RedHat: RHSA-2019-4238:01 Critical: chromium-browser security update

    Date15 Dec 2019
    323
    Posted ByLinuxSecurity Advisories
    An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA256
    
    =====================================================================
                       Red Hat Security Advisory
    
    Synopsis:          Critical: chromium-browser security update
    Advisory ID:       RHSA-2019:4238-01
    Product:           Red Hat Enterprise Linux Supplementary
    Advisory URL:      https://access.redhat.com/errata/RHSA-2019:4238
    Issue date:        2019-12-16
    CVE Names:         CVE-2019-13725 CVE-2019-13726 CVE-2019-13727 
                       CVE-2019-13728 CVE-2019-13729 CVE-2019-13730 
                       CVE-2019-13732 CVE-2019-13734 CVE-2019-13735 
                       CVE-2019-13736 CVE-2019-13737 CVE-2019-13738 
                       CVE-2019-13739 CVE-2019-13740 CVE-2019-13741 
                       CVE-2019-13742 CVE-2019-13743 CVE-2019-13744 
                       CVE-2019-13745 CVE-2019-13746 CVE-2019-13747 
                       CVE-2019-13748 CVE-2019-13749 CVE-2019-13750 
                       CVE-2019-13751 CVE-2019-13752 CVE-2019-13753 
                       CVE-2019-13754 CVE-2019-13755 CVE-2019-13756 
                       CVE-2019-13757 CVE-2019-13758 CVE-2019-13759 
                       CVE-2019-13761 CVE-2019-13762 CVE-2019-13763 
                       CVE-2019-13764 
    =====================================================================
    
    1. Summary:
    
    An update for chromium-browser is now available for Red Hat Enterprise
    Linux 6 Supplementary.
    
    Red Hat Product Security has rated this update as having a security impact
    of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
    gives a detailed severity rating, is available for each vulnerability from
    the CVE link(s) in the References section.
    
    2. Relevant releases/architectures:
    
    Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, i686, x86_64
    Red Hat Enterprise Linux HPC Node Supplementary (v. 6) - i686, x86_64
    Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, i686, x86_64
    Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, i686, x86_64
    
    3. Description:
    
    Chromium is an open-source web browser, powered by WebKit (Blink).
    
    This update upgrades Chromium to version 79.0.3945.79.
    
    Security Fix(es):
    
    * chromium-browser: Use after free in Bluetooth (CVE-2019-13725)
    
    * chromium-browser: Heap buffer overflow in password manager
    (CVE-2019-13726)
    
    * chromium-browser: Insufficient policy enforcement in WebSockets
    (CVE-2019-13727)
    
    * chromium-browser: Out of bounds write in V8 (CVE-2019-13728)
    
    * chromium-browser: Use after free in WebSockets (CVE-2019-13729)
    
    * chromium-browser: Type Confusion in V8 (CVE-2019-13730)
    
    * chromium-browser: Use after free in WebAudio (CVE-2019-13732)
    
    * chromium-browser: Out of bounds write in SQLite (CVE-2019-13734)
    
    * chromium-browser: Out of bounds write in V8 (CVE-2019-13735)
    
    * chromium-browser: Type Confusion in V8 (CVE-2019-13764)
    
    * chromium-browser: Integer overflow in PDFium (CVE-2019-13736)
    
    * chromium-browser: Insufficient policy enforcement in autocomplete
    (CVE-2019-13737)
    
    * chromium-browser: Insufficient policy enforcement in navigation
    (CVE-2019-13738)
    
    * chromium-browser: Incorrect security UI in Omnibox (CVE-2019-13739)
    
    * chromium-browser: Incorrect security UI in sharing (CVE-2019-13740)
    
    * chromium-browser: Insufficient validation of untrusted input in Blink
    (CVE-2019-13741)
    
    * chromium-browser: Incorrect security UI in Omnibox (CVE-2019-13742)
    
    * chromium-browser: Incorrect security UI in external protocol handling
    (CVE-2019-13743)
    
    * chromium-browser: Insufficient policy enforcement in cookies
    (CVE-2019-13744)
    
    * chromium-browser: Insufficient policy enforcement in audio
    (CVE-2019-13745)
    
    * chromium-browser: Insufficient policy enforcement in Omnibox
    (CVE-2019-13746)
    
    * chromium-browser: Uninitialized Use in rendering (CVE-2019-13747)
    
    * chromium-browser: Insufficient policy enforcement in developer tools
    (CVE-2019-13748)
    
    * chromium-browser: Incorrect security UI in Omnibox (CVE-2019-13749)
    
    * chromium-browser: Insufficient data validation in SQLite (CVE-2019-13750)
    
    * chromium-browser: Uninitialized Use in SQLite (CVE-2019-13751)
    
    * chromium-browser: Out of bounds read in SQLite (CVE-2019-13752)
    
    * chromium-browser: Out of bounds read in SQLite (CVE-2019-13753)
    
    * chromium-browser: Insufficient policy enforcement in extensions
    (CVE-2019-13754)
    
    * chromium-browser: Insufficient policy enforcement in extensions
    (CVE-2019-13755)
    
    * chromium-browser: Incorrect security UI in printing (CVE-2019-13756)
    
    * chromium-browser: Incorrect security UI in Omnibox (CVE-2019-13757)
    
    * chromium-browser: Insufficient policy enforcement in navigation
    (CVE-2019-13758)
    
    * chromium-browser: Incorrect security UI in interstitials (CVE-2019-13759)
    
    * chromium-browser: Incorrect security UI in Omnibox (CVE-2019-13761)
    
    * chromium-browser: Insufficient policy enforcement in downloads
    (CVE-2019-13762)
    
    * chromium-browser: Insufficient policy enforcement in payments
    (CVE-2019-13763)
    
    For more details about the security issue(s), including the impact, a CVSS
    score, acknowledgments, and other related information, refer to the CVE
    page(s) listed in the References section.
    
    4. Solution:
    
    For details on how to apply this update, which includes the changes
    described in this advisory, refer to:
    
    https://access.redhat.com/articles/11258
    
    After installing the update, Chromium must be restarted for the changes to
    take effect.
    
    5. Bugs fixed (https://bugzilla.redhat.com/):
    
    1781973 - CVE-2019-13725 chromium-browser: Use after free in Bluetooth
    1781974 - CVE-2019-13726 chromium-browser: Heap buffer overflow in password manager
    1781975 - CVE-2019-13727 chromium-browser: Insufficient policy enforcement in WebSockets
    1781976 - CVE-2019-13728 chromium-browser: Out of bounds write in V8
    1781977 - CVE-2019-13729 chromium-browser: Use after free in WebSockets
    1781978 - CVE-2019-13730 chromium-browser: Type Confusion in V8
    1781979 - CVE-2019-13732 chromium-browser: Use after free in WebAudio
    1781980 - CVE-2019-13734 chromium-browser: Out of bounds write in SQLite
    1781981 - CVE-2019-13735 chromium-browser: Out of bounds write in V8
    1781982 - CVE-2019-13764 chromium-browser: Type Confusion in V8
    1781983 - CVE-2019-13736 chromium-browser: Integer overflow in PDFium
    1781984 - CVE-2019-13737 chromium-browser: Insufficient policy enforcement in autocomplete
    1781985 - CVE-2019-13738 chromium-browser: Insufficient policy enforcement in navigation
    1781986 - CVE-2019-13739 chromium-browser: Incorrect security UI in Omnibox
    1781987 - CVE-2019-13740 chromium-browser: Incorrect security UI in sharing
    1781988 - CVE-2019-13741 chromium-browser: Insufficient validation of untrusted input in Blink
    1781989 - CVE-2019-13742 chromium-browser: Incorrect security UI in Omnibox
    1781990 - CVE-2019-13743 chromium-browser: Incorrect security UI in external protocol handling
    1781991 - CVE-2019-13745 chromium-browser: Insufficient policy enforcement in audio
    1781992 - CVE-2019-13746 chromium-browser: Insufficient policy enforcement in Omnibox
    1781993 - CVE-2019-13747 chromium-browser: Uninitialized Use in rendering
    1781994 - CVE-2019-13748 chromium-browser: Insufficient policy enforcement in developer tools
    1781995 - CVE-2019-13749 chromium-browser: Incorrect security UI in Omnibox
    1781997 - CVE-2019-13750 chromium-browser: Insufficient data validation in SQLite
    1781998 - CVE-2019-13751 chromium-browser: Uninitialized Use in SQLite
    1781999 - CVE-2019-13752 chromium-browser: Out of bounds read in SQLite
    1782000 - CVE-2019-13753 chromium-browser: Out of bounds read in SQLite
    1782001 - CVE-2019-13754 chromium-browser: Insufficient policy enforcement in extensions
    1782002 - CVE-2019-13755 chromium-browser: Insufficient policy enforcement in extensions
    1782003 - CVE-2019-13756 chromium-browser: Incorrect security UI in printing
    1782004 - CVE-2019-13757 chromium-browser: Incorrect security UI in Omnibox
    1782005 - CVE-2019-13759 chromium-browser: Incorrect security UI in interstitials
    1782006 - CVE-2019-13761 chromium-browser: Incorrect security UI in Omnibox
    1782007 - CVE-2019-13762 chromium-browser: Insufficient policy enforcement in downloads
    1782008 - CVE-2019-13763 chromium-browser: Insufficient policy enforcement in payments
    1782017 - CVE-2019-13758 chromium-browser: Insufficient policy enforcement in navigation
    1782021 - CVE-2019-13744 chromium-browser: Insufficient policy enforcement in cookies
    
    6. Package List:
    
    Red Hat Enterprise Linux Desktop Supplementary (v. 6):
    
    i386:
    chromium-browser-79.0.3945.79-1.el6_10.i686.rpm
    chromium-browser-debuginfo-79.0.3945.79-1.el6_10.i686.rpm
    
    i686:
    chromium-browser-79.0.3945.79-1.el6_10.i686.rpm
    chromium-browser-debuginfo-79.0.3945.79-1.el6_10.i686.rpm
    
    x86_64:
    chromium-browser-79.0.3945.79-1.el6_10.x86_64.rpm
    chromium-browser-debuginfo-79.0.3945.79-1.el6_10.x86_64.rpm
    
    Red Hat Enterprise Linux HPC Node Supplementary (v. 6):
    
    i686:
    chromium-browser-79.0.3945.79-1.el6_10.i686.rpm
    chromium-browser-debuginfo-79.0.3945.79-1.el6_10.i686.rpm
    
    x86_64:
    chromium-browser-79.0.3945.79-1.el6_10.x86_64.rpm
    chromium-browser-debuginfo-79.0.3945.79-1.el6_10.x86_64.rpm
    
    Red Hat Enterprise Linux Server Supplementary (v. 6):
    
    i386:
    chromium-browser-79.0.3945.79-1.el6_10.i686.rpm
    chromium-browser-debuginfo-79.0.3945.79-1.el6_10.i686.rpm
    
    i686:
    chromium-browser-79.0.3945.79-1.el6_10.i686.rpm
    chromium-browser-debuginfo-79.0.3945.79-1.el6_10.i686.rpm
    
    x86_64:
    chromium-browser-79.0.3945.79-1.el6_10.x86_64.rpm
    chromium-browser-debuginfo-79.0.3945.79-1.el6_10.x86_64.rpm
    
    Red Hat Enterprise Linux Workstation Supplementary (v. 6):
    
    i386:
    chromium-browser-79.0.3945.79-1.el6_10.i686.rpm
    chromium-browser-debuginfo-79.0.3945.79-1.el6_10.i686.rpm
    
    i686:
    chromium-browser-79.0.3945.79-1.el6_10.i686.rpm
    chromium-browser-debuginfo-79.0.3945.79-1.el6_10.i686.rpm
    
    x86_64:
    chromium-browser-79.0.3945.79-1.el6_10.x86_64.rpm
    chromium-browser-debuginfo-79.0.3945.79-1.el6_10.x86_64.rpm
    
    These packages are GPG signed by Red Hat for security.  Our key and
    details on how to verify the signature are available from
    https://access.redhat.com/security/team/key/
    
    7. References:
    
    https://access.redhat.com/security/cve/CVE-2019-13725
    https://access.redhat.com/security/cve/CVE-2019-13726
    https://access.redhat.com/security/cve/CVE-2019-13727
    https://access.redhat.com/security/cve/CVE-2019-13728
    https://access.redhat.com/security/cve/CVE-2019-13729
    https://access.redhat.com/security/cve/CVE-2019-13730
    https://access.redhat.com/security/cve/CVE-2019-13732
    https://access.redhat.com/security/cve/CVE-2019-13734
    https://access.redhat.com/security/cve/CVE-2019-13735
    https://access.redhat.com/security/cve/CVE-2019-13736
    https://access.redhat.com/security/cve/CVE-2019-13737
    https://access.redhat.com/security/cve/CVE-2019-13738
    https://access.redhat.com/security/cve/CVE-2019-13739
    https://access.redhat.com/security/cve/CVE-2019-13740
    https://access.redhat.com/security/cve/CVE-2019-13741
    https://access.redhat.com/security/cve/CVE-2019-13742
    https://access.redhat.com/security/cve/CVE-2019-13743
    https://access.redhat.com/security/cve/CVE-2019-13744
    https://access.redhat.com/security/cve/CVE-2019-13745
    https://access.redhat.com/security/cve/CVE-2019-13746
    https://access.redhat.com/security/cve/CVE-2019-13747
    https://access.redhat.com/security/cve/CVE-2019-13748
    https://access.redhat.com/security/cve/CVE-2019-13749
    https://access.redhat.com/security/cve/CVE-2019-13750
    https://access.redhat.com/security/cve/CVE-2019-13751
    https://access.redhat.com/security/cve/CVE-2019-13752
    https://access.redhat.com/security/cve/CVE-2019-13753
    https://access.redhat.com/security/cve/CVE-2019-13754
    https://access.redhat.com/security/cve/CVE-2019-13755
    https://access.redhat.com/security/cve/CVE-2019-13756
    https://access.redhat.com/security/cve/CVE-2019-13757
    https://access.redhat.com/security/cve/CVE-2019-13758
    https://access.redhat.com/security/cve/CVE-2019-13759
    https://access.redhat.com/security/cve/CVE-2019-13761
    https://access.redhat.com/security/cve/CVE-2019-13762
    https://access.redhat.com/security/cve/CVE-2019-13763
    https://access.redhat.com/security/cve/CVE-2019-13764
    https://access.redhat.com/security/updates/classification/#critical
    
    8. Contact:
    
    The Red Hat security contact is . More contact
    details at https://access.redhat.com/security/team/contact/
    
    Copyright 2019 Red Hat, Inc.
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1
    
    iQIVAwUBXfdJs9zjgjWX9erEAQhLew//QvXpeADCSwIw6mOpun14JVvWnNqFxqnw
    vmW3zrB8b3eVAN+MK//iag0iWatwFnEhShmj1XxJ7OEV1lK0bINzgeeLned9OghY
    V5l7XuTey7yasMjYAYs6N0imuGmqZX5PeMShX/d61shX10F6gWKhfoMuo+Klw17U
    VJ5JsLpSsC8wgsv600xI0c/Qb1iHT7GKaSNiG0eNe+2EUM+uT6M0LnHERLG3AlZb
    IxwlEqQfeg4sm4k83oIo4BC+hohBSupcnAT7WIsRvIdgsC3wulEldoRN+RzZMZJc
    uRi0t5o9TKDI386v/+2X1tiMgHGovuclThTdW0ZbbOu8pzC6VS3dUJRfS7H9gu6C
    NeEjJmkX9osWXh3Yr7b0duDuWkScEqaOpLZMQSyqlJz5u9m2ZmnQelE3yKG7IkbA
    d4cfx9EQwsIGlu7GTInZGvEoAnX/+oX09IQqA94oIW5HF1ALolPCI+oZy256K9NE
    3FtNxJhJKy3qc9ab+OvpQPlnjnUvX8ttdEI0q+bspQgv6rQplHodB5hpzQ75NiKI
    IeA8tesEFCmwy/7tTugGtHlh3b0yrbTuA9ON/DB1/cGnIYC+SNoKn5CezJOJ6VIh
    /NiC0j3gJuBs6TxEJPRcFB0vYUgDa63ob0j+0MFXUR5t931E9fqgT+D+xgDeJYIx
    Ch/qp3Y5Pzc=
    =jKmI
    -----END PGP SIGNATURE-----
    
    --
    RHSA-announce mailing list
    This email address is being protected from spambots. You need JavaScript enabled to view it.
    https://www.redhat.com/mailman/listinfo/rhsa-announce
    

    LinuxSecurity Poll

    What do you think of the LinuxSecurity Privacy news articles?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/25-what-do-you-think-of-the-linuxsecurity-privacy-news-articles?task=poll.vote&format=json
    25
    radio
    [{"id":"90","title":"Love them!","votes":"49","type":"x","order":"1","pct":89.09,"resources":[]},{"id":"91","title":"I'm indifferent","votes":"4","type":"x","order":"2","pct":7.27,"resources":[]},{"id":"92","title":"Not interested in this topic","votes":"2","type":"x","order":"3","pct":3.64,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    Advisories

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.