Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2020.1256
chromium security update
8 April 2020
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: chromium
Publisher: Debian
Operating System: Debian GNU/Linux 10
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Denial of Service -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2020-6452 CVE-2020-6451 CVE-2020-6450
Reference: ASB-2020.0068
ASB-2020.0067
ESB-2020.1246
Original Bulletin:
http://www.debian.org/security/2020/dsa-4654
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-4654-1 security@debian.org
https://www.debian.org/security/ Michael Gilbert
April 07, 2020 https://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : chromium
CVE ID : CVE-2020-6450 CVE-2020-6451 CVE-2020-6452
Several vulnerabilities have been discovered in the chromium web browser.
CVE-2020-6450
Man Yue Mo discovered a use-after-free issue in the WebAudio
implementation.
CVE-2020-6451
Man Yue Mo discovered a use-after-free issue in the WebAudio
implementation.
CVE-2020-6452
asnine discovered a buffer overflow issue.
For the oldstable distribution (stretch), security support for chromium
has been discontinued.
For the stable distribution (buster), these problems have been fixed in
version 80.0.3987.162-1~deb10u1.
We recommend that you upgrade your chromium packages.
For the detailed security status of chromium please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/chromium
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
iQQzBAEBCgAdFiEEIwTlZiOEpzUxIyp4mD40ZYkUaygFAl6NS4oACgkQmD40ZYkU
aygZkB/+IyENFm0PRk9c9xjSJIN+ue10N98xjMQVcgksGYhXxlLuJ4rkcYbcnPte
blShhcxpo7Ee+rfyOFKLeIebFbEg1HQxgCp8PYCv4Tc6c5PjTt6YHgsQBM4evLGF
sj7lMfoHSKJ8yBlRK5X6e1sOEl/wwvJwGTdaR4ko8V26Q83j2tTJWlOd7aKABsTB
OhPP7cTb8byaTBWjdx4sCgVq8TmxZTcaSUoPriHAhCj+ofgD02qybVMy+Iez9HJS
l6MW6g4YSsGECbaUrvPN2XBoo9WYO0tVz76OJ7TklM2cwRCd4vJ4AoktMTgH225Z
ymMUnwmqSzY+Vg+xUHDXvErgzRJgjglPj9vEO1yknvK0LbBID1fRBXbHq4G1mZ+G
+shKWLRRbRKlILT3/M8RQqHdMCANwKuiz01Bb1pG3qP5LYhWkq3xoX+SGCa3YQIi
LqYKognq5rouHXUXP2kMIwUzGzr+4IZKpAs+XRdT2BDPK240y8neDoR651FCzwby
B1TajGC12GOvTQNNw9PD7D0VGZ9jYVA8DFnvaCyLdoC8LNtu21TG92KHKSpnejit
a8xBxtH+1AY74DqJgA1EOnDHZMe4+hCCShjzb3MivYDIb0hMVn5czRKehwzEklJ2
gOXnoW3T/Y4XT+J7e5cZ5MPLpRXlwiS/5ffNa0UnbTKs04G5q4iy1+IBN3j8XC8j
YF027iDy/pkpWeI9APLL7VLLpwjk0GZcV7cKEdnrpzadwbS69yTaaNO2ehiyBHKH
Y/vKJ3A7tU83D/PsPUiUoPf088N8sIMF95ZilTHOAJSoC3SoTB5hwbNzYzs+9ECl
jIVS9FVqH/UCdt73RvQHiL6HqGublRw552hFoPY2WUjts+Wau9WiBcGSs6bwFHIw
mWprA6hAeIYmjlRd52ocht911l2DbrT9JGSEMAz8UaNwInSCB+oW0sX4c1qS4MDt
pnhjXcxAtluJxGkMIvXgEmnROqND4DYXM4ZxehIBjpM6pKcSZRzpMSI3HMRCArsk
OPQfNOARL0jamqU8xH/6EWmqhLxTF92PTtJu3lx4gnk7bMY77STTQFcTlkNA3w9n
v3s6pMtzZWdbHlc+4u3/Cn3E6MUt/nqeFnZiYWF8JDGonZxQguXeVNxgfVmFO9Ty
L64ValuBciq8K5ckTzYKzUn/Nr+3jG7zI4yUFrXlBkgqENxCOY4yPcC+Q0DmKO8B
8CrFTWX59b9h9+e8nsHQ0EdKokDI61pyZtSSN1XmxYS0sFt0Aw+Pcp+29icpr3cC
+L1Q4CUS5lEstH1lO4TN71E9wi4/IUjgZD4Zc/E8yvPIHfoH3LZgHibXw0JCwqxQ
VEcVDKJrrO6qxdZdX7pgrl6FKTe1RA==
=2+U5
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXo1lk2aOgq3Tt24GAQiBnA/+JfwGkkw3jqEVWj//jY0UU/dSCisd4QsO
hgMY1817Cst2Bz3JpCKvqKZzbxsJKtbP7rgYxarJWEK0dtJqSC6Oyid7bMDi29ak
XCXIKGoIsl/opmIdASI3Y5GDpWnQpUIlFKhK4zYhfwoUEdqDV2fHgeKED7OoP/Zf
1zsZeK2yRRoEu3hpwM7WWTlhT80faOFwe04o2W06hzuv6WmmuvxqUFRtVvHHW0jv
XAlCnZVKypRQ8GH+mcQE31HmCrHKFEB7LnfOl/Z6G8XNXjucNjI1XH8wgzYrZglA
s49mQYwkcOv1u7ZUE632qdglp5wZeaP0Nxsq7P/Or0OvnYx2Q3ru32Q7bQX0MTLK
yAIarJFKDp7U8GVWLIMh/t1XhJx7x3gPCVwUHv5GLoxxWN3j54ukqEjvcAqpvliO
VW0FBxCs4MHS3Wh5l0Yuil+Pdj+aBC0i6HgjU4t8Iy+WAGJOaEKEJXGCdFAZWoMf
7JS6zHkjZogWXb4UvFdPfSDT1xq9J3OycFzaZxKDbiEGBe+y98ls+FNRLhgaFYcq
NpysJpQUP+j7UxoUzzACypAddbX/dJQhCBvdZJRux11j1i+gi/1w7KchyNfjDafV
ylVLpKoMg4PWQPJDYz5RUZZocmY6MFQ/uDXTemwAxcYKHgq311B0wKwg8NvHR3j1
m9SIVoR1qyQ=
=MT35
-----END PGP SIGNATURE-----