Synopsis

Important: chromium-browser security update

Type/Severity

Security Advisory: Important

Topic

Updated chromium-browser packages that fix multiple security issues are now
available for Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having Important security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.

Description

Chromium is an open-source web browser, powered by WebKit (Blink).

Several flaws were found in the processing of malformed web content. A web
page containing malicious content could cause Chromium to crash or,
potentially, execute arbitrary code with the privileges of the user running
Chromium. (CVE-2015-1266, CVE-2015-1267, CVE-2015-1268, CVE-2015-1269)

All Chromium users should upgrade to these updated packages, which contain
Chromium version 43.0.2357.130, which corrects these issues. After
installing the update, Chromium must be restarted for the changes to take
effect.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Update Support 6.6 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support 6.6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Update Support from RHUI 6.6 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support from RHUI 6.6 i386
• Red Hat Enterprise Linux Server - AUS 6.6 x86_64

Fixes

• BZ - 1234696 - CVE-2015-1266 chromium-browser: Scheme validation error in WebUI
• BZ - 1234697 - CVE-2015-1268 chromium-browser: Cross-origin bypass in Blink
• BZ - 1234698 - CVE-2015-1267 chromium-browser: Cross-origin bypass in Blink
• BZ - 1234699 - CVE-2015-1269 chromium-browser: Normalization error in HSTS/HPKP preload list

CVEs

• CVE-2015-1268
• CVE-2015-1269
• CVE-2015-1266
• CVE-2015-1267

References

• https://access.redhat.com/security/updates/classification/#important
• https://googlechromereleases.blogspot.com/2015/06/chrome-stable-update.html

Red Hat Enterprise Linux Server 6

SRPM
x86_64
chromium-browser-43.0.2357.130-1.el6_6.x86_64.rpm	SHA-256: e906adb9adeb7d75cc3d5f6f76a0369e89747177efb784cc62fca98c50f315bc
chromium-browser-debuginfo-43.0.2357.130-1.el6_6.x86_64.rpm	SHA-256: 5f8fffb2cce9d2b8765c2fc024dda5b6fda245a105d1c0e666354b5b09524dbf
i386
chromium-browser-43.0.2357.130-1.el6_6.i686.rpm	SHA-256: 579edb5f93de6d94279fb2c0683e6d057b4fde9432aa1874caee97d033f1020e
chromium-browser-debuginfo-43.0.2357.130-1.el6_6.i686.rpm	SHA-256: 57efe9295923c5045286ce470f4c949de14d0803817f0cdfbe6b1c3bce6357e1

Red Hat Enterprise Linux Server - Extended Update Support 6.6

SRPM
x86_64
chromium-browser-43.0.2357.130-1.el6_6.x86_64.rpm	SHA-256: e906adb9adeb7d75cc3d5f6f76a0369e89747177efb784cc62fca98c50f315bc
chromium-browser-debuginfo-43.0.2357.130-1.el6_6.x86_64.rpm	SHA-256: 5f8fffb2cce9d2b8765c2fc024dda5b6fda245a105d1c0e666354b5b09524dbf
i386
chromium-browser-43.0.2357.130-1.el6_6.i686.rpm	SHA-256: 579edb5f93de6d94279fb2c0683e6d057b4fde9432aa1874caee97d033f1020e
chromium-browser-debuginfo-43.0.2357.130-1.el6_6.i686.rpm	SHA-256: 57efe9295923c5045286ce470f4c949de14d0803817f0cdfbe6b1c3bce6357e1

Red Hat Enterprise Linux Workstation 6

SRPM
i386
chromium-browser-43.0.2357.130-1.el6_6.i686.rpm	SHA-256: 579edb5f93de6d94279fb2c0683e6d057b4fde9432aa1874caee97d033f1020e
chromium-browser-debuginfo-43.0.2357.130-1.el6_6.i686.rpm	SHA-256: 57efe9295923c5045286ce470f4c949de14d0803817f0cdfbe6b1c3bce6357e1
x86_64
chromium-browser-43.0.2357.130-1.el6_6.x86_64.rpm	SHA-256: e906adb9adeb7d75cc3d5f6f76a0369e89747177efb784cc62fca98c50f315bc
chromium-browser-debuginfo-43.0.2357.130-1.el6_6.x86_64.rpm	SHA-256: 5f8fffb2cce9d2b8765c2fc024dda5b6fda245a105d1c0e666354b5b09524dbf

Red Hat Enterprise Linux Desktop 6

SRPM
x86_64
chromium-browser-43.0.2357.130-1.el6_6.x86_64.rpm	SHA-256: e906adb9adeb7d75cc3d5f6f76a0369e89747177efb784cc62fca98c50f315bc
chromium-browser-debuginfo-43.0.2357.130-1.el6_6.x86_64.rpm	SHA-256: 5f8fffb2cce9d2b8765c2fc024dda5b6fda245a105d1c0e666354b5b09524dbf
i386
chromium-browser-43.0.2357.130-1.el6_6.i686.rpm	SHA-256: 579edb5f93de6d94279fb2c0683e6d057b4fde9432aa1874caee97d033f1020e
chromium-browser-debuginfo-43.0.2357.130-1.el6_6.i686.rpm	SHA-256: 57efe9295923c5045286ce470f4c949de14d0803817f0cdfbe6b1c3bce6357e1

Red Hat Enterprise Linux Server from RHUI 6

SRPM
x86_64
chromium-browser-43.0.2357.130-1.el6_6.x86_64.rpm	SHA-256: e906adb9adeb7d75cc3d5f6f76a0369e89747177efb784cc62fca98c50f315bc
i386
chromium-browser-43.0.2357.130-1.el6_6.i686.rpm	SHA-256: 579edb5f93de6d94279fb2c0683e6d057b4fde9432aa1874caee97d033f1020e

Red Hat Enterprise Linux Server - Extended Update Support from RHUI 6.6

SRPM
x86_64
chromium-browser-43.0.2357.130-1.el6_6.x86_64.rpm	SHA-256: e906adb9adeb7d75cc3d5f6f76a0369e89747177efb784cc62fca98c50f315bc
chromium-browser-debuginfo-43.0.2357.130-1.el6_6.x86_64.rpm	SHA-256: 5f8fffb2cce9d2b8765c2fc024dda5b6fda245a105d1c0e666354b5b09524dbf
i386
chromium-browser-43.0.2357.130-1.el6_6.i686.rpm	SHA-256: 579edb5f93de6d94279fb2c0683e6d057b4fde9432aa1874caee97d033f1020e
chromium-browser-debuginfo-43.0.2357.130-1.el6_6.i686.rpm	SHA-256: 57efe9295923c5045286ce470f4c949de14d0803817f0cdfbe6b1c3bce6357e1

Red Hat Enterprise Linux Server - AUS 6.6

SRPM
x86_64
chromium-browser-43.0.2357.130-1.el6_6.x86_64.rpm	SHA-256: e906adb9adeb7d75cc3d5f6f76a0369e89747177efb784cc62fca98c50f315bc
chromium-browser-debuginfo-43.0.2357.130-1.el6_6.x86_64.rpm	SHA-256: 5f8fffb2cce9d2b8765c2fc024dda5b6fda245a105d1c0e666354b5b09524dbf