SB2017120719 - Red Hat update for chromium-browser

Description

This security bulletin contains information about 19 secuirty vulnerabilities.

1) Out-of-bounds write (CVE-ID: CVE-2017-15407)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to out-of-bounds write in QUIC. A remote attacker can trick the victim into visiting a specially crafted website, trigger out-of-bounds write and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in system compromise.

2) Heap-based buffer overflow (CVE-ID: CVE-2017-15408)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to heap-based buffer overflow in PDFium. A remote attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in system compromise.

3) Out-of-bounds write (CVE-ID: CVE-2017-15409)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to out-of-bounds write in Skia. A remote attacker can trick the victim into visiting a specially crafted website, trigger out-of-bounds write and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in system compromise.

4) Use-after-free error (CVE-ID: CVE-2017-15410)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error in PDFium. A remote attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in system compromise.

5) Use-after-free error (CVE-ID: CVE-2017-15411)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error in PDFium. A remote attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in system compromise.

6) Use-after-free error (CVE-ID: CVE-2017-15412)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error in libXML. A remote attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in system compromise.

7) Type confusion (CVE-ID: CVE-2017-15413)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to type confusion in WebAssembly. A remote attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in system compromise.

8) Information disclosure (CVE-ID: CVE-2017-15415)

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The weakness exists due to pointer information disclosure in IPC call. A remote attacker can trick the victim into visiting a specially crafted website and read arbitrary data from system memory.

Successful exploitation of the vulnerability results in information disclosure.

9) Out-of-bounds read (CVE-ID: CVE-2017-15416)

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The weakness exists due to out-of-bounds read in Blink. A remote attacker can trick the victim into visiting a specially crafted website and read arbitrary data from system memory.

Successful exploitation of the vulnerability results in information disclosure.

10) Information disclosure (CVE-ID: CVE-2017-15417)

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The weakness exists due to cross origin information disclosure in Skia. A remote attacker can trick the victim into visiting a specially crafted website and read arbitrary data from system memory.

Successful exploitation of the vulnerability results in information disclosure.

11) Information disclosure (CVE-ID: CVE-2017-15418)

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The weakness exists due to use of uninitialized value in Skia. A remote attacker can trick the victim into visiting a specially crafted website and read arbitrary data from system memory.

Successful exploitation of the vulnerability results in information disclosure.

12) Memory leak (CVE-ID: CVE-2017-15419)

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The weakness exists due to cross origin leak of redirect URL in Blink. A remote attacker can trick the victim into visiting a specially crafted website and read arbitrary data from system memory.

Successful exploitation of the vulnerability results in information disclosure.

13) Spoofing attack (CVE-ID: CVE-2017-15420)

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to URL spoofing in OmniBox. A remote attacker can trick the victim into visiting a specially crafted website and conduct domain spoofing attacks.

Successful exploitation of the vulnerability results in address spoofing.

14) Integer overflow (CVE-ID: CVE-2017-15422)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to integer overflow in ICU. A remote attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and cause the application to crash.

Successful exploitation of the vulnerability results in denial of service.

15) Security restrictions bypass (CVE-ID: CVE-2017-15423)

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to an issue with SPAKE implementation in BoringSSL. A remote attacker can trick the victim into visiting a specially crafted website and bypass security restrictions.

16) Spoofing attack (CVE-ID: CVE-2017-15424)

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to URL spoofing in OmniBox. A remote attacker can trick the victim into visiting a specially crafted website and conduct domain spoofing attacks.

Successful exploitation of the vulnerability results in address spoofing.

17) Spoofing attack (CVE-ID: CVE-2017-15425)

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to URL spoofing in OmniBox. A remote attacker can trick the victim into visiting a specially crafted website and conduct domain spoofing attacks.

Successful exploitation of the vulnerability results in address spoofing.

18) Spoofing attack (CVE-ID: CVE-2017-15426)

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to URL spoofing in OmniBox. A remote attacker can trick the victim into visiting a specially crafted website and conduct domain spoofing attacks.

Successful exploitation of the vulnerability results in address spoofing.

19) Security restrictions bypass (CVE-ID: CVE-2017-15427)

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to insufficient blocking of JavaScript in Omnibox. A remote attacker can trick the victim into visiting a specially crafted website and bypass security restrictions.

Remediation

Install update from vendor's website.

References

• https://access.redhat.com/errata/RHSA-2017:3401