You are here
Home > Preporuke > Sigurnosni nedostatak programskih paketa Chromium i Google Chrome

Sigurnosni nedostatak programskih paketa Chromium i Google Chrome

  • Detalji os-a: WN7
  • Važnost: IMP
  • Operativni sustavi: L
  • Kategorije: LGE

– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –
Gentoo Linux Security Advisory GLSA 202008-10
– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –
https://security.gentoo.org/
– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –

Severity: Normal
Title: Chromium, Google Chrome: Heap buffer overflow
Date: August 25, 2020
Bugs: #737942
ID: 202008-10

– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –

Synopsis
========

A vulnerablity has been found in Chromium and Google Chrome that could
allow a remote attacker to execute arbitrary code.

Background
==========

Chromium is an open-source browser project that aims to build a safer,
faster, and more stable way for all users to experience the web.

Google Chrome is one fast, simple, and secure browser for all your
devices.

Affected packages
=================

——————————————————————-
Package / Vulnerable / Unaffected
——————————————————————-
1 www-client/chromium < 84.0.4147.135 >= 84.0.4147.135
2 www-client/google-chrome
< 84.0.4147.135 >= 84.0.4147.135
——————————————————————-
2 affected packages

Description
===========

A buffer overflow has been discovered in Chromium and Google Chrome’s
SwiftShader component.

Impact
======

A remote attacker, by enticing a user to visit a specially crafted
website, could execute arbitrary code with the privileges of the
process.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All Chromium users should upgrade to the latest version:

# emerge –sync
# emerge –ask –oneshot -v “>=www-client/chromium-84.0.4147.135”

All Google Chrome users should upgrade to the latest version:

# emerge –sync
# emerge -a –oneshot -v “>=www-client/google-chrome-84.0.4147.135”

References
==========

[ 1 ] CVE-2020-6556
https://nvd.nist.gov/vuln/detail/CVE-2020-6556
[ 2 ] Upstream advisory
https://chromereleases.googleblog.com/2020/08/stable-channel-update-for-desktop_18.html

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

https://security.gentoo.org/glsa/202008-10

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users’ machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.

License
=======

Copyright 2020 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons – Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5

—–BEGIN PGP SIGNATURE—–

iNUEARYKAH0WIQSONjK3ErBA5VvN3hCxfj6E5hA8mwUCX0UJ4l8UgAAAAAAuAChp
c3N1ZXItZnByQG5vdGF0aW9ucy5vcGVucGdwLmZpZnRoaG9yc2VtYW4ubmV0OEUz
NjMyQjcxMkIwNDBFNTVCQ0RERTEwQjE3RTNFODRFNjEwM0M5QgAKCRCxfj6E5hA8
mysUAQCTGOshbB8cJNoe4KySoF9Y25lSbEq6BCiAGc6iiyfnjwD/bmGhrFM6+rQ+
n5AfSXb2wyg55KLDXxYc1+YYiBXQGwc=
=aDmU
—–END PGP SIGNATURE—–

AutorFilip Omazic
Cert idNCERT-REF-2020-08-0001-ADV
CveCERT-CVE-DUMMY
ID izvornikaCERT-ORIGID-DUMMY
ProizvodCERT-DUMMY-PRODUCT
IzvorAdobe
Top
More in Preporuke
Sigurnosni nedostaci jezgre operacijskog sustava

Otkriveni su sigurnosni nedostaci jezgre operacijskog sustava RHEL. Otkriveni nedostaci potencijalnim napadačima omogućuju izazivanje DoS stanja ili izvršavanje proizvoljnog programskog...

Close