CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
96.6%
An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Chromium is an open source web browser, powered by WebKit (Blink).
This update upgrades Chromium to version 55.0.2883.75.
Security Fix(es) :
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Red Hat Security Advisory RHSA-2016:2919. The text
# itself is copyright (C) Red Hat, Inc.
#
include("compat.inc");
if (description)
{
script_id(95622);
script_version("3.20");
script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/29");
script_cve_id("CVE-2016-5203", "CVE-2016-5204", "CVE-2016-5205", "CVE-2016-5206", "CVE-2016-5207", "CVE-2016-5208", "CVE-2016-5209", "CVE-2016-5210", "CVE-2016-5211", "CVE-2016-5212", "CVE-2016-5213", "CVE-2016-5214", "CVE-2016-5215", "CVE-2016-5216", "CVE-2016-5217", "CVE-2016-5218", "CVE-2016-5219", "CVE-2016-5220", "CVE-2016-5221", "CVE-2016-5222", "CVE-2016-5223", "CVE-2016-5224", "CVE-2016-5225", "CVE-2016-5226", "CVE-2016-9650", "CVE-2016-9651", "CVE-2016-9652");
script_xref(name:"RHSA", value:"2016:2919");
script_name(english:"RHEL 6 : chromium-browser (RHSA-2016:2919)");
script_summary(english:"Checks the rpm output for the updated packages");
script_set_attribute(
attribute:"synopsis",
value:"The remote Red Hat host is missing one or more security updates."
);
script_set_attribute(
attribute:"description",
value:
"An update for chromium-browser is now available for Red Hat Enterprise
Linux 6 Supplementary.
Red Hat Product Security has rated this update as having a security
impact of Important. A Common Vulnerability Scoring System (CVSS) base
score, which gives a detailed severity rating, is available for each
vulnerability from the CVE link(s) in the References section.
Chromium is an open source web browser, powered by WebKit (Blink).
This update upgrades Chromium to version 55.0.2883.75.
Security Fix(es) :
* Multiple flaws were found in the processing of malformed web
content. A web page containing malicious content could cause Chromium
to crash, execute arbitrary code, or disclose sensitive information
when visited by the victim. (CVE-2016-5203, CVE-2016-5204,
CVE-2016-5205, CVE-2016-5206, CVE-2016-5207, CVE-2016-5208,
CVE-2016-5209, CVE-2016-5210, CVE-2016-5211, CVE-2016-5212,
CVE-2016-5213, CVE-2016-9651, CVE-2016-9652, CVE-2016-5214,
CVE-2016-5215, CVE-2016-5216, CVE-2016-5217, CVE-2016-5218,
CVE-2016-5219, CVE-2016-5220, CVE-2016-5221, CVE-2016-5222,
CVE-2016-5223, CVE-2016-5224, CVE-2016-5225, CVE-2016-5226,
CVE-2016-9650)"
);
# https://googlechromereleases.blogspot.com/2016/12/
script_set_attribute(
attribute:"see_also",
value:"https://chromereleases.googleblog.com/2016/12/"
);
script_set_attribute(
attribute:"see_also",
value:"https://access.redhat.com/errata/RHSA-2016:2919"
);
script_set_attribute(
attribute:"see_also",
value:"https://access.redhat.com/security/cve/cve-2016-5203"
);
script_set_attribute(
attribute:"see_also",
value:"https://access.redhat.com/security/cve/cve-2016-5204"
);
script_set_attribute(
attribute:"see_also",
value:"https://access.redhat.com/security/cve/cve-2016-5205"
);
script_set_attribute(
attribute:"see_also",
value:"https://access.redhat.com/security/cve/cve-2016-5206"
);
script_set_attribute(
attribute:"see_also",
value:"https://access.redhat.com/security/cve/cve-2016-5207"
);
script_set_attribute(
attribute:"see_also",
value:"https://access.redhat.com/security/cve/cve-2016-5208"
);
script_set_attribute(
attribute:"see_also",
value:"https://access.redhat.com/security/cve/cve-2016-5209"
);
script_set_attribute(
attribute:"see_also",
value:"https://access.redhat.com/security/cve/cve-2016-5210"
);
script_set_attribute(
attribute:"see_also",
value:"https://access.redhat.com/security/cve/cve-2016-5211"
);
script_set_attribute(
attribute:"see_also",
value:"https://access.redhat.com/security/cve/cve-2016-5212"
);
script_set_attribute(
attribute:"see_also",
value:"https://access.redhat.com/security/cve/cve-2016-5213"
);
script_set_attribute(
attribute:"see_also",
value:"https://access.redhat.com/security/cve/cve-2016-5214"
);
script_set_attribute(
attribute:"see_also",
value:"https://access.redhat.com/security/cve/cve-2016-5215"
);
script_set_attribute(
attribute:"see_also",
value:"https://access.redhat.com/security/cve/cve-2016-5216"
);
script_set_attribute(
attribute:"see_also",
value:"https://access.redhat.com/security/cve/cve-2016-5217"
);
script_set_attribute(
attribute:"see_also",
value:"https://access.redhat.com/security/cve/cve-2016-5218"
);
script_set_attribute(
attribute:"see_also",
value:"https://access.redhat.com/security/cve/cve-2016-5219"
);
script_set_attribute(
attribute:"see_also",
value:"https://access.redhat.com/security/cve/cve-2016-5220"
);
script_set_attribute(
attribute:"see_also",
value:"https://access.redhat.com/security/cve/cve-2016-5221"
);
script_set_attribute(
attribute:"see_also",
value:"https://access.redhat.com/security/cve/cve-2016-5222"
);
script_set_attribute(
attribute:"see_also",
value:"https://access.redhat.com/security/cve/cve-2016-5223"
);
script_set_attribute(
attribute:"see_also",
value:"https://access.redhat.com/security/cve/cve-2016-5224"
);
script_set_attribute(
attribute:"see_also",
value:"https://access.redhat.com/security/cve/cve-2016-5225"
);
script_set_attribute(
attribute:"see_also",
value:"https://access.redhat.com/security/cve/cve-2016-5226"
);
script_set_attribute(
attribute:"see_also",
value:"https://access.redhat.com/security/cve/cve-2016-9650"
);
script_set_attribute(
attribute:"see_also",
value:"https://access.redhat.com/security/cve/cve-2016-9651"
);
script_set_attribute(
attribute:"see_also",
value:"https://access.redhat.com/security/cve/cve-2016-9652"
);
script_set_attribute(
attribute:"solution",
value:
"Update the affected chromium-browser and / or
chromium-browser-debuginfo packages."
);
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
script_set_attribute(attribute:"exploit_available", value:"true");
script_set_attribute(attribute:"exploited_by_malware", value:"true");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:chromium-browser");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:chromium-browser-debuginfo");
script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:6");
script_set_attribute(attribute:"vuln_publication_date", value:"2017/01/19");
script_set_attribute(attribute:"patch_publication_date", value:"2016/12/07");
script_set_attribute(attribute:"plugin_publication_date", value:"2016/12/08");
script_set_attribute(attribute:"generated_plugin", value:"current");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_copyright(english:"This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_family(english:"Red Hat Local Security Checks");
script_dependencies("ssh_get_info.nasl");
script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
exit(0);
}
include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("rpm.inc");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
os_ver = os_ver[1];
if (! preg(pattern:"^6([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 6.x", "Red Hat " + os_ver);
if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);
yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
if (!empty_or_null(yum_updateinfo))
{
rhsa = "RHSA-2016:2919";
yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
if (!empty_or_null(yum_report))
{
security_report_v4(
port : 0,
severity : SECURITY_HOLE,
extra : yum_report
);
exit(0);
}
else
{
audit_message = "affected by Red Hat security advisory " + rhsa;
audit(AUDIT_OS_NOT, audit_message);
}
}
else
{
flag = 0;
if (rpm_check(release:"RHEL6", cpu:"i686", reference:"chromium-browser-55.0.2883.75-1.el6", allowmaj:TRUE)) flag++;
if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"chromium-browser-55.0.2883.75-1.el6", allowmaj:TRUE)) flag++;
if (rpm_check(release:"RHEL6", cpu:"i686", reference:"chromium-browser-debuginfo-55.0.2883.75-1.el6", allowmaj:TRUE)) flag++;
if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"chromium-browser-debuginfo-55.0.2883.75-1.el6", allowmaj:TRUE)) flag++;
if (flag)
{
security_report_v4(
port : 0,
severity : SECURITY_HOLE,
extra : rpm_report_get() + redhat_report_package_caveat()
);
exit(0);
}
else
{
tested = pkg_tests_get();
if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
else audit(AUDIT_PACKAGE_NOT_INSTALLED, "chromium-browser / chromium-browser-debuginfo");
}
}
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5203
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5204
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5205
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5206
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5207
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5208
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5209
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5210
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5211
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5212
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5213
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5214
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5215
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5216
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5217
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5218
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5219
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5220
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5221
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5222
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5223
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5224
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5225
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5226
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9650
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9651
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9652
access.redhat.com/errata/RHSA-2016:2919
access.redhat.com/security/cve/cve-2016-5203
access.redhat.com/security/cve/cve-2016-5204
access.redhat.com/security/cve/cve-2016-5205
access.redhat.com/security/cve/cve-2016-5206
access.redhat.com/security/cve/cve-2016-5207
access.redhat.com/security/cve/cve-2016-5208
access.redhat.com/security/cve/cve-2016-5209
access.redhat.com/security/cve/cve-2016-5210
access.redhat.com/security/cve/cve-2016-5211
access.redhat.com/security/cve/cve-2016-5212
access.redhat.com/security/cve/cve-2016-5213
access.redhat.com/security/cve/cve-2016-5214
access.redhat.com/security/cve/cve-2016-5215
access.redhat.com/security/cve/cve-2016-5216
access.redhat.com/security/cve/cve-2016-5217
access.redhat.com/security/cve/cve-2016-5218
access.redhat.com/security/cve/cve-2016-5219
access.redhat.com/security/cve/cve-2016-5220
access.redhat.com/security/cve/cve-2016-5221
access.redhat.com/security/cve/cve-2016-5222
access.redhat.com/security/cve/cve-2016-5223
access.redhat.com/security/cve/cve-2016-5224
access.redhat.com/security/cve/cve-2016-5225
access.redhat.com/security/cve/cve-2016-5226
access.redhat.com/security/cve/cve-2016-9650
access.redhat.com/security/cve/cve-2016-9651
access.redhat.com/security/cve/cve-2016-9652
chromereleases.googleblog.com/2016/12/
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
96.6%