Important: chromium-browser security update
Advisory: | RHSA-2016:1485-1 |
---|---|
Type: | Security Advisory |
Severity: | Important |
Issued on: | 2016-07-26 |
Last updated on: | 2016-07-26 |
Affected Products: | Red Hat Enterprise Linux Desktop Supplementary (v. 6) Red Hat Enterprise Linux Server Supplementary (v. 6) Red Hat Enterprise Linux Workstation Supplementary (v. 6) |
CVEs (cve.mitre.org): |
CVE-2016-1705 CVE-2016-1706 CVE-2016-1708 CVE-2016-1709 CVE-2016-1710 CVE-2016-1711 CVE-2016-5127 CVE-2016-5128 CVE-2016-5129 CVE-2016-5130 CVE-2016-5131 CVE-2016-5132 CVE-2016-5133 CVE-2016-5134 CVE-2016-5135 CVE-2016-5136 CVE-2016-5137 |
Details
An update for chromium-browser is now available for Red Hat Enterprise Linux 6
Supplementary.
Red Hat Product Security has rated this update as having a security impact of
Important. A Common Vulnerability Scoring System (CVSS) base score, which gives
a detailed severity rating, is available for each vulnerability from the CVE
link(s) in the References section.
Chromium is an open-source web browser, powered by WebKit (Blink).
This update upgrades Chromium to version 52.0.2743.82.
Security Fix(es):
* Multiple flaws were found in the processing of malformed web content. A web
page containing malicious content could cause Chromium to crash, execute
arbitrary code, or disclose sensitive information when visited by the victim.
(CVE-2016-1706, CVE-2016-1708, CVE-2016-1709, CVE-2016-1710, CVE-2016-1711,
CVE-2016-5127, CVE-2016-5128, CVE-2016-5129, CVE-2016-5130, CVE-2016-5131,
CVE-2016-5132, CVE-2016-5133, CVE-2016-5134, CVE-2016-5135, CVE-2016-5136,
CVE-2016-5137, CVE-2016-1705)
Solution
this advisory, refer to:
https://access.redhat.com/articles/11258
After installing the update, Chromium must be restarted for the changes to take
effect.
Updated packages
Red Hat Enterprise Linux Desktop Supplementary (v. 6) | |
IA-32: | |
chromium-browser-52.0.2743.82-1.el6.i686.rpm File outdated by: RHSA-2017:0860 |
MD5: 0a67792fe0fd1358409a775e2484c2eb SHA-256: 4bd1826477348285d4d27452548120aed39ef9e378cf0816711da48ff649c5e0 |
chromium-browser-debuginfo-52.0.2743.82-1.el6.i686.rpm File outdated by: RHSA-2017:0860 |
MD5: fc2ae53d45efed76059bda71409ba076 SHA-256: c0cd9845fcf27cbe09e044ca74df5da3553a1b5432accc8063e7ec58413d65b0 |
x86_64: | |
chromium-browser-52.0.2743.82-1.el6.x86_64.rpm File outdated by: RHSA-2017:0860 |
MD5: e7fe407891aeeeecd9e275b0e6533bfa SHA-256: dbd8b3a6dcf9dadc800c294778588176cabe6f7a646fcb93fdcfb5c8bd5de7de |
chromium-browser-debuginfo-52.0.2743.82-1.el6.x86_64.rpm File outdated by: RHSA-2017:0860 |
MD5: 37ac368a7b378c439e7aebd34794073d SHA-256: 60d42ca65b05e68a1f4533f23514de13bbd04d040294e2428398d5916f9bf809 |
Red Hat Enterprise Linux Server Supplementary (v. 6) | |
IA-32: | |
chromium-browser-52.0.2743.82-1.el6.i686.rpm File outdated by: RHSA-2017:0860 |
MD5: 0a67792fe0fd1358409a775e2484c2eb SHA-256: 4bd1826477348285d4d27452548120aed39ef9e378cf0816711da48ff649c5e0 |
chromium-browser-debuginfo-52.0.2743.82-1.el6.i686.rpm File outdated by: RHSA-2017:0860 |
MD5: fc2ae53d45efed76059bda71409ba076 SHA-256: c0cd9845fcf27cbe09e044ca74df5da3553a1b5432accc8063e7ec58413d65b0 |
x86_64: | |
chromium-browser-52.0.2743.82-1.el6.x86_64.rpm File outdated by: RHSA-2017:0860 |
MD5: e7fe407891aeeeecd9e275b0e6533bfa SHA-256: dbd8b3a6dcf9dadc800c294778588176cabe6f7a646fcb93fdcfb5c8bd5de7de |
chromium-browser-debuginfo-52.0.2743.82-1.el6.x86_64.rpm File outdated by: RHSA-2017:0860 |
MD5: 37ac368a7b378c439e7aebd34794073d SHA-256: 60d42ca65b05e68a1f4533f23514de13bbd04d040294e2428398d5916f9bf809 |
Red Hat Enterprise Linux Workstation Supplementary (v. 6) | |
IA-32: | |
chromium-browser-52.0.2743.82-1.el6.i686.rpm File outdated by: RHSA-2017:0860 |
MD5: 0a67792fe0fd1358409a775e2484c2eb SHA-256: 4bd1826477348285d4d27452548120aed39ef9e378cf0816711da48ff649c5e0 |
chromium-browser-debuginfo-52.0.2743.82-1.el6.i686.rpm File outdated by: RHSA-2017:0860 |
MD5: fc2ae53d45efed76059bda71409ba076 SHA-256: c0cd9845fcf27cbe09e044ca74df5da3553a1b5432accc8063e7ec58413d65b0 |
x86_64: | |
chromium-browser-52.0.2743.82-1.el6.x86_64.rpm File outdated by: RHSA-2017:0860 |
MD5: e7fe407891aeeeecd9e275b0e6533bfa SHA-256: dbd8b3a6dcf9dadc800c294778588176cabe6f7a646fcb93fdcfb5c8bd5de7de |
chromium-browser-debuginfo-52.0.2743.82-1.el6.x86_64.rpm File outdated by: RHSA-2017:0860 |
MD5: 37ac368a7b378c439e7aebd34794073d SHA-256: 60d42ca65b05e68a1f4533f23514de13bbd04d040294e2428398d5916f9bf809 |
(The unlinked packages above are only available from the Red Hat Network) |
Bugs fixed (see bugzilla for more information)
1358630 - CVE-2016-1706 chromium-browser: sandbox escape in ppapi
1358632 - CVE-2016-1708 chromium-browser: use-after-free in extensions
1358633 - CVE-2016-1709 chromium-browser: heap-buffer-overflow in sfntly
1358634 - CVE-2016-1710 chromium-browser: same-origin bypass in blink
1358636 - CVE-2016-1711 chromium-browser: same-origin bypass in blink
1358637 - CVE-2016-5127 chromium-browser: use-after-free in blink
1358638 - CVE-2016-5128 chromium-browser: same-origin bypass in v8
1358639 - CVE-2016-5129 chromium-browser: memory corruption in v8
1358640 - CVE-2016-5130 chromium-browser: url spoofing
1358641 - CVE-2016-5131 chromium-browser: use-after-free in libxml
1358642 - CVE-2016-5132 chromium-browser: limited same-origin bypass in service workers
1358643 - CVE-2016-5133 chromium-browser: origin confusion in proxy authentication
1358645 - CVE-2016-5134 chromium-browser: url leakage via pac script
1358646 - CVE-2016-5135 chromium-browser: content-security-policy bypass
1358647 - CVE-2016-5136 chromium-browser: use after free in extensions
1358648 - CVE-2016-5137 chromium-browser: history sniffing with hsts and csp
1358649 - CVE-2016-1705 chromium-browser: various fixes from internal audits
References
https://www.redhat.com/security/data/cve/CVE-2016-1706.html
https://www.redhat.com/security/data/cve/CVE-2016-1708.html
https://www.redhat.com/security/data/cve/CVE-2016-1709.html
https://www.redhat.com/security/data/cve/CVE-2016-1710.html
https://www.redhat.com/security/data/cve/CVE-2016-1711.html
https://www.redhat.com/security/data/cve/CVE-2016-5127.html
https://www.redhat.com/security/data/cve/CVE-2016-5128.html
https://www.redhat.com/security/data/cve/CVE-2016-5129.html
https://www.redhat.com/security/data/cve/CVE-2016-5130.html
https://www.redhat.com/security/data/cve/CVE-2016-5131.html
https://www.redhat.com/security/data/cve/CVE-2016-5132.html
https://www.redhat.com/security/data/cve/CVE-2016-5133.html
https://www.redhat.com/security/data/cve/CVE-2016-5134.html
https://www.redhat.com/security/data/cve/CVE-2016-5135.html
https://www.redhat.com/security/data/cve/CVE-2016-5136.html
https://www.redhat.com/security/data/cve/CVE-2016-5137.html
https://access.redhat.com/security/updates/classification/#important
http://googlechromereleases.blogspot.com/2016/07/stable-channel-update.html
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package
The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/