Alerts This Week
Warning Icon 1 692
Alerts This Week
Warning Icon 1 692

Red Hat 6: RHSA-2020-0514-01 Important: Chromium Security Fix

red hat
Calendar Grey February 17, 2020
Dist Redhat Esm H88
Details on important chromium-browser update for Red Hat 6, including security issues and fixes.
An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.

Summary

Chromium is an open-source web browser, powered by WebKit (Blink).
This update upgrades Chromium to version 80.0.3987.87.
Security Fix(es):
* chromium-browser: Integer overflow in JavaScript (CVE-2020-6381)
* chromium-browser: Type Confusion in JavaScript (CVE-2020-6382)
* chromium-browser: Insufficient policy enforcement in storage (CVE-2020-6385)
* chromium-browser: Out of bounds write in WebRTC (CVE-2020-6387)
* chromium-browser: Out of bounds memory access in WebAudio (CVE-2020-6388)
* chromium-browser: Out of bounds write in WebRTC (CVE-2020-6389)
* chromium-browser: Out of bounds memory access in streams (CVE-2020-6390)
* libxslt: use after free in xsltCopyText in transform.c could lead to information disclosure (CVE-2019-18197)
* sqlite: invalid pointer dereference in exprListAppendList in window.c (CVE-2019-19880)
* sqlite: mishandling of certain uses of SELECT DISTINCT involving a LEFT JOIN in flattenSubquery in select.c leads to a NULL pointer dereference (CVE-2019-19923)
* sqlite: zipfileUpdate in ext/misc/zipfile.c mishandles a NULL pathname during an update of a ZIP archive (CVE-2019-19925)
* sqlite: error mishandling because of incomplete fix of CVE-2019-19880 (CVE-2019-19926)
* chromium-browser: Insufficient validation of untrusted input in Blink (CVE-2020-6391)
* chromium-browser: Insufficient policy enforcement in extensions (CVE-2020-6392)
* chromium-browser: Insufficient policy enforcement in Blink (CVE-2020-6393)
* chromium-browser: Insufficient policy enforcement in Blink (CVE-2020-6394)
* chromium-browser: Out of bounds read in JavaScript (CVE-2020-6395)
* chromium-browser: Inappropriate implementation in Skia (CVE-2020-6396)
* chromium-browser: Incorrect security UI in sharing (CVE-2020-6397)
* chromium-browser: Uninitialized use in PDFium (CVE-2020-6398)
* chromium-browser: Insufficient policy enforcement in AppCache (CVE-2020-6399)
* chromium-browser: Inappropriate implementation in CORS (CVE-2020-6400)
* chromium-browser: Insufficient validation of untrusted input in Omnibox (CVE-2020-6401)
* chromium-browser: Insufficient policy enforcement in downloads (CVE-2020-6402)
* chromium-browser: Incorrect security UI in Omnibox (CVE-2020-6403)
* chromium-browser: Inappropriate implementation in Blink (CVE-2020-6404)
* sqlite: Out-of-bounds read in SELECT with ON/USING clause (CVE-2020-6405)
* chromium-browser: Use after free in audio (CVE-2020-6406)
* chromium-browser: Insufficient policy enforcement in CORS (CVE-2020-6408)
* chromium-browser: Inappropriate implementation in Omnibox (CVE-2020-6409)
* chromium-browser: Insufficient policy enforcement in navigation (CVE-2020-6410)
* chromium-browser: Insufficient validation of untrusted input in Omnibox (CVE-2020-6411)
* chromium-browser: Insufficient validation of untrusted input in Omnibox (CVE-2020-6412)
* chromium-browser: Inappropriate implementation in Blink (CVE-2020-6413)
* chromium-browser: Insufficient policy enforcement in Safe Browsing (CVE-2020-6414)
* chromium-browser: Inappropriate implementation in JavaScript (CVE-2020-6415)
* chromium-browser: Insufficient data validation in streams (CVE-2020-6416)
* chromium-browser: Inappropriate implementation in installer (CVE-2020-6417)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Topics%20covered

Topics Covered

security advisory security issue update red hat threat important chromium-browser

References

https://access.redhat.com/security/cve/CVE-2019-18197 https://access.redhat.com/security/cve/CVE-2019-19880 https://access.redhat.com/security/cve/CVE-2019-19923 https://access.redhat.com/security/cve/CVE-2019-19925 https://access.redhat.com/security/cve/CVE-2019-19926 https://access.redhat.com/security/cve/CVE-2020-6381 https://access.redhat.com/security/cve/CVE-2020-6382 https://access.redhat.com/security/cve/CVE-2020-6385 https://access.redhat.com/security/cve/CVE-2020-6387 https://access.redhat.com/security/cve/CVE-2020-6388 https://access.redhat.com/security/cve/CVE-2020-6389 https://access.redhat.com/security/cve/CVE-2020-6390 https://access.redhat.com/security/cve/CVE-2020-6391 https://access.redhat.com/security/cve/CVE-2020-6392 https://access.redhat.com/security/cve/CVE-2020-6393 https://access.redhat.com/security/cve/CVE-2020-6394 https://access.redhat.com/security/cve/CVE-2020-6395 https://access.redhat.com/security/cve/CVE-2020-6396 https://access.redhat.com/security/cve/CVE-2020-6397 https://access.redhat.com/security/cve/CVE-2020-6398 https://access.redhat.com/security/cve/CVE-2020-6399 https://access.redhat.com/security/cve/CVE-2020-6400 https://access.redhat.com/security/cve/CVE-2020-6401 https://access.redhat.com/security/cve/CVE-2020-6402 Read the Full Advisory

Package List

Red Hat Enterprise Linux Desktop Supplementary (v. 6):
i386: chromium-browser-80.0.3987.87-1.el6_10.i686.rpm chromium-browser-debuginfo-80.0.3987.87-1.el6_10.i686.rpm
i686: chromium-browser-80.0.3987.87-1.el6_10.i686.rpm chromium-browser-debuginfo-80.0.3987.87-1.el6_10.i686.rpm
x86_64: chromium-browser-80.0.3987.87-1.el6_10.x86_64.rpm chromium-browser-debuginfo-80.0.3987.87-1.el6_10.x86_64.rpm
Red Hat Enterprise Linux HPC Node Supplementary (v. 6):
i686: chromium-browser-80.0.3987.87-1.el6_10.i686.rpm chromium-browser-debuginfo-80.0.3987.87-1.el6_10.i686.rpm
x86_64: chromium-browser-80.0.3987.87-1.el6_10.x86_64.rpm chromium-browser-debuginfo-80.0.3987.87-1.el6_10.x86_64.rpm
Red Hat Enterprise Linux Server Supplementary (v. 6):
i386: chromium-browser-80.0.3987.87-1.el6_10.i686.rpm chromium-browser-debuginfo-80.0.3987.87-1.el6_10.i686.rpm
i686: chromium-browser-80.0.3987.87-1.el6_10.i686.rpm chromium-browser-debuginfo-80.0.3987.87-1.el6_10.i686.rpm
x86_64: chromium-browser-80.0.3987.87-1.el6_10.x86_64.rpm chromium-browser-debuginfo-80.0.3987.87-1.el6_10.x86_64.rpm
Red Hat Enterprise Linux Workstation Supplementary (v. 6):
i386: chromium-browser-80.0.3987.87-1.el6_10.i686.rpm chromium-browser-debuginfo-80.0.3987.87-1.el6_10.i686.rpm
i686:

Read the Full Advisory


Severity
important
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2020:0514-01
Product: Red Hat Enterprise Linux Supplementary
Advisory URL: https://access.redhat.com/errata/RHSA-2020:0514
Issue date: 2020-02-17

Topic

An update for chromium-browser is now available for Red Hat EnterpriseLinux 6 Supplementary.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory security issue update red hat threat important chromium-browser

Relevant Releases Architectures

Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, i686, x86_64

Red Hat Enterprise Linux HPC Node Supplementary (v. 6) - i686, x86_64

Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, i686, x86_64

Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, i686, x86_64

Bugs Fixed

1770768 - CVE-2019-18197 libxslt: use after free in xsltCopyText in transform.c could lead to information disclosure

1787032 - CVE-2019-19880 sqlite: invalid pointer dereference in exprListAppendList in window.c

1788846 - CVE-2019-19923 sqlite: mishandling of certain uses of SELECT DISTINCT involving a LEFT JOIN in flattenSubquery in select.c leads to a NULL pointer dereference

1788866 - CVE-2019-19925 sqlite: zipfileUpdate in ext/misc/zipfile.c mishandles a NULL pathname during an update of a ZIP archive

1789364 - CVE-2019-19926 sqlite: error mishandling because of incomplete fix of CVE-2019-19880

1801160 - CVE-2020-6381 chromium-browser: Integer overflow in JavaScript

1801161 - CVE-2020-6382 chromium-browser: Type Confusion in JavaScript

1801162 - CVE-2020-6385 chromium-browser: Insufficient policy enforcement in storage

1801163 - CVE-2020-6387 chromium-browser: Out of bounds write in WebRTC

1801164 - CVE-2020-6388 chromium-browser: Out of bounds memory access in WebAudio

1801165 - CVE-2020-6389 chromium-browser: Out of bounds write in WebRTC

1801166 - CVE-2020-6390 chromium-browser: Out of bounds memory access in streams

1801167 - CVE-2020-6391 chromium-browser: Insufficient validation of untrusted input in Blink

1801168 - CVE-2020-6392 chromium-browser: Insufficient policy enforcement in extensions

1801169 - CVE-2020-6393 chromium-browser: Insufficient policy enforcement in Blink

Read the Full Advisory

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here