what you don't know can hurt you

Red Hat Security Advisory 2019-0309-01

Red Hat Security Advisory 2019-0309-01
Posted Feb 11, 2019
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2019-0309-01 - Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 72.0.3626.81. Issues addressed include a buffer overflow vulnerability.

tags | advisory, web, overflow
systems | linux, redhat
advisories | CVE-2019-5754, CVE-2019-5755, CVE-2019-5756, CVE-2019-5757, CVE-2019-5758, CVE-2019-5759, CVE-2019-5760, CVE-2019-5761, CVE-2019-5762, CVE-2019-5763, CVE-2019-5764, CVE-2019-5765, CVE-2019-5766, CVE-2019-5767, CVE-2019-5768, CVE-2019-5769, CVE-2019-5770, CVE-2019-5771, CVE-2019-5772, CVE-2019-5773, CVE-2019-5774, CVE-2019-5775, CVE-2019-5776, CVE-2019-5777, CVE-2019-5778, CVE-2019-5779, CVE-2019-5780, CVE-2019-5781
MD5 | 3121ab5441e39be58b3ed8ee75189d5f

Red Hat Security Advisory 2019-0309-01

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================
Red Hat Security Advisory

Synopsis: Critical: chromium-browser security update
Advisory ID: RHSA-2019:0309-01
Product: Red Hat Enterprise Linux Supplementary
Advisory URL: https://access.redhat.com/errata/RHSA-2019:0309
Issue date: 2019-02-11
CVE Names: CVE-2019-5754 CVE-2019-5755 CVE-2019-5756
CVE-2019-5757 CVE-2019-5758 CVE-2019-5759
CVE-2019-5760 CVE-2019-5761 CVE-2019-5762
CVE-2019-5763 CVE-2019-5764 CVE-2019-5765
CVE-2019-5766 CVE-2019-5767 CVE-2019-5768
CVE-2019-5769 CVE-2019-5770 CVE-2019-5771
CVE-2019-5772 CVE-2019-5773 CVE-2019-5774
CVE-2019-5775 CVE-2019-5776 CVE-2019-5777
CVE-2019-5778 CVE-2019-5779 CVE-2019-5780
CVE-2019-5781 CVE-2019-5782
====================================================================
1. Summary:

An update for chromium-browser is now available for Red Hat Enterprise
Linux 6 Supplementary.

Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64
Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64
Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64

3. Description:

Chromium is an open-source web browser, powered by WebKit (Blink).

This update upgrades Chromium to version 72.0.3626.81.

Security Fix(es):

* chromium-browser: Inappropriate implementation in QUIC Networking
(CVE-2019-5754)

* chromium-browser: Inappropriate implementation in V8 (CVE-2019-5755)

* chromium-browser: Use after free in PDFium (CVE-2019-5756)

* chromium-browser: Type Confusion in SVG (CVE-2019-5757)

* chromium-browser: Use after free in Blink (CVE-2019-5758)

* chromium-browser: Use after free in HTML select elements (CVE-2019-5759)

* chromium-browser: Use after free in WebRTC (CVE-2019-5760)

* chromium-browser: Use after free in SwiftShader (CVE-2019-5761)

* chromium-browser: Use after free in PDFium (CVE-2019-5762)

* chromium-browser: Insufficient validation of untrusted input in V8
(CVE-2019-5763)

* chromium-browser: Use after free in WebRTC (CVE-2019-5764)

* chromium-browser: Insufficient policy enforcement in the browser
(CVE-2019-5765)

* chromium-browser: Inappropriate implementation in V8 (CVE-2019-5782)

* chromium-browser: Insufficient policy enforcement in Canvas
(CVE-2019-5766)

* chromium-browser: Incorrect security UI in WebAPKs (CVE-2019-5767)

* chromium-browser: Insufficient policy enforcement in DevTools
(CVE-2019-5768)

* chromium-browser: Insufficient validation of untrusted input in Blink
(CVE-2019-5769)

* chromium-browser: Heap buffer overflow in WebGL (CVE-2019-5770)

* chromium-browser: Heap buffer overflow in SwiftShader (CVE-2019-5771)

* chromium-browser: Use after free in PDFium (CVE-2019-5772)

* chromium-browser: Insufficient data validation in IndexedDB
(CVE-2019-5773)

* chromium-browser: Insufficient validation of untrusted input in
SafeBrowsing (CVE-2019-5774)

* chromium-browser: Insufficient policy enforcement in Omnibox
(CVE-2019-5775)

* chromium-browser: Insufficient policy enforcement in Omnibox
(CVE-2019-5776)

* chromium-browser: Insufficient policy enforcement in Omnibox
(CVE-2019-5777)

* chromium-browser: Insufficient policy enforcement in Extensions
(CVE-2019-5778)

* chromium-browser: Insufficient policy enforcement in ServiceWorker
(CVE-2019-5779)

* chromium-browser: Insufficient policy enforcement (CVE-2019-5780)

* chromium-browser: Insufficient policy enforcement in Omnibox
(CVE-2019-5781)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

1670737 - CVE-2019-5754 chromium-browser: Inappropriate implementation in QUIC Networking
1670738 - CVE-2019-5782 chromium-browser: Inappropriate implementation in V8
1670739 - CVE-2019-5755 chromium-browser: Inappropriate implementation in V8
1670740 - CVE-2019-5756 chromium-browser: Use after free in PDFium
1670741 - CVE-2019-5757 chromium-browser: Type Confusion in SVG
1670742 - CVE-2019-5758 chromium-browser: Use after free in Blink
1670743 - CVE-2019-5759 chromium-browser: Use after free in HTML select elements
1670744 - CVE-2019-5760 chromium-browser: Use after free in WebRTC
1670745 - CVE-2019-5761 chromium-browser: Use after free in SwiftShader
1670746 - CVE-2019-5762 chromium-browser: Use after free in PDFium
1670747 - CVE-2019-5763 chromium-browser: Insufficient validation of untrusted input in V8
1670748 - CVE-2019-5764 chromium-browser: Use after free in WebRTC
1670749 - CVE-2019-5765 chromium-browser: Insufficient policy enforcement in the browser
1670750 - CVE-2019-5766 chromium-browser: Insufficient policy enforcement in Canvas
1670751 - CVE-2019-5767 chromium-browser: Incorrect security UI in WebAPKs
1670752 - CVE-2019-5768 chromium-browser: Insufficient policy enforcement in DevTools
1670753 - CVE-2019-5769 chromium-browser: Insufficient validation of untrusted input in Blink
1670754 - CVE-2019-5770 chromium-browser: Heap buffer overflow in WebGL
1670755 - CVE-2019-5771 chromium-browser: Heap buffer overflow in SwiftShader
1670756 - CVE-2019-5772 chromium-browser: Use after free in PDFium
1670757 - CVE-2019-5773 chromium-browser: Insufficient data validation in IndexedDB
1670758 - CVE-2019-5774 chromium-browser: Insufficient validation of untrusted input in SafeBrowsing
1670759 - CVE-2019-5775 chromium-browser: Insufficient policy enforcement in Omnibox
1670760 - CVE-2019-5776 chromium-browser: Insufficient policy enforcement in Omnibox
1670761 - CVE-2019-5777 chromium-browser: Insufficient policy enforcement in Omnibox
1670762 - CVE-2019-5778 chromium-browser: Insufficient policy enforcement in Extensions
1670763 - CVE-2019-5779 chromium-browser: Insufficient policy enforcement in ServiceWorker
1670764 - CVE-2019-5780 chromium-browser: Insufficient policy enforcement
1670771 - CVE-2019-5781 chromium-browser: Insufficient policy enforcement in Omnibox

6. Package List:

Red Hat Enterprise Linux Desktop Supplementary (v. 6):

i386:
chromium-browser-72.0.3626.81-1.el6_10.i686.rpm
chromium-browser-debuginfo-72.0.3626.81-1.el6_10.i686.rpm

x86_64:
chromium-browser-72.0.3626.81-1.el6_10.x86_64.rpm
chromium-browser-debuginfo-72.0.3626.81-1.el6_10.x86_64.rpm

Red Hat Enterprise Linux Server Supplementary (v. 6):

i386:
chromium-browser-72.0.3626.81-1.el6_10.i686.rpm
chromium-browser-debuginfo-72.0.3626.81-1.el6_10.i686.rpm

x86_64:
chromium-browser-72.0.3626.81-1.el6_10.x86_64.rpm
chromium-browser-debuginfo-72.0.3626.81-1.el6_10.x86_64.rpm

Red Hat Enterprise Linux Workstation Supplementary (v. 6):

i386:
chromium-browser-72.0.3626.81-1.el6_10.i686.rpm
chromium-browser-debuginfo-72.0.3626.81-1.el6_10.i686.rpm

x86_64:
chromium-browser-72.0.3626.81-1.el6_10.x86_64.rpm
chromium-browser-debuginfo-72.0.3626.81-1.el6_10.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2019-5754
https://access.redhat.com/security/cve/CVE-2019-5755
https://access.redhat.com/security/cve/CVE-2019-5756
https://access.redhat.com/security/cve/CVE-2019-5757
https://access.redhat.com/security/cve/CVE-2019-5758
https://access.redhat.com/security/cve/CVE-2019-5759
https://access.redhat.com/security/cve/CVE-2019-5760
https://access.redhat.com/security/cve/CVE-2019-5761
https://access.redhat.com/security/cve/CVE-2019-5762
https://access.redhat.com/security/cve/CVE-2019-5763
https://access.redhat.com/security/cve/CVE-2019-5764
https://access.redhat.com/security/cve/CVE-2019-5765
https://access.redhat.com/security/cve/CVE-2019-5766
https://access.redhat.com/security/cve/CVE-2019-5767
https://access.redhat.com/security/cve/CVE-2019-5768
https://access.redhat.com/security/cve/CVE-2019-5769
https://access.redhat.com/security/cve/CVE-2019-5770
https://access.redhat.com/security/cve/CVE-2019-5771
https://access.redhat.com/security/cve/CVE-2019-5772
https://access.redhat.com/security/cve/CVE-2019-5773
https://access.redhat.com/security/cve/CVE-2019-5774
https://access.redhat.com/security/cve/CVE-2019-5775
https://access.redhat.com/security/cve/CVE-2019-5776
https://access.redhat.com/security/cve/CVE-2019-5777
https://access.redhat.com/security/cve/CVE-2019-5778
https://access.redhat.com/security/cve/CVE-2019-5779
https://access.redhat.com/security/cve/CVE-2019-5780
https://access.redhat.com/security/cve/CVE-2019-5781
https://access.redhat.com/security/cve/CVE-2019-5782
https://access.redhat.com/security/updates/classification/#critical

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2019 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBXGHADdzjgjWX9erEAQgobA/+NLQCz6yn6c+90AYyWZryZHALs0zpfDS7
ZowZbdjP4mcPNU2XImW3wEh44zZ4yblzB34uWQ5zDKVCWOpv/zJtbycpFWQo1dM+
+fN2SU+9YwnC6ERuWv8OckYOUIjaPN9NOaMwxoCsb20j717kGS/+uTVQkZdZViZn
ShakiQ4G71b/Bb7ZZh8WCiMVNa5ai12SVT7VcvupMLGeRlKVlqwhuyHRDdVjzw6z
Svn3GU/whT89Np3elgPHvsp+CmREGMXpOvTBjcU2Qlnr5MmBrUlQm83fW8D5wyop
HznwTL7lq5APg25L5djhnRuw7J8oN4C0/l04G4mXFgRxhcFod5hCUI986Xqm6WDE
LNmhp8S5TexTxRqt6iUVX+oXtteqpObkakYsE6ySC54y9NvKNsHAChekW5bVBYA6
GZNJJV5AzyEQYu3vLJl9O5MbzeJTvg2qOPVoETmQ5pBSOxQx0vlarAve8Zk2xMO4
44/swuJe9hPa3Zs5iZgnR9HiGUymQYeBfJmkD56gWrUqwS5UbOxOtsTpJXJ5no6q
f7I5RIQiP54RoYtf7+BE6+ebplndPSBnK+sHtqW3hQLJItsabXNzIzyiqWJYbnat
1NbgTrb8wflHI+hlh0tkqbQAALm5yJxVr13tjlvoFuUs3YFk0ATGO/jvRT4RboIn
qULDfEwfZuM=ptcL
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

February 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    22 Files
  • 2
    Feb 2nd
    9 Files
  • 3
    Feb 3rd
    2 Files
  • 4
    Feb 4th
    15 Files
  • 5
    Feb 5th
    50 Files
  • 6
    Feb 6th
    24 Files
  • 7
    Feb 7th
    15 Files
  • 8
    Feb 8th
    6 Files
  • 9
    Feb 9th
    1 Files
  • 10
    Feb 10th
    1 Files
  • 11
    Feb 11th
    22 Files
  • 12
    Feb 12th
    25 Files
  • 13
    Feb 13th
    16 Files
  • 14
    Feb 14th
    32 Files
  • 15
    Feb 15th
    15 Files
  • 16
    Feb 16th
    10 Files
  • 17
    Feb 17th
    2 Files
  • 18
    Feb 18th
    27 Files
  • 19
    Feb 19th
    32 Files
  • 20
    Feb 20th
    7 Files
  • 21
    Feb 21st
    0 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close