Red Hat Security Advisory: chromium-browser security update

Fixed packages 2

Vulnerabilities 19

• High 8.8
  CVE-2017-15412

  Nokogiri gem, via libxml, is affected by DoS vulnerabilities

  Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

  chromium-browser oxide-qt libxml2 libxml2 Browsers Debian Ubuntu RubyGems
  Aug 28, 2018
• Unscored —
  CVE-2017-15407

  Out-of-bounds Write in the QUIC networking stack in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to ga…

  chromium-browser oxide-qt Browsers Ubuntu
  Aug 28, 2018
• Unscored —
  CVE-2017-15408

  Heap buffer overflow in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit…

  chromium-browser oxide-qt Browsers Ubuntu
  Aug 28, 2018
• Unscored —
  CVE-2017-15409

  Heap buffer overflow in Skia in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit he…

  chromium-browser oxide-qt Browsers Ubuntu
  Aug 28, 2018
• Unscored —
  CVE-2017-15410

  Use after free in PDFium in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap c…

  chromium-browser oxide-qt Browsers Ubuntu
  Aug 28, 2018
• Unscored —
  CVE-2017-15411

  Use after free in PDFium in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap c…

  chromium-browser oxide-qt Browsers Ubuntu
  Aug 28, 2018
• Unscored —
  CVE-2017-15413

  Type confusion in WebAssembly in V8 in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exp…

  chromium-browser oxide-qt Browsers Ubuntu
  Aug 28, 2018
• Unscored —
  CVE-2017-15415

  Incorrect serialization in IPC in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak the value of a …

  chromium-browser oxide-qt Browsers Ubuntu
  Aug 28, 2018
• Unscored —
  CVE-2017-15416

  Heap buffer overflow in Blob API in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploi…

  chromium-browser oxide-qt Browsers Ubuntu
  Aug 28, 2018
• Unscored —
  CVE-2017-15417

  Inappropriate implementation in Skia canvas composite operations in Google Chrome prior to 63.0.3239.84 allowed a remot…

  chromium-browser oxide-qt Browsers Ubuntu
  Aug 28, 2018
• Unscored —
  CVE-2017-15418

  Use of uninitialized memory in Skia in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to obtain potentia…

  chromium-browser oxide-qt Browsers Ubuntu
  Aug 28, 2018
• Unscored —
  CVE-2017-15419

  Insufficient policy enforcement in Resource Timing API in Google Chrome prior to 63.0.3239.84 allowed a remote attacker…

  chromium-browser oxide-qt Browsers Ubuntu
  Aug 28, 2018
• Unscored —
  CVE-2017-15420

  Incorrect handling of back navigations in error pages in Navigation in Google Chrome prior to 63.0.3239.84 allowed a re…

  Google Chrome chromium-browser oxide-qt Browsers Ubuntu
  Aug 28, 2018
• Unscored —
  CVE-2017-15422

  Integer overflow in international date handling in International Components for Unicode (ICU) for C/C++ before 60.1, as…

  chromium-browser oxide-qt icu icu Browsers Debian Ubuntu
  Aug 28, 2018
• Unscored —
  CVE-2017-15423

  Inappropriate implementation in BoringSSL SPAKE2 in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to le…

  chromium-browser oxide-qt Browsers Ubuntu
  Aug 28, 2018
• Unscored —
  CVE-2017-15424

  Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform …

  chromium-browser oxide-qt Browsers Ubuntu
  Aug 28, 2018
• Unscored —
  CVE-2017-15425

  Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform …

  chromium-browser oxide-qt Browsers Ubuntu
  Aug 28, 2018
• Unscored —
  CVE-2017-15426

  Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform …

  chromium-browser oxide-qt Browsers Ubuntu
  Aug 28, 2018
• Unscored —
  CVE-2017-15427

  Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a socially engineered user to…

  chromium-browser oxide-qt Browsers Ubuntu
  Aug 28, 2018

References

• article
  https://access.redhat.com/security/updates/classification/#critical
• article
  https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1523123
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1523124
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1523125
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1523126
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1523127
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1523128
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1523129
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1523130
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1523131
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1523132
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1523133
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1523134
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1523135
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1523136
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1523137
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1523138
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1523139
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1523140
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1523141
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_3401.json
• report
  https://access.redhat.com/security/cve/CVE-2017-15407
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-15407
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-15407
• report
  https://access.redhat.com/security/cve/CVE-2017-15408
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-15408
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-15408
• report
  https://access.redhat.com/security/cve/CVE-2017-15409
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-15409
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-15409
• report
  https://access.redhat.com/security/cve/CVE-2017-15410
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-15410
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-15410
• report
  https://access.redhat.com/security/cve/CVE-2017-15411
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-15411
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-15411
• report
  https://access.redhat.com/security/cve/CVE-2017-15412
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-15412