Arch Linux Security Advisory ASA-202011-11
=========================================
Severity: High
Date    : 2020-11-17
CVE-ID  : CVE-2020-16012 CVE-2020-16014 CVE-2020-16015 CVE-2020-16018
          CVE-2020-16019 CVE-2020-16020 CVE-2020-16021 CVE-2020-16022
          CVE-2020-16023 CVE-2020-16024 CVE-2020-16025 CVE-2020-16026
          CVE-2020-16027 CVE-2020-16028 CVE-2020-16029 CVE-2020-16030
          CVE-2020-16031 CVE-2020-16032 CVE-2020-16033 CVE-2020-16034
          CVE-2020-16035 CVE-2020-16036
Package : chromium
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-1277

Summary
======
The package chromium before version 87.0.4280.66-1 is vulnerable to
multiple issues including access restriction bypass, arbitrary code
execution, insufficient validation, content spoofing and information
disclosure.

Resolution
=========
Upgrade to 87.0.4280.66-1.

# pacman -Syu "chromium>=87.0.4280.66-1"

The problems have been fixed upstream in version 87.0.4280.66.

Workaround
=========
None.

Description
==========
- CVE-2020-16012 (information disclosure)

An information disclosure issue has been found in Firefox before 83.0
and chromium before 87.0.4280.66. When drawing a transparent image on
top of an unknown cross-origin image, the Skia library drawImage
function took a variable amount of time depending on the content of the
underlying image. This resulted in potential cross-origin information
exposure of image content through timing side-channel attacks.

- CVE-2020-16014 (arbitrary code execution)

A use after free security issue has been found in the PPAPI component
of the chromium browser before 87.0.4280.66.

- CVE-2020-16015 (insufficient validation)

An insufficient data validation security issue has been found in the
WASM component of the chromium browser before 87.0.4280.66.

- CVE-2020-16018 (arbitrary code execution)

A use after free security issue has been found in the payments
component of the chromium browser before 87.0.4280.66.

- CVE-2020-16019 (access restriction bypass)

An inappropriate implementation security issue has been found in the
filesystem component of the chromium browser before 87.0.4280.66.

- CVE-2020-16020 (access restriction bypass)

An inappropriate implementation security issue has been found in the
cryptohome component of the chromium browser before 87.0.4280.66.

- CVE-2020-16021 (arbitrary code execution)

A race condition has been found in the ImageBurner component of the
chromium browser before 87.0.4280.66, leading to possible memory
corruption.

- CVE-2020-16022 (access restriction bypass)

An insufficient policy enforcement security issue has been found in the
networking component of the chromium browser before 87.0.4280.66.

- CVE-2020-16023 (arbitrary code execution)

A use after free security issue has been found in the WebCodecs
component of the chromium browser before 87.0.4280.66.

- CVE-2020-16024 (arbitrary code execution)

A heap-based buffer overflow has been found in the UI component of the
chromium browser before 87.0.4280.66.

- CVE-2020-16025 (arbitrary code execution)

A heap-based buffer overflow has been found in the clipboard component
of the chromium browser before 87.0.4280.66.

- CVE-2020-16026 (arbitrary code execution)

A use after free security issue has been found in the WebRTC component
of the chromium browser before 87.0.4280.66.

- CVE-2020-16027 (access restriction bypass)

An insufficient policy enforcement security issue has been found in the
developer tools component of the chromium browser before 87.0.4280.66.

- CVE-2020-16028 (arbitrary code execution)

A heap-based buffer overflow has been found in the WebRTC component of
the chromium browser before 87.0.4280.66.

- CVE-2020-16029 (access restriction bypass)

An inappropriate implementation security issue has been found in the
PDFium component of the chromium browser before 87.0.4280.66.

- CVE-2020-16030 (insufficient validation)

An insufficient data validation security issue has been found in the
Blink component of the chromium browser before 87.0.4280.66.

- CVE-2020-16031 (content spoofing)

An incorrect security UI issue has been found in the tab preview
component of the chromium browser before 87.0.4280.66.

- CVE-2020-16032 (content spoofing)

An incorrect security UI issue has been found in the sharing component
of the chromium browser before 87.0.4280.66.

- CVE-2020-16033 (content spoofing)

A incorrect security UI issue has been found in the WebUSB component of
the chromium browser before 87.0.4280.66.

- CVE-2020-16034 (access restriction bypass)

An inappropriate implementation security issue has been found in the
WebRTC component of the chromium browser before 87.0.4280.66.

- CVE-2020-16035 (insufficient validation)

An insufficient data validation security issue has been found in the
cros-disks component of the chromium browser before 87.0.4280.66.

- CVE-2020-16036 (access restriction bypass)

An inappropriate implementation security issue has been found in the
cookies component of the chromium browser before 87.0.4280.66.

Impact
=====
A remote attacker might be able to trick a user into wrongly assessing
the security of a website, WebUSB connection or a tab preview via UI
spoofing. Further, a remote attacker may be able to bypass security
restrictions, access sensitive information and execute arbitrary code

References
=========
https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_11.html
https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_17.html
https://www.mozilla.org/en-US/security/advisories/mfsa2020-50/#CVE-2020-16012
https://bugzilla.mozilla.org/show_bug.cgi?id=1642028
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://bugs.chromium.org/p/chromium/issues/detail
https://security.archlinux.org/CVE-2020-16012
https://security.archlinux.org/CVE-2020-16014
https://security.archlinux.org/CVE-2020-16015
https://security.archlinux.org/CVE-2020-16018
https://security.archlinux.org/CVE-2020-16019
https://security.archlinux.org/CVE-2020-16020
https://security.archlinux.org/CVE-2020-16021
https://security.archlinux.org/CVE-2020-16022
https://security.archlinux.org/CVE-2020-16023
https://security.archlinux.org/CVE-2020-16024
https://security.archlinux.org/CVE-2020-16025
https://security.archlinux.org/CVE-2020-16026
https://security.archlinux.org/CVE-2020-16027
https://security.archlinux.org/CVE-2020-16028
https://security.archlinux.org/CVE-2020-16029
https://security.archlinux.org/CVE-2020-16030
https://security.archlinux.org/CVE-2020-16031
https://security.archlinux.org/CVE-2020-16032
https://security.archlinux.org/CVE-2020-16033
https://security.archlinux.org/CVE-2020-16034
https://security.archlinux.org/CVE-2020-16035
https://security.archlinux.org/CVE-2020-16036