Debian: DSA-4182-1: chromium-browser security update
Summary
Several vulnerabilities have been discovered in the chromium web browser.
CVE-2018-6056
lokihardt discovered an error in the v8 javascript library.
CVE-2018-6057
Gal Beniamini discovered errors related to shared memory permissions.
CVE-2018-6060
Omair discovered a use-after-free issue in blink/webkit.
CVE-2018-6061
Guang Gong discovered a race condition in the v8 javascript library.
CVE-2018-6062
A heap overflow issue was discovered in the v8 javascript library.
CVE-2018-6063
Gal Beniamini discovered errors related to shared memory permissions.
CVE-2018-6064
lokihardt discovered a type confusion error in the v8 javascript
library.
CVE-2018-6065
Mark Brand discovered an integer overflow issue in the v8 javascript
library.
CVE-2018-6066
Masato Kinugawa discovered a way to bypass the Same Origin Policy.
CVE-2018-6067
Ned Williamson discovered a buffer overflow issue in the skia library.
CVE-2018-6068
Luan Herrera discovered object lifecycle issues.
CVE-2018-6069
Wanglu and Yangkang discovered a stack overflow issue in the skia
library.
CVE-2018-6070
Rob Wu discovered a way to bypass the Content Security Policy.
CVE-2018-6071
A heap overflow issue was discovered in the skia library.
CVE-2018-6072
Atte Kettunen discovered an integer overflow issue in the pdfium
library.
CVE-2018-6073
Omair discover a heap overflow issue in the WebGL implementation.
CVE-2018-6074
Abdulrahman Alqabandi discovered a way to cause a downloaded web page
to not contain a Mark of the Web.
CVE-2018-6075
Inti De Ceukelaire discovered a way to bypass the Same Origin Policy.
CVE-2018-6076
Mateusz Krzeszowiec discovered that URL fragment identifiers could be
handled incorrectly.
CVE-2018-6077
Khalil Zhani discovered a timing issue.
CVE-2018-6078
Khalil Zhani discovered a URL spoofing issue.
CVE-2018-6079
Ivars discovered an information disclosure issue.
CVE-2018-6080
Gal Beniamini discovered an information disclosure issue.
CVE-2018-6081
Rob Wu discovered a cross-site scripting issue.
CVE-2018-6082
WenXu Wu discovered a way to bypass blocked ports.
CVE-2018-6083
Jun Kokatsu discovered that AppManifests could be handled incorrectly.
CVE-2018-6085
Ned Williamson discovered a use-after-free issue.
CVE-2018-6086
Ned Williamson discovered a use-after-free issue.
CVE-2018-6087
A use-after-free issue was discovered in the WebAssembly implementation.
CVE-2018-6088
A use-after-free issue was discovered in the pdfium library.
CVE-2018-6089
Rob Wu discovered a way to bypass the Same Origin Policy.
CVE-2018-6090
ZhanJia Song discovered a heap overflow issue in the skia library.
CVE-2018-6091
Jun Kokatsu discovered that plugins could be handled incorrectly.
CVE-2018-6092
Natalie Silvanovich discovered an integer overflow issue in the
WebAssembly implementation.
CVE-2018-6093
Jun Kokatsu discovered a way to bypass the Same Origin Policy.
CVE-2018-6094
Chris Rohlf discovered a regression in garbage collection hardening.
CVE-2018-6095
Abdulrahman Alqabandi discovered files could be uploaded without user
interaction.
CVE-2018-6096
WenXu Wu discovered a user interface spoofing issue.
CVE-2018-6097
xisigr discovered a user interface spoofing issue.
CVE-2018-6098
Khalil Zhani discovered a URL spoofing issue.
CVE-2018-6099
Jun Kokatsu discovered a way to bypass the Cross Origin Resource
Sharing mechanism.
CVE-2018-6100
Lnyas Zhang dsicovered a URL spoofing issue.
CVE-2018-6101
Rob Wu discovered an issue in the developer tools remote debugging
protocol.
CVE-2018-6102
Khalil Zhani discovered a URL spoofing issue.
CVE-2018-6103
Khalil Zhani discovered a user interface spoofing issue.
CVE-2018-6104
Khalil Zhani discovered a URL spoofing issue.
CVE-2018-6105
Khalil Zhani discovered a URL spoofing issue.
CVE-2018-6106
lokihardt discovered that v8 promises could be handled incorrectly.
CVE-2018-6107
Khalil Zhani discovered a URL spoofing issue.
CVE-2018-6108
Khalil Zhani discovered a URL spoofing issue.
CVE-2018-6109
Dominik Weber discovered a way to misuse the FileAPI feature.
CVE-2018-6110
Wenxiang Qian discovered that local plain text files could be handled
incorrectly.
CVE-2018-6111
Khalil Zhani discovered a use-after-free issue in the developer tools.
CVE-2018-6112
Khalil Zhani discovered incorrect handling of URLs in the developer
tools.
CVE-2018-6113
Khalil Zhani discovered a URL spoofing issue.
CVE-2018-6114
Lnyas Zhang discovered a way to bypass the Content Security Policy.
CVE-2018-6116
Chengdu Security Response Center discovered an error when memory
is low.
CVE-2018-6117
Spencer Dailey discovered an error in form autofill settings.
For the oldstable distribution (jessie), security support for chromium
has been discontinued.
For the stable distribution (stretch), these problems have been fixed in
version 66.0.3359.117-1~deb9u1.
We recommend that you upgrade your chromium-browser packages.
For the detailed security status of chromium-browser please refer to
its security tracker page at:
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
