A chromium-browser security update has been released for Red Hat Enterprise Linux 6
=====================================================================
Red Hat Security Advisory
Synopsis: Critical: chromium-browser security update
Advisory ID: RHSA-2019:4238-01
Product: Red Hat Enterprise Linux Supplementary
Advisory URL: https://access.redhat.com/errata/RHSA-2019:4238
Issue date: 2019-12-16
CVE Names: CVE-2019-13725 CVE-2019-13726 CVE-2019-13727
CVE-2019-13728 CVE-2019-13729 CVE-2019-13730
CVE-2019-13732 CVE-2019-13734 CVE-2019-13735
CVE-2019-13736 CVE-2019-13737 CVE-2019-13738
CVE-2019-13739 CVE-2019-13740 CVE-2019-13741
CVE-2019-13742 CVE-2019-13743 CVE-2019-13744
CVE-2019-13745 CVE-2019-13746 CVE-2019-13747
CVE-2019-13748 CVE-2019-13749 CVE-2019-13750
CVE-2019-13751 CVE-2019-13752 CVE-2019-13753
CVE-2019-13754 CVE-2019-13755 CVE-2019-13756
CVE-2019-13757 CVE-2019-13758 CVE-2019-13759
CVE-2019-13761 CVE-2019-13762 CVE-2019-13763
CVE-2019-13764
=====================================================================
1. Summary:
An update for chromium-browser is now available for Red Hat Enterprise
Linux 6 Supplementary.
Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, i686, x86_64
Red Hat Enterprise Linux HPC Node Supplementary (v. 6) - i686, x86_64
Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, i686, x86_64
Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, i686, x86_64
3. Description:
Chromium is an open-source web browser, powered by WebKit (Blink).
This update upgrades Chromium to version 79.0.3945.79.
Security Fix(es):
* chromium-browser: Use after free in Bluetooth (CVE-2019-13725)
* chromium-browser: Heap buffer overflow in password manager
(CVE-2019-13726)
* chromium-browser: Insufficient policy enforcement in WebSockets
(CVE-2019-13727)
* chromium-browser: Out of bounds write in V8 (CVE-2019-13728)
* chromium-browser: Use after free in WebSockets (CVE-2019-13729)
* chromium-browser: Type Confusion in V8 (CVE-2019-13730)
* chromium-browser: Use after free in WebAudio (CVE-2019-13732)
* chromium-browser: Out of bounds write in SQLite (CVE-2019-13734)
* chromium-browser: Out of bounds write in V8 (CVE-2019-13735)
* chromium-browser: Type Confusion in V8 (CVE-2019-13764)
* chromium-browser: Integer overflow in PDFium (CVE-2019-13736)
* chromium-browser: Insufficient policy enforcement in autocomplete
(CVE-2019-13737)
* chromium-browser: Insufficient policy enforcement in navigation
(CVE-2019-13738)
* chromium-browser: Incorrect security UI in Omnibox (CVE-2019-13739)
* chromium-browser: Incorrect security UI in sharing (CVE-2019-13740)
* chromium-browser: Insufficient validation of untrusted input in Blink
(CVE-2019-13741)
* chromium-browser: Incorrect security UI in Omnibox (CVE-2019-13742)
* chromium-browser: Incorrect security UI in external protocol handling
(CVE-2019-13743)
* chromium-browser: Insufficient policy enforcement in cookies
(CVE-2019-13744)
* chromium-browser: Insufficient policy enforcement in audio
(CVE-2019-13745)
* chromium-browser: Insufficient policy enforcement in Omnibox
(CVE-2019-13746)
* chromium-browser: Uninitialized Use in rendering (CVE-2019-13747)
* chromium-browser: Insufficient policy enforcement in developer tools
(CVE-2019-13748)
* chromium-browser: Incorrect security UI in Omnibox (CVE-2019-13749)
* chromium-browser: Insufficient data validation in SQLite (CVE-2019-13750)
* chromium-browser: Uninitialized Use in SQLite (CVE-2019-13751)
* chromium-browser: Out of bounds read in SQLite (CVE-2019-13752)
* chromium-browser: Out of bounds read in SQLite (CVE-2019-13753)
* chromium-browser: Insufficient policy enforcement in extensions
(CVE-2019-13754)
* chromium-browser: Insufficient policy enforcement in extensions
(CVE-2019-13755)
* chromium-browser: Incorrect security UI in printing (CVE-2019-13756)
* chromium-browser: Incorrect security UI in Omnibox (CVE-2019-13757)
* chromium-browser: Insufficient policy enforcement in navigation
(CVE-2019-13758)
* chromium-browser: Incorrect security UI in interstitials (CVE-2019-13759)
* chromium-browser: Incorrect security UI in Omnibox (CVE-2019-13761)
* chromium-browser: Insufficient policy enforcement in downloads
(CVE-2019-13762)
* chromium-browser: Insufficient policy enforcement in payments
(CVE-2019-13763)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing the update, Chromium must be restarted for the changes to
take effect.
5. Bugs fixed ( https://bugzilla.redhat.com/):
1781973 - CVE-2019-13725 chromium-browser: Use after free in Bluetooth
1781974 - CVE-2019-13726 chromium-browser: Heap buffer overflow in password manager
1781975 - CVE-2019-13727 chromium-browser: Insufficient policy enforcement in WebSockets
1781976 - CVE-2019-13728 chromium-browser: Out of bounds write in V8
1781977 - CVE-2019-13729 chromium-browser: Use after free in WebSockets
1781978 - CVE-2019-13730 chromium-browser: Type Confusion in V8
1781979 - CVE-2019-13732 chromium-browser: Use after free in WebAudio
1781980 - CVE-2019-13734 chromium-browser: Out of bounds write in SQLite
1781981 - CVE-2019-13735 chromium-browser: Out of bounds write in V8
1781982 - CVE-2019-13764 chromium-browser: Type Confusion in V8
1781983 - CVE-2019-13736 chromium-browser: Integer overflow in PDFium
1781984 - CVE-2019-13737 chromium-browser: Insufficient policy enforcement in autocomplete
1781985 - CVE-2019-13738 chromium-browser: Insufficient policy enforcement in navigation
1781986 - CVE-2019-13739 chromium-browser: Incorrect security UI in Omnibox
1781987 - CVE-2019-13740 chromium-browser: Incorrect security UI in sharing
1781988 - CVE-2019-13741 chromium-browser: Insufficient validation of untrusted input in Blink
1781989 - CVE-2019-13742 chromium-browser: Incorrect security UI in Omnibox
1781990 - CVE-2019-13743 chromium-browser: Incorrect security UI in external protocol handling
1781991 - CVE-2019-13745 chromium-browser: Insufficient policy enforcement in audio
1781992 - CVE-2019-13746 chromium-browser: Insufficient policy enforcement in Omnibox
1781993 - CVE-2019-13747 chromium-browser: Uninitialized Use in rendering
1781994 - CVE-2019-13748 chromium-browser: Insufficient policy enforcement in developer tools
1781995 - CVE-2019-13749 chromium-browser: Incorrect security UI in Omnibox
1781997 - CVE-2019-13750 chromium-browser: Insufficient data validation in SQLite
1781998 - CVE-2019-13751 chromium-browser: Uninitialized Use in SQLite
1781999 - CVE-2019-13752 chromium-browser: Out of bounds read in SQLite
1782000 - CVE-2019-13753 chromium-browser: Out of bounds read in SQLite
1782001 - CVE-2019-13754 chromium-browser: Insufficient policy enforcement in extensions
1782002 - CVE-2019-13755 chromium-browser: Insufficient policy enforcement in extensions
1782003 - CVE-2019-13756 chromium-browser: Incorrect security UI in printing
1782004 - CVE-2019-13757 chromium-browser: Incorrect security UI in Omnibox
1782005 - CVE-2019-13759 chromium-browser: Incorrect security UI in interstitials
1782006 - CVE-2019-13761 chromium-browser: Incorrect security UI in Omnibox
1782007 - CVE-2019-13762 chromium-browser: Insufficient policy enforcement in downloads
1782008 - CVE-2019-13763 chromium-browser: Insufficient policy enforcement in payments
1782017 - CVE-2019-13758 chromium-browser: Insufficient policy enforcement in navigation
1782021 - CVE-2019-13744 chromium-browser: Insufficient policy enforcement in cookies
6. Package List:
Red Hat Enterprise Linux Desktop Supplementary (v. 6):
i386:
chromium-browser-79.0.3945.79-1.el6_10.i686.rpm
chromium-browser-debuginfo-79.0.3945.79-1.el6_10.i686.rpm
i686:
chromium-browser-79.0.3945.79-1.el6_10.i686.rpm
chromium-browser-debuginfo-79.0.3945.79-1.el6_10.i686.rpm
x86_64:
chromium-browser-79.0.3945.79-1.el6_10.x86_64.rpm
chromium-browser-debuginfo-79.0.3945.79-1.el6_10.x86_64.rpm
Red Hat Enterprise Linux HPC Node Supplementary (v. 6):
i686:
chromium-browser-79.0.3945.79-1.el6_10.i686.rpm
chromium-browser-debuginfo-79.0.3945.79-1.el6_10.i686.rpm
x86_64:
chromium-browser-79.0.3945.79-1.el6_10.x86_64.rpm
chromium-browser-debuginfo-79.0.3945.79-1.el6_10.x86_64.rpm
Red Hat Enterprise Linux Server Supplementary (v. 6):
i386:
chromium-browser-79.0.3945.79-1.el6_10.i686.rpm
chromium-browser-debuginfo-79.0.3945.79-1.el6_10.i686.rpm
i686:
chromium-browser-79.0.3945.79-1.el6_10.i686.rpm
chromium-browser-debuginfo-79.0.3945.79-1.el6_10.i686.rpm
x86_64:
chromium-browser-79.0.3945.79-1.el6_10.x86_64.rpm
chromium-browser-debuginfo-79.0.3945.79-1.el6_10.x86_64.rpm
Red Hat Enterprise Linux Workstation Supplementary (v. 6):
i386:
chromium-browser-79.0.3945.79-1.el6_10.i686.rpm
chromium-browser-debuginfo-79.0.3945.79-1.el6_10.i686.rpm
i686:
chromium-browser-79.0.3945.79-1.el6_10.i686.rpm
chromium-browser-debuginfo-79.0.3945.79-1.el6_10.i686.rpm
x86_64:
chromium-browser-79.0.3945.79-1.el6_10.x86_64.rpm
chromium-browser-debuginfo-79.0.3945.79-1.el6_10.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2019-13725
https://access.redhat.com/security/cve/CVE-2019-13726
https://access.redhat.com/security/cve/CVE-2019-13727
https://access.redhat.com/security/cve/CVE-2019-13728
https://access.redhat.com/security/cve/CVE-2019-13729
https://access.redhat.com/security/cve/CVE-2019-13730
https://access.redhat.com/security/cve/CVE-2019-13732
https://access.redhat.com/security/cve/CVE-2019-13734
https://access.redhat.com/security/cve/CVE-2019-13735
https://access.redhat.com/security/cve/CVE-2019-13736
https://access.redhat.com/security/cve/CVE-2019-13737
https://access.redhat.com/security/cve/CVE-2019-13738
https://access.redhat.com/security/cve/CVE-2019-13739
https://access.redhat.com/security/cve/CVE-2019-13740
https://access.redhat.com/security/cve/CVE-2019-13741
https://access.redhat.com/security/cve/CVE-2019-13742
https://access.redhat.com/security/cve/CVE-2019-13743
https://access.redhat.com/security/cve/CVE-2019-13744
https://access.redhat.com/security/cve/CVE-2019-13745
https://access.redhat.com/security/cve/CVE-2019-13746
https://access.redhat.com/security/cve/CVE-2019-13747
https://access.redhat.com/security/cve/CVE-2019-13748
https://access.redhat.com/security/cve/CVE-2019-13749
https://access.redhat.com/security/cve/CVE-2019-13750
https://access.redhat.com/security/cve/CVE-2019-13751
https://access.redhat.com/security/cve/CVE-2019-13752
https://access.redhat.com/security/cve/CVE-2019-13753
https://access.redhat.com/security/cve/CVE-2019-13754
https://access.redhat.com/security/cve/CVE-2019-13755
https://access.redhat.com/security/cve/CVE-2019-13756
https://access.redhat.com/security/cve/CVE-2019-13757
https://access.redhat.com/security/cve/CVE-2019-13758
https://access.redhat.com/security/cve/CVE-2019-13759
https://access.redhat.com/security/cve/CVE-2019-13761
https://access.redhat.com/security/cve/CVE-2019-13762
https://access.redhat.com/security/cve/CVE-2019-13763
https://access.redhat.com/security/cve/CVE-2019-13764
https://access.redhat.com/security/updates/classification/#critical
8. Contact:
The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2019 Red Hat, Inc.
