what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Red Hat Security Advisory 2019-4238-01

Red Hat Security Advisory 2019-4238-01
Posted Dec 16, 2019
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2019-4238-01 - Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 79.0.3945.79. Issues addressed include buffer overflow and out of bounds write vulnerabilities.

tags | advisory, web, overflow, vulnerability
systems | linux, redhat
advisories | CVE-2019-13725, CVE-2019-13726, CVE-2019-13727, CVE-2019-13728, CVE-2019-13729, CVE-2019-13730, CVE-2019-13732, CVE-2019-13734, CVE-2019-13735, CVE-2019-13736, CVE-2019-13737, CVE-2019-13738, CVE-2019-13739, CVE-2019-13740, CVE-2019-13741, CVE-2019-13742, CVE-2019-13743, CVE-2019-13744, CVE-2019-13745, CVE-2019-13746, CVE-2019-13747, CVE-2019-13748, CVE-2019-13749, CVE-2019-13750, CVE-2019-13751, CVE-2019-13752
SHA-256 | e216583bc70a56cf0cbd9b3d18b8acf246a0e7051b07cfe4168bb85f5abb70e4

Red Hat Security Advisory 2019-4238-01

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Critical: chromium-browser security update
Advisory ID: RHSA-2019:4238-01
Product: Red Hat Enterprise Linux Supplementary
Advisory URL: https://access.redhat.com/errata/RHSA-2019:4238
Issue date: 2019-12-16
CVE Names: CVE-2019-13725 CVE-2019-13726 CVE-2019-13727
CVE-2019-13728 CVE-2019-13729 CVE-2019-13730
CVE-2019-13732 CVE-2019-13734 CVE-2019-13735
CVE-2019-13736 CVE-2019-13737 CVE-2019-13738
CVE-2019-13739 CVE-2019-13740 CVE-2019-13741
CVE-2019-13742 CVE-2019-13743 CVE-2019-13744
CVE-2019-13745 CVE-2019-13746 CVE-2019-13747
CVE-2019-13748 CVE-2019-13749 CVE-2019-13750
CVE-2019-13751 CVE-2019-13752 CVE-2019-13753
CVE-2019-13754 CVE-2019-13755 CVE-2019-13756
CVE-2019-13757 CVE-2019-13758 CVE-2019-13759
CVE-2019-13761 CVE-2019-13762 CVE-2019-13763
CVE-2019-13764
=====================================================================

1. Summary:

An update for chromium-browser is now available for Red Hat Enterprise
Linux 6 Supplementary.

Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, i686, x86_64
Red Hat Enterprise Linux HPC Node Supplementary (v. 6) - i686, x86_64
Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, i686, x86_64
Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, i686, x86_64

3. Description:

Chromium is an open-source web browser, powered by WebKit (Blink).

This update upgrades Chromium to version 79.0.3945.79.

Security Fix(es):

* chromium-browser: Use after free in Bluetooth (CVE-2019-13725)

* chromium-browser: Heap buffer overflow in password manager
(CVE-2019-13726)

* chromium-browser: Insufficient policy enforcement in WebSockets
(CVE-2019-13727)

* chromium-browser: Out of bounds write in V8 (CVE-2019-13728)

* chromium-browser: Use after free in WebSockets (CVE-2019-13729)

* chromium-browser: Type Confusion in V8 (CVE-2019-13730)

* chromium-browser: Use after free in WebAudio (CVE-2019-13732)

* chromium-browser: Out of bounds write in SQLite (CVE-2019-13734)

* chromium-browser: Out of bounds write in V8 (CVE-2019-13735)

* chromium-browser: Type Confusion in V8 (CVE-2019-13764)

* chromium-browser: Integer overflow in PDFium (CVE-2019-13736)

* chromium-browser: Insufficient policy enforcement in autocomplete
(CVE-2019-13737)

* chromium-browser: Insufficient policy enforcement in navigation
(CVE-2019-13738)

* chromium-browser: Incorrect security UI in Omnibox (CVE-2019-13739)

* chromium-browser: Incorrect security UI in sharing (CVE-2019-13740)

* chromium-browser: Insufficient validation of untrusted input in Blink
(CVE-2019-13741)

* chromium-browser: Incorrect security UI in Omnibox (CVE-2019-13742)

* chromium-browser: Incorrect security UI in external protocol handling
(CVE-2019-13743)

* chromium-browser: Insufficient policy enforcement in cookies
(CVE-2019-13744)

* chromium-browser: Insufficient policy enforcement in audio
(CVE-2019-13745)

* chromium-browser: Insufficient policy enforcement in Omnibox
(CVE-2019-13746)

* chromium-browser: Uninitialized Use in rendering (CVE-2019-13747)

* chromium-browser: Insufficient policy enforcement in developer tools
(CVE-2019-13748)

* chromium-browser: Incorrect security UI in Omnibox (CVE-2019-13749)

* chromium-browser: Insufficient data validation in SQLite (CVE-2019-13750)

* chromium-browser: Uninitialized Use in SQLite (CVE-2019-13751)

* chromium-browser: Out of bounds read in SQLite (CVE-2019-13752)

* chromium-browser: Out of bounds read in SQLite (CVE-2019-13753)

* chromium-browser: Insufficient policy enforcement in extensions
(CVE-2019-13754)

* chromium-browser: Insufficient policy enforcement in extensions
(CVE-2019-13755)

* chromium-browser: Incorrect security UI in printing (CVE-2019-13756)

* chromium-browser: Incorrect security UI in Omnibox (CVE-2019-13757)

* chromium-browser: Insufficient policy enforcement in navigation
(CVE-2019-13758)

* chromium-browser: Incorrect security UI in interstitials (CVE-2019-13759)

* chromium-browser: Incorrect security UI in Omnibox (CVE-2019-13761)

* chromium-browser: Insufficient policy enforcement in downloads
(CVE-2019-13762)

* chromium-browser: Insufficient policy enforcement in payments
(CVE-2019-13763)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

1781973 - CVE-2019-13725 chromium-browser: Use after free in Bluetooth
1781974 - CVE-2019-13726 chromium-browser: Heap buffer overflow in password manager
1781975 - CVE-2019-13727 chromium-browser: Insufficient policy enforcement in WebSockets
1781976 - CVE-2019-13728 chromium-browser: Out of bounds write in V8
1781977 - CVE-2019-13729 chromium-browser: Use after free in WebSockets
1781978 - CVE-2019-13730 chromium-browser: Type Confusion in V8
1781979 - CVE-2019-13732 chromium-browser: Use after free in WebAudio
1781980 - CVE-2019-13734 chromium-browser: Out of bounds write in SQLite
1781981 - CVE-2019-13735 chromium-browser: Out of bounds write in V8
1781982 - CVE-2019-13764 chromium-browser: Type Confusion in V8
1781983 - CVE-2019-13736 chromium-browser: Integer overflow in PDFium
1781984 - CVE-2019-13737 chromium-browser: Insufficient policy enforcement in autocomplete
1781985 - CVE-2019-13738 chromium-browser: Insufficient policy enforcement in navigation
1781986 - CVE-2019-13739 chromium-browser: Incorrect security UI in Omnibox
1781987 - CVE-2019-13740 chromium-browser: Incorrect security UI in sharing
1781988 - CVE-2019-13741 chromium-browser: Insufficient validation of untrusted input in Blink
1781989 - CVE-2019-13742 chromium-browser: Incorrect security UI in Omnibox
1781990 - CVE-2019-13743 chromium-browser: Incorrect security UI in external protocol handling
1781991 - CVE-2019-13745 chromium-browser: Insufficient policy enforcement in audio
1781992 - CVE-2019-13746 chromium-browser: Insufficient policy enforcement in Omnibox
1781993 - CVE-2019-13747 chromium-browser: Uninitialized Use in rendering
1781994 - CVE-2019-13748 chromium-browser: Insufficient policy enforcement in developer tools
1781995 - CVE-2019-13749 chromium-browser: Incorrect security UI in Omnibox
1781997 - CVE-2019-13750 chromium-browser: Insufficient data validation in SQLite
1781998 - CVE-2019-13751 chromium-browser: Uninitialized Use in SQLite
1781999 - CVE-2019-13752 chromium-browser: Out of bounds read in SQLite
1782000 - CVE-2019-13753 chromium-browser: Out of bounds read in SQLite
1782001 - CVE-2019-13754 chromium-browser: Insufficient policy enforcement in extensions
1782002 - CVE-2019-13755 chromium-browser: Insufficient policy enforcement in extensions
1782003 - CVE-2019-13756 chromium-browser: Incorrect security UI in printing
1782004 - CVE-2019-13757 chromium-browser: Incorrect security UI in Omnibox
1782005 - CVE-2019-13759 chromium-browser: Incorrect security UI in interstitials
1782006 - CVE-2019-13761 chromium-browser: Incorrect security UI in Omnibox
1782007 - CVE-2019-13762 chromium-browser: Insufficient policy enforcement in downloads
1782008 - CVE-2019-13763 chromium-browser: Insufficient policy enforcement in payments
1782017 - CVE-2019-13758 chromium-browser: Insufficient policy enforcement in navigation
1782021 - CVE-2019-13744 chromium-browser: Insufficient policy enforcement in cookies

6. Package List:

Red Hat Enterprise Linux Desktop Supplementary (v. 6):

i386:
chromium-browser-79.0.3945.79-1.el6_10.i686.rpm
chromium-browser-debuginfo-79.0.3945.79-1.el6_10.i686.rpm

i686:
chromium-browser-79.0.3945.79-1.el6_10.i686.rpm
chromium-browser-debuginfo-79.0.3945.79-1.el6_10.i686.rpm

x86_64:
chromium-browser-79.0.3945.79-1.el6_10.x86_64.rpm
chromium-browser-debuginfo-79.0.3945.79-1.el6_10.x86_64.rpm

Red Hat Enterprise Linux HPC Node Supplementary (v. 6):

i686:
chromium-browser-79.0.3945.79-1.el6_10.i686.rpm
chromium-browser-debuginfo-79.0.3945.79-1.el6_10.i686.rpm

x86_64:
chromium-browser-79.0.3945.79-1.el6_10.x86_64.rpm
chromium-browser-debuginfo-79.0.3945.79-1.el6_10.x86_64.rpm

Red Hat Enterprise Linux Server Supplementary (v. 6):

i386:
chromium-browser-79.0.3945.79-1.el6_10.i686.rpm
chromium-browser-debuginfo-79.0.3945.79-1.el6_10.i686.rpm

i686:
chromium-browser-79.0.3945.79-1.el6_10.i686.rpm
chromium-browser-debuginfo-79.0.3945.79-1.el6_10.i686.rpm

x86_64:
chromium-browser-79.0.3945.79-1.el6_10.x86_64.rpm
chromium-browser-debuginfo-79.0.3945.79-1.el6_10.x86_64.rpm

Red Hat Enterprise Linux Workstation Supplementary (v. 6):

i386:
chromium-browser-79.0.3945.79-1.el6_10.i686.rpm
chromium-browser-debuginfo-79.0.3945.79-1.el6_10.i686.rpm

i686:
chromium-browser-79.0.3945.79-1.el6_10.i686.rpm
chromium-browser-debuginfo-79.0.3945.79-1.el6_10.i686.rpm

x86_64:
chromium-browser-79.0.3945.79-1.el6_10.x86_64.rpm
chromium-browser-debuginfo-79.0.3945.79-1.el6_10.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2019-13725
https://access.redhat.com/security/cve/CVE-2019-13726
https://access.redhat.com/security/cve/CVE-2019-13727
https://access.redhat.com/security/cve/CVE-2019-13728
https://access.redhat.com/security/cve/CVE-2019-13729
https://access.redhat.com/security/cve/CVE-2019-13730
https://access.redhat.com/security/cve/CVE-2019-13732
https://access.redhat.com/security/cve/CVE-2019-13734
https://access.redhat.com/security/cve/CVE-2019-13735
https://access.redhat.com/security/cve/CVE-2019-13736
https://access.redhat.com/security/cve/CVE-2019-13737
https://access.redhat.com/security/cve/CVE-2019-13738
https://access.redhat.com/security/cve/CVE-2019-13739
https://access.redhat.com/security/cve/CVE-2019-13740
https://access.redhat.com/security/cve/CVE-2019-13741
https://access.redhat.com/security/cve/CVE-2019-13742
https://access.redhat.com/security/cve/CVE-2019-13743
https://access.redhat.com/security/cve/CVE-2019-13744
https://access.redhat.com/security/cve/CVE-2019-13745
https://access.redhat.com/security/cve/CVE-2019-13746
https://access.redhat.com/security/cve/CVE-2019-13747
https://access.redhat.com/security/cve/CVE-2019-13748
https://access.redhat.com/security/cve/CVE-2019-13749
https://access.redhat.com/security/cve/CVE-2019-13750
https://access.redhat.com/security/cve/CVE-2019-13751
https://access.redhat.com/security/cve/CVE-2019-13752
https://access.redhat.com/security/cve/CVE-2019-13753
https://access.redhat.com/security/cve/CVE-2019-13754
https://access.redhat.com/security/cve/CVE-2019-13755
https://access.redhat.com/security/cve/CVE-2019-13756
https://access.redhat.com/security/cve/CVE-2019-13757
https://access.redhat.com/security/cve/CVE-2019-13758
https://access.redhat.com/security/cve/CVE-2019-13759
https://access.redhat.com/security/cve/CVE-2019-13761
https://access.redhat.com/security/cve/CVE-2019-13762
https://access.redhat.com/security/cve/CVE-2019-13763
https://access.redhat.com/security/cve/CVE-2019-13764
https://access.redhat.com/security/updates/classification/#critical

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2019 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBXfdJs9zjgjWX9erEAQhLew//QvXpeADCSwIw6mOpun14JVvWnNqFxqnw
vmW3zrB8b3eVAN+MK//iag0iWatwFnEhShmj1XxJ7OEV1lK0bINzgeeLned9OghY
V5l7XuTey7yasMjYAYs6N0imuGmqZX5PeMShX/d61shX10F6gWKhfoMuo+Klw17U
VJ5JsLpSsC8wgsv600xI0c/Qb1iHT7GKaSNiG0eNe+2EUM+uT6M0LnHERLG3AlZb
IxwlEqQfeg4sm4k83oIo4BC+hohBSupcnAT7WIsRvIdgsC3wulEldoRN+RzZMZJc
uRi0t5o9TKDI386v/+2X1tiMgHGovuclThTdW0ZbbOu8pzC6VS3dUJRfS7H9gu6C
NeEjJmkX9osWXh3Yr7b0duDuWkScEqaOpLZMQSyqlJz5u9m2ZmnQelE3yKG7IkbA
d4cfx9EQwsIGlu7GTInZGvEoAnX/+oX09IQqA94oIW5HF1ALolPCI+oZy256K9NE
3FtNxJhJKy3qc9ab+OvpQPlnjnUvX8ttdEI0q+bspQgv6rQplHodB5hpzQ75NiKI
IeA8tesEFCmwy/7tTugGtHlh3b0yrbTuA9ON/DB1/cGnIYC+SNoKn5CezJOJ6VIh
/NiC0j3gJuBs6TxEJPRcFB0vYUgDa63ob0j+0MFXUR5t931E9fqgT+D+xgDeJYIx
Ch/qp3Y5Pzc=
=jKmI
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
Login or Register to add favorites

File Archive:

June 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    19 Files
  • 2
    Jun 2nd
    16 Files
  • 3
    Jun 3rd
    28 Files
  • 4
    Jun 4th
    0 Files
  • 5
    Jun 5th
    0 Files
  • 6
    Jun 6th
    19 Files
  • 7
    Jun 7th
    23 Files
  • 8
    Jun 8th
    11 Files
  • 9
    Jun 9th
    10 Files
  • 10
    Jun 10th
    4 Files
  • 11
    Jun 11th
    0 Files
  • 12
    Jun 12th
    0 Files
  • 13
    Jun 13th
    0 Files
  • 14
    Jun 14th
    0 Files
  • 15
    Jun 15th
    0 Files
  • 16
    Jun 16th
    0 Files
  • 17
    Jun 17th
    0 Files
  • 18
    Jun 18th
    0 Files
  • 19
    Jun 19th
    27 Files
  • 20
    Jun 20th
    65 Files
  • 21
    Jun 21st
    10 Files
  • 22
    Jun 22nd
    8 Files
  • 23
    Jun 23rd
    6 Files
  • 24
    Jun 24th
    6 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    15 Files
  • 28
    Jun 28th
    14 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close