Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×

Alerts This Week
Warning Icon 1 506
Alerts This Week
Warning Icon 1 506

Red Hat 6: RHSA-2017-0206-01 Important: Chromium Browser Security Issue

red hat
Calendar Grey January 26, 2017
Scroller Redhat
A recent update for firefox has resolved various vulnerabilities categorized as critical for CentOS Stream.
An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.

Summary

Chromium is an open-source web browser, powered by WebKit (Blink).
This update upgrades Chromium to version 56.0.2924.76.
Security Fix(es):
* Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when visited by the victim. (CVE-2017-5006, CVE-2017-5007, CVE-2017-5008, CVE-2017-5009, CVE-2017-5010, CVE-2017-5011, CVE-2017-5012, CVE-2017-5013, CVE-2017-5014, CVE-2017-5015, CVE-2017-5016, CVE-2017-5017, CVE-2017-5018, CVE-2017-5019, CVE-2017-5020, CVE-2017-5021, CVE-2017-5022, CVE-2017-5023, CVE-2017-5024, CVE-2017-5025, CVE-2017-5026)

Topics%20covered

Topics Covered

security advisory security issue update red hat important chromium

References

https://access.redhat.com/security/cve/CVE-2017-5006 https://access.redhat.com/security/cve/CVE-2017-5007 https://access.redhat.com/security/cve/CVE-2017-5008 https://access.redhat.com/security/cve/CVE-2017-5009 https://access.redhat.com/security/cve/CVE-2017-5010 https://access.redhat.com/security/cve/CVE-2017-5011 https://access.redhat.com/security/cve/CVE-2017-5012 https://access.redhat.com/security/cve/CVE-2017-5013 https://access.redhat.com/security/cve/CVE-2017-5014 https://access.redhat.com/security/cve/CVE-2017-5015 https://access.redhat.com/security/cve/CVE-2017-5016 https://access.redhat.com/security/cve/CVE-2017-5017 https://access.redhat.com/security/cve/CVE-2017-5018 https://access.redhat.com/security/cve/CVE-2017-5019 https://access.redhat.com/security/cve/CVE-2017-5020 https://access.redhat.com/security/cve/CVE-2017-5021 https://access.redhat.com/security/cve/CVE-2017-5022 https://access.redhat.com/security/cve/CVE-2017-5023 https://access.redhat.com/security/cve/CVE-2017-5024 https://access.redhat.com/security/cve/CVE-2017-5025 https://access.redhat.com/security/cve/CVE-2017-5026 https://access.redhat.com/security/updates/classification#important https://chromereleases.googleblog.com/2017/01/stable-channel-update-for-desktop.html

Package List

Red Hat Enterprise Linux Desktop Supplementary (v. 6):
i386: chromium-browser-56.0.2924.76-1.el6.i686.rpm chromium-browser-debuginfo-56.0.2924.76-1.el6.i686.rpm
x86_64: chromium-browser-56.0.2924.76-1.el6.x86_64.rpm chromium-browser-debuginfo-56.0.2924.76-1.el6.x86_64.rpm
Red Hat Enterprise Linux Server Supplementary (v. 6):
i386: chromium-browser-56.0.2924.76-1.el6.i686.rpm chromium-browser-debuginfo-56.0.2924.76-1.el6.i686.rpm
x86_64: chromium-browser-56.0.2924.76-1.el6.x86_64.rpm chromium-browser-debuginfo-56.0.2924.76-1.el6.x86_64.rpm
Red Hat Enterprise Linux Workstation Supplementary (v. 6):
i386: chromium-browser-56.0.2924.76-1.el6.i686.rpm chromium-browser-debuginfo-56.0.2924.76-1.el6.i686.rpm
x86_64: chromium-browser-56.0.2924.76-1.el6.x86_64.rpm chromium-browser-debuginfo-56.0.2924.76-1.el6.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key


Severity
important
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2017:0206-01
Product: Red Hat Enterprise Linux Supplementary
Advisory URL: https://access.redhat.com/errata/RHSA-2017:0206.html
Issue date: 2017-01-26

Topic

An update for chromium-browser is now available for Red Hat EnterpriseLinux 6 Supplementary.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory security issue update red hat important chromium

Relevant Releases Architectures

Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64

Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64

Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64

Bugs Fixed

1416657 - CVE-2017-5007 chromium-browser: universal xss in blink

1416658 - CVE-2017-5006 chromium-browser: universal xss in blink

1416659 - CVE-2017-5008 chromium-browser: universal xss in blink

1416660 - CVE-2017-5010 chromium-browser: universal xss in blink

1416661 - CVE-2017-5011 chromium-browser: unauthorised file access in devtools

1416662 - CVE-2017-5009 chromium-browser: out of bounds memory access in webrtc

1416663 - CVE-2017-5012 chromium-browser: heap overflow in v8

1416664 - CVE-2017-5013 chromium-browser: address spoofing in omnibox

1416665 - CVE-2017-5014 chromium-browser: heap overflow in skia

1416666 - CVE-2017-5015 chromium-browser: address spoofing in omnibox

1416667 - CVE-2017-5019 chromium-browser: use after free in renderer

1416668 - CVE-2017-5016 chromium-browser: ui spoofing in blink

1416669 - CVE-2017-5017 chromium-browser: uninitialised memory access in webm video

1416670 - CVE-2017-5018 chromium-browser: universal xss in chrome://apps

1416671 - CVE-2017-5020 chromium-browser: universal xss in chrome://downloads

1416672 - CVE-2017-5021 chromium-browser: use after free in extensions

1416673 - CVE-2017-5022 chromium-browser: bypass of content security policy in blink

1416674 - CVE-2017-5023 chromium-browser: type confusion in metrics

1416675 - CVE-2017-5024 chromium-browser: heap overflow in ffmpeg

Read the Full Advisory

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.