Fedora 26 update for chromium, chromium-native

1) Race condition

EUVDB-ID: #VU6417

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2017-5068

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a race condition in WebRTC when processing web pages. A remote attacker can create a specially crafted web page, trick the victim into visiting it and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 26

chromium-native_client: before 58.0.3029.81-1.20170421gitc948e9b.fc26

chromium: before 58.0.3029.110-2.fc26

CPE2.3

External links

https://bodhi.fedoraproject.org/updates/FEDORA-2017-811133dc2c

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Type confusion

EUVDB-ID: #VU6357

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2017-5057

CWE-ID: CWE-843 - Type confusion

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error in PDFium. A remote attacker can execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 26

chromium-native_client: before 58.0.3029.81-1.20170421gitc948e9b.fc26

chromium: before 58.0.3029.110-2.fc26

CPE2.3

External links

https://bodhi.fedoraproject.org/updates/FEDORA-2017-811133dc2c

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Use-after-free

EUVDB-ID: #VU6358

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2017-5058

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a use-after-free error in Print Preview. A remote attacker can trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 26

chromium-native_client: before 58.0.3029.81-1.20170421gitc948e9b.fc26

chromium: before 58.0.3029.110-2.fc26

CPE2.3

External links

https://bodhi.fedoraproject.org/updates/FEDORA-2017-811133dc2c

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Type confusion

EUVDB-ID: #VU6359

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2017-5059

CWE-ID: CWE-843 - Type confusion

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error in Blink within the processing of list item markers. A remote attacker can create a specially crafted web page, trigger a type confusion condition by manipulating a document's elements and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 26

chromium-native_client: before 58.0.3029.81-1.20170421gitc948e9b.fc26

chromium: before 58.0.3029.110-2.fc26

CPE2.3

External links

https://bodhi.fedoraproject.org/updates/FEDORA-2017-811133dc2c

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) URL spoofing

EUVDB-ID: #VU6360

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-5060

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to spoof URLs.

The vulnerability exists due to an error in Omnibox. A remote attacker can spoof URLs.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 26

chromium-native_client: before 58.0.3029.81-1.20170421gitc948e9b.fc26

chromium: before 58.0.3029.110-2.fc26

CPE2.3

External links

https://bodhi.fedoraproject.org/updates/FEDORA-2017-811133dc2c

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) URL spoofing

EUVDB-ID: #VU6361

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-5061

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to spoof URLs.

The vulnerability exists due to an error in Omnibox. A remote attacker can spoof URLs.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 26

chromium-native_client: before 58.0.3029.81-1.20170421gitc948e9b.fc26

chromium: before 58.0.3029.110-2.fc26

CPE2.3

External links

https://bodhi.fedoraproject.org/updates/FEDORA-2017-811133dc2c

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Use-after-free

EUVDB-ID: #VU6362

Risk: Medium

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2017-5062

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a use-after-free error in Chrome Apps. A remote attacker can trigger potentially exploitable browser crash.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 26

chromium-native_client: before 58.0.3029.81-1.20170421gitc948e9b.fc26

chromium: before 58.0.3029.110-2.fc26

CPE2.3

External links

https://bodhi.fedoraproject.org/updates/FEDORA-2017-811133dc2c

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Heap-based buffer overflow

EUVDB-ID: #VU6363

Risk: Medium

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2017-5063

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in Skia. A remote attacker can trigger potentially exploitable browser crash via heap-based buffer overflow.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 26

chromium-native_client: before 58.0.3029.81-1.20170421gitc948e9b.fc26

chromium: before 58.0.3029.110-2.fc26

CPE2.3

External links

https://bodhi.fedoraproject.org/updates/FEDORA-2017-811133dc2c

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Use-after-free

EUVDB-ID: #VU6364

Risk: Medium

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2017-5064

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a use-after-free error in Blink. A remote attacker can trigger potentially exploitable browser crash.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 26

chromium-native_client: before 58.0.3029.81-1.20170421gitc948e9b.fc26

chromium: before 58.0.3029.110-2.fc26

CPE2.3

External links

https://bodhi.fedoraproject.org/updates/FEDORA-2017-811133dc2c

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Security bypass

EUVDB-ID: #VU6365

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-5065

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to unspecified error related to incorrect UI in Blink.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 26

chromium-native_client: before 58.0.3029.81-1.20170421gitc948e9b.fc26

chromium: before 58.0.3029.110-2.fc26

CPE2.3

External links

https://bodhi.fedoraproject.org/updates/FEDORA-2017-811133dc2c

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Security bypass

EUVDB-ID: #VU6366

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-5066

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to unspecified error related to incorrect signature handing in Networking.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 26

chromium-native_client: before 58.0.3029.81-1.20170421gitc948e9b.fc26

chromium: before 58.0.3029.110-2.fc26

CPE2.3

External links

https://bodhi.fedoraproject.org/updates/FEDORA-2017-811133dc2c

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) URL spoofing

EUVDB-ID: #VU6367

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-5067

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to spoof URLs.

The vulnerability exists due to an error in Omnibox. A remote attacker can spoof URLs.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 26

chromium-native_client: before 58.0.3029.81-1.20170421gitc948e9b.fc26

chromium: before 58.0.3029.110-2.fc26

CPE2.3

External links

https://bodhi.fedoraproject.org/updates/FEDORA-2017-811133dc2c

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Cross-origin bypass

EUVDB-ID: #VU6368

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-5069

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform XSS attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in Blink. A remote attacker can bypass same origin policy restrictions and access potentially sensitive information.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 26

chromium-native_client: before 58.0.3029.81-1.20170421gitc948e9b.fc26

chromium: before 58.0.3029.110-2.fc26

CPE2.3

External links

https://bodhi.fedoraproject.org/updates/FEDORA-2017-811133dc2c

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Risk	High
Patch available	YES
Number of vulnerabilities	13
CVE-ID	CVE-2017-5068 CVE-2017-5057 CVE-2017-5058 CVE-2017-5059 CVE-2017-5060 CVE-2017-5061 CVE-2017-5062 CVE-2017-5063 CVE-2017-5064 CVE-2017-5065 CVE-2017-5066 CVE-2017-5067 CVE-2017-5069
CWE-ID	CWE-362 CWE-843 CWE-416 CWE-20 CWE-79
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	Fedora Operating systems & Components / Operating system chromium-native_client Operating systems & Components / Operating system package or component chromium Operating systems & Components / Operating system package or component
Vendor	Fedoraproject

Fedora 26 update for chromium, chromium-native_client

1) Race condition

2) Type confusion

3) Use-after-free

4) Type confusion

5) URL spoofing

6) URL spoofing

7) Use-after-free

8) Heap-based buffer overflow

9) Use-after-free

10) Security bypass

11) Security bypass

12) URL spoofing

13) Cross-origin bypass