Vulnerabilities > CVE-2018-6148 - CRLF Injection vulnerability in Google Chrome

047910
CVSS 6.5 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
HIGH
Availability impact
NONE
network
low complexity
google
CWE-93
nessus
NVD
Published: 2019-06-27
Updated: 2023-11-07

Summary

Incorrect implementation in Content Security Policy in Google Chrome prior to 67.0.3396.79 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.

Vulnerable Configurations

Part Description Count
Application
Google
3877

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Command Delimiters
    An attack of this type exploits a programs' vulnerabilities that allows an attacker's commands to be concatenated onto a legitimate command with the intent of targeting other resources such as the file system or database. The system that uses a filter or a blacklist input validation, as opposed to whitelist validation is vulnerable to an attacker who predicts delimiters (or combinations of delimiters) not present in the filter or blacklist. As with other injection attacks, the attacker uses the command delimiter payload as an entry point to tunnel through the application and activate additional attacks through SQL queries, shell commands, network scanning, and so on.
  • Web Logs Tampering
    Web Logs Tampering attacks involve an attacker injecting, deleting or otherwise tampering with the contents of web logs typically for the purposes of masking other malicious behavior. Additionally, writing malicious data to log files may target jobs, filters, reports, and other agents that process the logs in an asynchronous attack pattern. This pattern of attack is similar to "Log Injection-Tampering-Forging" except that in this case, the attack is targeting the logs of the web server and not the application.

Nessus

  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2018-759.NASL
    descriptionThis update for Chromium to version 67.0.3396.99 fixes multiple issues. Security issues fixed (bsc#1095163) : - CVE-2018-6123: Use after free in Blink - CVE-2018-6124: Type confusion in Blink - CVE-2018-6125: Overly permissive policy in WebUSB - CVE-2018-6126: Heap buffer overflow in Skia - CVE-2018-6127: Use after free in indexedDB - CVE-2018-6129: Out of bounds memory access in WebRTC - CVE-2018-6130: Out of bounds memory access in WebRTC - CVE-2018-6131: Incorrect mutability protection in WebAssembly - CVE-2018-6132: Use of uninitialized memory in WebRTC - CVE-2018-6133: URL spoof in Omnibox - CVE-2018-6134: Referrer Policy bypass in Blink - CVE-2018-6135: UI spoofing in Blink - CVE-2018-6136: Out of bounds memory access in V8 - CVE-2018-6137: Leak of visited status of page in Blink - CVE-2018-6138: Overly permissive policy in Extensions - CVE-2018-6139: Restrictions bypass in the debugger extension API - CVE-2018-6140: Restrictions bypass in the debugger extension API - CVE-2018-6141: Heap buffer overflow in Skia - CVE-2018-6142: Out of bounds memory access in V8 - CVE-2018-6143: Out of bounds memory access in V8 - CVE-2018-6144: Out of bounds memory access in PDFium - CVE-2018-6145: Incorrect escaping of MathML in Blink - CVE-2018-6147: Password fields not taking advantage of OS protections in Views - CVE-2018-6148: Incorrect handling of CSP header (boo#1096508) - CVE-2018-6149: Out of bounds write in V8 (boo#1097452) The following tracked packaging changes are included : - Require ffmpeg >= 4.0 (boo#1095545)
    last seen2020-06-05
    modified2018-07-26
    plugin id111345
    published2018-07-26
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/111345
    titleopenSUSE Security Update : Chromium (openSUSE-2018-759)
    code
    #%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from openSUSE Security Update openSUSE-2018-759.
#
# The text description of this plugin is (C) SUSE LLC.
#

include("compat.inc");

if (description)
{
  script_id(111345);
  script_version("1.6");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");

  script_cve_id("CVE-2018-6123", "CVE-2018-6124", "CVE-2018-6125", "CVE-2018-6126", "CVE-2018-6127", "CVE-2018-6128", "CVE-2018-6129", "CVE-2018-6130", "CVE-2018-6131", "CVE-2018-6132", "CVE-2018-6133", "CVE-2018-6134", "CVE-2018-6135", "CVE-2018-6136", "CVE-2018-6137", "CVE-2018-6138", "CVE-2018-6139", "CVE-2018-6140", "CVE-2018-6141", "CVE-2018-6142", "CVE-2018-6143", "CVE-2018-6144", "CVE-2018-6145", "CVE-2018-6147", "CVE-2018-6148", "CVE-2018-6149");

  script_name(english:"openSUSE Security Update : Chromium (openSUSE-2018-759)");
  script_summary(english:"Check for the openSUSE-2018-759 patch");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote openSUSE host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"This update for Chromium to version 67.0.3396.99 fixes multiple
issues.

Security issues fixed (bsc#1095163) :

  - CVE-2018-6123: Use after free in Blink

  - CVE-2018-6124: Type confusion in Blink

  - CVE-2018-6125: Overly permissive policy in WebUSB

  - CVE-2018-6126: Heap buffer overflow in Skia

  - CVE-2018-6127: Use after free in indexedDB

  - CVE-2018-6129: Out of bounds memory access in WebRTC

  - CVE-2018-6130: Out of bounds memory access in WebRTC

  - CVE-2018-6131: Incorrect mutability protection in
    WebAssembly

  - CVE-2018-6132: Use of uninitialized memory in WebRTC

  - CVE-2018-6133: URL spoof in Omnibox

  - CVE-2018-6134: Referrer Policy bypass in Blink

  - CVE-2018-6135: UI spoofing in Blink

  - CVE-2018-6136: Out of bounds memory access in V8

  - CVE-2018-6137: Leak of visited status of page in Blink

  - CVE-2018-6138: Overly permissive policy in Extensions

  - CVE-2018-6139: Restrictions bypass in the debugger
    extension API

  - CVE-2018-6140: Restrictions bypass in the debugger
    extension API

  - CVE-2018-6141: Heap buffer overflow in Skia

  - CVE-2018-6142: Out of bounds memory access in V8

  - CVE-2018-6143: Out of bounds memory access in V8

  - CVE-2018-6144: Out of bounds memory access in PDFium

  - CVE-2018-6145: Incorrect escaping of MathML in Blink

  - CVE-2018-6147: Password fields not taking advantage of
    OS protections in Views

  - CVE-2018-6148: Incorrect handling of CSP header
    (boo#1096508)

  - CVE-2018-6149: Out of bounds write in V8 (boo#1097452)

The following tracked packaging changes are included :

  - Require ffmpeg >= 4.0 (boo#1095545)"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1070421"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1093031"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1095163"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1095545"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1096508"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1097452"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected Chromium packages."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:chromedriver");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:chromedriver-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:chromium");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:chromium-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:chromium-debugsource");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:15.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:42.3");

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/01/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/07/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2018/07/26");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
if (release !~ "^(SUSE15\.0|SUSE42\.3)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "15.0 / 42.3", release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

ourarch = get_kb_item("Host/cpu");
if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
if (ourarch !~ "^(x86_64)$") audit(AUDIT_ARCH_NOT, "x86_64", ourarch);

flag = 0;

if ( rpm_check(release:"SUSE15.0", reference:"chromedriver-67.0.3396.99-lp150.2.3.3") ) flag++;
if ( rpm_check(release:"SUSE15.0", reference:"chromedriver-debuginfo-67.0.3396.99-lp150.2.3.3") ) flag++;
if ( rpm_check(release:"SUSE15.0", reference:"chromium-67.0.3396.99-lp150.2.3.3") ) flag++;
if ( rpm_check(release:"SUSE15.0", reference:"chromium-debuginfo-67.0.3396.99-lp150.2.3.3") ) flag++;
if ( rpm_check(release:"SUSE15.0", reference:"chromium-debugsource-67.0.3396.99-lp150.2.3.3") ) flag++;
if ( rpm_check(release:"SUSE42.3", reference:"chromedriver-67.0.3396.99-161.4") ) flag++;
if ( rpm_check(release:"SUSE42.3", reference:"chromedriver-debuginfo-67.0.3396.99-161.4") ) flag++;
if ( rpm_check(release:"SUSE42.3", reference:"chromium-67.0.3396.99-161.4") ) flag++;
if ( rpm_check(release:"SUSE42.3", reference:"chromium-debuginfo-67.0.3396.99-161.4") ) flag++;
if ( rpm_check(release:"SUSE42.3", reference:"chromium-debugsource-67.0.3396.99-161.4") ) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "chromedriver / chromedriver-debuginfo / chromium / etc");
}
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_4CB49A236C8911E88B33E8E0B747A45A.NASL
    descriptionGoogle Chrome Releases reports : 1 security fix contributed by external researchers : - [845961] High CVE-2018-6148: Incorrect handling of CSP header. Reported by Michal Bentkowski on 2018-05-23
    last seen2020-06-01
    modified2020-06-02
    plugin id110429
    published2018-06-11
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/110429
    titleFreeBSD : chromium -- Incorrect handling of CSP header (4cb49a23-6c89-11e8-8b33-e8e0b747a45a)
    code
    #
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from the FreeBSD VuXML database :
#
# Copyright 2003-2019 Jacques Vidrine and contributors
#
# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,
# HTML, PDF, PostScript, RTF and so forth) with or without modification,
# are permitted provided that the following conditions are met:
# 1. Redistributions of source code (VuXML) must retain the above
#    copyright notice, this list of conditions and the following
#    disclaimer as the first lines of this file unmodified.
# 2. Redistributions in compiled form (transformed to other DTDs,
#    published online in any format, converted to PDF, PostScript,
#    RTF and other formats) must reproduce the above copyright
#    notice, this list of conditions and the following disclaimer
#    in the documentation and/or other materials provided with the
#    distribution.
# 
# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS"
# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS
# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,
# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#

include("compat.inc");

if (description)
{
  script_id(110429);
  script_version("1.5");
  script_cvs_date("Date: 2019/07/03 12:01:40");

  script_cve_id("CVE-2018-6148");

  script_name(english:"FreeBSD : chromium -- Incorrect handling of CSP header (4cb49a23-6c89-11e8-8b33-e8e0b747a45a)");
  script_summary(english:"Checks for updated package in pkg_info output");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote FreeBSD host is missing a security-related update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Google Chrome Releases reports :

1 security fix contributed by external researchers :

- [845961] High CVE-2018-6148: Incorrect handling of CSP header.
Reported by Michal Bentkowski on 2018-05-23"
  );
  # https://chromereleases.googleblog.com/2018/06/stable-channel-update-for-desktop.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?4e9dbd17"
  );
  # https://vuxml.freebsd.org/freebsd/4cb49a23-6c89-11e8-8b33-e8e0b747a45a.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?68e2c24b"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:chromium");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:freebsd:freebsd");

  script_set_attribute(attribute:"vuln_publication_date", value:"2018/06/06");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/06/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2018/06/11");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"FreeBSD Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/FreeBSD/release", "Host/FreeBSD/pkg_info");

  exit(0);
}


include("audit.inc");
include("freebsd_package.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/FreeBSD/release")) audit(AUDIT_OS_NOT, "FreeBSD");
if (!get_kb_item("Host/FreeBSD/pkg_info")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;

if (pkg_test(save_report:TRUE, pkg:"chromium<67.0.3396.79")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get());
  else security_warning(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2018-687.NASL
    descriptionThis update for Opera 54.0.2952.41 fixes multiple issues. - CVE-2018-6148: Incorrect handling of CSP header (boo#1096508) This update to version 54.0.2952.41 also contains all security and bug fixes in this upstream version, including all fixes in the chromium engine.
    last seen2020-06-05
    modified2018-07-02
    plugin id110832
    published2018-07-02
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/110832
    titleopenSUSE Security Update : Opera (openSUSE-2018-687)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-4237.NASL
    descriptionSeveral vulnerabilities have been discovered in the chromium web browser. - CVE-2018-6118 Ned Williamson discovered a use-after-free issue. - CVE-2018-6120 Zhou Aiting discovered a buffer overflow issue in the pdfium library. - CVE-2018-6121 It was discovered that malicious extensions could escalate privileges. - CVE-2018-6122 A type confusion issue was discovered in the v8 JavaScript library. - CVE-2018-6123 Looben Yang discovered a use-after-free issue. - CVE-2018-6124 Guang Gong discovered a type confusion issue. - CVE-2018-6125 Yubico discovered that the WebUSB implementation was too permissive. - CVE-2018-6126 Ivan Fratric discovered a buffer overflow issue in the skia library. - CVE-2018-6127 Looben Yang discovered a use-after-free issue. - CVE-2018-6129 Natalie Silvanovich discovered an out-of-bounds read issue in WebRTC. - CVE-2018-6130 Natalie Silvanovich discovered an out-of-bounds read issue in WebRTC. - CVE-2018-6131 Natalie Silvanovich discovered an error in WebAssembly. - CVE-2018-6132 Ronald E. Crane discovered an uninitialized memory issue. - CVE-2018-6133 Khalil Zhani discovered a URL spoofing issue. - CVE-2018-6134 Jun Kokatsu discovered a way to bypass the Referrer Policy. - CVE-2018-6135 Jasper Rebane discovered a user interface spoofing issue. - CVE-2018-6136 Peter Wong discovered an out-of-bounds read issue in the v8 JavaScript library. - CVE-2018-6137 Michael Smith discovered an information leak. - CVE-2018-6138 Francois Lajeunesse-Robert discovered that the extensions policy was too permissive. - CVE-2018-6139 Rob Wu discovered a way to bypass restrictions in the debugger extension. - CVE-2018-6140 Rob Wu discovered a way to bypass restrictions in the debugger extension. - CVE-2018-6141 Yangkang discovered a buffer overflow issue in the skia library. - CVE-2018-6142 Choongwoo Han discovered an out-of-bounds read in the v8 JavaScript library. - CVE-2018-6143 Guang Gong discovered an out-of-bounds read in the v8 JavaScript library. - CVE-2018-6144 pdknsk discovered an out-of-bounds read in the pdfium library. - CVE-2018-6145 Masato Kinugawa discovered an error in the MathML implementation. - CVE-2018-6147 Michail Pishchagin discovered an error in password entry fields. - CVE-2018-6148 Michal Bentkowski discovered that the Content Security Policy header was handled incorrectly. - CVE-2018-6149 Yu Zhou and Jundong Xie discovered an out-of-bounds write issue in the v8 JavaScript library.
    last seen2020-06-01
    modified2020-06-02
    plugin id110820
    published2018-07-02
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/110820
    titleDebian DSA-4237-1 : chromium-browser - security update
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2018-09B59B0227.NASL
    descriptionUpdate to Chromium 67. Security fix for CVE-2018-6123 CVE-2018-6124 CVE-2018-6125 CVE-2018-6126 CVE-2018-6127 CVE-2018-6128 CVE-2018-6129 CVE-2018-6130 CVE-2018-6131 CVE-2018-6132 CVE-2018-6133 CVE-2018-6134 CVE-2018-6135 CVE-2018-6136 CVE-2018-6137 CVE-2018-6148 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2018-06-21
    plugin id110625
    published2018-06-21
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/110625
    titleFedora 27 : chromium (2018-09b59b0227)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2018-7C80AAEF26.NASL
    descriptionUpdate to Chromium 67. Security fix for CVE-2018-6123 CVE-2018-6124 CVE-2018-6125 CVE-2018-6126 CVE-2018-6127 CVE-2018-6128 CVE-2018-6129 CVE-2018-6130 CVE-2018-6131 CVE-2018-6132 CVE-2018-6133 CVE-2018-6134 CVE-2018-6135 CVE-2018-6136 CVE-2018-6137 CVE-2018-6148 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2019-01-03
    plugin id120558
    published2019-01-03
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/120558
    titleFedora 28 : chromium (2018-7c80aaef26)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2019-548.NASL
    descriptionThis update for Chromium to version 67.0.3396.99 fixes multiple issues. Security issues fixed (bsc#1095163) : - CVE-2018-6123: Use after free in Blink - CVE-2018-6124: Type confusion in Blink - CVE-2018-6125: Overly permissive policy in WebUSB - CVE-2018-6126: Heap buffer overflow in Skia - CVE-2018-6127: Use after free in indexedDB - CVE-2018-6129: Out of bounds memory access in WebRTC - CVE-2018-6130: Out of bounds memory access in WebRTC - CVE-2018-6131: Incorrect mutability protection in WebAssembly - CVE-2018-6132: Use of uninitialized memory in WebRTC - CVE-2018-6133: URL spoof in Omnibox - CVE-2018-6134: Referrer Policy bypass in Blink - CVE-2018-6135: UI spoofing in Blink - CVE-2018-6136: Out of bounds memory access in V8 - CVE-2018-6137: Leak of visited status of page in Blink - CVE-2018-6138: Overly permissive policy in Extensions - CVE-2018-6139: Restrictions bypass in the debugger extension API - CVE-2018-6140: Restrictions bypass in the debugger extension API - CVE-2018-6141: Heap buffer overflow in Skia - CVE-2018-6142: Out of bounds memory access in V8 - CVE-2018-6143: Out of bounds memory access in V8 - CVE-2018-6144: Out of bounds memory access in PDFium - CVE-2018-6145: Incorrect escaping of MathML in Blink - CVE-2018-6147: Password fields not taking advantage of OS protections in Views - CVE-2018-6148: Incorrect handling of CSP header (boo#1096508) - CVE-2018-6149: Out of bounds write in V8 (boo#1097452) The following tracked packaging changes are included : - Require ffmpeg >= 4.0 (boo#1095545)
    last seen2020-05-31
    modified2019-03-27
    plugin id123234
    published2019-03-27
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/123234
    titleopenSUSE Security Update : Chromium (openSUSE-2019-548)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2018-1825.NASL
    descriptionAn update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Chromium is an open source web browser, powered by WebKit (Blink). This update upgrades Chromium to version 67.0.3396.79. Security Fix(es) : * chromium-browser: Incorrect handling of CSP header (CVE-2018-6148) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
    last seen2020-05-31
    modified2018-06-12
    plugin id110468
    published2018-06-12
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/110468
    titleRHEL 6 : chromium-browser (RHSA-2018:1825)

Redhat

rpms
  • chromium-browser-0:67.0.3396.79-1.el6_9
  • chromium-browser-debuginfo-0:67.0.3396.79-1.el6_9

The Hacker News

idTHN:DF29659E5A248495936A65E622F049FC
last seen2018-06-06
modified2018-06-06
published2018-06-06
reporterMohit Kumar
sourcehttps://thehackernews.com/2018/06/google-chrome-csp.html
titleUpdate Google Chrome Immediately to Patch a High Severity Vulnerability

References