CVE-2021-21150
Use after free in Downloads in Google Chrome on Windows prior to 88.0. ...
Severity by source
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Ubuntu (medium).
Description
Use after free in Downloads in Google Chrome on Windows prior to 88.0.4324.182 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| alpine 3.14 | qt5-qtwebengine | 5.15.3_git20200401-r0 |
| alpine 3.15 | qt5-qtwebengine | 5.15.3_git20200401-r0 |
| alpine 3.16 | qt5-qtwebengine | 5.15.3_git20200401-r0 |
| alpine 3.17 | qt5-qtwebengine | 5.15.3_git20200401-r0 |
| alpine 3.18 | qt5-qtwebengine | 5.15.3_git20200401-r0 |
| alpine 3.19 | qt5-qtwebengine | 5.15.3_git20200401-r0 |
| alpine 3.20 | qt5-qtwebengine | 5.15.3_git20200401-r0 |
| alpine 3.21 | qt5-qtwebengine | 5.15.3_git20200401-r0 |
| alpine 3.22 | qt5-qtwebengine | 5.15.3_git20200401-r0 |
| alpine 3.23 | qt5-qtwebengine | 5.15.3_git20200401-r0 |
| debian 10 | chromium | 88.0.4324.182-1~deb10u1 |
| debian 11 | chromium | 88.0.4324.182-1 |
Show all 19 entries from 19 sources
| Source | Package | Fixed in |
|---|---|---|
| alpine 3.14 | qt5-qtwebengine | 5.15.3_git20200401-r0 |
| alpine 3.15 | qt5-qtwebengine | 5.15.3_git20200401-r0 |
| alpine 3.16 | qt5-qtwebengine | 5.15.3_git20200401-r0 |
| alpine 3.17 | qt5-qtwebengine | 5.15.3_git20200401-r0 |
| alpine 3.18 | qt5-qtwebengine | 5.15.3_git20200401-r0 |
| alpine 3.19 | qt5-qtwebengine | 5.15.3_git20200401-r0 |
| alpine 3.20 | qt5-qtwebengine | 5.15.3_git20200401-r0 |
| alpine 3.21 | qt5-qtwebengine | 5.15.3_git20200401-r0 |
| alpine 3.22 | qt5-qtwebengine | 5.15.3_git20200401-r0 |
| alpine 3.23 | qt5-qtwebengine | 5.15.3_git20200401-r0 |
| debian 10 | chromium | 88.0.4324.182-1~deb10u1 |
| debian 11 | chromium | 88.0.4324.182-1 |
| debian 12 | chromium | 88.0.4324.182-1 |
| debian 13 | chromium | 88.0.4324.182-1 |
| debian 14 | chromium | 88.0.4324.182-1 |
| debian 9 | chromium | no fix listed |
| echo | chromium | 88.0.4324.182-1 |
| ubuntu 16.04 | chromium-browser | 89.0.4389.82-0ubuntu0.16.04.1 |
| ubuntu 18.04 | chromium-browser | 89.0.4389.82-0ubuntu0.18.04.1 |
References
- https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-desktop_16.html
- https://crbug.com/1172192
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BI6ZIJQYP5DFMYVX4J5OGOU2NQLEZ3SB/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FE5SIKEVYTMDCC5OSXGOM2KRPYLHYMQX/
- https://security.gentoo.org/glsa/202104-08
- https://www.cve.org/CVERecord?id=CVE-2021-21150