Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2018.3593 chromium-browser security update 19 November 2018 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: chromium-browser Publisher: Debian Operating System: Debian GNU/Linux Impact/Access: Access Confidential Data -- Remote with User Interaction Reduced Security -- Unknown/Unspecified Resolution: Patch/Upgrade CVE Names: CVE-2018-17478 Reference: ASB-2018.0280 Original Bulletin: http://www.debian.org/security/2018/dsa-4340 - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - - ------------------------------------------------------------------------- Debian Security Advisory DSA-4340-1 security@debian.org https://www.debian.org/security/ Michael Gilbert November 18, 2018 https://www.debian.org/security/faq - - ------------------------------------------------------------------------- Package : chromium-browser CVE ID : CVE-2018-17478 An out-of-bounds bounds memory access issue was discovered in chromium's v8 javascript library by cloudfuzzer. This update also fixes two problems introduced by the previous security upload. Support for arm64 has been restored and gconf-service is no longer a package dependency. For the stable distribution (stretch), this problem has been fixed in version 70.0.3538.102-1~deb9u1. We recommend that you upgrade your chromium-browser packages. For the detailed security status of chromium-browser please refer to its security tracker page at: https://security-tracker.debian.org/tracker/chromium-browser Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org - -----BEGIN PGP SIGNATURE----- iQQzBAEBCgAdFiEEluhy7ASCBulP9FUWuNayzQLW9HMFAlvxFbkACgkQuNayzQLW 9HOVliAAorrsty4NkBthpun/Qv/Oq/1UPYD172/Gl3vTdhikZwgJHbA6ILCniTis CR0uuJ/x3QZS/0FO0ZXNBEhKkEEAtL2RoHTpoSyipQOVKXt/U3eTgSvRakRmqzSB HbnDzsqJUguylMEdk0C4qZTenO/vZUxbRHGu1yZsKc0Y8Fu21T/pOUXwIiM+7RNE qAU+jl5ZLql5Z/rPner1nv8pl56KieVlN+fewPdA3yOi58xcnQTx34SvWrP5J1Bc 2aqde1mJ4/T0LQmmc/ayj9PETakDD6SfJ7lM54T69tUneEhS8U29n/7sIsHt9RSB wPGPZles4IMSN3m6+tAt2kW8AayNvbbL2qJZvGNLXPh41F4dy+FhkXarC0UD/dEw AQ7kqm/UFHiSfVLhP90jD84rrmoxf3D2K6XjQaLprFylB0EoZcwyyUuUZQ1+ibso cA8epGoR3XPXmTSZCNaMXAyIgyDXUuMqOj2vB9I0NDJsSBCKS5RnICpCtY+hGbP8 F72ZUoJNGEIN68nkBIYDYiIG3ZrJ+ATA4HJsiyRa+8nnReRYQVu37shX+/DzC2G9 6Zh6KZzM7Z7LEWS89XH2h/NDKVukejJqpcEX23lL4YaFfoAtbDGo8rmpz6rcMlaO e40Dpy6e8wgCQKwXPNqDZ28nQHiUEDWJ6YxU1nK4ZD/GNn5ZWKmkISDJtc6sNB1U 7vmYrFH03zD0xqET+Ct7LiLehmROEDGE3w4rLn9srkFTyko8NDTvpYt4VCKBsvRL cTnUQuRs3EzgMQFk/F6Wh8KrkA5/Su90sb8i+g9wnCEXJcgSoM8rLcBfMkkK/6B+ gKQpcpdv0mk2k0oSArzpOLWiZRzK8ifcXoObmUi45uKSua6i03j8FWn81AUfn7wV vII+uACHJ2hFPDczwVD0DWErxxVVy2o7MAmg1gdRwSjHQHCwg8/TC+d7POwlLQry QoHCQ0pnhBIYRqyg+FbcyxielqLtQV1NUV7TklPG4W5Gl9Wa3bDgze5udOC8YzCV WEI5xqVNnRIREjv//VwJiO22SkiCkGdEm28VPGCDMrlPx/xK1UEzTL9skTaRaOZs 4kXE8I7snZHoA/K0r3cJMvbjOcgpOTDe9iWPnctpjuYoBHzPi4MyXb2sKLfxP8/K PhCPiGGlmhKE/vvjHIIlkqIRVNO3qBpecnj7n4JCAOIYi4jgamaea1z5a2tGxKUP 22PzIl2jUgl35tP6zVAWfurQUN9raJDgnt3LmFkwEW4vVjyzewR6e0Z6SmS6tb68 JOSp5NeOgii71S0o5U1Mx7AqAwo/V4yicIYSWQTPNyOwIpPb9cz9oIafhCQWzHep nkiN4nQ+9KEmJEY6PPFmcNrrzefOCw== =UwXD - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBW/IKB2aOgq3Tt24GAQhnyg//ZKdl13JQuQHfCLrjeg+ikpDDP7jWPXW0 0Q9i3u+ND5UyMuTEfqGjW+exU8g0AiOCeEXv0kSGQcVy02aZJYZZXAUm4upMtY/Y fV1KPYT4LCmrnooZG3aLnSrROkAyB0Mub5biYF9kQIcY9pTDkVyy1KmLPnLH4Mup n7tFsvkrNGBi8yWqIguzV2pRBsR9uaHsI93d9KQHoZjH6b7tQq25A0zctrOb5a1+ 95H8rG3NnQsUCnsT/XqOLTu8St1RGDjDKDr4isu9c8aO5ki8A6v92LBblMTIhclQ rI54MPrkUyAZed55+lZNY93TBxmuZU7TT1+xfdtvqrUgPGPxanYRkRcn3XP810D+ exYMyO0cLk62khOCHYqsZ66ouZQCB+JyniCF/gHetrXZJvYCDTwDqM+nxzx0/pjy 2mbCONS5l/9qzhptLMm7eNkQc5Crlg+cvktTOzqMtW565PBQ7vf/D6ZmEsx5e7pC mBap1qpFtrAo0V6FsqqqRmNSshJ4H4kG2Pkp/Ta6Hux7cD0fJlC4yY50oyvfvlTB Uz1iR3AFE7elHDHfMwy7bTBW1MNKu2YnQJ9ci1/eZVW7MtWMuOHCbutMj+zjOQEJ 19TNsTBqHXKb1HHfyhu1v5czD/bBAYpb8AMXerw4NWwVOxSsWOQNmNccCXV5oBP2 fXbPErnebvc= =3uN5 -----END PGP SIGNATURE-----