Red Hat Security Advisory: chromium-browser security update

Fixed packages 2

Vulnerabilities 23

• Unscored —
  CVE-2018-16065

  A Javascript reentrancy issues that caused a use-after-free in V8 in Google Chrome prior to 69.0.3497.81 allowed a remo…

  Google Chrome chromium-browser oxide-qt Browsers Ubuntu
  Jan 9, 2019
• Unscored —
  CVE-2018-16066

  A use after free in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially exploit heap …

  Google Chrome chromium-browser oxide-qt Browsers Ubuntu
  Jan 9, 2019
• Unscored —
  CVE-2018-16067

  A use after free in WebAudio in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially exploit he…

  Google Chrome chromium-browser oxide-qt Browsers Ubuntu
  Jan 9, 2019
• Unscored —
  CVE-2018-16068

  Missing validation in Mojo in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially perform a sa…

  Google Chrome chromium-browser oxide-qt Browsers Ubuntu
  Jan 9, 2019
• Unscored —
  CVE-2018-16069

  Unintended floating-point error accumulation in SwiftShader in Google Chrome prior to 69.0.3497.81 allowed a remote att…

  Google Chrome chromium-browser oxide-qt Browsers Ubuntu
  Jun 27, 2019
• Unscored —
  CVE-2018-16070

  Integer overflows in Skia in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially exploit heap …

  Google Chrome chromium-browser oxide-qt Browsers Ubuntu
  Jun 27, 2019
• Unscored —
  CVE-2018-16071 Public exploit

  A use after free in WebRTC in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially exploit heap…

  Google Chrome chromium-browser oxide-qt Browsers Ubuntu
  Jan 9, 2019
• Unscored —
  CVE-2018-16073

  Insufficient policy enforcement in site isolation in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to b…

  Google Chrome chromium-browser oxide-qt Browsers Ubuntu
  Jun 27, 2019
• Unscored —
  CVE-2018-16074

  Insufficient policy enforcement in site isolation in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to b…

  Google Chrome chromium-browser oxide-qt Browsers Ubuntu
  Jun 27, 2019
• Unscored —
  CVE-2018-16075

  Insufficient file type enforcement in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to obtain …

  Google Chrome chromium-browser oxide-qt Browsers Ubuntu
  Jun 27, 2019
• Unscored —
  CVE-2018-16076

  Missing bounds check in PDFium in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to perform an out of bo…

  Google Chrome chromium-browser oxide-qt Browsers Ubuntu
  Jan 9, 2019
• Unscored —
  CVE-2018-16077

  Object lifecycle issue in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to bypass content secu…

  Google Chrome chromium-browser oxide-qt Browsers Ubuntu
  Jun 27, 2019
• Unscored —
  CVE-2018-16078

  Unsafe handling of credit card details in Autofill in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to …

  Google Chrome chromium-browser oxide-qt Browsers Ubuntu
  Jan 9, 2019
• Unscored —
  CVE-2018-16079

  A race condition between permission prompts and navigations in Prompts in Google Chrome prior to 69.0.3497.81 allowed a…

  Google Chrome chromium-browser oxide-qt Browsers Ubuntu
  Jan 9, 2019
• Unscored —
  CVE-2018-16080

  A missing check for popup window handling in Fullscreen in Google Chrome on macOS prior to 69.0.3497.81 allowed a remot…

  Google Chrome chromium-browser oxide-qt Browsers Ubuntu
  Jan 9, 2019
• Unscored —
  CVE-2018-16081

  Allowing the chrome.debugger API to run on file:// URLs in DevTools in Google Chrome prior to 69.0.3497.81 allowed an a…

  Google Chrome chromium-browser oxide-qt Browsers Ubuntu
  Jan 9, 2019
• Unscored —
  CVE-2018-16082

  An out of bounds read in Swiftshader in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially pe…

  Google Chrome chromium-browser oxide-qt Browsers Ubuntu
  Jan 9, 2019
• Unscored —
  CVE-2018-16083 Public exploit

  An out of bounds read in forward error correction code in WebRTC in Google Chrome prior to 69.0.3497.81 allowed a remot…

  Google Chrome chromium-browser oxide-qt Browsers Ubuntu
  Jan 9, 2019
• Unscored —
  CVE-2018-16084

  The default selected dialog button in CustomHandlers in Google Chrome prior to 69.0.3497.81 allowed a remote attacker w…

  Google Chrome chromium-browser oxide-qt Browsers Ubuntu
  Jan 9, 2019
• Unscored —
  CVE-2018-16085

  A use after free in ResourceCoordinator in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially…

  Google Chrome chromium-browser oxide-qt Browsers Ubuntu
  Jan 9, 2019
• Unscored —
  CVE-2018-16086

  Insufficient policy enforcement in extensions API in Google Chrome prior to 69.0.3497.81 allowed an attacker who convin…

  Google Chrome chromium-browser oxide-qt Browsers Ubuntu
  Jun 27, 2019
• Unscored —
  CVE-2018-16087

  Lack of proper state tracking in Permissions in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to bypass…

  Google Chrome chromium-browser oxide-qt Browsers Ubuntu
  Jan 9, 2019
• Unscored —
  CVE-2018-16088

  A missing check for JS-simulated input events in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker…

  Google Chrome chromium-browser oxide-qt Browsers Ubuntu
  Jan 9, 2019

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1625466
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1625467
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1625469
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1625470
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1625471
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1625472
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1625473
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1625475
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1625476
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1625477
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1625478
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1625479
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1625480
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1625481
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1625482
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1625484
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1625485
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1625486
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1625487
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1625488
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1626286
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1626287
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1626288
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2666.json
• report
  https://access.redhat.com/security/cve/CVE-2018-16065
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-16065
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-16065
• article
  https://chromereleases.googleblog.com/2018/09/stable-channel-update-for-desktop.html
• report
  https://access.redhat.com/security/cve/CVE-2018-16066
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-16066
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-16066
• report
  https://access.redhat.com/security/cve/CVE-2018-16067
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-16067
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-16067
• report
  https://access.redhat.com/security/cve/CVE-2018-16068
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-16068
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-16068
• report
  https://access.redhat.com/security/cve/CVE-2018-16069