CVE-2016-5202
chromium-browser: various fixes from internal audits
Severidad por fuente
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según Red Hat (alta), Ubuntu (media).
Descripción
browser/extensions/api/dial/dial_registry.cc in Google Chrome before 54.0.2840.98 on macOS, before 54.0.2840.99 on Windows, and before 54.0.2840.100 on Linux neglects to copy a device ID before an erase() call, which causes the erase operation to access data that that erase operation will destroy.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| debian 7 | chromium-browser | sin corrección indicada |
| debian 8 | chromium-browser | 55.0.2883.75-1~deb8u1 |
| ubuntu 14.04 | chromium-browser, oxide-qt | 58.0.3029.81-0ubuntu0.14.04.1172 y 1 más |
| ubuntu 16.04 | chromium-browser, oxide-qt | 55.0.2883.87-0ubuntu0.16.04.1263 y 1 más |
| ubuntu 16.04-ESM | oxide-qt | 1.18.5-0ubuntu0.16.04.1 |
| ubuntu 16.10 | chromium-browser, oxide-qt | 55.0.2883.87-0ubuntu0.16.10.1328 y 1 más |
| ubuntu 17.04 | chromium-browser, oxide-qt | 55.0.2883.87-0ubuntu1 y 1 más |
Mostrar las 11 entradas de 7 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| debian 7 | chromium-browser | sin corrección indicada |
| debian 8 | chromium-browser | 55.0.2883.75-1~deb8u1 |
| ubuntu 14.04 | chromium-browser | 58.0.3029.81-0ubuntu0.14.04.1172 |
| ubuntu 14.04 | oxide-qt | 1.18.5-0ubuntu0.14.04.1 |
| ubuntu 16.04 | chromium-browser | 55.0.2883.87-0ubuntu0.16.04.1263 |
| ubuntu 16.04 | oxide-qt | 1.18.5-0ubuntu0.16.04.1 |
| ubuntu 16.04-ESM | oxide-qt | 1.18.5-0ubuntu0.16.04.1 |
| ubuntu 16.10 | chromium-browser | 55.0.2883.87-0ubuntu0.16.10.1328 |
| ubuntu 16.10 | oxide-qt | 1.18.5-0ubuntu0.16.10.1 |
| ubuntu 17.04 | chromium-browser | 55.0.2883.87-0ubuntu1 |
| ubuntu 17.04 | oxide-qt | 1.19.6-0ubuntu2 |
Referencias
- http://lists.opensuse.org/opensuse-security-announce/2016-11/msg00029.html
- https://access.redhat.com/security/cve/CVE-2016-5202
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-5202
- https://bugzilla.suse.com/show_bug.cgi?id=CVE-2016-5202
- https://googlechromereleases.blogspot.com/2016/11/stable-channel-update-for-desktop_9.html
- https://nvd.nist.gov/vuln/detail/CVE-2016-5202
- https://security-tracker.debian.org/tracker/CVE-2016-5202
- https://ubuntu.com/security/notices/USN-3133-1