You are here
Home > Preporuke > Sigurnosni nedostaci programskog paketa chromium

Sigurnosni nedostaci programskog paketa chromium

  • Detalji os-a: WN7
  • Važnost: IMP
  • Operativni sustavi: L
  • Kategorije: LRH

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Important: chromium-browser security update
Advisory ID: RHSA-2019:0708-01
Product: Red Hat Enterprise Linux Supplementary
Advisory URL: https://access.redhat.com/errata/RHSA-2019:0708
Issue date: 2019-04-08
CVE Names: CVE-2019-5787 CVE-2019-5788 CVE-2019-5789
CVE-2019-5790 CVE-2019-5791 CVE-2019-5792
CVE-2019-5793 CVE-2019-5794 CVE-2019-5795
CVE-2019-5796 CVE-2019-5797 CVE-2019-5798
CVE-2019-5799 CVE-2019-5800 CVE-2019-5802
CVE-2019-5803
=====================================================================

1. Summary:

An update for chromium-browser is now available for Red Hat Enterprise
Linux 6 Supplementary.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Desktop Supplementary (v. 6) – i386, i686, x86_64
Red Hat Enterprise Linux HPC Node Supplementary (v. 6) – i686, x86_64
Red Hat Enterprise Linux Server Supplementary (v. 6) – i386, i686, x86_64
Red Hat Enterprise Linux Workstation Supplementary (v. 6) – i386, i686, x86_64

3. Description:

Chromium is an open-source web browser, powered by WebKit (Blink).

This update upgrades Chromium to version 73.0.3683.75.

Security Fix(es):

* chromium-browser: Use after free in Canvas (CVE-2019-5787)

* chromium-browser: Use after free in FileAPI (CVE-2019-5788)

* chromium-browser: Use after free in WebMIDI (CVE-2019-5789)

* chromium-browser: Heap buffer overflow in V8 (CVE-2019-5790)

* chromium-browser: Type confusion in V8 (CVE-2019-5791)

* chromium-browser: Integer overflow in PDFium (CVE-2019-5792)

* chromium-browser: Excessive permissions for private API in Extensions
(CVE-2019-5793)

* chromium-browser: Security UI spoofing (CVE-2019-5794)

* chromium-browser: Integer overflow in PDFium (CVE-2019-5795)

* chromium-browser: Race condition in Extensions (CVE-2019-5796)

* chromium-browser: Race condition in DOMStorage (CVE-2019-5797)

* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)

* chromium-browser: CSP bypass with blob URL (CVE-2019-5799)

* chromium-browser: CSP bypass with blob URL (CVE-2019-5800)

* chromium-browser: Security UI spoofing (CVE-2019-5802)

* chromium-browser: CSP bypass with Javascript URLs (CVE-2019-5803)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

1688189 – CVE-2019-5787 chromium-browser: Use after free in Canvas
1688190 – CVE-2019-5788 chromium-browser: Use after free in FileAPI
1688191 – CVE-2019-5789 chromium-browser: Use after free in WebMIDI
1688192 – CVE-2019-5790 chromium-browser: Heap buffer overflow in V8
1688193 – CVE-2019-5791 chromium-browser: Type confusion in V8
1688194 – CVE-2019-5792 chromium-browser: Integer overflow in PDFium
1688195 – CVE-2019-5793 chromium-browser: Excessive permissions for private API in Extensions
1688196 – CVE-2019-5794 chromium-browser: Security UI spoofing
1688197 – CVE-2019-5795 chromium-browser: Integer overflow in PDFium
1688198 – CVE-2019-5796 chromium-browser: Race condition in Extensions
1688199 – CVE-2019-5797 chromium-browser: Race condition in DOMStorage
1688200 – CVE-2019-5798 chromium-browser: Out of bounds read in Skia
1688201 – CVE-2019-5799 chromium-browser: CSP bypass with blob URL
1688202 – CVE-2019-5800 chromium-browser: CSP bypass with blob URL
1688204 – CVE-2019-5802 chromium-browser: Security UI spoofing
1688205 – CVE-2019-5803 chromium-browser: CSP bypass with Javascript URLs

6. Package List:

Red Hat Enterprise Linux Desktop Supplementary (v. 6):

i386:
chromium-browser-73.0.3683.75-1.el6_10.i686.rpm
chromium-browser-debuginfo-73.0.3683.75-1.el6_10.i686.rpm

i686:
chromium-browser-73.0.3683.75-1.el6_10.i686.rpm
chromium-browser-debuginfo-73.0.3683.75-1.el6_10.i686.rpm

x86_64:
chromium-browser-73.0.3683.75-1.el6_10.x86_64.rpm
chromium-browser-debuginfo-73.0.3683.75-1.el6_10.x86_64.rpm

Red Hat Enterprise Linux HPC Node Supplementary (v. 6):

i686:
chromium-browser-73.0.3683.75-1.el6_10.i686.rpm
chromium-browser-debuginfo-73.0.3683.75-1.el6_10.i686.rpm

x86_64:
chromium-browser-73.0.3683.75-1.el6_10.x86_64.rpm
chromium-browser-debuginfo-73.0.3683.75-1.el6_10.x86_64.rpm

Red Hat Enterprise Linux Server Supplementary (v. 6):

i386:
chromium-browser-73.0.3683.75-1.el6_10.i686.rpm
chromium-browser-debuginfo-73.0.3683.75-1.el6_10.i686.rpm

i686:
chromium-browser-73.0.3683.75-1.el6_10.i686.rpm
chromium-browser-debuginfo-73.0.3683.75-1.el6_10.i686.rpm

x86_64:
chromium-browser-73.0.3683.75-1.el6_10.x86_64.rpm
chromium-browser-debuginfo-73.0.3683.75-1.el6_10.x86_64.rpm

Red Hat Enterprise Linux Workstation Supplementary (v. 6):

i386:
chromium-browser-73.0.3683.75-1.el6_10.i686.rpm
chromium-browser-debuginfo-73.0.3683.75-1.el6_10.i686.rpm

i686:
chromium-browser-73.0.3683.75-1.el6_10.i686.rpm
chromium-browser-debuginfo-73.0.3683.75-1.el6_10.i686.rpm

x86_64:
chromium-browser-73.0.3683.75-1.el6_10.x86_64.rpm
chromium-browser-debuginfo-73.0.3683.75-1.el6_10.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2019-5787
https://access.redhat.com/security/cve/CVE-2019-5788
https://access.redhat.com/security/cve/CVE-2019-5789
https://access.redhat.com/security/cve/CVE-2019-5790
https://access.redhat.com/security/cve/CVE-2019-5791
https://access.redhat.com/security/cve/CVE-2019-5792
https://access.redhat.com/security/cve/CVE-2019-5793
https://access.redhat.com/security/cve/CVE-2019-5794
https://access.redhat.com/security/cve/CVE-2019-5795
https://access.redhat.com/security/cve/CVE-2019-5796
https://access.redhat.com/security/cve/CVE-2019-5797
https://access.redhat.com/security/cve/CVE-2019-5798
https://access.redhat.com/security/cve/CVE-2019-5799
https://access.redhat.com/security/cve/CVE-2019-5800
https://access.redhat.com/security/cve/CVE-2019-5802
https://access.redhat.com/security/cve/CVE-2019-5803
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2019 Red Hat, Inc.
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1

iQIVAwUBXKr89tzjgjWX9erEAQhGShAAgqY9HJy2Pbn0OlTsXcl3a90fUgcF4HEA
0arUR3GlzdBFAQCGOm/Vh0gbaZfKf7BWkC1s4sid9iKR691GArPfN52Ot+I2Jt0L
tdEuEYfzqpXWXBTPUMPx7igAPrz5kRt/0UNxDYyJEqPuTP6KbU1FKX//OVO7rRTn
UWmjqB1MbO0zcA+sEuuRbWP1WXX/EbgtRoNFdYg4FTlSKLd6fKsPzj9NSYS51vZE
qSxDLaLSXt2SFOBX545CutHlN35cJcgZ44+2bKf9I2GRgGkWCWVWLESdnXipJ5ae
MIHV8jhkZbSMuTb9LM2pv0Ru521Wy4BI95ZdhP6UjdWUdmGpCNb9BL40eayy9aRM
jWj1yPxYcpicDLGBMfC8vFpc0KrOjWONzhDhNC6T91PIB7FkC6LPtBc4a/ijjeC2
Cc1Nydvj7dTgBt0GKsNb0hSAVQvROfFrCkGy/Z+rW3Et/wf9Xg72U3J81mw5Uj2b
6V29kK/pacoAYbw36ycoQwpXc4R8dBWQp51MsT78r8+SR7njHX9SkOq9eAyl8Wv9
PM/LX0l+qJqdKoCtU2BOvjmic8vTS5Sk0K+ZbbEw74gYgzWzpIFrD42V1wSb8VCm
FBcjI+dvFlvlbQSXyo4m8bHWYgX/vW+DZ7tzBtCFA5CZiSZ9mFeDJr1YeuPGTXh4
dAAGR4+78/A=
=ajj1
—–END PGP SIGNATURE—–


RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

AutorToni Vugdelija
Cert idNCERT-REF-2019-04-0001-ADV
CveCERT-CVE-DUMMY
ID izvornikaCERT-ORIGID-DUMMY
ProizvodCERT-DUMMY-PRODUCT
IzvorAdobe
Top
More in Preporuke
Sigurnosni nedostatak programskog paketa evolution

Otkriven je sigurnosni nedostatak u programskom paketu evolution za operacijski sustav Fedora. Otkriveni nedostatak potencijalnim napadačima omogućuje zaobilaženje sigurnosnih ograničenja....

Close