Vulnerabilities > CVE-2020-6392 - Cross-site Scripting vulnerability in multiple products

047910
CVSS 4.3 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
LOW
Availability impact
NONE

Summary

Insufficient policy enforcement in extensions in Google Chrome prior to 80.0.3987.87 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension.

Vulnerable Configurations

Part Description Count
Application
Google
5601
Application
Opensuse
1
Application
Suse
1
OS
Fedoraproject
2
OS
Debian
2
OS
Suse
1
OS
Redhat
3

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Cross Site Scripting through Log Files
    An attacker may leverage a system weakness where logs are susceptible to log injection to insert scripts into the system's logs. If these logs are later viewed by an administrator through a thin administrative interface and the log data is not properly HTML encoded before being written to the page, the attackers' scripts stored in the log will be executed in the administrative interface with potentially serious consequences. This attack pattern is really a combination of two other attack patterns: log injection and stored cross site scripting.
  • Embedding Scripts in Non-Script Elements
    This attack is a form of Cross-Site Scripting (XSS) where malicious scripts are embedded in elements that are not expected to host scripts such as image tags (<img>), comments in XML documents (< !-CDATA->), etc. These tags may not be subject to the same input validation, output validation, and other content filtering and checking routines, so this can create an opportunity for an attacker to tunnel through the application's elements and launch a XSS attack through other elements. As with all remote attacks, it is important to differentiate the ability to launch an attack (such as probing an internal network for unpatched servers) and the ability of the remote attacker to collect and interpret the output of said attack.
  • Embedding Scripts within Scripts
    An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute scripts. The attacker leverages this capability to execute scripts to execute his/her own script by embedding it within other scripts that the target software is likely to execute. The attacker must have the ability to inject script into script that is likely to be executed. If this is done, then the attacker can potentially launch a variety of probes and attacks against the web server's local environment, in many cases the so-called DMZ, back end resources the web server can communicate with, and other hosts. With the proliferation of intermediaries, such as Web App Firewalls, network devices, and even printers having JVMs and Web servers, there are many locales where an attacker can inject malicious scripts. Since this attack pattern defines scripts within scripts, there are likely privileges to execute said attack on the host. Of course, these attacks are not solely limited to the server side, client side scripts like Ajax and client side JavaScript can contain malicious scripts as well. In general all that is required is for there to be sufficient privileges to execute a script, but not protected against writing.
  • Cross-Site Scripting in Error Pages
    An attacker distributes a link (or possibly some other query structure) with a request to a third party web server that is malformed and also contains a block of exploit code in order to have the exploit become live code in the resulting error page. When the third party web server receives the crafted request and notes the error it then creates an error message that echoes the malformed message, including the exploit. Doing this converts the exploit portion of the message into to valid language elements that are executed by the viewing browser. When a victim executes the query provided by the attacker the infected error message error message is returned including the exploit code which then runs in the victim's browser. XSS can result in execution of code as well as data leakage (e.g. session cookies can be sent to the attacker). This type of attack is especially dangerous since the exploit appears to come from the third party web server, who the victim may trust and hence be more vulnerable to deception.
  • Cross-Site Scripting Using Alternate Syntax
    The attacker uses alternate forms of keywords or commands that result in the same action as the primary form but which may not be caught by filters. For example, many keywords are processed in a case insensitive manner. If the site's web filtering algorithm does not convert all tags into a consistent case before the comparison with forbidden keywords it is possible to bypass filters (e.g., incomplete black lists) by using an alternate case structure. For example, the "script" tag using the alternate forms of "Script" or "ScRiPt" may bypass filters where "script" is the only form tested. Other variants using different syntax representations are also possible as well as using pollution meta-characters or entities that are eventually ignored by the rendering engine. The attack can result in the execution of otherwise prohibited functionality.

Nessus

  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2020-39E0B8BD14.NASL
    descriptionUpdate to 80.0.3987.149. Upstream says it fixes
    last seen2020-05-31
    modified2020-03-30
    plugin id134990
    published2020-03-30
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/134990
    titleFedora 30 : chromium (2020-39e0b8bd14)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Fedora Security Advisory FEDORA-2020-39e0b8bd14.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(134990);
      script_version("1.3");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/29");
    
      script_cve_id("CVE-2019-20446", "CVE-2019-20503", "CVE-2020-10531", "CVE-2020-6378", "CVE-2020-6379", "CVE-2020-6380", "CVE-2020-6381", "CVE-2020-6382", "CVE-2020-6383", "CVE-2020-6384", "CVE-2020-6385", "CVE-2020-6386", "CVE-2020-6387", "CVE-2020-6388", "CVE-2020-6389", "CVE-2020-6390", "CVE-2020-6391", "CVE-2020-6392", "CVE-2020-6393", "CVE-2020-6394", "CVE-2020-6395", "CVE-2020-6396", "CVE-2020-6397", "CVE-2020-6398", "CVE-2020-6399", "CVE-2020-6400", "CVE-2020-6401", "CVE-2020-6402", "CVE-2020-6403", "CVE-2020-6404", "CVE-2020-6405", "CVE-2020-6406", "CVE-2020-6407", "CVE-2020-6408", "CVE-2020-6409", "CVE-2020-6410", "CVE-2020-6411", "CVE-2020-6412", "CVE-2020-6413", "CVE-2020-6414", "CVE-2020-6415", "CVE-2020-6416", "CVE-2020-6417", "CVE-2020-6418", "CVE-2020-6420", "CVE-2020-6422", "CVE-2020-6424", "CVE-2020-6425", "CVE-2020-6426", "CVE-2020-6427", "CVE-2020-6428", "CVE-2020-6429", "CVE-2020-6449");
      script_xref(name:"FEDORA", value:"2020-39e0b8bd14");
    
      script_name(english:"Fedora 30 : chromium (2020-39e0b8bd14)");
      script_summary(english:"Checks rpm output for the updated package.");
    
      script_set_attribute(
        attribute:"synopsis",
        value:"The remote Fedora host is missing a security update."
      );
      script_set_attribute(
        attribute:"description",
        value:
    "Update to 80.0.3987.149. Upstream says it fixes '13' security issues,
    but only lists these CVEs :
    
      - CVE-2020-6422: Use after free in WebGL
    
      - CVE-2020-6424: Use after free in media
    
      - CVE-2020-6425: Insufficient policy enforcement in
        extensions. 
    
      - CVE-2020-6426: Inappropriate implementation in V8
    
      - CVE-2020-6427: Use after free in audio
    
      - CVE-2020-6428: Use after free in audio
    
      - CVE-2020-6429: Use after free in audio.
    
      - CVE-2019-20503: Out of bounds read in usersctplib.
    
      - CVE-2020-6449: Use after free in audio
    
    ----
    
    Update to 80.0.3987.132. Lots of security fixes here. VAAPI re-enabled
    by default except on NVIDIA.
    
    List of CVEs fixed (since last update) :
    
      - CVE-2019-20446
    
      - CVE-2020-6381 
    
      - CVE-2020-6382 
    
      - CVE-2020-6383 
    
      - CVE-2020-6384
    
      - CVE-2020-6385 
    
      - CVE-2020-6386
    
      - CVE-2020-6387 
    
      - CVE-2020-6388
    
      - CVE-2020-6389
    
      - CVE-2020-6390 
    
      - CVE-2020-6391
    
      - CVE-2020-6392 
    
      - CVE-2020-6393
    
      - CVE-2020-6394
    
      - CVE-2020-6395
    
      - CVE-2020-6396 
    
      - CVE-2020-6397 
    
      - CVE-2020-6398
    
      - CVE-2020-6399 
    
      - CVE-2020-6400 
    
      - CVE-2020-6401 
    
      - CVE-2020-6402 
    
      - CVE-2020-6403 
    
      - CVE-2020-6404 
    
      - CVE-2020-6405 
    
      - CVE-2020-6406 
    
      - CVE-2020-6407
    
      - CVE-2020-6408 
    
      - CVE-2020-6409 
    
      - CVE-2020-6410 
    
      - CVE-2020-6411 
    
      - CVE-2020-6412 
    
      - CVE-2020-6413 
    
      - CVE-2020-6414 
    
      - CVE-2020-6415 
    
      - CVE-2020-6416 
    
      - CVE-2020-6417
    
      - CVE-2020-6418
    
      - CVE-2020-6420 
    
    ----
    
    Update to 79.0.3945.130. Fixes the following security issues :
    
      - CVE-2020-6378
    
      - CVE-2020-6379
    
      - CVE-2020-6380
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Fedora update system website.
    Tenable has attempted to automatically clean and format it as much as
    possible without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bodhi.fedoraproject.org/updates/FEDORA-2020-39e0b8bd14"
      );
      script_set_attribute(
        attribute:"solution",
        value:"Update the affected chromium package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Google Chrome 80 JSCreate side-effect type confusion exploit');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:chromium");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:30");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2020/02/02");
      script_set_attribute(attribute:"patch_publication_date", value:"2020/03/27");
      script_set_attribute(attribute:"plugin_publication_date", value:"2020/03/30");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Fedora Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
    os_ver = pregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
    os_ver = os_ver[1];
    if (! preg(pattern:"^30([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 30", "Fedora " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"FC30", reference:"chromium-80.0.3987.149-1.fc30", allowmaj:TRUE)) flag++;
    
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "chromium");
    }
    
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-202003-08.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-202003-08 (Chromium, Google Chrome: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Chromium and Google Chrome. Please review the referenced CVE identifiers and Google Chrome Releases for details. Impact : A remote attacker could execute arbitrary code, escalate privileges, obtain sensitive information, spoof an URL or cause a Denial of Service condition. Workaround : There is no known workaround at this time.
    last seen2020-03-19
    modified2020-03-13
    plugin id134475
    published2020-03-13
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/134475
    titleGLSA-202003-08 : Chromium, Google Chrome: Multiple vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Gentoo Linux Security Advisory GLSA 202003-08.
    #
    # The advisory text is Copyright (C) 2001-2020 Gentoo Foundation, Inc.
    # and licensed under the Creative Commons - Attribution / Share Alike 
    # license. See http://creativecommons.org/licenses/by-sa/3.0/
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(134475);
      script_version("1.2");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/18");
    
      script_cve_id("CVE-2019-13723", "CVE-2019-13724", "CVE-2019-13725", "CVE-2019-13726", "CVE-2019-13727", "CVE-2019-13728", "CVE-2019-13729", "CVE-2019-13730", "CVE-2019-13732", "CVE-2019-13734", "CVE-2019-13735", "CVE-2019-13736", "CVE-2019-13737", "CVE-2019-13738", "CVE-2019-13739", "CVE-2019-13740", "CVE-2019-13741", "CVE-2019-13742", "CVE-2019-13743", "CVE-2019-13744", "CVE-2019-13745", "CVE-2019-13746", "CVE-2019-13747", "CVE-2019-13748", "CVE-2019-13749", "CVE-2019-13750", "CVE-2019-13751", "CVE-2019-13752", "CVE-2019-13753", "CVE-2019-13754", "CVE-2019-13755", "CVE-2019-13756", "CVE-2019-13757", "CVE-2019-13758", "CVE-2019-13759", "CVE-2019-13761", "CVE-2019-13762", "CVE-2019-13763", "CVE-2019-13764", "CVE-2019-13767", "CVE-2020-6377", "CVE-2020-6378", "CVE-2020-6379", "CVE-2020-6380", "CVE-2020-6381", "CVE-2020-6382", "CVE-2020-6385", "CVE-2020-6387", "CVE-2020-6388", "CVE-2020-6389", "CVE-2020-6390", "CVE-2020-6391", "CVE-2020-6392", "CVE-2020-6393", "CVE-2020-6394", "CVE-2020-6395", "CVE-2020-6396", "CVE-2020-6397", "CVE-2020-6398", "CVE-2020-6399", "CVE-2020-6400", "CVE-2020-6401", "CVE-2020-6402", "CVE-2020-6403", "CVE-2020-6404", "CVE-2020-6406", "CVE-2020-6407", "CVE-2020-6408", "CVE-2020-6409", "CVE-2020-6410", "CVE-2020-6411", "CVE-2020-6412", "CVE-2020-6413", "CVE-2020-6414", "CVE-2020-6415", "CVE-2020-6416", "CVE-2020-6418", "CVE-2020-6420");
      script_xref(name:"GLSA", value:"202003-08");
    
      script_name(english:"GLSA-202003-08 : Chromium, Google Chrome: Multiple vulnerabilities");
      script_summary(english:"Checks for updated package(s) in /var/db/pkg");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Gentoo host is missing one or more security-related
    patches."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The remote host is affected by the vulnerability described in GLSA-202003-08
    (Chromium, Google Chrome: Multiple vulnerabilities)
    
        Multiple vulnerabilities have been discovered in Chromium and Google
          Chrome. Please review the referenced CVE identifiers and Google Chrome
          Releases for details.
      
    Impact :
    
        A remote attacker could execute arbitrary code, escalate privileges,
          obtain sensitive information, spoof an URL or cause a Denial of Service
          condition.
      
    Workaround :
    
        There is no known workaround at this time."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security.gentoo.org/glsa/202003-08"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "All Chromium users should upgrade to the latest version:
          # emerge --sync
          # emerge --ask --oneshot --verbose
          '>=www-client/chromium-80.0.3987.132'
        All Google Chrome users should upgrade to the latest version:
          # emerge --sync
          # emerge --ask --oneshot --verbose
          '>=www-client/google-chrome-80.0.3987.132'"
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Google Chrome 80 JSCreate side-effect type confusion exploit');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:chromium");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:google-chrome");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2019/11/25");
      script_set_attribute(attribute:"patch_publication_date", value:"2020/03/13");
      script_set_attribute(attribute:"plugin_publication_date", value:"2020/03/13");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Gentoo Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("qpkg.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
    if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (qpkg_check(package:"www-client/chromium", unaffected:make_list("ge 80.0.3987.132"), vulnerable:make_list("lt 80.0.3987.132"))) flag++;
    if (qpkg_check(package:"www-client/google-chrome", unaffected:make_list("ge 80.0.3987.132"), vulnerable:make_list("lt 80.0.3987.132"))) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = qpkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "Chromium / Google Chrome");
    }
    
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-4638.NASL
    descriptionSeveral vulnerabilities have been discovered in the chromium web browser. - CVE-2019-19880 Richard Lorenz discovered an issue in the sqlite library. - CVE-2019-19923 Richard Lorenz discovered an out-of-bounds read issue in the sqlite library. - CVE-2019-19925 Richard Lorenz discovered an issue in the sqlite library. - CVE-2019-19926 Richard Lorenz discovered an implementation error in the sqlite library. - CVE-2020-6381 UK
    last seen2020-03-17
    modified2020-03-12
    plugin id134433
    published2020-03-12
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/134433
    titleDebian DSA-4638-1 : chromium - security update
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Debian Security Advisory DSA-4638. The text 
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(134433);
      script_version("1.2");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/16");
    
      script_cve_id("CVE-2019-19880", "CVE-2019-19923", "CVE-2019-19925", "CVE-2019-19926", "CVE-2020-6381", "CVE-2020-6382", "CVE-2020-6383", "CVE-2020-6384", "CVE-2020-6385", "CVE-2020-6386", "CVE-2020-6387", "CVE-2020-6388", "CVE-2020-6389", "CVE-2020-6390", "CVE-2020-6391", "CVE-2020-6392", "CVE-2020-6393", "CVE-2020-6394", "CVE-2020-6395", "CVE-2020-6396", "CVE-2020-6397", "CVE-2020-6398", "CVE-2020-6399", "CVE-2020-6400", "CVE-2020-6401", "CVE-2020-6402", "CVE-2020-6403", "CVE-2020-6404", "CVE-2020-6405", "CVE-2020-6406", "CVE-2020-6407", "CVE-2020-6408", "CVE-2020-6409", "CVE-2020-6410", "CVE-2020-6411", "CVE-2020-6412", "CVE-2020-6413", "CVE-2020-6414", "CVE-2020-6415", "CVE-2020-6416", "CVE-2020-6418", "CVE-2020-6420");
      script_xref(name:"DSA", value:"4638");
    
      script_name(english:"Debian DSA-4638-1 : chromium - security update");
      script_summary(english:"Checks dpkg output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Debian host is missing a security-related update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Several vulnerabilities have been discovered in the chromium web
    browser.
    
      - CVE-2019-19880
        Richard Lorenz discovered an issue in the sqlite
        library.
    
      - CVE-2019-19923
        Richard Lorenz discovered an out-of-bounds read issue in
        the sqlite library.
    
      - CVE-2019-19925
        Richard Lorenz discovered an issue in the sqlite
        library.
    
      - CVE-2019-19926
        Richard Lorenz discovered an implementation error in the
        sqlite library.
    
      - CVE-2020-6381
        UK's National Cyber Security Centre discovered an
        integer overflow issue in the v8 JavaScript library.
    
      - CVE-2020-6382
        Soyeon Park and Wen Xu discovered a type error in the v8
        JavaScript library.
    
      - CVE-2020-6383
        Sergei Glazunov discovered a type error in the v8
        JavaScript library.
    
      - CVE-2020-6384
        David Manoucheri discovered a use-after-free issue in
        WebAudio.
    
      - CVE-2020-6385
        Sergei Glazunov discovered a policy enforcement error.
    
      - CVE-2020-6386
        Zhe Jin discovered a use-after-free issue in speech
        processing.
    
      - CVE-2020-6387
        Natalie Silvanovich discovered an out-of-bounds write
        error in the WebRTC implementation.
    
      - CVE-2020-6388
        Sergei Glazunov discovered an out-of-bounds read error
        in the WebRTC implementation.
    
      - CVE-2020-6389
        Natalie Silvanovich discovered an out-of-bounds write
        error in the WebRTC implementation.
    
      - CVE-2020-6390
        Sergei Glazunov discovered an out-of-bounds read error.
    
      - CVE-2020-6391
        Michal Bentkowski discoverd that untrusted input was
        insufficiently validated.
    
      - CVE-2020-6392
        The Microsoft Edge Team discovered a policy enforcement
        error.
    
      - CVE-2020-6393
        Mark Amery discovered a policy enforcement error.
    
      - CVE-2020-6394
        Phil Freo discovered a policy enforcement error.
    
      - CVE-2020-6395
        Pierre Langlois discovered an out-of-bounds read error
        in the v8 JavaScript library.
    
      - CVE-2020-6396
        William Luc Ritchie discovered an error in the skia
        library.
    
      - CVE-2020-6397
        Khalil Zhani discovered a user interface error.
    
      - CVE-2020-6398
        pdknsk discovered an uninitialized variable in the
        pdfium library.
    
      - CVE-2020-6399
        Luan Herrera discovered a policy enforcement error.
    
      - CVE-2020-6400
        Takashi Yoneuchi discovered an error in Cross-Origin
        Resource Sharing.
    
      - CVE-2020-6401
        Tzachy Horesh discovered that user input was
        insufficiently validated.
    
      - CVE-2020-6402
        Vladimir Metnew discovered a policy enforcement error.
    
      - CVE-2020-6403
        Khalil Zhani discovered a user interface error.
    
      - CVE-2020-6404
        kanchi discovered an error in Blink/Webkit.
    
      - CVE-2020-6405
        Yongheng Chen and Rui Zhong discovered an out-of-bounds
        read issue in the sqlite library.
    
      - CVE-2020-6406
        Sergei Glazunov discovered a use-after-free issue.
    
      - CVE-2020-6407
        Sergei Glazunov discovered an out-of-bounds read error.
    
      - CVE-2020-6408
        Zhong Zhaochen discovered a policy enforcement error in
        Cross-Origin Resource Sharing.
    
      - CVE-2020-6409
        Divagar S and Bharathi V discovered an error in the
        omnibox implementation.
    
      - CVE-2020-6410
        evil1m0 discovered a policy enforcement error.
    
      - CVE-2020-6411
        Khalil Zhani discovered that user input was
        insufficiently validated.
    
      - CVE-2020-6412
        Zihan Zheng discovered that user input was
        insufficiently validated.
    
      - CVE-2020-6413
        Michal Bentkowski discovered an error in Blink/Webkit.
    
      - CVE-2020-6414
        Lijo A.T discovered a policy safe browsing policy
        enforcement error.
    
      - CVE-2020-6415
        Avihay Cohen discovered an implementation error in the
        v8 JavaScript library.
    
      - CVE-2020-6416
        Woojin Oh discovered that untrusted input was
        insufficiently validated.
    
      - CVE-2020-6418
        Clement Lecigne discovered a type error in the v8
        JavaScript library.
    
      - CVE-2020-6420
        Taras Uzdenov discovered a policy enforcement error."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2019-19880"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2019-19923"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2019-19925"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2019-19926"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2020-6381"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2020-6382"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2020-6383"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2020-6384"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2020-6385"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2020-6386"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2020-6387"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2020-6388"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2020-6389"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2020-6390"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2020-6391"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2020-6392"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2020-6393"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2020-6394"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2020-6395"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2020-6396"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2020-6397"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2020-6398"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2020-6399"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2020-6400"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2020-6401"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2020-6402"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2020-6403"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2020-6404"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2020-6405"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2020-6406"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2020-6407"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2020-6408"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2020-6409"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2020-6410"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2020-6411"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2020-6412"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2020-6413"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2020-6414"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2020-6415"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2020-6416"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2020-6418"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2020-6420"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/source-package/chromium"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://packages.debian.org/source/buster/chromium"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.debian.org/security/2020/dsa-4638"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "Upgrade the chromium packages.
    
    For the oldstable distribution (stretch), security support for
    chromium has been discontinued.
    
    For the stable distribution (buster), these problems have been fixed
    in version 80.0.3987.132-1~deb10u1."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Google Chrome 80 JSCreate side-effect type confusion exploit');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:chromium");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:10.0");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2019/12/18");
      script_set_attribute(attribute:"patch_publication_date", value:"2020/03/10");
      script_set_attribute(attribute:"plugin_publication_date", value:"2020/03/12");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"10.0", prefix:"chromium", reference:"80.0.3987.132-1~deb10u1")) flag++;
    if (deb_check(release:"10.0", prefix:"chromium-common", reference:"80.0.3987.132-1~deb10u1")) flag++;
    if (deb_check(release:"10.0", prefix:"chromium-driver", reference:"80.0.3987.132-1~deb10u1")) flag++;
    if (deb_check(release:"10.0", prefix:"chromium-l10n", reference:"80.0.3987.132-1~deb10u1")) flag++;
    if (deb_check(release:"10.0", prefix:"chromium-sandbox", reference:"80.0.3987.132-1~deb10u1")) flag++;
    if (deb_check(release:"10.0", prefix:"chromium-shell", reference:"80.0.3987.132-1~deb10u1")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyWindows
    NASL idGOOGLE_CHROME_80_0_3987_87.NASL
    descriptionThe version of Google Chrome installed on the remote Windows host is prior to 80.0.3987.87. It is, therefore, affected by multiple vulnerabilities as referenced in the 2020_02_stable-channel-update-for-desktop advisory. Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-04-30
    modified2020-02-04
    plugin id133465
    published2020-02-04
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/133465
    titleGoogle Chrome < 80.0.3987.87 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include('compat.inc');
    
    if (description)
    {
      script_id(133465);
      script_version("1.6");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/04/24");
    
      script_cve_id(
        "CVE-2019-18197",
        "CVE-2019-19923",
        "CVE-2019-19926",
        "CVE-2020-6381",
        "CVE-2020-6382",
        "CVE-2020-6385",
        "CVE-2020-6387",
        "CVE-2020-6388",
        "CVE-2020-6389",
        "CVE-2020-6390",
        "CVE-2020-6391",
        "CVE-2020-6392",
        "CVE-2020-6393",
        "CVE-2020-6394",
        "CVE-2020-6395",
        "CVE-2020-6396",
        "CVE-2020-6397",
        "CVE-2020-6398",
        "CVE-2020-6399",
        "CVE-2020-6400",
        "CVE-2020-6401",
        "CVE-2020-6402",
        "CVE-2020-6403",
        "CVE-2020-6404",
        "CVE-2020-6405",
        "CVE-2020-6406",
        "CVE-2020-6408",
        "CVE-2020-6409",
        "CVE-2020-6410",
        "CVE-2020-6411",
        "CVE-2020-6412",
        "CVE-2020-6413",
        "CVE-2020-6414",
        "CVE-2020-6415",
        "CVE-2020-6416",
        "CVE-2020-6417"
      );
    
      script_name(english:"Google Chrome < 80.0.3987.87 Multiple Vulnerabilities");
    
      script_set_attribute(attribute:"synopsis", value:
    "A web browser installed on the remote Windows host is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The version of Google Chrome installed on the remote Windows host is prior to 80.0.3987.87. It is, therefore, affected
    by multiple vulnerabilities as referenced in the 2020_02_stable-channel-update-for-desktop advisory. Note that Nessus
    has not tested for this issue but has instead relied only on the application's self-reported version number.");
      # https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?fc6a32b5");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1034394");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1031909");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1020745");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1042700");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1035399");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1042535");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1042879");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1042933");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1045874");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1017871");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1030411");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1035058");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1014371");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1022855");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1035271");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1027408");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1032090");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1039869");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1038036");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1017707");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1029375");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1006012");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1024256");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1042145");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1042254");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1042578");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1026546");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1037889");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/881675");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/929711");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/968505");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1005713");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1021855");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1029576");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1031895");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1033824");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1048330");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to Google Chrome version 80.0.3987.87 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-6406");
    
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2019/10/18");
      script_set_attribute(attribute:"patch_publication_date", value:"2020/02/04");
      script_set_attribute(attribute:"plugin_publication_date", value:"2020/02/04");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:google:chrome");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows");
    
      script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("google_chrome_installed.nasl");
      script_require_keys("SMB/Google_Chrome/Installed");
    
      exit(0);
    }
    include('google_chrome_version.inc');
    
    get_kb_item_or_exit('SMB/Google_Chrome/Installed');
    installs = get_kb_list('SMB/Google_Chrome/*');
    
    google_chrome_check_version(installs:installs, fix:'80.0.3987.87', severity:SECURITY_HOLE, xss:FALSE, xsrf:FALSE);
    
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_GOOGLE_CHROME_80_0_3987_87.NASL
    descriptionThe version of Google Chrome installed on the remote macOS host is prior to 80.0.3987.87. It is, therefore, affected by multiple vulnerabilities as referenced in the 2020_02_stable-channel-update-for-desktop advisory. Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-04-30
    modified2020-02-04
    plugin id133464
    published2020-02-04
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/133464
    titleGoogle Chrome < 80.0.3987.87 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include('compat.inc');
    
    if (description)
    {
      script_id(133464);
      script_version("1.6");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/04/24");
    
      script_cve_id(
        "CVE-2019-18197",
        "CVE-2019-19923",
        "CVE-2019-19926",
        "CVE-2020-6381",
        "CVE-2020-6382",
        "CVE-2020-6385",
        "CVE-2020-6387",
        "CVE-2020-6388",
        "CVE-2020-6389",
        "CVE-2020-6390",
        "CVE-2020-6391",
        "CVE-2020-6392",
        "CVE-2020-6393",
        "CVE-2020-6394",
        "CVE-2020-6395",
        "CVE-2020-6396",
        "CVE-2020-6397",
        "CVE-2020-6398",
        "CVE-2020-6399",
        "CVE-2020-6400",
        "CVE-2020-6401",
        "CVE-2020-6402",
        "CVE-2020-6403",
        "CVE-2020-6404",
        "CVE-2020-6405",
        "CVE-2020-6406",
        "CVE-2020-6408",
        "CVE-2020-6409",
        "CVE-2020-6410",
        "CVE-2020-6411",
        "CVE-2020-6412",
        "CVE-2020-6413",
        "CVE-2020-6414",
        "CVE-2020-6415",
        "CVE-2020-6416",
        "CVE-2020-6417"
      );
    
      script_name(english:"Google Chrome < 80.0.3987.87 Multiple Vulnerabilities");
    
      script_set_attribute(attribute:"synopsis", value:
    "A web browser installed on the remote macOS host is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The version of Google Chrome installed on the remote macOS host is prior to 80.0.3987.87. It is, therefore, affected by
    multiple vulnerabilities as referenced in the 2020_02_stable-channel-update-for-desktop advisory. Note that Nessus has
    not tested for this issue but has instead relied only on the application's self-reported version number.");
      # https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?fc6a32b5");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1034394");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1031909");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1020745");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1042700");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1035399");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1042535");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1042879");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1042933");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1045874");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1017871");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1030411");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1035058");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1014371");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1022855");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1035271");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1027408");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1032090");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1039869");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1038036");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1017707");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1029375");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1006012");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1024256");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1042145");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1042254");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1042578");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1026546");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1037889");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/881675");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/929711");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/968505");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1005713");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1021855");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1029576");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1031895");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1033824");
      script_set_attribute(attribute:"see_also", value:"https://crbug.com/1048330");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to Google Chrome version 80.0.3987.87 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-6406");
    
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2019/10/18");
      script_set_attribute(attribute:"patch_publication_date", value:"2020/02/04");
      script_set_attribute(attribute:"plugin_publication_date", value:"2020/02/04");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:google:chrome");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"MacOS X Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("macosx_google_chrome_installed.nbin");
      script_require_keys("MacOSX/Google Chrome/Installed");
    
      exit(0);
    }
    include('google_chrome_version.inc');
    
    get_kb_item_or_exit('MacOSX/Google Chrome/Installed');
    
    google_chrome_check_version(fix:'80.0.3987.87', severity:SECURITY_HOLE, xss:FALSE, xsrf:FALSE);
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2020-0514.NASL
    descriptionAn update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Chromium is an open source web browser, powered by WebKit (Blink). This update upgrades Chromium to version 80.0.3987.87. Security Fix(es) : * chromium-browser: Integer overflow in JavaScript (CVE-2020-6381) * chromium-browser: Type Confusion in JavaScript (CVE-2020-6382) * chromium-browser: Insufficient policy enforcement in storage (CVE-2020-6385) * chromium-browser: Out of bounds write in WebRTC (CVE-2020-6387) * chromium-browser: Out of bounds memory access in WebAudio (CVE-2020-6388) * chromium-browser: Out of bounds write in WebRTC (CVE-2020-6389) * chromium-browser: Out of bounds memory access in streams (CVE-2020-6390) * libxslt: use after free in xsltCopyText in transform.c could lead to information disclosure (CVE-2019-18197) * sqlite: invalid pointer dereference in exprListAppendList in window.c (CVE-2019-19880) * sqlite: mishandling of certain uses of SELECT DISTINCT involving a LEFT JOIN in flattenSubquery in select.c leads to a NULL pointer dereference (CVE-2019-19923) * sqlite: zipfileUpdate in ext/misc/zipfile.c mishandles a NULL pathname during an update of a ZIP archive (CVE-2019-19925) * sqlite: error mishandling because of incomplete fix of CVE-2019-19880 (CVE-2019-19926) * chromium-browser: Insufficient validation of untrusted input in Blink (CVE-2020-6391) * chromium-browser: Insufficient policy enforcement in extensions (CVE-2020-6392) * chromium-browser: Insufficient policy enforcement in Blink (CVE-2020-6393) * chromium-browser: Insufficient policy enforcement in Blink (CVE-2020-6394) * chromium-browser: Out of bounds read in JavaScript (CVE-2020-6395) * chromium-browser: Inappropriate implementation in Skia (CVE-2020-6396) * chromium-browser: Incorrect security UI in sharing (CVE-2020-6397) * chromium-browser: Uninitialized use in PDFium (CVE-2020-6398) * chromium-browser: Insufficient policy enforcement in AppCache (CVE-2020-6399) * chromium-browser: Inappropriate implementation in CORS (CVE-2020-6400) * chromium-browser: Insufficient validation of untrusted input in Omnibox (CVE-2020-6401) * chromium-browser: Insufficient policy enforcement in downloads (CVE-2020-6402) * chromium-browser: Incorrect security UI in Omnibox (CVE-2020-6403) * chromium-browser: Inappropriate implementation in Blink (CVE-2020-6404) * sqlite: Out-of-bounds read in SELECT with ON/USING clause (CVE-2020-6405) * chromium-browser: Use after free in audio (CVE-2020-6406) * chromium-browser: Insufficient policy enforcement in CORS (CVE-2020-6408) * chromium-browser: Inappropriate implementation in Omnibox (CVE-2020-6409) * chromium-browser: Insufficient policy enforcement in navigation (CVE-2020-6410) * chromium-browser: Insufficient validation of untrusted input in Omnibox (CVE-2020-6411) * chromium-browser: Insufficient validation of untrusted input in Omnibox (CVE-2020-6412) * chromium-browser: Inappropriate implementation in Blink (CVE-2020-6413) * chromium-browser: Insufficient policy enforcement in Safe Browsing (CVE-2020-6414) * chromium-browser: Inappropriate implementation in JavaScript (CVE-2020-6415) * chromium-browser: Insufficient data validation in streams (CVE-2020-6416) * chromium-browser: Inappropriate implementation in installer (CVE-2020-6417) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
    last seen2020-06-02
    modified2020-02-18
    plugin id133749
    published2020-02-18
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/133749
    titleRHEL 6 : chromium-browser (RHSA-2020:0514)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Red Hat Security Advisory RHSA-2020:0514. The text
    # itself is copyright (C) Red Hat, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(133749);
      script_version("1.3");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/01");
    
      script_cve_id("CVE-2019-18197", "CVE-2019-19880", "CVE-2019-19923", "CVE-2019-19925", "CVE-2019-19926", "CVE-2020-6381", "CVE-2020-6382", "CVE-2020-6385", "CVE-2020-6387", "CVE-2020-6388", "CVE-2020-6389", "CVE-2020-6390", "CVE-2020-6391", "CVE-2020-6392", "CVE-2020-6393", "CVE-2020-6394", "CVE-2020-6395", "CVE-2020-6396", "CVE-2020-6397", "CVE-2020-6398", "CVE-2020-6399", "CVE-2020-6400", "CVE-2020-6401", "CVE-2020-6402", "CVE-2020-6403", "CVE-2020-6404", "CVE-2020-6405", "CVE-2020-6406", "CVE-2020-6408", "CVE-2020-6409", "CVE-2020-6410", "CVE-2020-6411", "CVE-2020-6412", "CVE-2020-6413", "CVE-2020-6414", "CVE-2020-6415", "CVE-2020-6416", "CVE-2020-6417");
      script_xref(name:"RHSA", value:"2020:0514");
    
      script_name(english:"RHEL 6 : chromium-browser (RHSA-2020:0514)");
      script_summary(english:"Checks the rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis",
        value:"The remote Red Hat host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description",
        value:
    "An update for chromium-browser is now available for Red Hat Enterprise
    Linux 6 Supplementary.
    
    Red Hat Product Security has rated this update as having a security
    impact of Important. A Common Vulnerability Scoring System (CVSS) base
    score, which gives a detailed severity rating, is available for each
    vulnerability from the CVE link(s) in the References section.
    
    Chromium is an open source web browser, powered by WebKit (Blink).
    
    This update upgrades Chromium to version 80.0.3987.87.
    
    Security Fix(es) :
    
    * chromium-browser: Integer overflow in JavaScript (CVE-2020-6381)
    
    * chromium-browser: Type Confusion in JavaScript (CVE-2020-6382)
    
    * chromium-browser: Insufficient policy enforcement in storage
    (CVE-2020-6385)
    
    * chromium-browser: Out of bounds write in WebRTC (CVE-2020-6387)
    
    * chromium-browser: Out of bounds memory access in WebAudio
    (CVE-2020-6388)
    
    * chromium-browser: Out of bounds write in WebRTC (CVE-2020-6389)
    
    * chromium-browser: Out of bounds memory access in streams
    (CVE-2020-6390)
    
    * libxslt: use after free in xsltCopyText in transform.c could lead to
    information disclosure (CVE-2019-18197)
    
    * sqlite: invalid pointer dereference in exprListAppendList in
    window.c (CVE-2019-19880)
    
    * sqlite: mishandling of certain uses of SELECT DISTINCT involving a
    LEFT JOIN in flattenSubquery in select.c leads to a NULL pointer
    dereference (CVE-2019-19923)
    
    * sqlite: zipfileUpdate in ext/misc/zipfile.c mishandles a NULL
    pathname during an update of a ZIP archive (CVE-2019-19925)
    
    * sqlite: error mishandling because of incomplete fix of
    CVE-2019-19880 (CVE-2019-19926)
    
    * chromium-browser: Insufficient validation of untrusted input in
    Blink (CVE-2020-6391)
    
    * chromium-browser: Insufficient policy enforcement in extensions
    (CVE-2020-6392)
    
    * chromium-browser: Insufficient policy enforcement in Blink
    (CVE-2020-6393)
    
    * chromium-browser: Insufficient policy enforcement in Blink
    (CVE-2020-6394)
    
    * chromium-browser: Out of bounds read in JavaScript (CVE-2020-6395)
    
    * chromium-browser: Inappropriate implementation in Skia
    (CVE-2020-6396)
    
    * chromium-browser: Incorrect security UI in sharing (CVE-2020-6397)
    
    * chromium-browser: Uninitialized use in PDFium (CVE-2020-6398)
    
    * chromium-browser: Insufficient policy enforcement in AppCache
    (CVE-2020-6399)
    
    * chromium-browser: Inappropriate implementation in CORS
    (CVE-2020-6400)
    
    * chromium-browser: Insufficient validation of untrusted input in
    Omnibox (CVE-2020-6401)
    
    * chromium-browser: Insufficient policy enforcement in downloads
    (CVE-2020-6402)
    
    * chromium-browser: Incorrect security UI in Omnibox (CVE-2020-6403)
    
    * chromium-browser: Inappropriate implementation in Blink
    (CVE-2020-6404)
    
    * sqlite: Out-of-bounds read in SELECT with ON/USING clause
    (CVE-2020-6405)
    
    * chromium-browser: Use after free in audio (CVE-2020-6406)
    
    * chromium-browser: Insufficient policy enforcement in CORS
    (CVE-2020-6408)
    
    * chromium-browser: Inappropriate implementation in Omnibox
    (CVE-2020-6409)
    
    * chromium-browser: Insufficient policy enforcement in navigation
    (CVE-2020-6410)
    
    * chromium-browser: Insufficient validation of untrusted input in
    Omnibox (CVE-2020-6411)
    
    * chromium-browser: Insufficient validation of untrusted input in
    Omnibox (CVE-2020-6412)
    
    * chromium-browser: Inappropriate implementation in Blink
    (CVE-2020-6413)
    
    * chromium-browser: Insufficient policy enforcement in Safe Browsing
    (CVE-2020-6414)
    
    * chromium-browser: Inappropriate implementation in JavaScript
    (CVE-2020-6415)
    
    * chromium-browser: Insufficient data validation in streams
    (CVE-2020-6416)
    
    * chromium-browser: Inappropriate implementation in installer
    (CVE-2020-6417)
    
    For more details about the security issue(s), including the impact, a
    CVSS score, acknowledgments, and other related information, refer to
    the CVE page(s) listed in the References section."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/errata/RHSA-2020:0514"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2019-18197"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2019-19880"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2019-19923"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2019-19925"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2019-19926"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6381"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6382"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6385"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6387"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6388"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6389"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6390"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6391"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6392"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6393"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6394"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6395"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6396"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6397"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6398"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6399"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6400"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6401"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6402"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6403"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6404"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6405"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6406"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6408"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6409"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6410"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6411"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6412"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6413"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6414"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6415"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6416"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2020-6417"
      );
      script_set_attribute(
        attribute:"solution",
        value:
    "Update the affected chromium-browser and / or
    chromium-browser-debuginfo packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-6406");
      script_cwe_id(125, 20, 416, 476, 476, 476);
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:redhat:enterprise_linux:6");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:redhat:rhel_extras:6");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:chromium-browser");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2019/10/18");
      script_set_attribute(attribute:"patch_publication_date", value:"2020/02/17");
      script_set_attribute(attribute:"plugin_publication_date", value:"2020/02/18");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Red Hat Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
    os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
    os_ver = os_ver[1];
    if (! preg(pattern:"^6([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 6.x", "Red Hat " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);
    
    pkgs = [
        {'reference':'chromium-browser-80.0.3987.87-1.el6_10', 'cpu':'i686', 'release':'6', 'allowmaj':TRUE},
        {'reference':'chromium-browser-80.0.3987.87-1.el6_10', 'cpu':'x86_64', 'release':'6', 'allowmaj':TRUE}
    ];
    
    flag = 0;
    foreach package_array ( pkgs ) {
      reference = NULL;
      release = NULL;
      sp = NULL;
      cpu = NULL;
      el_string = NULL;
      rpm_spec_vers_cmp = NULL;
      epoch = NULL;
      allowmaj = NULL;
      if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
      if (!empty_or_null(package_array['release'])) release = 'RHEL' + package_array['release'];
      if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
      if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];
      if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
      if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
      if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
      if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
      if (reference && release) {
        if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;
      }
    }
    
    if (flag)
    {
      security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : rpm_report_get() + redhat_report_package_caveat()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'chromium-browser');
    }
    
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2020-F6271D7AFA.NASL
    descriptionUpdate to 80.0.3987.132. Lots of security fixes here. VAAPI re-enabled by default except on NVIDIA. List of CVEs fixed (since last update) : - CVE-2019-20446 - CVE-2020-6381 - CVE-2020-6382 - CVE-2020-6383 - CVE-2020-6384 - CVE-2020-6385 - CVE-2020-6386 - CVE-2020-6387 - CVE-2020-6388 - CVE-2020-6389 - CVE-2020-6390 - CVE-2020-6391 - CVE-2020-6392 - CVE-2020-6393 - CVE-2020-6394 - CVE-2020-6395 - CVE-2020-6396 - CVE-2020-6397 - CVE-2020-6398 - CVE-2020-6399 - CVE-2020-6400 - CVE-2020-6401 - CVE-2020-6402 - CVE-2020-6403 - CVE-2020-6404 - CVE-2020-6405 - CVE-2020-6406 - CVE-2020-6407 - CVE-2020-6408 - CVE-2020-6409 - CVE-2020-6410 - CVE-2020-6411 - CVE-2020-6412 - CVE-2020-6413 - CVE-2020-6414 - CVE-2020-6415 - CVE-2020-6416 - CVE-2020-6417 - CVE-2020-6418 - CVE-2020-6420 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-31
    modified2020-03-20
    plugin id134718
    published2020-03-20
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/134718
    titleFedora 31 : chromium (2020-f6271d7afa)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Fedora Security Advisory FEDORA-2020-f6271d7afa.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(134718);
      script_version("1.3");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/29");
    
      script_cve_id("CVE-2019-20446", "CVE-2020-10531", "CVE-2020-6381", "CVE-2020-6382", "CVE-2020-6383", "CVE-2020-6384", "CVE-2020-6385", "CVE-2020-6386", "CVE-2020-6387", "CVE-2020-6388", "CVE-2020-6389", "CVE-2020-6390", "CVE-2020-6391", "CVE-2020-6392", "CVE-2020-6393", "CVE-2020-6394", "CVE-2020-6395", "CVE-2020-6396", "CVE-2020-6397", "CVE-2020-6398", "CVE-2020-6399", "CVE-2020-6400", "CVE-2020-6401", "CVE-2020-6402", "CVE-2020-6403", "CVE-2020-6404", "CVE-2020-6405", "CVE-2020-6406", "CVE-2020-6407", "CVE-2020-6408", "CVE-2020-6409", "CVE-2020-6410", "CVE-2020-6411", "CVE-2020-6412", "CVE-2020-6413", "CVE-2020-6414", "CVE-2020-6415", "CVE-2020-6416", "CVE-2020-6417", "CVE-2020-6418", "CVE-2020-6420");
      script_xref(name:"FEDORA", value:"2020-f6271d7afa");
    
      script_name(english:"Fedora 31 : chromium (2020-f6271d7afa)");
      script_summary(english:"Checks rpm output for the updated package.");
    
      script_set_attribute(
        attribute:"synopsis",
        value:"The remote Fedora host is missing a security update."
      );
      script_set_attribute(
        attribute:"description",
        value:
    "Update to 80.0.3987.132. Lots of security fixes here. VAAPI re-enabled
    by default except on NVIDIA.
    
    List of CVEs fixed (since last update) :
    
      - CVE-2019-20446
    
      - CVE-2020-6381 
    
      - CVE-2020-6382 
    
      - CVE-2020-6383 
    
      - CVE-2020-6384
    
      - CVE-2020-6385 
    
      - CVE-2020-6386
    
      - CVE-2020-6387 
    
      - CVE-2020-6388
    
      - CVE-2020-6389
    
      - CVE-2020-6390 
    
      - CVE-2020-6391
    
      - CVE-2020-6392 
    
      - CVE-2020-6393
    
      - CVE-2020-6394
    
      - CVE-2020-6395
    
      - CVE-2020-6396 
    
      - CVE-2020-6397 
    
      - CVE-2020-6398
    
      - CVE-2020-6399 
    
      - CVE-2020-6400 
    
      - CVE-2020-6401 
    
      - CVE-2020-6402 
    
      - CVE-2020-6403 
    
      - CVE-2020-6404 
    
      - CVE-2020-6405 
    
      - CVE-2020-6406 
    
      - CVE-2020-6407
    
      - CVE-2020-6408 
    
      - CVE-2020-6409 
    
      - CVE-2020-6410 
    
      - CVE-2020-6411 
    
      - CVE-2020-6412 
    
      - CVE-2020-6413 
    
      - CVE-2020-6414 
    
      - CVE-2020-6415 
    
      - CVE-2020-6416 
    
      - CVE-2020-6417
    
      - CVE-2020-6418
    
      - CVE-2020-6420
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Fedora update system website.
    Tenable has attempted to automatically clean and format it as much as
    possible without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bodhi.fedoraproject.org/updates/FEDORA-2020-f6271d7afa"
      );
      script_set_attribute(
        attribute:"solution",
        value:"Update the affected chromium package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Google Chrome 80 JSCreate side-effect type confusion exploit');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:chromium");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:31");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2020/02/02");
      script_set_attribute(attribute:"patch_publication_date", value:"2020/03/20");
      script_set_attribute(attribute:"plugin_publication_date", value:"2020/03/20");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Fedora Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
    os_ver = pregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
    os_ver = os_ver[1];
    if (! preg(pattern:"^31([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 31", "Fedora " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"FC31", reference:"chromium-80.0.3987.132-1.fc31", allowmaj:TRUE)) flag++;
    
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "chromium");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2020-189.NASL
    descriptionThis update for chromium fixes the following issues : Chromium was updated to version 80.0.3987.87 (boo#1162833). Security issues fixed : - CVE-2020-6381: Integer overflow in JavaScript (boo#1162833). - CVE-2020-6382: Type Confusion in JavaScript (boo#1162833). - CVE-2019-18197: Multiple vulnerabilities in XML (boo#1162833). - CVE-2019-19926: Inappropriate implementation in SQLite (boo#1162833). - CVE-2020-6385: Insufficient policy enforcement in storage (boo#1162833). - CVE-2019-19880, CVE-2019-19925: Multiple vulnerabilities in SQLite (boo#1162833). - CVE-2020-6387: Out of bounds write in WebRTC (boo#1162833). - CVE-2020-6388: Out of bounds memory access in WebAudio (boo#1162833). - CVE-2020-6389: Out of bounds write in WebRTC (boo#1162833). - CVE-2020-6390: Out of bounds memory access in streams (boo#1162833). - CVE-2020-6391: Insufficient validation of untrusted input in Blink (boo#1162833). - CVE-2020-6392: Insufficient policy enforcement in extensions (boo#1162833). - CVE-2020-6393: Insufficient policy enforcement in Blink (boo#1162833). - CVE-2020-6394: Insufficient policy enforcement in Blink (boo#1162833). - CVE-2020-6395: Out of bounds read in JavaScript (boo#1162833). - CVE-2020-6396: Inappropriate implementation in Skia (boo#1162833). - CVE-2020-6397: Incorrect security UI in sharing (boo#1162833). - CVE-2020-6398: Uninitialized use in PDFium (boo#1162833). - CVE-2020-6399: Insufficient policy enforcement in AppCache (boo#1162833). - CVE-2020-6400: Inappropriate implementation in CORS (boo#1162833). - CVE-2020-6401: Insufficient validation of untrusted input in Omnibox (boo#1162833). - CVE-2020-6402: Insufficient policy enforcement in downloads (boo#1162833). - CVE-2020-6403: Incorrect security UI in Omnibox (boo#1162833). - CVE-2020-6404: Inappropriate implementation in Blink (boo#1162833). - CVE-2020-6405: Out of bounds read in SQLite (boo#1162833). - CVE-2020-6406: Use after free in audio (boo#1162833). - CVE-2019-19923: Out of bounds memory access in SQLite (boo#1162833). - CVE-2020-6408: Insufficient policy enforcement in CORS (boo#1162833). - CVE-2020-6409: Inappropriate implementation in Omnibox (boo#1162833). - CVE-2020-6410: Insufficient policy enforcement in navigation (boo#1162833). - CVE-2020-6411: Insufficient validation of untrusted input in Omnibox (boo#1162833). - CVE-2020-6412: Insufficient validation of untrusted input in Omnibox (boo#1162833). - CVE-2020-6413: Inappropriate implementation in Blink (boo#1162833). - CVE-2020-6414: Insufficient policy enforcement in Safe Browsing (boo#1162833). - CVE-2020-6415: Inappropriate implementation in JavaScript (boo#1162833). - CVE-2020-6416: Insufficient data validation in streams (boo#1162833). - CVE-2020-6417: Inappropriate implementation in installer (boo#1162833).
    last seen2020-05-31
    modified2020-02-10
    plugin id133593
    published2020-02-10
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/133593
    titleopenSUSE Security Update : chromium (openSUSE-2020-189)

Redhat

advisories
rhsa
idRHSA-2020:0514
rpms
  • chromium-browser-0:80.0.3987.87-1.el6_10
  • chromium-browser-debuginfo-0:80.0.3987.87-1.el6_10