what you don't know can hurt you

Red Hat Security Advisory 2019-0708-01

Red Hat Security Advisory 2019-0708-01
Posted Apr 8, 2019
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2019-0708-01 - Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 73.0.3683.75. Issues addressed include buffer overflow and bypass vulnerabilities.

tags | advisory, web, overflow, vulnerability
systems | linux, redhat
advisories | CVE-2019-5787, CVE-2019-5788, CVE-2019-5789, CVE-2019-5790, CVE-2019-5791, CVE-2019-5792, CVE-2019-5793, CVE-2019-5794, CVE-2019-5795, CVE-2019-5796, CVE-2019-5797, CVE-2019-5798, CVE-2019-5799, CVE-2019-5800, CVE-2019-5802, CVE-2019-5803
MD5 | 34532bfa952cce5193284c32609a391c

Red Hat Security Advisory 2019-0708-01

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================
Red Hat Security Advisory

Synopsis: Important: chromium-browser security update
Advisory ID: RHSA-2019:0708-01
Product: Red Hat Enterprise Linux Supplementary
Advisory URL: https://access.redhat.com/errata/RHSA-2019:0708
Issue date: 2019-04-08
CVE Names: CVE-2019-5787 CVE-2019-5788 CVE-2019-5789
CVE-2019-5790 CVE-2019-5791 CVE-2019-5792
CVE-2019-5793 CVE-2019-5794 CVE-2019-5795
CVE-2019-5796 CVE-2019-5797 CVE-2019-5798
CVE-2019-5799 CVE-2019-5800 CVE-2019-5802
CVE-2019-5803
====================================================================
1. Summary:

An update for chromium-browser is now available for Red Hat Enterprise
Linux 6 Supplementary.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, i686, x86_64
Red Hat Enterprise Linux HPC Node Supplementary (v. 6) - i686, x86_64
Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, i686, x86_64
Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, i686, x86_64

3. Description:

Chromium is an open-source web browser, powered by WebKit (Blink).

This update upgrades Chromium to version 73.0.3683.75.

Security Fix(es):

* chromium-browser: Use after free in Canvas (CVE-2019-5787)

* chromium-browser: Use after free in FileAPI (CVE-2019-5788)

* chromium-browser: Use after free in WebMIDI (CVE-2019-5789)

* chromium-browser: Heap buffer overflow in V8 (CVE-2019-5790)

* chromium-browser: Type confusion in V8 (CVE-2019-5791)

* chromium-browser: Integer overflow in PDFium (CVE-2019-5792)

* chromium-browser: Excessive permissions for private API in Extensions
(CVE-2019-5793)

* chromium-browser: Security UI spoofing (CVE-2019-5794)

* chromium-browser: Integer overflow in PDFium (CVE-2019-5795)

* chromium-browser: Race condition in Extensions (CVE-2019-5796)

* chromium-browser: Race condition in DOMStorage (CVE-2019-5797)

* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)

* chromium-browser: CSP bypass with blob URL (CVE-2019-5799)

* chromium-browser: CSP bypass with blob URL (CVE-2019-5800)

* chromium-browser: Security UI spoofing (CVE-2019-5802)

* chromium-browser: CSP bypass with Javascript URLs (CVE-2019-5803)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

1688189 - CVE-2019-5787 chromium-browser: Use after free in Canvas
1688190 - CVE-2019-5788 chromium-browser: Use after free in FileAPI
1688191 - CVE-2019-5789 chromium-browser: Use after free in WebMIDI
1688192 - CVE-2019-5790 chromium-browser: Heap buffer overflow in V8
1688193 - CVE-2019-5791 chromium-browser: Type confusion in V8
1688194 - CVE-2019-5792 chromium-browser: Integer overflow in PDFium
1688195 - CVE-2019-5793 chromium-browser: Excessive permissions for private API in Extensions
1688196 - CVE-2019-5794 chromium-browser: Security UI spoofing
1688197 - CVE-2019-5795 chromium-browser: Integer overflow in PDFium
1688198 - CVE-2019-5796 chromium-browser: Race condition in Extensions
1688199 - CVE-2019-5797 chromium-browser: Race condition in DOMStorage
1688200 - CVE-2019-5798 chromium-browser: Out of bounds read in Skia
1688201 - CVE-2019-5799 chromium-browser: CSP bypass with blob URL
1688202 - CVE-2019-5800 chromium-browser: CSP bypass with blob URL
1688204 - CVE-2019-5802 chromium-browser: Security UI spoofing
1688205 - CVE-2019-5803 chromium-browser: CSP bypass with Javascript URLs

6. Package List:

Red Hat Enterprise Linux Desktop Supplementary (v. 6):

i386:
chromium-browser-73.0.3683.75-1.el6_10.i686.rpm
chromium-browser-debuginfo-73.0.3683.75-1.el6_10.i686.rpm

i686:
chromium-browser-73.0.3683.75-1.el6_10.i686.rpm
chromium-browser-debuginfo-73.0.3683.75-1.el6_10.i686.rpm

x86_64:
chromium-browser-73.0.3683.75-1.el6_10.x86_64.rpm
chromium-browser-debuginfo-73.0.3683.75-1.el6_10.x86_64.rpm

Red Hat Enterprise Linux HPC Node Supplementary (v. 6):

i686:
chromium-browser-73.0.3683.75-1.el6_10.i686.rpm
chromium-browser-debuginfo-73.0.3683.75-1.el6_10.i686.rpm

x86_64:
chromium-browser-73.0.3683.75-1.el6_10.x86_64.rpm
chromium-browser-debuginfo-73.0.3683.75-1.el6_10.x86_64.rpm

Red Hat Enterprise Linux Server Supplementary (v. 6):

i386:
chromium-browser-73.0.3683.75-1.el6_10.i686.rpm
chromium-browser-debuginfo-73.0.3683.75-1.el6_10.i686.rpm

i686:
chromium-browser-73.0.3683.75-1.el6_10.i686.rpm
chromium-browser-debuginfo-73.0.3683.75-1.el6_10.i686.rpm

x86_64:
chromium-browser-73.0.3683.75-1.el6_10.x86_64.rpm
chromium-browser-debuginfo-73.0.3683.75-1.el6_10.x86_64.rpm

Red Hat Enterprise Linux Workstation Supplementary (v. 6):

i386:
chromium-browser-73.0.3683.75-1.el6_10.i686.rpm
chromium-browser-debuginfo-73.0.3683.75-1.el6_10.i686.rpm

i686:
chromium-browser-73.0.3683.75-1.el6_10.i686.rpm
chromium-browser-debuginfo-73.0.3683.75-1.el6_10.i686.rpm

x86_64:
chromium-browser-73.0.3683.75-1.el6_10.x86_64.rpm
chromium-browser-debuginfo-73.0.3683.75-1.el6_10.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2019-5787
https://access.redhat.com/security/cve/CVE-2019-5788
https://access.redhat.com/security/cve/CVE-2019-5789
https://access.redhat.com/security/cve/CVE-2019-5790
https://access.redhat.com/security/cve/CVE-2019-5791
https://access.redhat.com/security/cve/CVE-2019-5792
https://access.redhat.com/security/cve/CVE-2019-5793
https://access.redhat.com/security/cve/CVE-2019-5794
https://access.redhat.com/security/cve/CVE-2019-5795
https://access.redhat.com/security/cve/CVE-2019-5796
https://access.redhat.com/security/cve/CVE-2019-5797
https://access.redhat.com/security/cve/CVE-2019-5798
https://access.redhat.com/security/cve/CVE-2019-5799
https://access.redhat.com/security/cve/CVE-2019-5800
https://access.redhat.com/security/cve/CVE-2019-5802
https://access.redhat.com/security/cve/CVE-2019-5803
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2019 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBXKr89tzjgjWX9erEAQhGShAAgqY9HJy2Pbn0OlTsXcl3a90fUgcF4HEA
0arUR3GlzdBFAQCGOm/Vh0gbaZfKf7BWkC1s4sid9iKR691GArPfN52Ot+I2Jt0L
tdEuEYfzqpXWXBTPUMPx7igAPrz5kRt/0UNxDYyJEqPuTP6KbU1FKX//OVO7rRTn
UWmjqB1MbO0zcA+sEuuRbWP1WXX/EbgtRoNFdYg4FTlSKLd6fKsPzj9NSYS51vZE
qSxDLaLSXt2SFOBX545CutHlN35cJcgZ44+2bKf9I2GRgGkWCWVWLESdnXipJ5ae
MIHV8jhkZbSMuTb9LM2pv0Ru521Wy4BI95ZdhP6UjdWUdmGpCNb9BL40eayy9aRM
jWj1yPxYcpicDLGBMfC8vFpc0KrOjWONzhDhNC6T91PIB7FkC6LPtBc4a/ijjeC2
Cc1Nydvj7dTgBt0GKsNb0hSAVQvROfFrCkGy/Z+rW3Et/wf9Xg72U3J81mw5Uj2b
6V29kK/pacoAYbw36ycoQwpXc4R8dBWQp51MsT78r8+SR7njHX9SkOq9eAyl8Wv9
PM/LX0l+qJqdKoCtU2BOvjmic8vTS5Sk0K+ZbbEw74gYgzWzpIFrD42V1wSb8VCm
FBcjI+dvFlvlbQSXyo4m8bHWYgX/vW+DZ7tzBtCFA5CZiSZ9mFeDJr1YeuPGTXh4
dAAGR4+78/A=ajj1
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
Login or Register to add favorites

File Archive:

January 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jan 1st
    4 Files
  • 2
    Jan 2nd
    3 Files
  • 3
    Jan 3rd
    3 Files
  • 4
    Jan 4th
    33 Files
  • 5
    Jan 5th
    31 Files
  • 6
    Jan 6th
    21 Files
  • 7
    Jan 7th
    15 Files
  • 8
    Jan 8th
    19 Files
  • 9
    Jan 9th
    1 Files
  • 10
    Jan 10th
    1 Files
  • 11
    Jan 11th
    33 Files
  • 12
    Jan 12th
    19 Files
  • 13
    Jan 13th
    27 Files
  • 14
    Jan 14th
    8 Files
  • 15
    Jan 15th
    16 Files
  • 16
    Jan 16th
    0 Files
  • 17
    Jan 17th
    0 Files
  • 18
    Jan 18th
    0 Files
  • 19
    Jan 19th
    0 Files
  • 20
    Jan 20th
    0 Files
  • 21
    Jan 21st
    0 Files
  • 22
    Jan 22nd
    0 Files
  • 23
    Jan 23rd
    0 Files
  • 24
    Jan 24th
    0 Files
  • 25
    Jan 25th
    0 Files
  • 26
    Jan 26th
    0 Files
  • 27
    Jan 27th
    0 Files
  • 28
    Jan 28th
    0 Files
  • 29
    Jan 29th
    0 Files
  • 30
    Jan 30th
    0 Files
  • 31
    Jan 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close