Operating System:

[RedHat]

Published:

14 October 2020

Protect yourself against future threats.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2020.3531
                Critical: chromium-browser security update
                              14 October 2020

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           chromium-browser
Publisher:         Red Hat
Operating System:  Red Hat
Impact/Access:     Execute Arbitrary Code/Commands -- Remote with User Interaction
                   Denial of Service               -- Remote with User Interaction
                   Access Confidential Data        -- Remote with User Interaction
                   Reduced Security                -- Remote with User Interaction
Resolution:        Patch/Upgrade
CVE Names:         CVE-2020-15992 CVE-2020-15991 CVE-2020-15990
                   CVE-2020-15989 CVE-2020-15988 CVE-2020-15987
                   CVE-2020-15986 CVE-2020-15985 CVE-2020-15984
                   CVE-2020-15983 CVE-2020-15982 CVE-2020-15981
                   CVE-2020-15980 CVE-2020-15979 CVE-2020-15978
                   CVE-2020-15977 CVE-2020-15976 CVE-2020-15975
                   CVE-2020-15974 CVE-2020-15973 CVE-2020-15972
                   CVE-2020-15971 CVE-2020-15970 CVE-2020-15969
                   CVE-2020-15968 CVE-2020-15967 CVE-2020-6557

Original Bulletin: 
   https://access.redhat.com/errata/RHSA-2020:4235

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Critical: chromium-browser security update
Advisory ID:       RHSA-2020:4235-01
Product:           Red Hat Enterprise Linux Supplementary
Advisory URL:      https://access.redhat.com/errata/RHSA-2020:4235
Issue date:        2020-10-13
CVE Names:         CVE-2020-6557 CVE-2020-15967 CVE-2020-15968 
                   CVE-2020-15969 CVE-2020-15970 CVE-2020-15971 
                   CVE-2020-15972 CVE-2020-15973 CVE-2020-15974 
                   CVE-2020-15975 CVE-2020-15976 CVE-2020-15977 
                   CVE-2020-15978 CVE-2020-15979 CVE-2020-15980 
                   CVE-2020-15981 CVE-2020-15982 CVE-2020-15983 
                   CVE-2020-15984 CVE-2020-15985 CVE-2020-15986 
                   CVE-2020-15987 CVE-2020-15988 CVE-2020-15989 
                   CVE-2020-15990 CVE-2020-15991 CVE-2020-15992 
=====================================================================

1. Summary:

An update for chromium-browser is now available for Red Hat Enterprise
Linux 6 Supplementary.

Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, i686, x86_64
Red Hat Enterprise Linux HPC Node Supplementary (v. 6) - i686, x86_64
Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, i686, x86_64
Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, i686, x86_64

3. Description:

Chromium is an open-source web browser, powered by WebKit (Blink).

This update upgrades Chromium to version 86.0.4240.75.

Security Fix(es):

* chromium-browser: Use after free in payments (CVE-2020-15967)

* chromium-browser: Use after free in Blink (CVE-2020-15968)

* chromium-browser: Use after free in WebRTC (CVE-2020-15969)

* chromium-browser: Use after free in NFC (CVE-2020-15970)

* chromium-browser: Use after free in printing (CVE-2020-15971)

* chromium-browser: Use after free in audio (CVE-2020-15972)

* chromium-browser: Use after free in autofill (CVE-2020-15990)

* chromium-browser: Use after free in password manager (CVE-2020-15991)

* chromium-browser: Inappropriate implementation in networking
(CVE-2020-6557)

* chromium-browser: Insufficient policy enforcement in extensions
(CVE-2020-15973)

* chromium-browser: Integer overflow in Blink (CVE-2020-15974)

* chromium-browser: Integer overflow in SwiftShader (CVE-2020-15975)

* chromium-browser: Use after free in WebXR (CVE-2020-15976)

* chromium-browser: Insufficient data validation in dialogs
(CVE-2020-15977)

* chromium-browser: Insufficient data validation in navigation
(CVE-2020-15978)

* chromium-browser: Inappropriate implementation in V8 (CVE-2020-15979)

* chromium-browser: Insufficient policy enforcement in Intents
(CVE-2020-15980)

* chromium-browser: Out of bounds read in audio (CVE-2020-15981)

* chromium-browser: Side-channel information leakage in cache
(CVE-2020-15982)

* chromium-browser: Insufficient data validation in webUI (CVE-2020-15983)

* chromium-browser: Insufficient policy enforcement in Omnibox
(CVE-2020-15984)

* chromium-browser: Inappropriate implementation in Blink (CVE-2020-15985)

* chromium-browser: Integer overflow in media (CVE-2020-15986)

* chromium-browser: Use after free in WebRTC (CVE-2020-15987)

* chromium-browser: Insufficient policy enforcement in networking
(CVE-2020-15992)

* chromium-browser: Insufficient policy enforcement in downloads
(CVE-2020-15988)

* chromium-browser: Uninitialized use in PDFium (CVE-2020-15989)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

1885883 - CVE-2020-15967 chromium-browser: Use after free in payments
1885884 - CVE-2020-15968 chromium-browser: Use after free in Blink
1885885 - CVE-2020-15969 chromium-browser: Use after free in WebRTC
1885886 - CVE-2020-15970 chromium-browser: Use after free in NFC
1885887 - CVE-2020-15971 chromium-browser: Use after free in printing
1885888 - CVE-2020-15972 chromium-browser: Use after free in audio
1885889 - CVE-2020-15990 chromium-browser: Use after free in autofill
1885890 - CVE-2020-15991 chromium-browser: Use after free in password manager
1885891 - CVE-2020-15973 chromium-browser: Insufficient policy enforcement in extensions
1885892 - CVE-2020-15974 chromium-browser: Integer overflow in Blink
1885893 - CVE-2020-15975 chromium-browser: Integer overflow in SwiftShader
1885894 - CVE-2020-15976 chromium-browser: Use after free in WebXR
1885896 - CVE-2020-6557 chromium-browser: Inappropriate implementation in networking
1885897 - CVE-2020-15977 chromium-browser: Insufficient data validation in dialogs
1885899 - CVE-2020-15978 chromium-browser: Insufficient data validation in navigation
1885901 - CVE-2020-15979 chromium-browser: Inappropriate implementation in V8
1885902 - CVE-2020-15980 chromium-browser: Insufficient policy enforcement in Intents
1885903 - CVE-2020-15981 chromium-browser: Out of bounds read in audio
1885904 - CVE-2020-15982 chromium-browser: Side-channel information leakage in cache
1885905 - CVE-2020-15983 chromium-browser: Insufficient data validation in webUI
1885906 - CVE-2020-15984 chromium-browser: Insufficient policy enforcement in Omnibox
1885907 - CVE-2020-15985 chromium-browser: Inappropriate implementation in Blink
1885908 - CVE-2020-15986 chromium-browser: Integer overflow in media
1885909 - CVE-2020-15987 chromium-browser: Use after free in WebRTC
1885910 - CVE-2020-15992 chromium-browser: Insufficient policy enforcement in networking
1885911 - CVE-2020-15988 chromium-browser: Insufficient policy enforcement in downloads
1885912 - CVE-2020-15989 chromium-browser: Uninitialized use in PDFium

6. Package List:

Red Hat Enterprise Linux Desktop Supplementary (v. 6):

i386:
chromium-browser-86.0.4240.75-1.el6_10.i686.rpm
chromium-browser-debuginfo-86.0.4240.75-1.el6_10.i686.rpm

i686:
chromium-browser-86.0.4240.75-1.el6_10.i686.rpm
chromium-browser-debuginfo-86.0.4240.75-1.el6_10.i686.rpm

x86_64:
chromium-browser-86.0.4240.75-1.el6_10.x86_64.rpm
chromium-browser-debuginfo-86.0.4240.75-1.el6_10.x86_64.rpm

Red Hat Enterprise Linux HPC Node Supplementary (v. 6):

i686:
chromium-browser-86.0.4240.75-1.el6_10.i686.rpm
chromium-browser-debuginfo-86.0.4240.75-1.el6_10.i686.rpm

x86_64:
chromium-browser-86.0.4240.75-1.el6_10.x86_64.rpm
chromium-browser-debuginfo-86.0.4240.75-1.el6_10.x86_64.rpm

Red Hat Enterprise Linux Server Supplementary (v. 6):

i386:
chromium-browser-86.0.4240.75-1.el6_10.i686.rpm
chromium-browser-debuginfo-86.0.4240.75-1.el6_10.i686.rpm

i686:
chromium-browser-86.0.4240.75-1.el6_10.i686.rpm
chromium-browser-debuginfo-86.0.4240.75-1.el6_10.i686.rpm

x86_64:
chromium-browser-86.0.4240.75-1.el6_10.x86_64.rpm
chromium-browser-debuginfo-86.0.4240.75-1.el6_10.x86_64.rpm

Red Hat Enterprise Linux Workstation Supplementary (v. 6):

i386:
chromium-browser-86.0.4240.75-1.el6_10.i686.rpm
chromium-browser-debuginfo-86.0.4240.75-1.el6_10.i686.rpm

i686:
chromium-browser-86.0.4240.75-1.el6_10.i686.rpm
chromium-browser-debuginfo-86.0.4240.75-1.el6_10.i686.rpm

x86_64:
chromium-browser-86.0.4240.75-1.el6_10.x86_64.rpm
chromium-browser-debuginfo-86.0.4240.75-1.el6_10.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2020-6557
https://access.redhat.com/security/cve/CVE-2020-15967
https://access.redhat.com/security/cve/CVE-2020-15968
https://access.redhat.com/security/cve/CVE-2020-15969
https://access.redhat.com/security/cve/CVE-2020-15970
https://access.redhat.com/security/cve/CVE-2020-15971
https://access.redhat.com/security/cve/CVE-2020-15972
https://access.redhat.com/security/cve/CVE-2020-15973
https://access.redhat.com/security/cve/CVE-2020-15974
https://access.redhat.com/security/cve/CVE-2020-15975
https://access.redhat.com/security/cve/CVE-2020-15976
https://access.redhat.com/security/cve/CVE-2020-15977
https://access.redhat.com/security/cve/CVE-2020-15978
https://access.redhat.com/security/cve/CVE-2020-15979
https://access.redhat.com/security/cve/CVE-2020-15980
https://access.redhat.com/security/cve/CVE-2020-15981
https://access.redhat.com/security/cve/CVE-2020-15982
https://access.redhat.com/security/cve/CVE-2020-15983
https://access.redhat.com/security/cve/CVE-2020-15984
https://access.redhat.com/security/cve/CVE-2020-15985
https://access.redhat.com/security/cve/CVE-2020-15986
https://access.redhat.com/security/cve/CVE-2020-15987
https://access.redhat.com/security/cve/CVE-2020-15988
https://access.redhat.com/security/cve/CVE-2020-15989
https://access.redhat.com/security/cve/CVE-2020-15990
https://access.redhat.com/security/cve/CVE-2020-15991
https://access.redhat.com/security/cve/CVE-2020-15992
https://access.redhat.com/security/updates/classification/#critical

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2020 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBX4VjutzjgjWX9erEAQiBog/8D4EAnQmD6yqmkt9gVgCzoz1v/uOgnTHv
lghXbEidNiTmb8DlvwZKbqA/2wz/kz+vW5v0bXZNjngYnbZsev252qT9L2LQ99UA
+uirPF/zddn+T0tZ5PQHWBYpWgjF8XRQu7lJo7QHbB7GEMXJJ4SBN3erYqOjKKUo
3DakSX4DH1VIrSY+6kJ6fx26IwD7tWSBlsRklatxX1NkhrBg0Ha7lWjHhRV6WLjz
CZFxwFNJJ6bGsf8eIaaps8Ab21m87BbwOyGt2aaFT9sC5noR4mTTjBGB4lmbslB3
Vcl7PSxqs/AzDK6fAqLOJ7nqZJpiQq9ii5Z3oBbiG3J8BO6sgY7cG+D2bVWD+3eV
9L13REiW/iPXqGbpgPre8WhAwg3wdNYDiaYO6pIC7N1a/btxIdq5Gjb31dWiFdyq
XOtdEO9CieZGYNEoKf+wfe03SXCEvJz0EZZVwcFhqd8cF8xhUa2MNjpKDHryUjXg
8rJGA+5uS/UJHwToK++Q4+0Ze/jIxSuKRA7h9UhdACksgeMmFUdyfuLVfx1RdgEX
TRtO8kHaGBHz60SY4Kd6xkZks1+FqotFF2zvs4gq8XvPFbHvPgt36qbtxOHYj1BF
pl+WqaRsDOp6VmbMLAEJwZnRsR0dNN62MCgxB5sNRb5l7sSYOqYClV2zR47cEgFJ
ObQiF6iTAHk=
=AItV
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBX4aSvONLKJtyKPYoAQh3tA//b6UyKbmpKHYIi2Zbg3peoYBHX2LHLh6u
S2nIKxsiVGpjDlqsRV+M6WyQC2C41rrqhk0vYQkRq3c+dktKDSOaM3bbFfK0jxoM
NG6vzBdR+lcMemK5npLMr5++sXH8wNKLlveUyG/WM64NdCkvxA47Ckj0TcdGB1tX
QNS8pQ9dVDQ249SoyZmaSgzo0n3A55osowYMwqnHfH8TTUiC+Vww8TuMdR5CKWXL
2OqtRr92XoqlAXZANA24XVO7Vd0knRHymmks4JDjA/8C8T7ogNV5jYLyI5IWLdDS
z/9KU2NgffCKqRoULtbZ1MYIjrLbM7b14FTK40yGxfOS4UTloFC3hLgsejtTfKo7
MW52f29HyHOB/ksosvawyem1xlVZIAI6i2/O6O5L6HN0yepuqt8mZpVjz5z8eorx
TwDQIN7HEPaleqs5Jh2LNw7P/mXF2qFPAlonVpFpXU0TEoLxn0VG/HyM+Uy0q0QS
BpS9oBukLqKhZ8MEOAt7RCQqq+XflRpeQaPOrpR0pLzo3DSYdhs5lN6qLoBkiiDt
F9LP1t80zBtujdFiDTTKXSidJIobZWs6uue3QfpylYVt08LEXQ3Z/xgPpY6QZj1q
a70qe5zS5Rx7+/wc8KO4JEopjfKTEXH484WeSTCSY3cu08/WBQ7rmQycXlPn9cRW
Ev7KVczd/Hc=
=Qxe5
-----END PGP SIGNATURE-----