Arch Linux Security Advisory ASA-201707-29 ========================================== Severity: Critical Date : 2017-07-27 CVE-ID : CVE-2017-5091 CVE-2017-5092 CVE-2017-5093 CVE-2017-5094 CVE-2017-5095 CVE-2017-5097 CVE-2017-5098 CVE-2017-5099 CVE-2017-5100 CVE-2017-5101 CVE-2017-5102 CVE-2017-5103 CVE-2017-5104 CVE-2017-5105 CVE-2017-5106 CVE-2017-5107 CVE-2017-5108 CVE-2017-5109 CVE-2017-5110 CVE-2017-7000 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-363 Summary ======= The package chromium before version 60.0.3112.78-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing and information disclosure. Resolution ========== Upgrade to 60.0.3112.78-1. # pacman -Syu "chromium>=60.0.3112.78-1" The problems have been fixed upstream in version 60.0.3112.78. Workaround ========== None. Description =========== - CVE-2017-5091 (arbitrary code execution) A use after free vulnerability has been found in the IndexedDB component of the Chromium browser < 60.0.3112.78. - CVE-2017-5092 (arbitrary code execution) A use after free vulnerability has been found in the PPAPI component of the Chromium browser < 60.0.3112.78. - CVE-2017-5093 (content spoofing) A UI spoofing vulnerability has been found in the Blink component of the Chromium browser < 60.0.3112.78. - CVE-2017-5094 (arbitrary code execution) A type confusion vulnerability has been found in the extensions component of the Chromium browser < 60.0.3112.78. - CVE-2017-5095 (arbitrary code execution) An out-of-bounds write vulnerability has been found in the PDFium component of the Chromium browser < 60.0.3112.78. - CVE-2017-5097 (information disclosure) An out-of-bounds read vulnerability has been found in the Skia component of the Chromium browser < 60.0.3112.78. - CVE-2017-5098 (arbitrary code execution) A use-after-free vulnerability has been found in the V8 component of the Chromium browser < 60.0.3112.78. - CVE-2017-5099 (arbitrary code execution) An out-of-bounds write vulnerability has been found in the PPAPI component of the Chromium browser < 60.0.3112.78. - CVE-2017-5100 (arbitrary code execution) A use-after-free vulnerability has been found in the Chrome Apps component of the Chromium browser < 60.0.3112.78. - CVE-2017-5101 (content spoofing) A URL spoofing vulnerability has been found in the Omnibox component of the Chromium browser < 60.0.3112.78. - CVE-2017-5102 (information disclosure) An uninitialized use vulnerability has been found in the Skia component of the Chromium browser < 60.0.3112.78. - CVE-2017-5103 (information disclosure) An uninitialized use vulnerability has been found in the Skia component of the Chromium browser < 60.0.3112.78. - CVE-2017-5104 (content spoofing) A UI spoofing vulnerability has been found in the Chromium browser < 60.0.3112.78. - CVE-2017-5105 (content spoofing) A URL spoofing vulnerability has been found in the Omnibox component of the Chromium browser < 60.0.3112.78. - CVE-2017-5106 (content spoofing) A URL spoofing vulnerability using Cyrillic letters has been found in the Omnibox component of the Chromium browser < 60.0.3112.78. - CVE-2017-5107 (information disclosure) An information leakage vulnerability has been found in the Chromium browser < 60.0.3112.78. By rendering a FeConvolveMatrix SVG filter over a target iframe and timing its execution an attacking page can extract pixel values from a cross-origin page being iframe'd. This also allows reading ones own origin for history sniffing. - CVE-2017-5108 (arbitrary code execution) A type confusion vulnerability has been found in the PDFium component of the Chromium browser < 60.0.3112.78. - CVE-2017-5109 (content spoofing) A UI spoofing vulnerability has been found in the Chromium browser < 60.0.3112.78. - CVE-2017-5110 (content spoofing) A UI spoofing vulnerability has been found in the payments dialog component of the Chromium browser < 60.0.3112.78. - CVE-2017-7000 (information disclosure) A pointer disclosure vulnerability has been found in SQLite, as used in the Chromium browser < 60.0.3112.78. Impact ====== A remote attacker can spoof the content displayed to the user, access sensitive information and execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desk... https://crbug.com/728887 https://crbug.com/733549 https://crbug.com/550017 https://crbug.com/702946 https://crbug.com/732661 https://crbug.com/740789 https://crbug.com/740803 https://crbug.com/733548 https://crbug.com/718292 https://crbug.com/681740 https://crbug.com/727678 https://crbug.com/726199 https://crbug.com/729105 https://crbug.com/729979 https://crbug.com/714628 https://crbug.com/686253 https://crbug.com/695830 https://crbug.com/710400 https://crbug.com/717476 https://crbug.com/742407 https://security.archlinux.org/CVE-2017-5091 https://security.archlinux.org/CVE-2017-5092 https://security.archlinux.org/CVE-2017-5093 https://security.archlinux.org/CVE-2017-5094 https://security.archlinux.org/CVE-2017-5095 https://security.archlinux.org/CVE-2017-5097 https://security.archlinux.org/CVE-2017-5098 https://security.archlinux.org/CVE-2017-5099 https://security.archlinux.org/CVE-2017-5100 https://security.archlinux.org/CVE-2017-5101 https://security.archlinux.org/CVE-2017-5102 https://security.archlinux.org/CVE-2017-5103 https://security.archlinux.org/CVE-2017-5104 https://security.archlinux.org/CVE-2017-5105 https://security.archlinux.org/CVE-2017-5106 https://security.archlinux.org/CVE-2017-5107 https://security.archlinux.org/CVE-2017-5108 https://security.archlinux.org/CVE-2017-5109 https://security.archlinux.org/CVE-2017-5110 https://security.archlinux.org/CVE-2017-7000