Arch Linux Security Advisory ASA-202012-14 ========================================== Severity: High Date : 2020-12-09 CVE-ID : CVE-2020-16037 CVE-2020-16038 CVE-2020-16039 CVE-2020-16040 CVE-2020-16041 CVE-2020-16042 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1323 Summary ======= The package chromium before version 87.0.4280.88-1 is vulnerable to multiple issues including arbitrary code execution, information disclosure, insufficient validation and denial of service. Resolution ========== Upgrade to 87.0.4280.88-1. # pacman -Syu "chromium>=87.0.4280.88-1" The problems have been fixed upstream in version 87.0.4280.88. Workaround ========== None. Description =========== - CVE-2020-16037 (arbitrary code execution) A use after free security issue has been found in the clipboard component of the chromium browser before version 87.0.4280.88. - CVE-2020-16038 (arbitrary code execution) A use after free security issue has been found in the media component of the chromium browser before version 87.0.4280.88. - CVE-2020-16039 (arbitrary code execution) A use after free security issue has been found in the extensions component of the chromium browser before version 87.0.4280.88. - CVE-2020-16040 (insufficient validation) An insufficient data validation security issue has been found in the V8 component of the chromium browser before version 87.0.4280.88. - CVE-2020-16041 (denial of service) An out of bounds read security issue has been found in the networking component of the chromium browser before version 87.0.4280.88. - CVE-2020-16042 (information disclosure) An uninitialized use security issue has been found in the V8 component of the chromium browser before version 87.0.4280.88 and Firefox before 84.0. Impact ====== A remote attacker might be able to crash the application, read memory or execute arbitrary code. References ========== https://chromereleases.googleblog.com/2020/12/stable-channel-update-for-desk... https://crbug.com/1142331 https://crbug.com/1138683 https://crbug.com/1149177 https://crbug.com/1150649 https://crbug.com/1151865 https://crbug.com/1151890 https://www.mozilla.org/en-US/security/advisories/mfsa2020-54/#CVE-2020-1604... https://bugzilla.mozilla.org/show_bug.cgi?id=1679003 https://security.archlinux.org/CVE-2020-16037 https://security.archlinux.org/CVE-2020-16038 https://security.archlinux.org/CVE-2020-16039 https://security.archlinux.org/CVE-2020-16040 https://security.archlinux.org/CVE-2020-16041 https://security.archlinux.org/CVE-2020-16042