Red Hat Security Advisory

RHSA-2019:1477

chromium-browser security update

Released 2019-06-17 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Desktop Supplementary (v. 6) chromium-browser-75.0.3770.80-1.el6_10
Red Hat Enterprise Linux HPC Node Supplementary (v. 6) chromium-browser-75.0.3770.80-1.el6_10
Red Hat Enterprise Linux Server Supplementary (v. 6) chromium-browser-75.0.3770.80-1.el6_10
Red Hat Enterprise Linux Workstation Supplementary (v. 6) chromium-browser-75.0.3770.80-1.el6_10

Fixes 12 records

TI-2019-04143 CVE-2019-5831 · GHSA-fwjh-4hpr-6hgj

Out-of-bounds write in Google Chrome

MEDIUM 42

Object lifecycle issue in V8 in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01937 Published 2019-06-27 Fixed in 75.0.3770.80 CWE-787

TI-2019-04148 CVE-2019-5836 · GHSA-47j8-5m5g-5qgc

Out-of-bounds write in Google Chrome

MEDIUM 41

Heap buffer overflow in ANGLE in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01431 Published 2019-06-27 Fixed in 75.0.3770.80 CWE-787

TI-2019-04141 CVE-2019-5829 · GHSA-38vh-jg38-2rqp

Integer overflow in Google Chrome

MEDIUM 41

Integer overflow in download manager in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01273 Published 2019-06-27 Fixed in 75.0.3770.80 CWE-190

TI-2019-04140 CVE-2019-5828 · GHSA-9gx2-96v5-4pmr

Use after free in Google Chrome

MEDIUM 41

Object lifecycle issue in ServiceWorker in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01365 Published 2019-06-27 Fixed in 75.0.3770.80 CWE-416

TI-2019-04149 CVE-2019-5837 · GHSA-w2mf-wwj8-hghw

Resource size information leakage in Blink in Google Chrome prior to 75.0.3770.80 allowed…

LOW 32

Resource size information leakage in Blink in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01519 Published 2019-06-27 Fixed in 75.0.3770.80

TI-2019-04147 CVE-2019-5835 · GHSA-2gx6-hp98-v3j4

Out-of-bounds read in Google Chrome

LOW 32

Object lifecycle issue in SwiftShader in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01622 Published 2019-06-27 Fixed in 75.0.3770.80 CWE-125

TI-2019-04142 CVE-2019-5830 · GHSA-vcxm-w3w8-v59f

Insufficient policy enforcement in CORS in Google Chrome prior to 75.0.3770.80 allowed a…

LOW 32

Insufficient policy enforcement in CORS in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01374 Published 2019-06-27 Fixed in 75.0.3770.80

TI-2019-04144 CVE-2019-5832 · GHSA-pcfh-3f2w-h4gq

Insufficient policy enforcement in XMLHttpRequest in Google Chrome prior to 75.0.3770.80…

LOW 31

Insufficient policy enforcement in XMLHttpRequest in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01247 Published 2019-06-27 Fixed in 75.0.3770.80

TI-2019-04151 CVE-2019-5839 · GHSA-gvgm-q66c-22r4

Improper input validation in Google Chrome

LOW 23

Excessive data validation in URL parser in Google Chrome prior to 75.0.3770.80 allowed a remote attacker who convinced a user to input a URL to bypass website URL validation via a crafted URL.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.01252 Published 2019-06-27 Fixed in 75.0.3770.80 CWE-20

TI-2019-04152 CVE-2019-5840 · GHSA-xw96-xcrg-p8w2

Race condition in Google Chrome

LOW 22

Incorrect security UI in popup blocker in Google Chrome on iOS prior to 75.0.3770.80 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.01037 Published 2019-06-27 Fixed in 75.0.3770.80 CWE-362

TI-2019-04145 CVE-2019-5833 · GHSA-9wc2-4ch6-q6wv

Incorrect dialog box scoping in browser in Google Chrome on Android prior to 75.0.3770.80…

LOW 22

Incorrect dialog box scoping in browser in Google Chrome on Android prior to 75.0.3770.80 allowed a remote attacker to display misleading security UI via a crafted HTML page.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00962 Published 2019-06-27 Fixed in 75.0.3770.80

TI-2019-04150 CVE-2019-5838 · GHSA-h7hj-53wf-rwww

Incorrect authorization in Google Chrome

LOW 21

Insufficient policy enforcement in extensions API in Google Chrome prior to 75.0.3770.80 allowed an attacker who convinced a user to install a malicious extension to bypass restrictions on file URIs via a crafted Chrome…

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00771 Published 2019-06-27 Fixed in 75.0.3770.80 CWE-863