "fedora", "title": "[SECURITY] Fedora 26 Update: chromium-63.0.3239.108-1.fc26", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15386", "CVE-2017-15387", "CVE-2017-15388", "CVE-2017-15389", "CVE-2017-15390", "CVE-2017-15391", "CVE-2017-15392", "CVE-2017-15393", "CVE-2017-15394", "CVE-2017-15395", "CVE-2017-15398", "CVE-2017-15399", "CVE-2017-15407", "CVE-2017-15408", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15413", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15417", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15420", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426", "CVE-2017-15427", "CVE-2017-15429", "CVE-2017-5124", "CVE-2017-5125", "CVE-2017-5126", "CVE-2017-5127", "CVE-2017-5128", "CVE-2017-5129", "CVE-2017-5130", "CVE-2017-5131", "CVE-2017-5132", "CVE-2017-5133"], "modified": "2018-01-01T22:22:45", "id": "FEDORA:EC7F86046254", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/TCX6RNONWP5H4F6S2D3GX2IVGKVND34L/", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-12-21T08:17:54", "description": "Chromium is an open-source web browser, powered by WebKit (Blink). ", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2018-03-30T13:40:00", "type": "fedora", "title": "[SECURITY] Fedora 28 Update: chromium-65.0.3325.181-1.fc28", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15396", "CVE-2017-15407", "CVE-2017-15408", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15413", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15417", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15420", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426", "CVE-2017-15427", "CVE-2018-6056", "CVE-2018-6057", "CVE-2018-6058", "CVE-2018-6059", "CVE-2018-6060", "CVE-2018-6061", "CVE-2018-6062", "CVE-2018-6063", "CVE-2018-6064", "CVE-2018-6065", "CVE-2018-6066", "CVE-2018-6067", "CVE-2018-6068", "CVE-2018-6069", "CVE-2018-6070", "CVE-2018-6071", "CVE-2018-6072", "CVE-2018-6073", "CVE-2018-6074", "CVE-2018-6075", "CVE-2018-6076", "CVE-2018-6077", "CVE-2018-6078", "CVE-2018-6079", "CVE-2018-6080", "CVE-2018-6081", "CVE-2018-6082", "CVE-2018-6083", "CVE-2018-6406"], "modified": "2018-03-30T13:40:00", "id": "FEDORA:855A9625F2AD", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/ZOWNVIEOYMNSUHRE2HFKDEWQD5CBMCB4/", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-12-21T08:17:54", "description": "Chromium is an open-source web browser, powered by WebKit (Blink). ", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2018-03-27T20:18:19", "type": "fedora", "title": "[SECURITY] Fedora 27 Update: chromium-65.0.3325.181-1.fc27", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15396", "CVE-2017-15407", "CVE-2017-15408", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15413", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15417", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15420", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426", "CVE-2017-15427", "CVE-2018-6056", "CVE-2018-6057", "CVE-2018-6058", "CVE-2018-6059", "CVE-2018-6060", "CVE-2018-6061", "CVE-2018-6062", "CVE-2018-6063", "CVE-2018-6064", "CVE-2018-6065", "CVE-2018-6066", "CVE-2018-6067", "CVE-2018-6068", "CVE-2018-6069", "CVE-2018-6070", "CVE-2018-6071", "CVE-2018-6072", "CVE-2018-6073", "CVE-2018-6074", "CVE-2018-6075", "CVE-2018-6076", "CVE-2018-6077", "CVE-2018-6078", "CVE-2018-6079", "CVE-2018-6080", "CVE-2018-6081", "CVE-2018-6082", "CVE-2018-6083", "CVE-2018-6406"], "modified": "2018-03-27T20:18:19", "id": "FEDORA:0F54C60BE23D", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/XCBSSV5ZSWY3Q4NKEKL22B4MOSHCBKVN/", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "gentoo": [{"lastseen": "2022-01-17T19:04:41", "description": "### Background\n\nChromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web. \n\nGoogle Chrome is one fast, simple, and secure browser for all your devices \n\n### Description\n\nMultiple vulnerabilities have been discovered in Chromium and Google Chrome. Please review the CVE identifiers referenced below for details. \n\n### Impact\n\nA remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, bypass content security controls, or conduct URL spoofing. \n\n### Workaround\n\nThere are no known workarounds at this time.\n\n### Resolution\n\nAll Chromium users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose\n \">=www-client/chromium-63.0.3239.108\"\n \n\nAll Google Chrome users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose\n \">=www-client/google-chrome-63.0.3239.108\"", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2018-01-07T00:00:00", "type": "gentoo", "title": "Chromium, Google Chrome: Multiple vulnerabilities ", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15407", "CVE-2017-15408", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15413", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15417", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15420", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426", "CVE-2017-15427", "CVE-2017-15429"], "modified": "2018-01-07T00:00:00", "id": "GLSA-201801-03", "href": "https://security.gentoo.org/glsa/201801-03", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "chrome": [{"lastseen": "2021-12-30T22:33:05", "description": "The Chrome team is delighted to announce the promotion of Chrome 63 to the stable channel for Windows, Mac and Linux. This will roll out over the coming days/weeks.\n\n\n\n\n\nChrome 63.0.3239.84 contains a number of fixes and improvements -- a list of changes is available in the[ log](<https://chromium.googlesource.com/chromium/src/+log/62.0.3202.94..63.0.3239.84?pretty=fuller&n=10000>). Watch out for upcoming[ Chrome](<https://chrome.blogspot.com/>) and[ Chromium](<https://blog.chromium.org/>) blog posts about new features and big efforts delivered in 63.\n\n** \n** \n\n\n**Security Fixes and Rewards**\n\nNote: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven&#x27;t yet fixed.\n\n** \n** \n\n\nThis update includes [37](<https://bugs.chromium.org/p/chromium/issues/list?can=1&q=type%3Abug-security+os%3DAndroid%2Cios%2Clinux%2Cmac%2Cwindows%2Call+label%3ARelease-0-M63>) security fixes. Below, we highlight fixes that were contributed by external researchers. Please see the [Chrome Security Page](<http://sites.google.com/a/chromium.org/dev/Home/chromium-security>) for more information.\n\n** \n** \n\n\n[$10500][[778505](<https://crbug.com/778505>)] Critical CVE-2017-15407: Out of bounds write in QUIC. Reported by Ned Williamson on 2017-10-26\n\n[$6337][[762374](<https://crbug.com/762374>)] High CVE-2017-15408: Heap buffer overflow in PDFium. Reported by Ke Liu of Tencent's Xuanwu LAB on 2017-09-06\n\n[$5000][[763972](<https://crbug.com/763972>)] High CVE-2017-15409: Out of bounds write in Skia. Reported by Anonymous on 2017-09-11\n\n[$5000][[765921](<https://crbug.com/765921>)] High CVE-2017-15410: Use after free in PDFium. Reported by Lu\u1eadt Nguy\u1ec5n (@l4wio) of KeenLab, Tencent on 2017-09-16\n\n[$5000][[770148](<https://crbug.com/770148>)] High CVE-2017-15411: Use after free in PDFium. Reported by Lu\u1eadt Nguy\u1ec5n (@l4wio) of KeenLab, Tencent on 2017-09-29\n\n[$3500][[727039](<https://crbug.com/727039>)] High CVE-2017-15412: Use after free in libXML. Reported by Nick Wellnhofer on 2017-05-27\n\n[$500][[766666](<https://crbug.com/766666>)] High CVE-2017-15413: Type confusion in WebAssembly. Reported by Gaurav Dewan(@007gauravdewan) of Adobe Systems India Pvt. Ltd. on 2017-09-19\n\n[$3337][[765512](<https://crbug.com/765512>)] Medium CVE-2017-15415: Pointer information disclosure in IPC call. Reported by Viktor Brange of Microsoft Offensive Security Research Team on 2017-09-15\n\n[$2500][[779314](<https://crbug.com/779314>)] Medium CVE-2017-15416: Out of bounds read in Blink. Reported by Ned Williamson on 2017-10-28\n\n[$2000][[699028](<https://crbug.com/699028>)] Medium CVE-2017-15417: Cross origin information disclosure in Skia . Reported by Max May on 2017-03-07\n\n[$1000][[765858](<https://crbug.com/765858>)] Medium CVE-2017-15418: Use of uninitialized value in Skia. Reported by Kushal Arvind Shah of Fortinet's FortiGuard Labs on 2017-09-15\n\n[$1000][[780312](<https://crbug.com/780312>)] Medium CVE-2017-15419: Cross origin leak of redirect URL in Blink. Reported by Jun Kokatsu (@shhnjk) on 2017-10-31\n\n[$500][[777419](<https://crbug.com/777419>)] Medium CVE-2017-15420: URL spoofing in Omnibox. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-10-23\n\n[$TBD][[774382](<https://crbug.com/774382>)] Medium CVE-2017-15422: Integer overflow in ICU. Reported by Yuan Deng of Ant-financial Light-Year Security Lab on 2017-10-13 \n[$500][[780484](<https://crbug.com/780484>)] Medium** **CVE-2017-15430: Unsafe navigation in Chromecast Plugin. _Reported by jinmo123 on 11/1/2017_\n\n[$500][[778101](<https://crbug.com/778101>)] Low CVE-2017-15423: Issue with SPAKE implementation in BoringSSL. Reported by Greg Hudson on 2017-10-25\n\n[$N/A][[756226](<https://crbug.com/756226>)] Low CVE-2017-15424: URL Spoof in Omnibox. Reported by Khalil Zhani on 2017-08-16\n\n[$N/A][[756456](<https://crbug.com/756456>)] Low CVE-2017-15425: URL Spoof in Omnibox. Reported by xisigr of Tencent's Xuanwu Lab on 2017-08-17\n\n[$N/A][[756735](<https://crbug.com/756735>)] Low CVE-2017-15426: URL Spoof in Omnibox. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-08-18\n\n[$N/A][[768910](<https://crbug.com/768910>)] Low CVE-2017-15427: Insufficient blocking of JavaScript in Omnibox. Reported by Junaid Farhan (fb.me/junaid.farhan.54) on 2017-09-26\n\n** \n** \n\n\nWe would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel. \n\nAs usual, our ongoing internal security work was responsible for a wide range of fixes:\n\n * [[792099](<https://crbug.com/792099>)] Various fixes from internal audits, fuzzing and other initiatives\n\nMany of our security bugs are detected using [AddressSanitizer](<http://code.google.com/p/address-sanitizer/wiki/AddressSanitizer>), [MemorySanitizer](<https://code.google.com/p/memory-sanitizer/wiki/MemorySanitizer>), [UndefinedBehaviorSanitizer](<https://www.chromium.org/developers/testing/undefinedbehaviorsanitizer>), [Control Flow Integrity](<https://sites.google.com/a/chromium.org/dev/developers/testing/control-flow-integrity>), [libFuzzer](<https://sites.google.com/a/chromium.org/dev/developers/testing/libfuzzer>), or [AFL](<http://lcamtuf.coredump.cx/afl/>). \n\n\nA list of all changes is available in the [log](<https://chromium.googlesource.com/chromium/src/+log/62.0.3202.94..63.0.3239.84?pretty=fuller&n=10000>).Interested in switching release channels?[ Find out how](<https://www.chromium.org/getting-involved/dev-channel>). If you find a new issue, please let us know by[ filing a bug](<https://crbug.com/>). The [community help forum](<https://productforums.google.com/forum/#!forum/chrome>) is also a great place to reach out for help or learn about common issues.\n\n\n\n\n\n\n\nKrishna Govind\n\nGoogle Chrome", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2017-12-06T00:00:00", "type": "chrome", "title": "Stable Channel Update for Desktop", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15407", "CVE-2017-15408", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15413", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15417", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15420", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426", "CVE-2017-15427", "CVE-2017-15430"], "modified": "2017-12-06T00:00:00", "id": "GCSA-6993857189147290065", "href": "https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "freebsd": [{"lastseen": "2022-01-19T15:51:31", "description": "\n\nGoogle Chrome Releases reports:\n\n37 security fixes in this release, including:\n\n[778505] Critical CVE-2017-15407: Out of bounds write in QUIC. Reported by\n\t Ned Williamson on 2017-10-26\n[762374] High CVE-2017-15408: Heap buffer overflow in PDFium. Reported by\n\t Ke Liu of Tencent's Xuanwu LAB on 2017-09-06\n[763972] High CVE-2017-15409: Out of bounds write in Skia. Reported by\n\t Anonymous on 2017-09-11\n[765921] High CVE-2017-15410: Use after free in PDFium. Reported by\n\t Luat Nguyen of KeenLab, Tencent on 2017-09-16\n[770148] High CVE-2017-15411: Use after free in PDFium. Reported by\n\t Luat Nguyen of KeenLab, Tencent on 2017-09-29\n[727039] High CVE-2017-15412: Use after free in libXML. Reported by\n\t Nick Wellnhofer on 2017-05-27\n[766666] High CVE-2017-15413: Type confusion in WebAssembly. Reported by\n\t Gaurav Dewan of Adobe Systems India Pvt. Ltd. on 2017-09-19\n[765512] Medium CVE-2017-15415: Pointer information disclosure in IPC call.\n\t Reported by Viktor Brange of Microsoft Offensive Security Research Team on 2017-09-15\n[779314] Medium CVE-2017-15416: Out of bounds read in Blink. Reported by\n\t Ned Williamson on 2017-10-28\n[699028] Medium CVE-2017-15417: Cross origin information disclosure in Skia.\n\t Reported by Max May on 2017-03-07\n[765858] Medium CVE-2017-15418: Use of uninitialized value in Skia. Reported by\n\t Kushal Arvind Shah of Fortinet's FortiGuard Labs on 2017-09-15\n[780312] Medium CVE-2017-15419: Cross origin leak of redirect URL in Blink.\n\t Reported by Jun Kokatsu on 2017-10-31\n[777419] Medium CVE-2017-15420: URL spoofing in Omnibox. Reported by\n\t WenXu Wu of Tencent's Xuanwu Lab on 2017-10-23\n[774382] Medium CVE-2017-15422: Integer overflow in ICU. Reported by\n\t Yuan Deng of Ant-financial Light-Year Security Lab on 2017-10-13\n[780484] Medium CVE-2017-15430: Unsafe navigation in Chromecast Plugin.\n\t Reported by jinmo123 on 2017-01-11\n[778101] Low CVE-2017-15423: Issue with SPAKE implementation in BoringSSL.\n\t Reported by Greg Hudson on 2017-10-25\n[756226] Low CVE-2017-15424: URL Spoof in Omnibox. Reported by\n\t Khalil Zhani on 2017-08-16\n[756456] Low CVE-2017-15425: URL Spoof in Omnibox. Reported by\n\t xisigr of Tencent's Xuanwu Lab on 2017-08-17\n[757735] Low CVE-2017-15426: URL Spoof in Omnibox. Reported by\n\t WenXu Wu of Tencent's Xuanwu Lab on 2017-08-18\n[768910] Low CVE-2017-15427: Insufficient blocking of Javascript in Omnibox.\n\t Reported by Junaid Farhan on 2017-09-26\n[792099] Various fixes from internal audits, fuzzing and other initiatives\n\n\n\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2017-12-06T00:00:00", "type": "freebsd", "title": "chromium -- multiple vulnerabilities", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-15407", "CVE-2017-15408", "CVE-2017-15409", "CVE-2017-15410", "CVE-2017-15411", "CVE-2017-15412", "CVE-2017-15413", "CVE-2017-15415", "CVE-2017-15416", "CVE-2017-15417", "CVE-2017-15418", "CVE-2017-15419", "CVE-2017-15420", "CVE-2017-15422", "CVE-2017-15423", "CVE-2017-15424", "CVE-2017-15425", "CVE-2017-15426", "CVE-2017-15427", "CVE-2017-15430"], "modified": "2017-12-06T00:00:00", "id": "1D951E85-FFDB-11E7-8B91-E8E0B747A45A", "href": "https://vuxml.freebsd.org/freebsd/1d951e85-ffdb-11e7-8b91-e8e0b747a45a.html", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}]}