Out-of-bounds read in Google Chromium - CVE-2019-5835

Vulnerability identifier: #VU66465

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-5835

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the Swiftshader component in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger an out-of-bounds read error and gain access to sensitive information.

Google Chromium
Google Chrome
Arch Linux
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for Scientific Computing
chromium
chromium-browser (Red Hat package)
chromium-browser-debuginfo (Red Hat package)

Update to version 75.0.3770.80.

Google Chromium - update to 75.0.3770.80
Google Chrome - update to 75.0.3770.80
chromium - update to 75.0.3770.80-1
chromium-browser (Red Hat package) - update to 75.0.3770.80-1.el6_10
chromium-browser-debuginfo (Red Hat package) - update to 75.0.3770.80-1.el6_10

• https://chromereleases.googleblog.com/2019/06/stable-channel-update-for-desktop.html
• https://crbug.com/939239

• Multiple vulnerabilities in Google Chrome
• Arch Linux update for chromium
• Red Hat Enterprise Linux 6 Supplementary update for chromium-browser