Arch Linux Security Advisory ASA-201712-5
========================================
Severity: Critical
Date    : 2017-12-07
CVE-ID  : CVE-2017-15407 CVE-2017-15408 CVE-2017-15409 CVE-2017-15410
          CVE-2017-15411 CVE-2017-15412 CVE-2017-15413 CVE-2017-15415
          CVE-2017-15416 CVE-2017-15417 CVE-2017-15418 CVE-2017-15419
          CVE-2017-15420 CVE-2017-15422 CVE-2017-15423 CVE-2017-15424
          CVE-2017-15425 CVE-2017-15426 CVE-2017-15427
Package : chromium
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-544

Summary
======
The package chromium before version 63.0.3239.84-1 is vulnerable to
multiple issues including arbitrary code execution, content spoofing,
information disclosure and access restriction bypass.

Resolution
=========
Upgrade to 63.0.3239.84-1.

# pacman -Syu "chromium>=63.0.3239.84-1"

The problems have been fixed upstream in version 63.0.3239.84.

Workaround
=========
None.

Description
==========
- CVE-2017-15407 (arbitrary code execution)

An out of bounds write has been found in the QUIC component of the
Chromium browser before 63.0.3239.84.

- CVE-2017-15408 (arbitrary code execution)

A heap-based buffer overflow has been found in the PDFium component of
the Chromium browser before 63.0.3239.84.

- CVE-2017-15409 (arbitrary code execution)

An out of bounds write has been found in the Skia component of the
Chromium browser before 63.0.3239.84.

- CVE-2017-15410 (arbitrary code execution)

A use after free has been found in the PDFium component of the Chromium
browser before 63.0.3239.84.

- CVE-2017-15411 (arbitrary code execution)

A use after free has been found in the PDFium component of the Chromium
browser before 63.0.3239.84.

- CVE-2017-15412 (arbitrary code execution)

A use after free has been found in the libxml component of the Chromium
browser before 63.0.3239.84.

- CVE-2017-15413 (arbitrary code execution)

A type confusion has been found in the WebAssembly component of the
Chromium browser before 63.0.3239.84.

- CVE-2017-15415 (information disclosure)

A pointer information disclosure has been found in the IPC call
component of the Chromium browser before 63.0.3239.84.

- CVE-2017-15416 (information disclosure)

An out of bounds read has been found in the Blink component of the
Chromium browser before 63.0.3239.84.

- CVE-2017-15417 (information disclosure)

A cross-origin information disclosure has been found in the Skia
component of the Chromium browser before 63.0.3239.84.

- CVE-2017-15418 (information disclosure)

A use of uninitialized value has been found in the Skia component of
the Chromium browser before 63.0.3239.84.

- CVE-2017-15419 (information disclosure)

A cross-origin leak of redirect URL has been found in the Blink
component of the Chromium browser before 63.0.3239.84.

- CVE-2017-15420 (content spoofing)

A URL spoofing issue has been found in the Omnibox component of the
Chromium browser before 63.0.3239.84.

- CVE-2017-15422 (arbitrary code execution)

An integer overflow has been found in the ICU component of the Chromium
browser before 63.0.3239.84.

- CVE-2017-15423 (information disclosure)

An information disclosure issue has been found in the SPAKE
implementation of the BoringSSL component of the Chromium browser
before 63.0.3239.84.

- CVE-2017-15424 (content spoofing)

A URL spoofing issue has been found in the Omnibox component of the
Chromium browser before 63.0.3239.84.

- CVE-2017-15425 (content spoofing)

A URL spoofing issue has been found in the Omnibox component of the
Chromium browser before 63.0.3239.84.

- CVE-2017-15426 (content spoofing)

A URL spoofing issue has been found in the Omnibox component of the
Chromium browser before 63.0.3239.84.

- CVE-2017-15427 (access restriction bypass)

An insufficient blocking of Javascript issue has been found in the
Omnibox component of the Chromium browser before 63.0.3239.84.

Impact
=====
A remote attacker can execute arbitrary code on the affected host,
spoof the URL, access sensitive information and bypass security
measures.

References
=========
https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://github.com/google/boringssl/commit/696c13bd6ab78011adfe7b775519c8b7cc82b604
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://security.archlinux.org/CVE-2017-15407
https://security.archlinux.org/CVE-2017-15408
https://security.archlinux.org/CVE-2017-15409
https://security.archlinux.org/CVE-2017-15410
https://security.archlinux.org/CVE-2017-15411
https://security.archlinux.org/CVE-2017-15412
https://security.archlinux.org/CVE-2017-15413
https://security.archlinux.org/CVE-2017-15415
https://security.archlinux.org/CVE-2017-15416
https://security.archlinux.org/CVE-2017-15417
https://security.archlinux.org/CVE-2017-15418
https://security.archlinux.org/CVE-2017-15419
https://security.archlinux.org/CVE-2017-15420
https://security.archlinux.org/CVE-2017-15422
https://security.archlinux.org/CVE-2017-15423
https://security.archlinux.org/CVE-2017-15424
https://security.archlinux.org/CVE-2017-15425
https://security.archlinux.org/CVE-2017-15426
https://security.archlinux.org/CVE-2017-15427