Vulnerabilities > CVE-2020-6449 - Use After Free vulnerability in multiple products
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
HIGH Summary
Use after free in audio in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Nessus
NASL family Fedora Local Security Checks NASL id FEDORA_2020-39E0B8BD14.NASL description Update to 80.0.3987.149. Upstream says it fixes last seen 2020-05-31 modified 2020-03-30 plugin id 134990 published 2020-03-30 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/134990 title Fedora 30 : chromium (2020-39e0b8bd14) code # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Fedora Security Advisory FEDORA-2020-39e0b8bd14. # include("compat.inc"); if (description) { script_id(134990); script_version("1.3"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/29"); script_cve_id("CVE-2019-20446", "CVE-2019-20503", "CVE-2020-10531", "CVE-2020-6378", "CVE-2020-6379", "CVE-2020-6380", "CVE-2020-6381", "CVE-2020-6382", "CVE-2020-6383", "CVE-2020-6384", "CVE-2020-6385", "CVE-2020-6386", "CVE-2020-6387", "CVE-2020-6388", "CVE-2020-6389", "CVE-2020-6390", "CVE-2020-6391", "CVE-2020-6392", "CVE-2020-6393", "CVE-2020-6394", "CVE-2020-6395", "CVE-2020-6396", "CVE-2020-6397", "CVE-2020-6398", "CVE-2020-6399", "CVE-2020-6400", "CVE-2020-6401", "CVE-2020-6402", "CVE-2020-6403", "CVE-2020-6404", "CVE-2020-6405", "CVE-2020-6406", "CVE-2020-6407", "CVE-2020-6408", "CVE-2020-6409", "CVE-2020-6410", "CVE-2020-6411", "CVE-2020-6412", "CVE-2020-6413", "CVE-2020-6414", "CVE-2020-6415", "CVE-2020-6416", "CVE-2020-6417", "CVE-2020-6418", "CVE-2020-6420", "CVE-2020-6422", "CVE-2020-6424", "CVE-2020-6425", "CVE-2020-6426", "CVE-2020-6427", "CVE-2020-6428", "CVE-2020-6429", "CVE-2020-6449"); script_xref(name:"FEDORA", value:"2020-39e0b8bd14"); script_name(english:"Fedora 30 : chromium (2020-39e0b8bd14)"); script_summary(english:"Checks rpm output for the updated package."); script_set_attribute( attribute:"synopsis", value:"The remote Fedora host is missing a security update." ); script_set_attribute( attribute:"description", value: "Update to 80.0.3987.149. Upstream says it fixes '13' security issues, but only lists these CVEs : - CVE-2020-6422: Use after free in WebGL - CVE-2020-6424: Use after free in media - CVE-2020-6425: Insufficient policy enforcement in extensions. - CVE-2020-6426: Inappropriate implementation in V8 - CVE-2020-6427: Use after free in audio - CVE-2020-6428: Use after free in audio - CVE-2020-6429: Use after free in audio. - CVE-2019-20503: Out of bounds read in usersctplib. - CVE-2020-6449: Use after free in audio ---- Update to 80.0.3987.132. Lots of security fixes here. VAAPI re-enabled by default except on NVIDIA. List of CVEs fixed (since last update) : - CVE-2019-20446 - CVE-2020-6381 - CVE-2020-6382 - CVE-2020-6383 - CVE-2020-6384 - CVE-2020-6385 - CVE-2020-6386 - CVE-2020-6387 - CVE-2020-6388 - CVE-2020-6389 - CVE-2020-6390 - CVE-2020-6391 - CVE-2020-6392 - CVE-2020-6393 - CVE-2020-6394 - CVE-2020-6395 - CVE-2020-6396 - CVE-2020-6397 - CVE-2020-6398 - CVE-2020-6399 - CVE-2020-6400 - CVE-2020-6401 - CVE-2020-6402 - CVE-2020-6403 - CVE-2020-6404 - CVE-2020-6405 - CVE-2020-6406 - CVE-2020-6407 - CVE-2020-6408 - CVE-2020-6409 - CVE-2020-6410 - CVE-2020-6411 - CVE-2020-6412 - CVE-2020-6413 - CVE-2020-6414 - CVE-2020-6415 - CVE-2020-6416 - CVE-2020-6417 - CVE-2020-6418 - CVE-2020-6420 ---- Update to 79.0.3945.130. Fixes the following security issues : - CVE-2020-6378 - CVE-2020-6379 - CVE-2020-6380 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); script_set_attribute( attribute:"see_also", value:"https://bodhi.fedoraproject.org/updates/FEDORA-2020-39e0b8bd14" ); script_set_attribute( attribute:"solution", value:"Update the affected chromium package." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"metasploit_name", value:'Google Chrome 80 JSCreate side-effect type confusion exploit'); script_set_attribute(attribute:"exploit_framework_metasploit", value:"true"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:chromium"); script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:30"); script_set_attribute(attribute:"vuln_publication_date", value:"2020/02/02"); script_set_attribute(attribute:"patch_publication_date", value:"2020/03/27"); script_set_attribute(attribute:"plugin_publication_date", value:"2020/03/30"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Fedora Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/RedHat/release"); if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora"); os_ver = pregmatch(pattern: "Fedora.*release ([0-9]+)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora"); os_ver = os_ver[1]; if (! preg(pattern:"^30([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 30", "Fedora " + os_ver); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu); flag = 0; if (rpm_check(release:"FC30", reference:"chromium-80.0.3987.149-1.fc30", allowmaj:TRUE)) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_HOLE, extra : rpm_report_get() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "chromium"); }
NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-202003-53.NASL description The remote host is affected by the vulnerability described in GLSA-202003-53 (Chromium, Google Chrome: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Chromium and Google Chrome. Please review the referenced CVE identifiers for details. Impact : A remote attacker could entice a user to open a specially crafted HTML or multimedia file using Chromium or Google Chrome, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition. Workaround : There is no known workaround at this time. last seen 2020-03-31 modified 2020-03-26 plugin id 134928 published 2020-03-26 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/134928 title GLSA-202003-53 : Chromium, Google Chrome: Multiple vulnerabilities NASL family SuSE Local Security Checks NASL id OPENSUSE-2020-365.NASL description This update for chromium to version 80.0.3987.149 fixes the following issues : Chromium was update to 80.0.3987.149 (bsc#1167090) : - CVE-2020-6422: Fixed a use after free in WebGL. - CVE-2020-6424: Fixed a use after free in media. - CVE-2020-6425: Fixed an insufficient policy enforcement in extensions. - CVE-2020-6426: Fixed an inappropriate implementation in V8. - CVE-2020-6427: Fixed a use after free in audio. - CVE-2020-6428: Fixed a use after free in audio. - CVE-2020-6429: Fixed a use after free in audio. - CVE-2019-20503: Fixed an out of bounds read in usersctplib. - CVE-2020-6449: Fixed a use after free in audio. last seen 2020-05-31 modified 2020-03-23 plugin id 134822 published 2020-03-23 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/134822 title openSUSE Security Update : chromium (openSUSE-2020-365) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2020-1270.NASL description The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1270 advisory. - usrsctp: Out of bounds reads in sctp_load_addresses_from_init() (CVE-2019-20503) - chromium-browser: Use after free in WebGL (CVE-2020-6422) - chromium-browser: Use after free in media (CVE-2020-6424) - chromium-browser: Insufficient policy enforcement in extensions (CVE-2020-6425) - chromium-browser: Inappropriate implementation in V8 (CVE-2020-6426) - chromium-browser: Use after free in audio (CVE-2020-6427, CVE-2020-6428, CVE-2020-6429, CVE-2020-6449) Note that Nessus has not tested for this issue but has instead relied only on the application last seen 2020-06-02 modified 2020-04-01 plugin id 135086 published 2020-04-01 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/135086 title RHEL 6 : chromium-browser (RHSA-2020:1270) NASL family Fedora Local Security Checks NASL id FEDORA_2020-7FD051B378.NASL description Update to 80.0.3987.149. Upstream says it fixes last seen 2020-05-31 modified 2020-03-24 plugin id 134842 published 2020-03-24 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/134842 title Fedora 31 : chromium (2020-7fd051b378) NASL family Windows NASL id GOOGLE_CHROME_80_0_3987_149.NASL description The version of Google Chrome installed on the remote Windows host is prior to 80.0.3987.149. It is, therefore, affected by multiple vulnerabilities as referenced in the 2020_03_stable-channel-update-for-desktop_18 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application last seen 2020-04-04 modified 2020-03-19 plugin id 134701 published 2020-03-19 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/134701 title Google Chrome < 80.0.3987.149 Multiple Vulnerabilities NASL family MacOS X Local Security Checks NASL id MACOSX_GOOGLE_CHROME_80_0_3987_149.NASL description The version of Google Chrome installed on the remote macOS host is prior to 80.0.3987.149. It is, therefore, affected by multiple vulnerabilities as referenced in the 2020_03_stable-channel-update-for-desktop_18 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application last seen 2020-04-04 modified 2020-03-19 plugin id 134700 published 2020-03-19 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/134700 title Google Chrome < 80.0.3987.149 Multiple Vulnerabilities NASL family Debian Local Security Checks NASL id DEBIAN_DSA-4645.NASL description Several vulnerabilities have been discovered in the chromium web browser. - CVE-2019-20503 Natalie Silvanovich discovered an out-of-bounds read issue in the usrsctp library. - CVE-2020-6422 David Manouchehri discovered a use-after-free issue in the WebGL implementation. - CVE-2020-6424 Sergei Glazunov discovered a use-after-free issue. - CVE-2020-6425 Sergei Glazunov discovered a policy enforcement error related to extensions. - CVE-2020-6426 Avihay Cohen discovered an implementation error in the v8 JavaScript library. - CVE-2020-6427 Man Yue Mo discovered a use-after-free issue in the audio implementation. - CVE-2020-6428 Man Yue Mo discovered a use-after-free issue in the audio implementation. - CVE-2020-6429 Man Yue Mo discovered a use-after-free issue in the audio implementation. - CVE-2020-6449 Man Yue Mo discovered a use-after-free issue in the audio implementation. last seen 2020-03-26 modified 2020-03-24 plugin id 134839 published 2020-03-24 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/134839 title Debian DSA-4645-1 : chromium - security update
Redhat
rpms |
|
References
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00028.html
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00028.html
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00037.html
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00037.html
- http://packetstormsecurity.com/files/172843/Chrome-WebAudio-Use-After-Free.html
- http://packetstormsecurity.com/files/172843/Chrome-WebAudio-Use-After-Free.html
- https://chromereleases.googleblog.com/2020/03/stable-channel-update-for-desktop_18.html
- https://chromereleases.googleblog.com/2020/03/stable-channel-update-for-desktop_18.html
- https://crbug.com/1059686
- https://crbug.com/1059686
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2DDNOAGIX5D77TTHT6YPMVJ5WTXTCQEI/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2DDNOAGIX5D77TTHT6YPMVJ5WTXTCQEI/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IOHSO6BUKC6I66J5PZOMAGFVJ66ZS57/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IOHSO6BUKC6I66J5PZOMAGFVJ66ZS57/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JWANFIR3PYAL5RJQ4AO3ZS2DYMSF2ZGZ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JWANFIR3PYAL5RJQ4AO3ZS2DYMSF2ZGZ/
- https://security.gentoo.org/glsa/202003-53
- https://security.gentoo.org/glsa/202003-53
- https://www.debian.org/security/2020/dsa-4645
- https://www.debian.org/security/2020/dsa-4645