Arch Linux alert ASA-202012-14 (chromium)
| From: | Morten Linderud <foxboron@archlinux.org> | |
| To: | arch-security@archlinux.org | |
| Subject: | [ASA-202012-14] chromium: multiple issues | |
| Date: | Thu, 17 Dec 2020 20:21:59 +0100 | |
| Message-ID: | <20201217192159.42xxds4pksiyphtq@anathema> |
Arch Linux Security Advisory ASA-202012-14 ========================================== Severity: High Date : 2020-12-09 CVE-ID : CVE-2020-16037 CVE-2020-16038 CVE-2020-16039 CVE-2020-16040 CVE-2020-16041 CVE-2020-16042 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1323 Summary ======= The package chromium before version 87.0.4280.88-1 is vulnerable to multiple issues including arbitrary code execution, information disclosure, insufficient validation and denial of service. Resolution ========== Upgrade to 87.0.4280.88-1. # pacman -Syu "chromium>=87.0.4280.88-1" The problems have been fixed upstream in version 87.0.4280.88. Workaround ========== None. Description =========== - CVE-2020-16037 (arbitrary code execution) A use after free security issue has been found in the clipboard component of the chromium browser before version 87.0.4280.88. - CVE-2020-16038 (arbitrary code execution) A use after free security issue has been found in the media component of the chromium browser before version 87.0.4280.88. - CVE-2020-16039 (arbitrary code execution) A use after free security issue has been found in the extensions component of the chromium browser before version 87.0.4280.88. - CVE-2020-16040 (insufficient validation) An insufficient data validation security issue has been found in the V8 component of the chromium browser before version 87.0.4280.88. - CVE-2020-16041 (denial of service) An out of bounds read security issue has been found in the networking component of the chromium browser before version 87.0.4280.88. - CVE-2020-16042 (information disclosure) An uninitialized use security issue has been found in the V8 component of the chromium browser before version 87.0.4280.88 and Firefox before 84.0. Impact ====== A remote attacker might be able to crash the application, read memory or execute arbitrary code. References ========== https://chromereleases.googleblog.com/2020/12/stable-chan... https://crbug.com/1142331 https://crbug.com/1138683 https://crbug.com/1149177 https://crbug.com/1150649 https://crbug.com/1151865 https://crbug.com/1151890 https://www.mozilla.org/en-US/security/advisories/mfsa202... https://bugzilla.mozilla.org/show_bug.cgi?id=1679003 https://security.archlinux.org/CVE-2020-16037 https://security.archlinux.org/CVE-2020-16038 https://security.archlinux.org/CVE-2020-16039 https://security.archlinux.org/CVE-2020-16040 https://security.archlinux.org/CVE-2020-16041 https://security.archlinux.org/CVE-2020-16042