ESB-2018.3593 - [Debian] chromium-browser: Multiple vulnerabilities 2018-11-19

Printable version
PGP/GPG verifiable version

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2018.3593
                     chromium-browser security update
                             19 November 2018

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           chromium-browser
Publisher:         Debian
Operating System:  Debian GNU/Linux
Impact/Access:     Access Confidential Data -- Remote with User Interaction
                   Reduced Security         -- Unknown/Unspecified         
Resolution:        Patch/Upgrade
CVE Names:         CVE-2018-17478  

Reference:         ASB-2018.0280

Original Bulletin: 
   http://www.debian.org/security/2018/dsa-4340

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- - -------------------------------------------------------------------------
Debian Security Advisory DSA-4340-1                   security@debian.org
https://www.debian.org/security/                          Michael Gilbert
November 18, 2018                     https://www.debian.org/security/faq
- - -------------------------------------------------------------------------

Package        : chromium-browser
CVE ID         : CVE-2018-17478

An out-of-bounds bounds memory access issue was discovered in chromium's
v8 javascript library by cloudfuzzer.

This update also fixes two problems introduced by the previous security
upload.  Support for arm64 has been restored and gconf-service is no longer
a package dependency.

For the stable distribution (stretch), this problem has been fixed in
version 70.0.3538.102-1~deb9u1.

We recommend that you upgrade your chromium-browser packages.

For the detailed security status of chromium-browser please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/chromium-browser

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----

iQQzBAEBCgAdFiEEluhy7ASCBulP9FUWuNayzQLW9HMFAlvxFbkACgkQuNayzQLW
9HOVliAAorrsty4NkBthpun/Qv/Oq/1UPYD172/Gl3vTdhikZwgJHbA6ILCniTis
CR0uuJ/x3QZS/0FO0ZXNBEhKkEEAtL2RoHTpoSyipQOVKXt/U3eTgSvRakRmqzSB
HbnDzsqJUguylMEdk0C4qZTenO/vZUxbRHGu1yZsKc0Y8Fu21T/pOUXwIiM+7RNE
qAU+jl5ZLql5Z/rPner1nv8pl56KieVlN+fewPdA3yOi58xcnQTx34SvWrP5J1Bc
2aqde1mJ4/T0LQmmc/ayj9PETakDD6SfJ7lM54T69tUneEhS8U29n/7sIsHt9RSB
wPGPZles4IMSN3m6+tAt2kW8AayNvbbL2qJZvGNLXPh41F4dy+FhkXarC0UD/dEw
AQ7kqm/UFHiSfVLhP90jD84rrmoxf3D2K6XjQaLprFylB0EoZcwyyUuUZQ1+ibso
cA8epGoR3XPXmTSZCNaMXAyIgyDXUuMqOj2vB9I0NDJsSBCKS5RnICpCtY+hGbP8
F72ZUoJNGEIN68nkBIYDYiIG3ZrJ+ATA4HJsiyRa+8nnReRYQVu37shX+/DzC2G9
6Zh6KZzM7Z7LEWS89XH2h/NDKVukejJqpcEX23lL4YaFfoAtbDGo8rmpz6rcMlaO
e40Dpy6e8wgCQKwXPNqDZ28nQHiUEDWJ6YxU1nK4ZD/GNn5ZWKmkISDJtc6sNB1U
7vmYrFH03zD0xqET+Ct7LiLehmROEDGE3w4rLn9srkFTyko8NDTvpYt4VCKBsvRL
cTnUQuRs3EzgMQFk/F6Wh8KrkA5/Su90sb8i+g9wnCEXJcgSoM8rLcBfMkkK/6B+
gKQpcpdv0mk2k0oSArzpOLWiZRzK8ifcXoObmUi45uKSua6i03j8FWn81AUfn7wV
vII+uACHJ2hFPDczwVD0DWErxxVVy2o7MAmg1gdRwSjHQHCwg8/TC+d7POwlLQry
QoHCQ0pnhBIYRqyg+FbcyxielqLtQV1NUV7TklPG4W5Gl9Wa3bDgze5udOC8YzCV
WEI5xqVNnRIREjv//VwJiO22SkiCkGdEm28VPGCDMrlPx/xK1UEzTL9skTaRaOZs
4kXE8I7snZHoA/K0r3cJMvbjOcgpOTDe9iWPnctpjuYoBHzPi4MyXb2sKLfxP8/K
PhCPiGGlmhKE/vvjHIIlkqIRVNO3qBpecnj7n4JCAOIYi4jgamaea1z5a2tGxKUP
22PzIl2jUgl35tP6zVAWfurQUN9raJDgnt3LmFkwEW4vVjyzewR6e0Z6SmS6tb68
JOSp5NeOgii71S0o5U1Mx7AqAwo/V4yicIYSWQTPNyOwIpPb9cz9oIafhCQWzHep
nkiN4nQ+9KEmJEY6PPFmcNrrzefOCw==
=UwXD
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBW/IKB2aOgq3Tt24GAQhnyg//ZKdl13JQuQHfCLrjeg+ikpDDP7jWPXW0
0Q9i3u+ND5UyMuTEfqGjW+exU8g0AiOCeEXv0kSGQcVy02aZJYZZXAUm4upMtY/Y
fV1KPYT4LCmrnooZG3aLnSrROkAyB0Mub5biYF9kQIcY9pTDkVyy1KmLPnLH4Mup
n7tFsvkrNGBi8yWqIguzV2pRBsR9uaHsI93d9KQHoZjH6b7tQq25A0zctrOb5a1+
95H8rG3NnQsUCnsT/XqOLTu8St1RGDjDKDr4isu9c8aO5ki8A6v92LBblMTIhclQ
rI54MPrkUyAZed55+lZNY93TBxmuZU7TT1+xfdtvqrUgPGPxanYRkRcn3XP810D+
exYMyO0cLk62khOCHYqsZ66ouZQCB+JyniCF/gHetrXZJvYCDTwDqM+nxzx0/pjy
2mbCONS5l/9qzhptLMm7eNkQc5Crlg+cvktTOzqMtW565PBQ7vf/D6ZmEsx5e7pC
mBap1qpFtrAo0V6FsqqqRmNSshJ4H4kG2Pkp/Ta6Hux7cD0fJlC4yY50oyvfvlTB
Uz1iR3AFE7elHDHfMwy7bTBW1MNKu2YnQJ9ci1/eZVW7MtWMuOHCbutMj+zjOQEJ
19TNsTBqHXKb1HHfyhu1v5czD/bBAYpb8AMXerw4NWwVOxSsWOQNmNccCXV5oBP2
fXbPErnebvc=
=3uN5
-----END PGP SIGNATURE-----

« Back to bulletins