Описание
Security update for chromium
This update for chromium to version 76.0.3809.87 fixes the following issues:
- CVE-2019-5850: Use-after-free in offline page fetcher (boo#1143492)
- CVE-2019-5860: Use-after-free in PDFium (boo#1143492)
- CVE-2019-5853: Memory corruption in regexp length check (boo#1143492)
- CVE-2019-5851: Use-after-poison in offline audio context (boo#1143492)
- CVE-2019-5859: res: URIs can load alternative browsers (boo#1143492)
- CVE-2019-5856: Insufficient checks on filesystem: URI permissions (boo#1143492)
- CVE-2019-5855: Integer overflow in PDFium (boo#1143492)
- CVE-2019-5865: Site isolation bypass from compromised renderer (boo#1143492)
- CVE-2019-5858: Insufficient filtering of Open URL service parameters (boo#1143492)
- CVE-2019-5864: Insufficient port filtering in CORS for extensions (boo#1143492)
- CVE-2019-5862: AppCache not robust to compromised renderers (boo#1143492)
- CVE-2019-5861: Click location incorrectly checked (boo#1143492)
- CVE-2019-5857: Comparison of -0 and null yields crash (boo#1143492)
- CVE-2019-5854: Integer overflow in PDFium text rendering (boo#1143492)
- CVE-2019-5852: Object leak of utility functions (boo#1143492)
Список пакетов
openSUSE Leap 15.1
Ссылки
- E-Mail link for openSUSE-SU-2019:1849-1
- SUSE Security Ratings
- SUSE Bug 1143492
- SUSE Bug 1144625
- SUSE CVE CVE-2019-5850 page
- SUSE CVE CVE-2019-5851 page
- SUSE CVE CVE-2019-5852 page
- SUSE CVE CVE-2019-5853 page
- SUSE CVE CVE-2019-5854 page
- SUSE CVE CVE-2019-5855 page
- SUSE CVE CVE-2019-5856 page
- SUSE CVE CVE-2019-5857 page
- SUSE CVE CVE-2019-5858 page
- SUSE CVE CVE-2019-5859 page
- SUSE CVE CVE-2019-5860 page
- SUSE CVE CVE-2019-5861 page
- SUSE CVE CVE-2019-5862 page
- SUSE CVE CVE-2019-5863 page
- SUSE CVE CVE-2019-5864 page
- SUSE CVE CVE-2019-5865 page
Описание
Use after free in offline mode in Google Chrome prior to 76.0.3809.87 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
Затронутые продукты
Ссылки
- CVE-2019-5850
- SUSE Bug 1143492
Описание
Use after free in WebAudio in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Затронутые продукты
Ссылки
- CVE-2019-5851
- SUSE Bug 1143492
Описание
Inappropriate implementation in JavaScript in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
Затронутые продукты
Ссылки
- CVE-2019-5852
- SUSE Bug 1143492
Описание
Inappropriate implementation in JavaScript in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Затронутые продукты
Ссылки
- CVE-2019-5853
- SUSE Bug 1143492
Описание
Integer overflow in PDFium in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
Затронутые продукты
Ссылки
- CVE-2019-5854
- SUSE Bug 1143492
Описание
Integer overflow in PDFium in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
Затронутые продукты
Ссылки
- CVE-2019-5855
- SUSE Bug 1143492
Описание
Insufficient policy enforcement in storage in Google Chrome prior to 76.0.3809.87 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.
Затронутые продукты
Ссылки
- CVE-2019-5856
- SUSE Bug 1143492
Описание
Inappropriate implementation in JavaScript in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page.
Затронутые продукты
Ссылки
- CVE-2019-5857
- SUSE Bug 1143492
Описание
Incorrect security UI in MacOS services integration in Google Chrome on OS X prior to 76.0.3809.87 allowed a local attacker to execute arbitrary code via a crafted HTML page.
Затронутые продукты
Ссылки
- CVE-2019-5858
- SUSE Bug 1143492
Описание
Insufficient filtering in URI schemes in Google Chrome on Windows prior to 76.0.3809.87 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
Затронутые продукты
Ссылки
- CVE-2019-5859
- SUSE Bug 1143492
Описание
Use after free in PDFium in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
Затронутые продукты
Ссылки
- CVE-2019-5860
- SUSE Bug 1143492
Описание
Insufficient data validation in Blink in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to bypass anti-clickjacking policy via a crafted HTML page.
Затронутые продукты
Ссылки
- CVE-2019-5861
- SUSE Bug 1143492
Описание
Insufficient data validation in AppCache in Google Chrome prior to 76.0.3809.87 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.
Затронутые продукты
Ссылки
- CVE-2019-5862
- SUSE Bug 1143492
Описание
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
Затронутые продукты
Ссылки
- CVE-2019-5863
- SUSE Bug 1143492
Описание
Insufficient data validation in CORS in Google Chrome prior to 76.0.3809.87 allowed an attacker who convinced a user to install a malicious extension to bypass content security policy via a crafted Chrome Extension.
Затронутые продукты
Ссылки
- CVE-2019-5864
- SUSE Bug 1143492
Описание
Insufficient policy enforcement in navigations in Google Chrome prior to 76.0.3809.87 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.
Затронутые продукты
Ссылки
- CVE-2019-5865
- SUSE Bug 1143492