Arch Linux Security Advisory ASA-201710-27
=========================================
Severity: Critical
Date    : 2017-10-19
CVE-ID  : CVE-2017-15386 CVE-2017-15387 CVE-2017-15388 CVE-2017-15389
          CVE-2017-15390 CVE-2017-15391 CVE-2017-15392 CVE-2017-15393
          CVE-2017-15394 CVE-2017-15395 CVE-2017-5124 CVE-2017-5125
          CVE-2017-5126 CVE-2017-5127 CVE-2017-5128 CVE-2017-5129
          CVE-2017-5130 CVE-2017-5131 CVE-2017-5132 CVE-2017-5133
Package : chromium
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-456

Summary
======
The package chromium before version 62.0.3202.62-1 is vulnerable to
multiple issues including arbitrary code execution, cross-site
scripting, access restriction bypass, content spoofing, information
disclosure and denial of service.

Resolution
=========
Upgrade to 62.0.3202.62-1.

# pacman -Syu "chromium>=62.0.3202.62-1"

The problems have been fixed upstream in version 62.0.3202.62.

Workaround
=========
None.

Description
==========
- CVE-2017-15386 (content spoofing)

A UI spoofing issue has been found in the Blink component of the
Chromium browser < 62.0.3202.62.

- CVE-2017-15387 (access restriction bypass)

A content security bypass has been found in the Chromium browser <
62.0.3202.62.

- CVE-2017-15388 (information disclosure)

An out-of-bounds read has been found in the Skia component of the
Chromium browser < 62.0.3202.62.

- CVE-2017-15389 (content spoofing)

A URL spoofing issue has been found in the Omnibox component of the
Chromium browser < 62.0.3202.62.

- CVE-2017-15390 (content spoofing)

A URL spoofing issue has been found in the Omnibox component of the
Chromium browser < 62.0.3202.62.

- CVE-2017-15391 (access restriction bypass)

An extension limitation bypass has been found in the Extensions
component of the Chromium browser < 62.0.3202.62.

- CVE-2017-15392 (access restriction bypass)

An incorrect registry key handling issue has been found in the
PlatformIntegration component of the Chromium browser < 62.0.3202.62.

- CVE-2017-15393 (information disclosure)

A referrer leak has been found in the Devtools component of the
Chromium browser < 62.0.3202.62.

- CVE-2017-15394 (content spoofing)

A URL spoofing flaw has been found in the extensions UI of the Chromium
browser < 62.0.3202.62.

- CVE-2017-15395 (denial of service)

A null-pointer dereference flaw has been found in the ImageCapture
component of the Chromium browser < 62.0.3202.62.

- CVE-2017-5124 (cross-site scripting)

A universal XSS flaw has been found in the MHTML component of the
Chromium browser < 62.0.3202.62.

- CVE-2017-5125 (arbitrary code execution)

A heap overflow security issue has been found in the Skia component of
the Chromium browser < 62.0.3202.62.

- CVE-2017-5126 (arbitrary code execution)

A use-after-free security issue has been found in the PDFium component
of the Chromium browser < 62.0.3202.62.

- CVE-2017-5127 (arbitrary code execution)

A use-after-free security issue has been found in the PDFium component
of the Chromium browser < 62.0.3202.62.

- CVE-2017-5128 (arbitrary code execution)

A heap overflow security issue has been found in the WebGL component of
the Chromium browser < 62.0.3202.62.

- CVE-2017-5129 (arbitrary code execution)

A use-after-free security issue has been found in the WebAudio
component of the Chromium browser < 62.0.3202.62.

- CVE-2017-5130 (arbitrary code execution)

A heap overflow security issue has been found in libxml2.

- CVE-2017-5131 (arbitrary code execution)

An out-of-bounds write has been found in the Skia component of the
Chromium browser < 62.0.3202.62.

- CVE-2017-5132 (arbitrary code execution)

An incorrect stack manipulation security issue has been found in the
WebAssembly component of the Chromium browser < 62.0.3202.62.

- CVE-2017-5133 (arbitrary code execution)

An out-of-bounds write has been found in the Skia component of the
Chromium browser < 62.0.3202.62.

Impact
=====
A remote attacker can bypass security measures, trick the user by
spoofing parts of the UI, cause a denial of service or execute
arbitrary code on the affected host.

References
=========
https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://security.archlinux.org/CVE-2017-15386
https://security.archlinux.org/CVE-2017-15387
https://security.archlinux.org/CVE-2017-15388
https://security.archlinux.org/CVE-2017-15389
https://security.archlinux.org/CVE-2017-15390
https://security.archlinux.org/CVE-2017-15391
https://security.archlinux.org/CVE-2017-15392
https://security.archlinux.org/CVE-2017-15393
https://security.archlinux.org/CVE-2017-15394
https://security.archlinux.org/CVE-2017-15395
https://security.archlinux.org/CVE-2017-5124
https://security.archlinux.org/CVE-2017-5125
https://security.archlinux.org/CVE-2017-5126
https://security.archlinux.org/CVE-2017-5127
https://security.archlinux.org/CVE-2017-5128
https://security.archlinux.org/CVE-2017-5129
https://security.archlinux.org/CVE-2017-5130
https://security.archlinux.org/CVE-2017-5131
https://security.archlinux.org/CVE-2017-5132
https://security.archlinux.org/CVE-2017-5133

ArchLinux: 201710-27: chromium: multiple issues

October 19, 2017

Summary

- CVE-2017-15386 (content spoofing) A UI spoofing issue has been found in the Blink component of the Chromium browser < 62.0.3202.62.
- CVE-2017-15387 (access restriction bypass)
A content security bypass has been found in the Chromium browser < 62.0.3202.62.
- CVE-2017-15388 (information disclosure)
An out-of-bounds read has been found in the Skia component of the Chromium browser < 62.0.3202.62.
- CVE-2017-15389 (content spoofing)
A URL spoofing issue has been found in the Omnibox component of the Chromium browser < 62.0.3202.62.
- CVE-2017-15390 (content spoofing)
A URL spoofing issue has been found in the Omnibox component of the Chromium browser < 62.0.3202.62.
- CVE-2017-15391 (access restriction bypass)
An extension limitation bypass has been found in the Extensions component of the Chromium browser < 62.0.3202.62.
- CVE-2017-15392 (access restriction bypass)
An incorrect registry key handling issue has been found in the PlatformIntegration component of the Chromium browser < 62.0.3202.62.
- CVE-2017-15393 (information disclosure)
A referrer leak has been found in the Devtools component of the Chromium browser < 62.0.3202.62.
- CVE-2017-15394 (content spoofing)
A URL spoofing flaw has been found in the extensions UI of the Chromium browser < 62.0.3202.62.
- CVE-2017-15395 (denial of service)
A null-pointer dereference flaw has been found in the ImageCapture component of the Chromium browser < 62.0.3202.62.
- CVE-2017-5124 (cross-site scripting)
A universal XSS flaw has been found in the MHTML component of the Chromium browser < 62.0.3202.62.
- CVE-2017-5125 (arbitrary code execution)
A heap overflow security issue has been found in the Skia component of the Chromium browser < 62.0.3202.62.
- CVE-2017-5126 (arbitrary code execution)
A use-after-free security issue has been found in the PDFium component of the Chromium browser < 62.0.3202.62.
- CVE-2017-5127 (arbitrary code execution)
A use-after-free security issue has been found in the PDFium component of the Chromium browser < 62.0.3202.62.
- CVE-2017-5128 (arbitrary code execution)
A heap overflow security issue has been found in the WebGL component of the Chromium browser < 62.0.3202.62.
- CVE-2017-5129 (arbitrary code execution)
A use-after-free security issue has been found in the WebAudio component of the Chromium browser < 62.0.3202.62.
- CVE-2017-5130 (arbitrary code execution)
A heap overflow security issue has been found in libxml2.
- CVE-2017-5131 (arbitrary code execution)
An out-of-bounds write has been found in the Skia component of the Chromium browser < 62.0.3202.62.
- CVE-2017-5132 (arbitrary code execution)
An incorrect stack manipulation security issue has been found in the WebAssembly component of the Chromium browser < 62.0.3202.62.
- CVE-2017-5133 (arbitrary code execution)
An out-of-bounds write has been found in the Skia component of the Chromium browser < 62.0.3202.62.

Resolution

Upgrade to 62.0.3202.62-1. # pacman -Syu "chromium>=62.0.3202.62-1"
The problems have been fixed upstream in version 62.0.3202.62.

References

https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html https://bugs.chromium.org/p/chromium/issues/detail https://bugs.chromium.org/p/chromium/issues/detail https://bugs.chromium.org/p/chromium/issues/detail https://bugs.chromium.org/p/chromium/issues/detail https://bugs.chromium.org/p/chromium/issues/detail https://bugs.chromium.org/p/chromium/issues/detail https://bugs.chromium.org/p/chromium/issues/detail https://bugs.chromium.org/p/chromium/issues/detail https://bugs.chromium.org/p/chromium/issues/detail https://bugs.chromium.org/p/chromium/issues/detail https://bugs.chromium.org/p/chromium/issues/detail https://bugs.chromium.org/p/chromium/issues/detail https://bugs.chromium.org/p/chromium/issues/detail https://bugs.chromium.org/p/chromium/issues/detail https://bugs.chromium.org/p/chromium/issues/detail https://bugs.chromium.org/p/chromium/issues/detail https://bugs.chromium.org/p/chromium/issues/detail https://bugs.chromium.org/p/chromium/issues/detail https://bugs.chromium.org/p/chromium/issues/detail https://bugs.chromium.org/p/chromium/issues/detail https://security.archlinux.org/CVE-2017-15386 https://security.archlinux.org/CVE-2017-15387 https://security.archlinux.org/CVE-2017-15388 https://security.archlinux.org/CVE-2017-15389 https://security.archlinux.org/CVE-2017-15390 https://security.archlinux.org/CVE-2017-15391 https://security.archlinux.org/CVE-2017-15392 https://security.archlinux.org/CVE-2017-15393 https://security.archlinux.org/CVE-2017-15394 https://security.archlinux.org/CVE-2017-15395 https://security.archlinux.org/CVE-2017-5124 https://security.archlinux.org/CVE-2017-5125 https://security.archlinux.org/CVE-2017-5126 https://security.archlinux.org/CVE-2017-5127 https://security.archlinux.org/CVE-2017-5128 https://security.archlinux.org/CVE-2017-5129 https://security.archlinux.org/CVE-2017-5130 https://security.archlinux.org/CVE-2017-5131 https://security.archlinux.org/CVE-2017-5132 https://security.archlinux.org/CVE-2017-5133

Severity
CVE-2017-15390 CVE-2017-15391 CVE-2017-15392 CVE-2017-15393
CVE-2017-15394 CVE-2017-15395 CVE-2017-5124 CVE-2017-5125
CVE-2017-5126 CVE-2017-5127 CVE-2017-5128 CVE-2017-5129
CVE-2017-5130 CVE-2017-5131 CVE-2017-5132 CVE-2017-5133
Package : chromium
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-456

Workaround

None.

Related News

Google Chrome 129: Addressing Crucial Vulnerabilities and Enhancing Security
2 - 4 min read
Google Chrome remains the crown jewel in the browser market, with an impressive user base of approximately 3.45 billion. However, this immense
Fighting Back Against Hadooken Malware by Strengthening WebLogic Security
2 - 4 min read
Cybercriminals have been relentlessly attacking the digital landscape, aiming to exploit vulnerabilities in well-known systems. One such exploit is
CISA Sounds Alarm on Newly Exploited Vulnerabilities: Is Your System at Risk?
3 - 5 min read
CISA regularly publishes updates regarding vulnerabilities that present severe threats to global cybersecurity. Recently, CISA added three
Defending Against Remote Code Execution in Google Chrome: A Critical Update
2 - 3 min read
Google Chrome, a widely used web browser, serves millions of internet users by connecting them to the online world. Unfortunately, severe
Navigating the Linux Kernel
2 - 4 min read
The Linux operating system, widely acclaimed for its robustness and security , recently received widespread media attention due to a significant
Staying a Step Ahead of Adversaries: Mitigating Chromium
2 - 4 min read
Google Chrome, one of the world's most widely used web browsers, has recently been scrutinized due to the discovery of multiple Chromium
Unmasking Cicada3301: Examining the Threat of the New Rust-Based Ransomware
2 - 4 min read
Ransomware has long been a severe threat to organizations and admins alike. Recently, cybersecurity researchers discovered a new variant called
Buffer Overflow Exploits in Linux: Origins, Impact, and Countermeasures
3 - 6 min read
Buffer overflow vulnerabilities have long been one of the biggest headaches in computer security, especially on Linux operating systems that power

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved