RHSA-2018:1815 - Security Advisory

Topic

An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Chromium is an open-source web browser, powered by WebKit (Blink).

This update upgrades Chromium to version 67.0.3396.62.

Security Fix(es):

• chromium-browser: Use after free in Blink (CVE-2018-6123)
• chromium-browser: Type confusion in Blink (CVE-2018-6124)
• chromium-browser: Overly permissive policy in WebUSB (CVE-2018-6125)
• chromium-browser: Heap buffer overflow in Skia (CVE-2018-6126)
• chromium-browser: Use after free in indexedDB (CVE-2018-6127)
• chromium-browser: Out of bounds memory access in WebRTC (CVE-2018-6129)
• chromium-browser: Out of bounds memory access in WebRTC (CVE-2018-6130)
• chromium-browser: Incorrect mutability protection in WebAssembly (CVE-2018-6131)
• chromium-browser: Use of uninitialized memory in WebRTC (CVE-2018-6132)
• chromium-browser: URL spoof in Omnibox (CVE-2018-6133)
• chromium-browser: Referrer Policy bypass in Blink (CVE-2018-6134)
• chromium-browser: UI spoofing in Blink (CVE-2018-6135)
• chromium-browser: Out of bounds memory access in V8 (CVE-2018-6136)
• chromium-browser: Leak of visited status of page in Blink (CVE-2018-6137)
• chromium-browser: Overly permissive policy in Extensions (CVE-2018-6138)
• chromium-browser: Restrictions bypass in the debugger extension API (CVE-2018-6139)
• chromium-browser: Restrictions bypass in the debugger extension API (CVE-2018-6140)
• chromium-browser: Heap buffer overflow in Skia (CVE-2018-6141)
• chromium-browser: Out of bounds memory access in V8 (CVE-2018-6142)
• chromium-browser: Out of bounds memory access in V8 (CVE-2018-6143)
• chromium-browser: Out of bounds memory access in PDFium (CVE-2018-6144)
• chromium-browser: Incorrect escaping of MathML in Blink (CVE-2018-6145)
• chromium-browser: Password fields not taking advantage of OS protections in Views (CVE-2018-6147)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386

Fixes

• BZ - 1584032 - CVE-2018-6123 chromium-browser: Use after free in Blink
• BZ - 1584033 - CVE-2018-6124 chromium-browser: Type confusion in Blink
• BZ - 1584034 - CVE-2018-6125 chromium-browser: Overly permissive policy in WebUSB
• BZ - 1584035 - CVE-2018-6126 chromium-browser: Heap buffer overflow in Skia
• BZ - 1584037 - CVE-2018-6127 chromium-browser: Use after free in indexedDB
• BZ - 1584039 - CVE-2018-6129 chromium-browser: Out of bounds memory access in WebRTC
• BZ - 1584040 - CVE-2018-6130 chromium-browser: Out of bounds memory access in WebRTC
• BZ - 1584042 - CVE-2018-6131 chromium-browser: Incorrect mutability protection in WebAssembly
• BZ - 1584043 - CVE-2018-6132 chromium-browser: Use of uninitialized memory in WebRTC
• BZ - 1584044 - CVE-2018-6133 chromium-browser: URL spoof in Omnibox
• BZ - 1584045 - CVE-2018-6134 chromium-browser: Referrer Policy bypass in Blink
• BZ - 1584046 - CVE-2018-6135 chromium-browser: UI spoofing in Blink
• BZ - 1584047 - CVE-2018-6136 chromium-browser: Out of bounds memory access in V8
• BZ - 1584048 - CVE-2018-6137 chromium-browser: Leak of visited status of page in Blink
• BZ - 1584049 - CVE-2018-6138 chromium-browser: Overly permissive policy in Extensions
• BZ - 1584050 - CVE-2018-6139 chromium-browser: Restrictions bypass in the debugger extension API
• BZ - 1584051 - CVE-2018-6140 chromium-browser: Restrictions bypass in the debugger extension API
• BZ - 1584052 - CVE-2018-6141 chromium-browser: Heap buffer overflow in Skia
• BZ - 1584054 - CVE-2018-6142 chromium-browser: Out of bounds memory access in V8
• BZ - 1584055 - CVE-2018-6143 chromium-browser: Out of bounds memory access in V8
• BZ - 1584056 - CVE-2018-6144 chromium-browser: Out of bounds memory access in PDFium
• BZ - 1584057 - CVE-2018-6145 chromium-browser: Incorrect escaping of MathML in Blink
• BZ - 1584058 - CVE-2018-6147 chromium-browser: Password fields not taking advantage of OS protections in Views

CVEs

• CVE-2018-6123
• CVE-2018-6124
• CVE-2018-6125
• CVE-2018-6126
• CVE-2018-6127
• CVE-2018-6129
• CVE-2018-6130
• CVE-2018-6131
• CVE-2018-6132
• CVE-2018-6133
• CVE-2018-6134
• CVE-2018-6135
• CVE-2018-6136
• CVE-2018-6137
• CVE-2018-6138
• CVE-2018-6139
• CVE-2018-6140
• CVE-2018-6141
• CVE-2018-6142
• CVE-2018-6143
• CVE-2018-6144
• CVE-2018-6145
• CVE-2018-6147

References

• https://access.redhat.com/security/updates/classification/#important