Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×

Alerts This Week
Warning Icon 1 439
Alerts This Week
Warning Icon 1 439

Red Hat: RHSA-2019-4238-01 Critical: Chromium Browser Security Fix

red hat
Calendar Grey December 16, 2019
Scroller Redhat
Oracle unveiled a vital patch for java-runtime, tackling multiple vulnerabilities. Crucial for developers.
An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.

Summary

Chromium is an open-source web browser, powered by WebKit (Blink).
This update upgrades Chromium to version 79.0.3945.79.
Security Fix(es):
* chromium-browser: Use after free in Bluetooth (CVE-2019-13725)
* chromium-browser: Heap buffer overflow in password manager (CVE-2019-13726)
* chromium-browser: Insufficient policy enforcement in WebSockets (CVE-2019-13727)
* chromium-browser: Out of bounds write in V8 (CVE-2019-13728)
* chromium-browser: Use after free in WebSockets (CVE-2019-13729)
* chromium-browser: Type Confusion in V8 (CVE-2019-13730)
* chromium-browser: Use after free in WebAudio (CVE-2019-13732)
* chromium-browser: Out of bounds write in SQLite (CVE-2019-13734)
* chromium-browser: Out of bounds write in V8 (CVE-2019-13735)
* chromium-browser: Type Confusion in V8 (CVE-2019-13764)
* chromium-browser: Integer overflow in PDFium (CVE-2019-13736)
* chromium-browser: Insufficient policy enforcement in autocomplete (CVE-2019-13737)
* chromium-browser: Insufficient policy enforcement in navigation (CVE-2019-13738)
* chromium-browser: Incorrect security UI in Omnibox (CVE-2019-13739)
* chromium-browser: Incorrect security UI in sharing (CVE-2019-13740)
* chromium-browser: Insufficient validation of untrusted input in Blink (CVE-2019-13741)
* chromium-browser: Incorrect security UI in Omnibox (CVE-2019-13742)
* chromium-browser: Incorrect security UI in external protocol handling (CVE-2019-13743)
* chromium-browser: Insufficient policy enforcement in cookies (CVE-2019-13744)
* chromium-browser: Insufficient policy enforcement in audio (CVE-2019-13745)
* chromium-browser: Insufficient policy enforcement in Omnibox (CVE-2019-13746)
* chromium-browser: Uninitialized Use in rendering (CVE-2019-13747)
* chromium-browser: Insufficient policy enforcement in developer tools (CVE-2019-13748)
* chromium-browser: Incorrect security UI in Omnibox (CVE-2019-13749)
* chromium-browser: Insufficient data validation in SQLite (CVE-2019-13750)
* chromium-browser: Uninitialized Use in SQLite (CVE-2019-13751)
* chromium-browser: Out of bounds read in SQLite (CVE-2019-13752)
* chromium-browser: Out of bounds read in SQLite (CVE-2019-13753)
* chromium-browser: Insufficient policy enforcement in extensions (CVE-2019-13754)
* chromium-browser: Insufficient policy enforcement in extensions (CVE-2019-13755)
* chromium-browser: Incorrect security UI in printing (CVE-2019-13756)
* chromium-browser: Incorrect security UI in Omnibox (CVE-2019-13757)
* chromium-browser: Insufficient policy enforcement in navigation (CVE-2019-13758)
* chromium-browser: Incorrect security UI in interstitials (CVE-2019-13759)
* chromium-browser: Incorrect security UI in Omnibox (CVE-2019-13761)
* chromium-browser: Insufficient policy enforcement in downloads (CVE-2019-13762)
* chromium-browser: Insufficient policy enforcement in payments (CVE-2019-13763)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Topics%20covered

Topics Covered

security advisory Red Hat critical update security impact chromium-browser

References

https://access.redhat.com/security/cve/CVE-2019-13725 https://access.redhat.com/security/cve/CVE-2019-13726 https://access.redhat.com/security/cve/CVE-2019-13727 https://access.redhat.com/security/cve/CVE-2019-13728 https://access.redhat.com/security/cve/CVE-2019-13729 https://access.redhat.com/security/cve/CVE-2019-13730 https://access.redhat.com/security/cve/CVE-2019-13732 https://access.redhat.com/security/cve/CVE-2019-13734 https://access.redhat.com/security/cve/CVE-2019-13735 https://access.redhat.com/security/cve/CVE-2019-13736 https://access.redhat.com/security/cve/CVE-2019-13737 https://access.redhat.com/security/cve/CVE-2019-13738 https://access.redhat.com/security/cve/CVE-2019-13739 https://access.redhat.com/security/cve/CVE-2019-13740 https://access.redhat.com/security/cve/CVE-2019-13741 https://access.redhat.com/security/cve/CVE-2019-13742 https://access.redhat.com/security/cve/CVE-2019-13743 https://access.redhat.com/security/cve/CVE-2019-13744 https://access.redhat.com/security/cve/CVE-2019-13745 https://access.redhat.com/security/cve/CVE-2019-13746 https://access.redhat.com/security/cve/CVE-2019-13747 https://access.redhat.com/security/cve/CVE-2019-13748 https://access.redhat.com/security/cve/CVE-2019-13749 Read the Full Advisory

Package List

Red Hat Enterprise Linux Desktop Supplementary (v. 6):
i386: chromium-browser-79.0.3945.79-1.el6_10.i686.rpm chromium-browser-debuginfo-79.0.3945.79-1.el6_10.i686.rpm
i686: chromium-browser-79.0.3945.79-1.el6_10.i686.rpm chromium-browser-debuginfo-79.0.3945.79-1.el6_10.i686.rpm
x86_64: chromium-browser-79.0.3945.79-1.el6_10.x86_64.rpm chromium-browser-debuginfo-79.0.3945.79-1.el6_10.x86_64.rpm
Red Hat Enterprise Linux HPC Node Supplementary (v. 6):
i686: chromium-browser-79.0.3945.79-1.el6_10.i686.rpm chromium-browser-debuginfo-79.0.3945.79-1.el6_10.i686.rpm
x86_64: chromium-browser-79.0.3945.79-1.el6_10.x86_64.rpm chromium-browser-debuginfo-79.0.3945.79-1.el6_10.x86_64.rpm
Red Hat Enterprise Linux Server Supplementary (v. 6):
i386: chromium-browser-79.0.3945.79-1.el6_10.i686.rpm chromium-browser-debuginfo-79.0.3945.79-1.el6_10.i686.rpm
i686: chromium-browser-79.0.3945.79-1.el6_10.i686.rpm chromium-browser-debuginfo-79.0.3945.79-1.el6_10.i686.rpm
x86_64: chromium-browser-79.0.3945.79-1.el6_10.x86_64.rpm chromium-browser-debuginfo-79.0.3945.79-1.el6_10.x86_64.rpm
Red Hat Enterprise Linux Workstation Supplementary (v. 6):
i386: chromium-browser-79.0.3945.79-1.el6_10.i686.rpm chromium-browser-debuginfo-79.0.3945.79-1.el6_10.i686.rpm
i686:

Read the Full Advisory


Severity
critical
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2019:4238-01
Product: Red Hat Enterprise Linux Supplementary
Advisory URL: https://access.redhat.com/errata/RHSA-2019:4238
Issue date: 2019-12-16

Topic

An update for chromium-browser is now available for Red Hat EnterpriseLinux 6 Supplementary.Red Hat Product Security has rated this update as having a security impactof Critical. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory Red Hat critical update security impact chromium-browser

Relevant Releases Architectures

Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, i686, x86_64

Red Hat Enterprise Linux HPC Node Supplementary (v. 6) - i686, x86_64

Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, i686, x86_64

Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, i686, x86_64

Bugs Fixed

1781973 - CVE-2019-13725 chromium-browser: Use after free in Bluetooth

1781974 - CVE-2019-13726 chromium-browser: Heap buffer overflow in password manager

1781975 - CVE-2019-13727 chromium-browser: Insufficient policy enforcement in WebSockets

1781976 - CVE-2019-13728 chromium-browser: Out of bounds write in V8

1781977 - CVE-2019-13729 chromium-browser: Use after free in WebSockets

1781978 - CVE-2019-13730 chromium-browser: Type Confusion in V8

1781979 - CVE-2019-13732 chromium-browser: Use after free in WebAudio

1781980 - CVE-2019-13734 chromium-browser: Out of bounds write in SQLite

1781981 - CVE-2019-13735 chromium-browser: Out of bounds write in V8

1781982 - CVE-2019-13764 chromium-browser: Type Confusion in V8

1781983 - CVE-2019-13736 chromium-browser: Integer overflow in PDFium

1781984 - CVE-2019-13737 chromium-browser: Insufficient policy enforcement in autocomplete

1781985 - CVE-2019-13738 chromium-browser: Insufficient policy enforcement in navigation

1781986 - CVE-2019-13739 chromium-browser: Incorrect security UI in Omnibox

1781987 - CVE-2019-13740 chromium-browser: Incorrect security UI in sharing

1781988 - CVE-2019-13741 chromium-browser: Insufficient validation of untrusted input in Blink

1781989 - CVE-2019-13742 chromium-browser: Incorrect security UI in Omnibox

1781990 - CVE-2019-13743 chromium-browser: Incorrect security UI in external protocol handling

Read the Full Advisory

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.