[RHSA-2019:3211-01] Critical: chromium-browser security update

Tue Oct 29 09:29:10 UTC 2019

An update for chromium-browser is now available for Red Hat Enterprise
Linux 6 Supplementary.

Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, i686, x86_64
Red Hat Enterprise Linux HPC Node Supplementary (v. 6) - i686, x86_64
Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, i686, x86_64
Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, i686, x86_64

3. Description:

Chromium is an open-source web browser, powered by WebKit (Blink).

This update upgrades Chromium to version 77.0.3865.120.

Security Fix(es):

* chromium-browser: Use-after-free in media (CVE-2019-5870)

* chromium-browser: Heap overflow in Skia (CVE-2019-5871)

* chromium-browser: Use-after-free in Mojo (CVE-2019-5872)

* chromium-browser: External URIs may trigger other browsers
(CVE-2019-5874)

* chromium-browser: URL bar spoof via download redirect (CVE-2019-5875)

* chromium-browser: Use-after-free in media (CVE-2019-5876)

* chromium-browser: Out-of-bounds access in V8 (CVE-2019-5877)

* chromium-browser: Use-after-free in V8 (CVE-2019-5878)

* chromium-browser: Use-after-free in offline pages (CVE-2019-13686)

* chromium-browser: Use-after-free in media (CVE-2019-13688)

* chromium-browser: Omnibox spoof (CVE-2019-13691)

* chromium-browser: SOP bypass (CVE-2019-13692)

* chromium-browser: Use-after-free in IndexedDB (CVE-2019-13693)

* chromium-browser: Use-after-free in WebRTC (CVE-2019-13694)

* chromium-browser: Use-after-free in audio (CVE-2019-13695)

* chromium-browser: Use-after-free in V8 (CVE-2019-13696)

* chromium-browser: Cross-origin size leak (CVE-2019-13697)

* chromium-browser: Extensions can read some local files (CVE-2019-5879)

* chromium-browser: SameSite cookie bypass (CVE-2019-5880)

* chromium-browser: Arbitrary read in SwiftShader (CVE-2019-5881)

* chromium-browser: URL spoof (CVE-2019-13659)

* chromium-browser: Full screen notification overlap (CVE-2019-13660)

* chromium-browser: Full screen notification spoof (CVE-2019-13661)

* chromium-browser: CSP bypass (CVE-2019-13662)

* chromium-browser: IDN spoof (CVE-2019-13663)

* chromium-browser: CSRF bypass (CVE-2019-13664)

* chromium-browser: Multiple file download protection bypass
(CVE-2019-13665)

* chromium-browser: Side channel using storage size estimate
(CVE-2019-13666)

* chromium-browser: URI bar spoof when using external app URIs
(CVE-2019-13667)

* chromium-browser: Global window leak via console (CVE-2019-13668)

* chromium-browser: HTTP authentication spoof (CVE-2019-13669)

* chromium-browser: V8 memory corruption in regex (CVE-2019-13670)

* chromium-browser: Dialog box fails to show origin (CVE-2019-13671)

* chromium-browser: Cross-origin information leak using devtools
(CVE-2019-13673)

* chromium-browser: IDN spoofing (CVE-2019-13674)

* chromium-browser: Extensions can be disabled by trailing slash
(CVE-2019-13675)

* chromium-browser: Google URI shown for certificate warning
(CVE-2019-13676)

* chromium-browser: Chrome web store origin needs to be isolated
(CVE-2019-13677)

* chromium-browser: Download dialog spoofing (CVE-2019-13678)

* chromium-browser: User gesture needed for printing (CVE-2019-13679)

* chromium-browser: IP address spoofing to servers (CVE-2019-13680)

* chromium-browser: Bypass on download restrictions (CVE-2019-13681)

* chromium-browser: Site isolation bypass (CVE-2019-13682)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

1762366 - CVE-2019-5870 chromium-browser: Use-after-free in media
1762367 - CVE-2019-5871 chromium-browser: Heap overflow in Skia
1762368 - CVE-2019-5872 chromium-browser: Use-after-free in Mojo
1762370 - CVE-2019-5874 chromium-browser: External URIs may trigger other browsers
1762371 - CVE-2019-5875 chromium-browser: URL bar spoof via download redirect
1762372 - CVE-2019-13691 chromium-browser: Omnibox spoof
1762373 - CVE-2019-13692 chromium-browser: SOP bypass
1762374 - CVE-2019-5876 chromium-browser: Use-after-free in media
1762375 - CVE-2019-5877 chromium-browser: Out-of-bounds access in V8
1762376 - CVE-2019-5878 chromium-browser: Use-after-free in V8
1762377 - CVE-2019-5879 chromium-browser: Extensions can read some local files
1762378 - CVE-2019-5880 chromium-browser: SameSite cookie bypass
1762379 - CVE-2019-5881 chromium-browser: Arbitrary read in SwiftShader
1762380 - CVE-2019-13659 chromium-browser: URL spoof
1762381 - CVE-2019-13660 chromium-browser: Full screen notification overlap
1762382 - CVE-2019-13661 chromium-browser: Full screen notification spoof
1762383 - CVE-2019-13662 chromium-browser: CSP bypass
1762384 - CVE-2019-13663 chromium-browser: IDN spoof
1762385 - CVE-2019-13664 chromium-browser: CSRF bypass
1762386 - CVE-2019-13665 chromium-browser: Multiple file download protection bypass
1762387 - CVE-2019-13666 chromium-browser: Side channel using storage size estimate
1762388 - CVE-2019-13667 chromium-browser: URI bar spoof when using external app URIs
1762389 - CVE-2019-13668 chromium-browser: Global window leak via console
1762390 - CVE-2019-13669 chromium-browser: HTTP authentication spoof
1762391 - CVE-2019-13670 chromium-browser: V8 memory corruption in regex
1762392 - CVE-2019-13671 chromium-browser: Dialog box fails to show origin
1762393 - CVE-2019-13673 chromium-browser: Cross-origin information leak using devtools
1762394 - CVE-2019-13674 chromium-browser: IDN spoofing
1762395 - CVE-2019-13675 chromium-browser: Extensions can be disabled by trailing slash
1762396 - CVE-2019-13676 chromium-browser: Google URI shown for certificate warning
1762397 - CVE-2019-13677 chromium-browser: Chrome web store origin needs to be isolated
1762398 - CVE-2019-13678 chromium-browser: Download dialog spoofing
1762399 - CVE-2019-13679 chromium-browser: User gesture needed for printing
1762400 - CVE-2019-13680 chromium-browser: IP address spoofing to servers
1762401 - CVE-2019-13681 chromium-browser: Bypass on download restrictions
1762402 - CVE-2019-13682 chromium-browser: Site isolation bypass
1762474 - CVE-2019-13688 chromium-browser: Use-after-free in media
1762476 - CVE-2019-13686 chromium-browser: Use-after-free in offline pages
1762518 - CVE-2019-13693 chromium-browser: Use-after-free in IndexedDB
1762519 - CVE-2019-13694 chromium-browser: Use-after-free in WebRTC
1762520 - CVE-2019-13695 chromium-browser: Use-after-free in audio
1762521 - CVE-2019-13696 chromium-browser: Use-after-free in V8
1762522 - CVE-2019-13697 chromium-browser: Cross-origin size leak

6. Package List:

Red Hat Enterprise Linux Desktop Supplementary (v. 6):

i386:
chromium-browser-77.0.3865.120-2.el6_10.i686.rpm
chromium-browser-debuginfo-77.0.3865.120-2.el6_10.i686.rpm

i686:
chromium-browser-77.0.3865.120-2.el6_10.i686.rpm
chromium-browser-debuginfo-77.0.3865.120-2.el6_10.i686.rpm

x86_64:
chromium-browser-77.0.3865.120-2.el6_10.x86_64.rpm
chromium-browser-debuginfo-77.0.3865.120-2.el6_10.x86_64.rpm

Red Hat Enterprise Linux HPC Node Supplementary (v. 6):

i686:
chromium-browser-77.0.3865.120-2.el6_10.i686.rpm
chromium-browser-debuginfo-77.0.3865.120-2.el6_10.i686.rpm

x86_64:
chromium-browser-77.0.3865.120-2.el6_10.x86_64.rpm
chromium-browser-debuginfo-77.0.3865.120-2.el6_10.x86_64.rpm

Red Hat Enterprise Linux Server Supplementary (v. 6):

i386:
chromium-browser-77.0.3865.120-2.el6_10.i686.rpm
chromium-browser-debuginfo-77.0.3865.120-2.el6_10.i686.rpm

i686:
chromium-browser-77.0.3865.120-2.el6_10.i686.rpm
chromium-browser-debuginfo-77.0.3865.120-2.el6_10.i686.rpm

x86_64:
chromium-browser-77.0.3865.120-2.el6_10.x86_64.rpm
chromium-browser-debuginfo-77.0.3865.120-2.el6_10.x86_64.rpm

Red Hat Enterprise Linux Workstation Supplementary (v. 6):

i386:
chromium-browser-77.0.3865.120-2.el6_10.i686.rpm
chromium-browser-debuginfo-77.0.3865.120-2.el6_10.i686.rpm

i686:
chromium-browser-77.0.3865.120-2.el6_10.i686.rpm
chromium-browser-debuginfo-77.0.3865.120-2.el6_10.i686.rpm

x86_64:
chromium-browser-77.0.3865.120-2.el6_10.x86_64.rpm
chromium-browser-debuginfo-77.0.3865.120-2.el6_10.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2019-5870
https://access.redhat.com/security/cve/CVE-2019-5871
https://access.redhat.com/security/cve/CVE-2019-5872
https://access.redhat.com/security/cve/CVE-2019-5874
https://access.redhat.com/security/cve/CVE-2019-5875
https://access.redhat.com/security/cve/CVE-2019-5876
https://access.redhat.com/security/cve/CVE-2019-5877
https://access.redhat.com/security/cve/CVE-2019-5878
https://access.redhat.com/security/cve/CVE-2019-5879
https://access.redhat.com/security/cve/CVE-2019-5880
https://access.redhat.com/security/cve/CVE-2019-5881
https://access.redhat.com/security/cve/CVE-2019-13659
https://access.redhat.com/security/cve/CVE-2019-13660
https://access.redhat.com/security/cve/CVE-2019-13661
https://access.redhat.com/security/cve/CVE-2019-13662
https://access.redhat.com/security/cve/CVE-2019-13663
https://access.redhat.com/security/cve/CVE-2019-13664
https://access.redhat.com/security/cve/CVE-2019-13665
https://access.redhat.com/security/cve/CVE-2019-13666
https://access.redhat.com/security/cve/CVE-2019-13667
https://access.redhat.com/security/cve/CVE-2019-13668
https://access.redhat.com/security/cve/CVE-2019-13669
https://access.redhat.com/security/cve/CVE-2019-13670
https://access.redhat.com/security/cve/CVE-2019-13671
https://access.redhat.com/security/cve/CVE-2019-13673
https://access.redhat.com/security/cve/CVE-2019-13674
https://access.redhat.com/security/cve/CVE-2019-13675
https://access.redhat.com/security/cve/CVE-2019-13676
https://access.redhat.com/security/cve/CVE-2019-13677
https://access.redhat.com/security/cve/CVE-2019-13678
https://access.redhat.com/security/cve/CVE-2019-13679
https://access.redhat.com/security/cve/CVE-2019-13680
https://access.redhat.com/security/cve/CVE-2019-13681
https://access.redhat.com/security/cve/CVE-2019-13682
https://access.redhat.com/security/cve/CVE-2019-13686
https://access.redhat.com/security/cve/CVE-2019-13688
https://access.redhat.com/security/cve/CVE-2019-13691
https://access.redhat.com/security/cve/CVE-2019-13692
https://access.redhat.com/security/cve/CVE-2019-13693
https://access.redhat.com/security/cve/CVE-2019-13694
https://access.redhat.com/security/cve/CVE-2019-13695
https://access.redhat.com/security/cve/CVE-2019-13696
https://access.redhat.com/security/cve/CVE-2019-13697
https://access.redhat.com/security/updates/classification/#critical

8. Contact:

The Red Hat security contact is <secalert at redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2019 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBXbgGY9zjgjWX9erEAQj5wRAAm+j/C5YBPVUg7udi96drwCfuSa6gmk9L
NtbMW6kPN9zgCKb/hvB/jIzbn7OKUKUOvNc0oChsn2ZBUYoD807RWOs/yhAMw7qV
p/9uNGAgSmX77rcvWF0IGSG5xcwoVpPcN18ZFRtz6c3QrRo24wSOygDZVuXFjZ2Y
fBcwqtVDiwhCj2m64q9DXXdS0+Xf7h79xZYoBZHboHS5l/XupFL/E7VLp92uW/uX
mxgaLFi+BWau1aMXxxyzDn/yWD19ImAZ+i3e8tsDVyMJqZspkIlb6Gvskp7vLyqw
TtSxWUnopoR3LE5oEeBhnQoV6Pzuu5FFq+iQ/ZxM4vcKelUtNi/A6x/EQYsqRZ7v
p002vFgQweppzKdZqybAzRLuPeWWuoCDqOoCWJHGtce2CHi+MIX0P9PYkBZHmdI8
AI2L4CvH5xLwrZvQfNR/JwEr2TiC6WNkV96vGJcS10V7qPezRJWBTS6W/R26D9Wo
IkjP6XWxBUti9wUZ5Ij4ozb/RPaRuAGjYl3Y56M2X0vcCqaRb76/3J3BsJi9xhe0
InutsymfIQRhRoHNQWApvhNqu0pvPjpoArtssjvanKP1U92+jEp5SO3VoRHKm3Bk
231kkQHF2G5wfIQoyaivZO6dWW0eelJyHKennFIG9kbTYdtq1DkqxwJElRqLEmEP
eDhYjjUM1yo=
=/Xwd
-----END PGP SIGNATURE-----