[manjaro-security] [ASA-202011-11] chromium: multiple issues

Wed Nov 18 22:12:18 CET 2020

Arch Linux Security Advisory ASA-202011-11
==========================================

Severity: High
Date    : 2020-11-17
CVE-ID  : CVE-2020-16012 CVE-2020-16014 CVE-2020-16015 CVE-2020-16018
          CVE-2020-16019 CVE-2020-16020 CVE-2020-16021 CVE-2020-16022
          CVE-2020-16023 CVE-2020-16024 CVE-2020-16025 CVE-2020-16026
          CVE-2020-16027 CVE-2020-16028 CVE-2020-16029 CVE-2020-16030
          CVE-2020-16031 CVE-2020-16032 CVE-2020-16033 CVE-2020-16034
          CVE-2020-16035 CVE-2020-16036
Package : chromium
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-1277

Summary
=======

The package chromium before version 87.0.4280.66-1 is vulnerable to
multiple issues including access restriction bypass, arbitrary code
execution, insufficient validation, content spoofing and information
disclosure.

Resolution
==========

Upgrade to 87.0.4280.66-1.

# pacman -Syu "chromium>=87.0.4280.66-1"

The problems have been fixed upstream in version 87.0.4280.66.

Workaround
==========

None.

Description
===========

- CVE-2020-16012 (information disclosure)

An information disclosure issue has been found in Firefox before 83.0
and chromium before 87.0.4280.66. When drawing a transparent image on
top of an unknown cross-origin image, the Skia library drawImage
function took a variable amount of time depending on the content of the
underlying image. This resulted in potential cross-origin information
exposure of image content through timing side-channel attacks.

- CVE-2020-16014 (arbitrary code execution)

A use after free security issue has been found in the PPAPI component
of the chromium browser before 87.0.4280.66.

- CVE-2020-16015 (insufficient validation)

An insufficient data validation security issue has been found in the
WASM component of the chromium browser before 87.0.4280.66.

- CVE-2020-16018 (arbitrary code execution)

A use after free security issue has been found in the payments
component of the chromium browser before 87.0.4280.66.

- CVE-2020-16019 (access restriction bypass)

An inappropriate implementation security issue has been found in the
filesystem component of the chromium browser before 87.0.4280.66.

- CVE-2020-16020 (access restriction bypass)

An inappropriate implementation security issue has been found in the
cryptohome component of the chromium browser before 87.0.4280.66.

- CVE-2020-16021 (arbitrary code execution)

A race condition has been found in the ImageBurner component of the
chromium browser before 87.0.4280.66, leading to possible memory
corruption.

- CVE-2020-16022 (access restriction bypass)

An insufficient policy enforcement security issue has been found in the
networking component of the chromium browser before 87.0.4280.66.

- CVE-2020-16023 (arbitrary code execution)

A use after free security issue has been found in the WebCodecs
component of the chromium browser before 87.0.4280.66.

- CVE-2020-16024 (arbitrary code execution)

A heap-based buffer overflow has been found in the UI component of the
chromium browser before 87.0.4280.66.

- CVE-2020-16025 (arbitrary code execution)

A heap-based buffer overflow has been found in the clipboard component
of the chromium browser before 87.0.4280.66.

- CVE-2020-16026 (arbitrary code execution)

A use after free security issue has been found in the WebRTC component
of the chromium browser before 87.0.4280.66.

- CVE-2020-16027 (access restriction bypass)

An insufficient policy enforcement security issue has been found in the
developer tools component of the chromium browser before 87.0.4280.66.

- CVE-2020-16028 (arbitrary code execution)

A heap-based buffer overflow has been found in the WebRTC component of
the chromium browser before 87.0.4280.66.

- CVE-2020-16029 (access restriction bypass)

An inappropriate implementation security issue has been found in the
PDFium component of the chromium browser before 87.0.4280.66.

- CVE-2020-16030 (insufficient validation)

An insufficient data validation security issue has been found in the
Blink component of the chromium browser before 87.0.4280.66.

- CVE-2020-16031 (content spoofing)

An incorrect security UI issue has been found in the tab preview
component of the chromium browser before 87.0.4280.66.

- CVE-2020-16032 (content spoofing)

An incorrect security UI issue has been found in the sharing component
of the chromium browser before 87.0.4280.66.

- CVE-2020-16033 (content spoofing)

A incorrect security UI issue has been found in the WebUSB component of
the chromium browser before 87.0.4280.66.

- CVE-2020-16034 (access restriction bypass)

An inappropriate implementation security issue has been found in the
WebRTC component of the chromium browser before 87.0.4280.66.

- CVE-2020-16035 (insufficient validation)

An insufficient data validation security issue has been found in the
cros-disks component of the chromium browser before 87.0.4280.66.

- CVE-2020-16036 (access restriction bypass)

An inappropriate implementation security issue has been found in the
cookies component of the chromium browser before 87.0.4280.66.

Impact
======

A remote attacker might be able to trick a user into wrongly assessing
the security of a website, WebUSB connection or a tab preview via UI
spoofing. Further, a remote attacker may be able to bypass security
restrictions, access sensitive information and execute arbitrary code

References
==========

https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_11.html
https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_17.html
https://www.mozilla.org/en-US/security/advisories/mfsa2020-50/#CVE-2020-16012
https://bugzilla.mozilla.org/show_bug.cgi?id=1642028
https://crbug.com/1146675
https://crbug.com/1146673
https://crbug.com/1136078
https://crbug.com/1139408
https://crbug.com/1139411
https://crbug.com/1139414
https://crbug.com/1145680
https://crbug.com/1146761
https://crbug.com/1147430
https://crbug.com/1147431
https://crbug.com/1139153
https://crbug.com/1116444
https://crbug.com/1138446
https://crbug.com/1134338
https://crbug.com/1141350
https://crbug.com/1133183
https://crbug.com/1136714
https://crbug.com/1143057
https://crbug.com/1137362
https://crbug.com/1139409
https://crbug.com/830808
https://security.archlinux.org/CVE-2020-16012
https://security.archlinux.org/CVE-2020-16014
https://security.archlinux.org/CVE-2020-16015
https://security.archlinux.org/CVE-2020-16018
https://security.archlinux.org/CVE-2020-16019
https://security.archlinux.org/CVE-2020-16020
https://security.archlinux.org/CVE-2020-16021
https://security.archlinux.org/CVE-2020-16022
https://security.archlinux.org/CVE-2020-16023
https://security.archlinux.org/CVE-2020-16024
https://security.archlinux.org/CVE-2020-16025
https://security.archlinux.org/CVE-2020-16026
https://security.archlinux.org/CVE-2020-16027
https://security.archlinux.org/CVE-2020-16028
https://security.archlinux.org/CVE-2020-16029
https://security.archlinux.org/CVE-2020-16030
https://security.archlinux.org/CVE-2020-16031
https://security.archlinux.org/CVE-2020-16032
https://security.archlinux.org/CVE-2020-16033
https://security.archlinux.org/CVE-2020-16034
https://security.archlinux.org/CVE-2020-16035
https://security.archlinux.org/CVE-2020-16036

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <http://lists.manjaro.org/pipermail/manjaro-security/attachments/20201118/5353088e/attachment.sig>