Package chromium updated to version 70.0.3538.67-alt1 for branch sisyphus in task 215624.

Published: 2018-09-25

BDU:2018-01336

Уязвимость компонента AppCache веб-браузера Chrome, позволяющая нарушителю выйти из изолированной среды и выполнить произвольный код

Severity: HIGH (8.8) Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References:

CVE-2018-17462

Published: 2018-09-25

BDU:2018-01337

Уязвимость обработчика JavaScript-сценариев V8 веб-браузера Chrome, позволяющая нарушителю выполнить произвольный код или вызвать отказ в обслуживании

Severity: HIGH (8.8) Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References:

CVE-2018-17463

Published: 2018-09-20

BDU:2018-01338

Уязвимость компонента Omnibox веб-браузера Chrome, позволяющая нарушителю подменить адрес URI

Severity: HIGH (7.3) Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References:

CVE-2018-17464

Published: 2018-09-05

BDU:2018-01339

Уязвимость библиотеи angle веб-браузера Chrome, позволяющая нарушителю выполнить произвольный код

Severity: HIGH (8.8) Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References:

CVE-2018-17466

Published: 2018-05-19

BDU:2018-01340

Уязвимость компонента Omnibox веб-браузера Chrome, позволяющая нарушителю подменить адрес URI

Severity: HIGH (7.3) Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References:

CVE-2018-17467

Published: 2018-10-16

BDU:2019-04356

Уязвимость обработчика JavaScript-сценариев V8 браузера Google Chrome, позволяющая нарушителю оказать воздействие на целостность данных, получить несанкционированный доступ к защищаемой информации, а также вызвать отказ в обслуживании

Severity: HIGH (8.8) Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References:

CVE-2018-17465

Published: 2018-10-16

BDU:2019-04357

Уязвимость механизма отображения веб-страниц Blink браузера Google Chrome, позволяющая нарушителю получить URL-адреса перекрестного происхождения

Severity: MEDIUM (6.5) Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References:

CVE-2018-17468

Published: 2018-10-16

BDU:2019-04358

Уязвимость обработчика PDF-содержимого PDFium браузера Google Chrome, позволяющая нарушителю выполнить произвольный код

Severity: HIGH (8.8) Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References:

CVE-2018-17469

Published: 2018-10-16

BDU:2019-04359

Уязвимость реализации движка графического процессора браузера Google Chrome, позволяющая нарушителю вызвать отказ в обслуживании

Severity: HIGH (7.4) Vector: AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H

References:

CVE-2018-17470

Published: 2018-10-16

BDU:2019-04360

Уязвимость браузера Google Chrome, существующая из-за недостаточной проверки входных данных, позволяющая нарушителю скрыть предупреждение о переходе в полноэкранный режим

Severity: MEDIUM (4.3) Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

References:

CVE-2018-17471

Published: 2018-10-16

BDU:2019-04361

Уязвимость браузера Google Chrome, существующая из-за недостаточной проверки входных данных, позволяющая нарушителю осуществить подмену содержимого компонента Omnibox (URL)

Severity: MEDIUM (4.3) Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

References:

CVE-2018-17473

Published: 2018-10-16

BDU:2019-04378

Уязвимость функции HTMLImportsController механизма отображения веб-страниц Blink браузера Google Chrome, позволяющая нарушителю выполнить произвольный код

Severity: HIGH (8.8) Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References:

CVE-2018-17474

Published: 2018-10-16

BDU:2019-04379

Severity: MEDIUM (4.3) Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

References:

CVE-2018-17475

Published: 2018-10-16

BDU:2019-04380

Уязвимость компонента Cast браузера Google Chrome, существующая из-за недостаточной проверки входных данных, позволяющая нарушителю скрыть предупреждение о переходе в полноэкранный режим

Severity: MEDIUM (4.3) Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

References:

CVE-2018-17476

Published: 2018-10-16

BDU:2019-04381

Уязвимость браузера Google Chrome, существующая из-за недостаточной проверки входных данных, позволяющая нарушителю осуществить подмену пользовательского интерфейса во вкладке «Расширения»

Severity: MEDIUM (4.3) Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

References:

CVE-2018-17477

Published: 2018-04-26

BDU:2019-04383

Уязвимость скрипта ServiceWorker браузера Google Chrome, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

Severity: HIGH (7.5) Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References:

CVE-2018-5179

Published: 2018-11-14
Modified: 2024-11-21

CVE-2018-17462

Incorrect refcounting in AppCache in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to perform a sandbox escape via a crafted HTML page.

Severity: CRITICAL (9.6) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

References:

Published: 2018-11-14
Modified: 2025-02-20

CVE-2018-17463

Incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

Severity: HIGH (8.8) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References:

Published: 2018-11-14
Modified: 2024-11-21

CVE-2018-17464

Incorrect handling of history on iOS in Navigation in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.

Severity: MEDIUM (4.3) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

References:

Published: 2018-11-14
Modified: 2024-11-21

CVE-2018-17465

Incorrect implementation of object trimming in V8 in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page.

Severity: HIGH (8.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References:

Published: 2018-11-14
Modified: 2024-11-21

CVE-2018-17466

Incorrect texture handling in Angle in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

Severity: HIGH (8.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References:

Published: 2018-11-14
Modified: 2024-11-21

CVE-2018-17467

Insufficiently quick clearing of stale rendered content in Navigation in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.

Severity: MEDIUM (4.3) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

References:

Published: 2018-11-14
Modified: 2024-11-21

CVE-2018-17468

Incorrect handling of timer information during navigation in Blink in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to obtain cross origin URLs via a crafted HTML page.

Severity: MEDIUM (6.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References:

Published: 2018-11-14
Modified: 2024-11-21

CVE-2018-17469

Incorrect handling of PDF filter chains in PDFium in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file.

Severity: HIGH (8.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References:

Published: 2019-01-09
Modified: 2024-11-21

CVE-2018-17470

A heap buffer overflow in GPU in Google Chrome prior to 70.0.3538.67 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

Severity: HIGH (7.4) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H

References:

Published: 2018-11-14
Modified: 2024-11-21

CVE-2018-17471

Incorrect dialog placement in WebContents in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to obscure the full screen warning via a crafted HTML page.

Severity: MEDIUM (4.3) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

References:

Published: 2018-11-14
Modified: 2024-11-21

CVE-2018-17472

Incorrect handling of googlechrome:// URL scheme on iOS in Intents in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to escape the sandbox via a crafted HTML page.</p> <div class="pf-l-level pf-m-gutter"> <div class="pf-l-level__item"> <span class="pf-c-label pf-m-outline" style="--pf-c-label--BorderRadius: 0px; --pf-c-label--BackgroundColor: #000000; --pf-c-label__content--Color: #FFFFFF"> <span class="pf-c-label__content pf-u-font-size-sm">Severity: CRITICAL (9.6)</span> </span> <span class="pf-c-label pf-m-outline" style="--pf-c-label--BorderRadius: 0px; --pf-c-label--BackgroundColor: white; --pf-c-label__content--Color: black"> <span class="pf-c-label__content pf-u-font-size-sm">Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H</span> </span> </div> </div> </div> </div> <div class="pf-c-card__title">References:</div> <div class="pf-c-card__body pf-u-pl-xs pf-u-pr-xs pf-u-pl-md-on-xl pf-u-pr-md-on-xl"> <ul class="pf-c-list"> <li><a href="http://www.securityfocus.com/bid/105666">105666</a></li> <li><a href="http://www.securityfocus.com/bid/105666">105666</a></li> <li><a href="https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.html">https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.html</a></li> <li><a href="https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.html">https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.html</a></li> <li><a href="https://crbug.com/822518">https://crbug.com/822518</a></li> <li><a href="https://crbug.com/822518">https://crbug.com/822518</a></li> <li><a href="https://security.gentoo.org/glsa/201811-10">GLSA-201811-10</a></li> <li><a href="https://security.gentoo.org/glsa/201811-10">GLSA-201811-10</a></li> </ul> </div> </div> <div class="pf-c-card"> <div class="pf-c-card__header"> <div class="pf-c-card__actions pf-m-no-offset"> <div class="pf-u-font-size-sm"> Published: 2018-11-14<br> Modified: 2024-11-21 </div> </div> <h1 class="pf-c-title pf-m-2xl" id="card-action-no-offset-check-label" style="--pf-c-content--h1--MarginTop: 0px"> <a href=https://nvd.nist.gov/vuln/detail/CVE-2018-17473 id="CVE-2018-17473">CVE-2018-17473</a> </h1> </div> <div class="pf-c-card__body pf-u-pl-xs pf-u-pr-xs pf-u-pl-md-on-xl pf-u-pr-md-on-xl"> <div class="pf-c-content pf-u-p-md pf-u-p-0-on-xl"> <p>Incorrect handling of confusable characters in Omnibox in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.</p> <div class="pf-l-level pf-m-gutter"> <div class="pf-l-level__item"> <span class="pf-c-label pf-m-outline" style="--pf-c-label--BorderRadius: 0px; --pf-c-label--BackgroundColor: #FFA500; --pf-c-label__content--Color: #000000"> <span class="pf-c-label__content pf-u-font-size-sm">Severity: MEDIUM (4.3)</span> </span> <span class="pf-c-label pf-m-outline" style="--pf-c-label--BorderRadius: 0px; --pf-c-label--BackgroundColor: white; --pf-c-label__content--Color: black"> <span class="pf-c-label__content pf-u-font-size-sm">Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N</span> </span> </div> </div> </div> </div> <div class="pf-c-card__title">References:</div> <div class="pf-c-card__body pf-u-pl-xs pf-u-pr-xs pf-u-pl-md-on-xl pf-u-pr-md-on-xl"> <ul class="pf-c-list"> <li><a href="http://www.securityfocus.com/bid/105666">105666</a></li> <li><a href="http://www.securityfocus.com/bid/105666">105666</a></li> <li><a href="https://access.redhat.com/errata/RHSA-2018:3004">RHSA-2018:3004</a></li> <li><a href="https://access.redhat.com/errata/RHSA-2018:3004">RHSA-2018:3004</a></li> <li><a href="https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.html">https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.html</a></li> <li><a href="https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.html">https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.html</a></li> <li><a href="https://crbug.com/882078">https://crbug.com/882078</a></li> <li><a href="https://crbug.com/882078">https://crbug.com/882078</a></li> <li><a href="https://security.gentoo.org/glsa/201811-10">GLSA-201811-10</a></li> <li><a href="https://security.gentoo.org/glsa/201811-10">GLSA-201811-10</a></li> <li><a href="https://www.debian.org/security/2018/dsa-4330">DSA-4330</a></li> <li><a href="https://www.debian.org/security/2018/dsa-4330">DSA-4330</a></li> </ul> </div> </div> <div class="pf-c-card"> <div class="pf-c-card__header"> <div class="pf-c-card__actions pf-m-no-offset"> <div class="pf-u-font-size-sm"> Published: 2018-11-14<br> Modified: 2024-11-21 </div> </div> <h1 class="pf-c-title pf-m-2xl" id="card-action-no-offset-check-label" style="--pf-c-content--h1--MarginTop: 0px"> <a href=https://nvd.nist.gov/vuln/detail/CVE-2018-17474 id="CVE-2018-17474">CVE-2018-17474</a> </h1> </div> <div class="pf-c-card__body pf-u-pl-xs pf-u-pr-xs pf-u-pl-md-on-xl pf-u-pr-md-on-xl"> <div class="pf-c-content pf-u-p-md pf-u-p-0-on-xl"> <p>Use after free in HTMLImportsController in Blink in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.</p> <div class="pf-l-level pf-m-gutter"> <div class="pf-l-level__item"> <span class="pf-c-label pf-m-outline" style="--pf-c-label--BorderRadius: 0px; --pf-c-label--BackgroundColor: #FF0000; --pf-c-label__content--Color: #FFFFFF"> <span class="pf-c-label__content pf-u-font-size-sm">Severity: HIGH (8.8)</span> </span> <span class="pf-c-label pf-m-outline" style="--pf-c-label--BorderRadius: 0px; --pf-c-label--BackgroundColor: white; --pf-c-label__content--Color: black"> <span class="pf-c-label__content pf-u-font-size-sm">Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H</span> </span> </div> </div> </div> </div> <div class="pf-c-card__title">References:</div> <div class="pf-c-card__body pf-u-pl-xs pf-u-pr-xs pf-u-pl-md-on-xl pf-u-pr-md-on-xl"> <ul class="pf-c-list"> <li><a href="http://www.securityfocus.com/bid/105666">105666</a></li> <li><a href="http://www.securityfocus.com/bid/105666">105666</a></li> <li><a href="https://access.redhat.com/errata/RHSA-2018:3004">RHSA-2018:3004</a></li> <li><a href="https://access.redhat.com/errata/RHSA-2018:3004">RHSA-2018:3004</a></li> <li><a href="https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.html">https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.html</a></li> <li><a href="https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.html">https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.html</a></li> <li><a href="https://crbug.com/843151">https://crbug.com/843151</a></li> <li><a href="https://crbug.com/843151">https://crbug.com/843151</a></li> <li><a href="https://security.gentoo.org/glsa/201811-10">GLSA-201811-10</a></li> <li><a href="https://security.gentoo.org/glsa/201811-10">GLSA-201811-10</a></li> <li><a href="https://www.debian.org/security/2018/dsa-4330">DSA-4330</a></li> <li><a href="https://www.debian.org/security/2018/dsa-4330">DSA-4330</a></li> </ul> </div> </div> <div class="pf-c-card"> <div class="pf-c-card__header"> <div class="pf-c-card__actions pf-m-no-offset"> <div class="pf-u-font-size-sm"> Published: 2018-11-14<br> Modified: 2024-11-21 </div> </div> <h1 class="pf-c-title pf-m-2xl" id="card-action-no-offset-check-label" style="--pf-c-content--h1--MarginTop: 0px"> <a href=https://nvd.nist.gov/vuln/detail/CVE-2018-17475 id="CVE-2018-17475">CVE-2018-17475</a> </h1> </div> <div class="pf-c-card__body pf-u-pl-xs pf-u-pr-xs pf-u-pl-md-on-xl pf-u-pr-md-on-xl"> <div class="pf-c-content pf-u-p-md pf-u-p-0-on-xl"> <p>Incorrect handling of history on iOS in Navigation in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.</p> <div class="pf-l-level pf-m-gutter"> <div class="pf-l-level__item"> <span class="pf-c-label pf-m-outline" style="--pf-c-label--BorderRadius: 0px; --pf-c-label--BackgroundColor: #FFA500; --pf-c-label__content--Color: #000000"> <span class="pf-c-label__content pf-u-font-size-sm">Severity: MEDIUM (4.3)</span> </span> <span class="pf-c-label pf-m-outline" style="--pf-c-label--BorderRadius: 0px; --pf-c-label--BackgroundColor: white; --pf-c-label__content--Color: black"> <span class="pf-c-label__content pf-u-font-size-sm">Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N</span> </span> </div> </div> </div> </div> <div class="pf-c-card__title">References:</div> <div class="pf-c-card__body pf-u-pl-xs pf-u-pr-xs pf-u-pl-md-on-xl pf-u-pr-md-on-xl"> <ul class="pf-c-list"> <li><a href="http://www.securityfocus.com/bid/105666">105666</a></li> <li><a href="http://www.securityfocus.com/bid/105666">105666</a></li> <li><a href="https://access.redhat.com/errata/RHSA-2018:3004">RHSA-2018:3004</a></li> <li><a href="https://access.redhat.com/errata/RHSA-2018:3004">RHSA-2018:3004</a></li> <li><a href="https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.html">https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.html</a></li> <li><a href="https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.html">https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.html</a></li> <li><a href="https://crbug.com/852634">https://crbug.com/852634</a></li> <li><a href="https://crbug.com/852634">https://crbug.com/852634</a></li> <li><a href="https://security.gentoo.org/glsa/201811-10">GLSA-201811-10</a></li> <li><a href="https://security.gentoo.org/glsa/201811-10">GLSA-201811-10</a></li> <li><a href="https://www.debian.org/security/2018/dsa-4330">DSA-4330</a></li> <li><a href="https://www.debian.org/security/2018/dsa-4330">DSA-4330</a></li> </ul> </div> </div> <div class="pf-c-card"> <div class="pf-c-card__header"> <div class="pf-c-card__actions pf-m-no-offset"> <div class="pf-u-font-size-sm"> Published: 2018-11-14<br> Modified: 2024-11-21 </div> </div> <h1 class="pf-c-title pf-m-2xl" id="card-action-no-offset-check-label" style="--pf-c-content--h1--MarginTop: 0px"> <a href=https://nvd.nist.gov/vuln/detail/CVE-2018-17476 id="CVE-2018-17476">CVE-2018-17476</a> </h1> </div> <div class="pf-c-card__body pf-u-pl-xs pf-u-pr-xs pf-u-pl-md-on-xl pf-u-pr-md-on-xl"> <div class="pf-c-content pf-u-p-md pf-u-p-0-on-xl"> <p>Incorrect dialog placement in Cast UI in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to obscure the full screen warning via a crafted HTML page.</p> <div class="pf-l-level pf-m-gutter"> <div class="pf-l-level__item"> <span class="pf-c-label pf-m-outline" style="--pf-c-label--BorderRadius: 0px; --pf-c-label--BackgroundColor: #FFA500; --pf-c-label__content--Color: #000000"> <span class="pf-c-label__content pf-u-font-size-sm">Severity: MEDIUM (4.3)</span> </span> <span class="pf-c-label pf-m-outline" style="--pf-c-label--BorderRadius: 0px; --pf-c-label--BackgroundColor: white; --pf-c-label__content--Color: black"> <span class="pf-c-label__content pf-u-font-size-sm">Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N</span> </span> </div> </div> </div> </div> <div class="pf-c-card__title">References:</div> <div class="pf-c-card__body pf-u-pl-xs pf-u-pr-xs pf-u-pl-md-on-xl pf-u-pr-md-on-xl"> <ul class="pf-c-list"> <li><a href="http://www.securityfocus.com/bid/105666">105666</a></li> <li><a href="http://www.securityfocus.com/bid/105666">105666</a></li> <li><a href="https://access.redhat.com/errata/RHSA-2018:3004">RHSA-2018:3004</a></li> <li><a href="https://access.redhat.com/errata/RHSA-2018:3004">RHSA-2018:3004</a></li> <li><a href="https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.html">https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.html</a></li> <li><a href="https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.html">https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.html</a></li> <li><a href="https://crbug.com/812769">https://crbug.com/812769</a></li> <li><a href="https://crbug.com/812769">https://crbug.com/812769</a></li> <li><a href="https://security.gentoo.org/glsa/201811-10">GLSA-201811-10</a></li> <li><a href="https://security.gentoo.org/glsa/201811-10">GLSA-201811-10</a></li> <li><a href="https://www.debian.org/security/2018/dsa-4330">DSA-4330</a></li> <li><a href="https://www.debian.org/security/2018/dsa-4330">DSA-4330</a></li> </ul> </div> </div> <div class="pf-c-card"> <div class="pf-c-card__header"> <div class="pf-c-card__actions pf-m-no-offset"> <div class="pf-u-font-size-sm"> Published: 2018-11-14<br> Modified: 2024-11-21 </div> </div> <h1 class="pf-c-title pf-m-2xl" id="card-action-no-offset-check-label" style="--pf-c-content--h1--MarginTop: 0px"> <a href=https://nvd.nist.gov/vuln/detail/CVE-2018-17477 id="CVE-2018-17477">CVE-2018-17477</a> </h1> </div> <div class="pf-c-card__body pf-u-pl-xs pf-u-pr-xs pf-u-pl-md-on-xl pf-u-pr-md-on-xl"> <div class="pf-c-content pf-u-p-md pf-u-p-0-on-xl"> <p>Incorrect dialog placement in Extensions in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents of extension popups via a crafted HTML page.</p> <div class="pf-l-level pf-m-gutter"> <div class="pf-l-level__item"> <span class="pf-c-label pf-m-outline" style="--pf-c-label--BorderRadius: 0px; --pf-c-label--BackgroundColor: #FFA500; --pf-c-label__content--Color: #000000"> <span class="pf-c-label__content pf-u-font-size-sm">Severity: MEDIUM (4.3)</span> </span> <span class="pf-c-label pf-m-outline" style="--pf-c-label--BorderRadius: 0px; --pf-c-label--BackgroundColor: white; --pf-c-label__content--Color: black"> <span class="pf-c-label__content pf-u-font-size-sm">Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N</span> </span> </div> </div> </div> </div> <div class="pf-c-card__title">References:</div> <div class="pf-c-card__body pf-u-pl-xs pf-u-pr-xs pf-u-pl-md-on-xl pf-u-pr-md-on-xl"> <ul class="pf-c-list"> <li><a href="http://www.securityfocus.com/bid/105666">105666</a></li> <li><a href="http://www.securityfocus.com/bid/105666">105666</a></li> <li><a href="https://access.redhat.com/errata/RHSA-2018:3004">RHSA-2018:3004</a></li> <li><a href="https://access.redhat.com/errata/RHSA-2018:3004">RHSA-2018:3004</a></li> <li><a href="https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.html">https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.html</a></li> <li><a href="https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.html">https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.html</a></li> <li><a href="https://crbug.com/863703">https://crbug.com/863703</a></li> <li><a href="https://crbug.com/863703">https://crbug.com/863703</a></li> <li><a href="https://security.gentoo.org/glsa/201811-10">GLSA-201811-10</a></li> <li><a href="https://security.gentoo.org/glsa/201811-10">GLSA-201811-10</a></li> <li><a href="https://www.debian.org/security/2018/dsa-4330">DSA-4330</a></li> <li><a href="https://www.debian.org/security/2018/dsa-4330">DSA-4330</a></li> </ul> </div> </div> <div class="pf-c-card"> <div class="pf-c-card__header"> <div class="pf-c-card__actions pf-m-no-offset"> <div class="pf-u-font-size-sm"> Published: 2019-01-09<br> Modified: 2024-11-21 </div> </div> <h1 class="pf-c-title pf-m-2xl" id="card-action-no-offset-check-label" style="--pf-c-content--h1--MarginTop: 0px"> <a href=https://nvd.nist.gov/vuln/detail/CVE-2018-20071 id="CVE-2018-20071">CVE-2018-20071</a> </h1> </div> <div class="pf-c-card__body pf-u-pl-xs pf-u-pr-xs pf-u-pl-md-on-xl pf-u-pr-md-on-xl"> <div class="pf-c-content pf-u-p-md pf-u-p-0-on-xl"> <p>Insufficiently strict origin checks during JIT payment app installation in Payments in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to install a service worker for a domain that can host attacker controled files via a crafted HTML page.</p> <div class="pf-l-level pf-m-gutter"> <div class="pf-l-level__item"> <span class="pf-c-label pf-m-outline" style="--pf-c-label--BorderRadius: 0px; --pf-c-label--BackgroundColor: #FFA500; --pf-c-label__content--Color: #000000"> <span class="pf-c-label__content pf-u-font-size-sm">Severity: MEDIUM (6.1)</span> </span> <span class="pf-c-label pf-m-outline" style="--pf-c-label--BorderRadius: 0px; --pf-c-label--BackgroundColor: white; --pf-c-label__content--Color: black"> <span class="pf-c-label__content pf-u-font-size-sm">Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N</span> </span> </div> </div> </div> </div> <div class="pf-c-card__title">References:</div> <div class="pf-c-card__body pf-u-pl-xs pf-u-pr-xs pf-u-pl-md-on-xl pf-u-pr-md-on-xl"> <ul class="pf-c-list"> <li><a href="https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html">https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html</a></li> <li><a href="https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html">https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html</a></li> <li><a href="https://crbug.com/853937">https://crbug.com/853937</a></li> <li><a href="https://crbug.com/853937">https://crbug.com/853937</a></li> </ul> </div> </div> <div class="pf-c-card"> <div class="pf-c-card__header"> <div class="pf-c-card__actions pf-m-no-offset"> <div class="pf-u-font-size-sm"> Published: 2019-04-26<br> Modified: 2024-11-21 </div> </div> <h1 class="pf-c-title pf-m-2xl" id="card-action-no-offset-check-label" style="--pf-c-content--h1--MarginTop: 0px"> <a href=https://nvd.nist.gov/vuln/detail/CVE-2018-5179 id="CVE-2018-5179">CVE-2018-5179</a> </h1> </div> <div class="pf-c-card__body pf-u-pl-xs pf-u-pr-xs pf-u-pl-md-on-xl pf-u-pr-md-on-xl"> <div class="pf-c-content pf-u-p-md pf-u-p-0-on-xl"> <p>A service worker can send the activate event on itself periodically which allows it to run perpetually, allowing it to monitor activity by users. Affects all versions prior to Firefox 60.</p> <div class="pf-l-level pf-m-gutter"> <div class="pf-l-level__item"> <span class="pf-c-label pf-m-outline" style="--pf-c-label--BorderRadius: 0px; --pf-c-label--BackgroundColor: #FF0000; --pf-c-label__content--Color: #FFFFFF"> <span class="pf-c-label__content pf-u-font-size-sm">Severity: HIGH (7.5)</span> </span> <span class="pf-c-label pf-m-outline" style="--pf-c-label--BorderRadius: 0px; --pf-c-label--BackgroundColor: white; --pf-c-label__content--Color: black"> <span class="pf-c-label__content pf-u-font-size-sm">Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N</span> </span> </div> </div> </div> </div> <div class="pf-c-card__title">References:</div> <div class="pf-c-card__body pf-u-pl-xs pf-u-pr-xs pf-u-pl-md-on-xl pf-u-pr-md-on-xl"> <ul class="pf-c-list"> <li><a href="https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/">https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/</a></li> <li><a href="https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/">https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/</a></li> </ul> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </section> <section class="pf-c-page__main-section pf-m-no-fill" style="background-color: var(--pf-global--BackgroundColor--100);"> <div class="pf-l-grid pf-u-py-xl-on-sm pf-u-py-0-on-md pf-u-align-items-center pf-u-font-size-md"> <div class="pf-l-grid__item pf-m-12-col pf-m-9-col-on-lg"> <div class="pf-l-flex"> <a class="pf-l-flex__item pf-u-mr-sm" href="https://vk.com/altlinux" target="_blank">VKontakte</a> <span class="pf-l-flex__item pf-u-mr-sm">|</span> <a class="pf-l-flex__item pf-u-mr-sm" href="https://teleg.one/alt_linux" target="_blank">Telegram</a> <span class="pf-l-flex__item pf-u-mr-sm">|</span> <a class="pf-l-flex__item pf-u-mr-sm" href="https://www.youtube.com/channel/UCtCfzqL49AkFYQ7JQcL_iSw" target="_blank">YouTube</a> <span class="pf-l-flex__item pf-u-mr-sm">|</span> <a class="pf-l-flex__item pf-u-mr-sm" href="https://forum.altlinux.org/" target="_blank">Forum</a> <span class="pf-l-flex__item pf-u-mr-sm">|</span> <a class="pf-l-flex__item pf-u-mr-sm" href="https://github.com/altlinux" target="_blank">GitHub</a> <span class="pf-l-flex__item pf-u-mr-sm">|</span> <a class="pf-l-flex__item pf-u-mr-sm" href="https://bugzilla.altlinux.org/" target="_blank">Bugzilla</a> </div> </div> <div class="pf-l-grid__item pf-m-12-col pf-m-3-col-on-lg"> <span class="ws-org-pfsite-site-copyright"> <span>Version: 2.1.0 </span> </span> </div> </div> </section> </div> </div> </div> </section> <div class="pf-c-back-to-top pf-m-hidden" style="z-index: 999;"> <a class="pf-c-button pf-m-warning" id="pf-c-back-to-top">Back to top <span class="pf-c-button__icon pf-m-end"> <i class="fas fa-angle-up" aria-hidden="true"></i> </span> </a> </div> </main> <div class="pf-c-popover" role="dialog"></div> </div> </body> </html>

Package chromium update in sisyphus on 2018-11-07

ALT-PU-2018-2599-1

Closed vulnerabilities

BDU:2018-01336

BDU:2018-01337

BDU:2018-01338

BDU:2018-01339

BDU:2018-01340

BDU:2019-04356

BDU:2019-04357

BDU:2019-04358

BDU:2019-04359

BDU:2019-04360

BDU:2019-04361

BDU:2019-04378

BDU:2019-04379

BDU:2019-04380

BDU:2019-04381

BDU:2019-04383

CVE-2018-17462

CVE-2018-17463

CVE-2018-17464

CVE-2018-17465

CVE-2018-17466

CVE-2018-17467

CVE-2018-17468

CVE-2018-17469

CVE-2018-17470

CVE-2018-17471

CVE-2018-17472