1. Forum
  2. Usenet
  3. LINUX.DEBIAN.ANNOUNCE.SEC

  • [SECURITY] [DSA 4182-1] chromium-browser security update (1/2)

    From Michael Gilbert@1:229/2 to All on Sat Apr 28 07:40:01 2018
    From: [email protected]

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA512

    - ------------------------------------------------------------------------- Debian Security Advisory DSA-4182-1 [email protected] https://www.debian.org/security/ Michael Gilbert
    April 28, 2018 https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package : chromium-browser
    CVE ID : CVE-2018-6056 CVE-2018-6057 CVE-2018-6060 CVE-2018-6061
    CVE-2018-6062 CVE-2018-6063 CVE-2018-6064 CVE-2018-6065
    CVE-2018-6066 CVE-2018-6067 CVE-2018-6068 CVE-2018-6069
    CVE-2018-6070 CVE-2018-6071 CVE-2018-6072 CVE-2018-6073
    CVE-2018-6074 CVE-2018-6075 CVE-2018-6076 CVE-2018-6077
    CVE-2018-6078 CVE-2018-6079 CVE-2018-6080 CVE-2018-6081
    CVE-2018-6082 CVE-2018-6083 CVE-2018-6085 CVE-2018-6086
    CVE-2018-6087 CVE-2018-6088 CVE-2018-6089 CVE-2018-6090
    CVE-2018-6091 CVE-2018-6092 CVE-2018-6093 CVE-2018-6094
    CVE-2018-6095 CVE-2018-6096 CVE-2018-6097 CVE-2018-6098
    CVE-2018-6099 CVE-2018-6100 CVE-2018-6101 CVE-2018-6102
    CVE-2018-6103 CVE-2018-6104 CVE-2018-6105 CVE-2018-6106
    CVE-2018-6107 CVE-2018-6108 CVE-2018-6109 CVE-2018-6110
    CVE-2018-6111 CVE-2018-6112 CVE-2018-6113 CVE-2018-6114
    CVE-2018-6116 CVE-2018-6117

    Several vulnerabilities have been discovered in the chromium web browser.

    CVE-2018-6056

    lokihardt discovered an error in the v8 javascript library.

    CVE-2018-6057

    Gal Beniamini discovered errors related to shared memory permissions.

    CVE-2018-6060

    Omair discovered a use-after-free issue in blink/webkit.

    CVE-2018-6061

    Guang Gong discovered a race condition in the v8 javascript library.

    CVE-2018-6062

    A heap overflow issue was discovered in the v8 javascript library.

    CVE-2018-6063

    Gal Beniamini discovered errors related to shared memory permissions.

    CVE-2018-6064

    lokihardt discovered a type confusion error in the v8 javascript
    library.

    CVE-2018-6065

    Mark Brand discovered an integer overflow issue in the v8 javascript
    library.

    CVE-2018-6066

    Masato Kinugawa discovered a way to bypass the Same Origin Policy.

    CVE-2018-6067

    Ned Williamson discovered a buffer overflow issue in the skia library.

    CVE-2018-6068

    Luan Herrera discovered object lifecycle issues.

    CVE-2018-6069

    Wanglu and Yangkang discovered a stack overflow issue in the skia
    library.

    CVE-2018-6070

    Rob Wu discovered a way to bypass the Content Security Policy.

    CVE-2018-6071

    A heap overflow issue was discovered in the skia library.

    CVE-2018-6072

    Atte Kettunen discovered an integer overflow issue in the pdfium
    library.

    CVE-2018-6073

    Omair discover a heap overflow issue in the WebGL implementation.

    CVE-2018-6074

    Abdulrahman Alqabandi discovered a way to cause a downloaded web page
    to not contain a Mark of the Web.

    CVE-2018-6075

    Inti De Ceukelaire discovered a way to bypass the Same Origin Policy.

    CVE-2018-6076

    Mateusz Krzeszowiec discovered that URL fragment identifiers could be
    handled incorrectly.

    CVE-2018-6077

    Khalil Zhani discovered a timing issue.

    CVE-2018-6078

    Khalil Zhani discovered a URL spoofing issue.

    CVE-2018-6079

    Ivars discovered an information disclosure issue.

    CVE-2018-6080

    Gal Beniamini discovered an information disclosure issue.

    CVE-2018-6081

    Rob Wu discovered a cross-site scripting issue.

    CVE-2018-6082

    WenXu Wu discovered a way to bypass blocked ports.

    CVE-2018-6083

    Jun Kokatsu discovered that AppManifests could be handled incorrectly.

    CVE-2018-6085

    Ned Williamson discovered a use-after-free issue.

    CVE-2018-6086

    Ned Williamson discovered a use-after-free issue.

    CVE-2018-6087

    A use-after-free issue was discovered in the WebAssembly implementation.

    CVE-2018-6088


    [continued in next message]

    --- SoupGate-Win32 v1.05
    * Origin: you cannot sedate... all the things you hate (1:229/2)