Chromium 68へ更新します。以下のためのセキュリティ修正 CVE-2018-4117 CVE-2018-6044 CVE-2018-6150 CVE-2018-6151 CVE-2018-6152 CVE-2018-6153 CVE-2018-6154 CVE-2018-6155 CVE-2018-6156 CVE-2018-6157 CVE-2018-6158 CVE-2018-6159 CVE-2018-6161 CVE-2018-6162 CVE-2018-6163 CVE-2018-6149

注意：Tenable Network Securityは、前述の記述ブロックをFedora更新システムのWebサイトから直接抽出しています。
Tenableでは、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

リモートのWindowsホストにインストールされているApple iTunesのバージョンは、12.7.4より前です。したがって、HT208694のアドバイザリに記載されているとおり、WebKitの複数の脆弱性による影響を受けます。

Nessus はこの問題をテストしておらず、代わりにアプリケーションの自己報告されたバージョン番号にのみ依存しています。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - 特定の Apple 製品で問題が見つかりました。 11.3 より前の iOS が影響を受けます。 11.1 より前の Safari が影響を受けます。 Windows 上の 7.4 より前の iCloud が影響を受けます。 Windows での 12.7.4 より前の iTunes が影響を受けます。 4.3 より前の watchOS が影響を受けます。の問題は、WebKit コンポーネントのフェッチ API に関係します。これにより、リモートの攻撃者が、同一生成元ポリシーをバイパスし、細工された Web サイトを通じて機密情報を取得する可能性があります。
    (CVE-2018-4117)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The version of Apple iOS running on the mobile device is prior to 11.3. It is, therefore, affected by multiple vulnerabilities.

The version of Apple Safari installed on the remote host is prior to 11.1. It is, therefore, affected by multiple vulnerabilities as described in the HT208695 security advisory.

The version of Google Chrome installed on the remote host is prior to 68.0.3440.75, and is affected by multiple vulnerabilities :

 - A flaw exists as it does not properly limit certain characters (U+0153, U+00E6, U+04D5, U+0499, and U+0525) before displaying them as Unicode. With a specially crafted IDN domain, a context-dependent attacker can spoof an Omnibox address.
 - A flaw exists as it does not properly limit certain characters (U+0153, U+00E6, U+04D5, U+0499, and U+0525) before displaying them as Unicode. With a specially crafted IDN domain, a context-dependent attacker can spoof an Omnibox address.
 - A flaw exists in the 'ComputeRandomMagic()' function in 'blink/renderer/platform/heap/heap_page.cc' that is triggered as random numbers are not properly handled when generating heap magic values. This may lead to weaker heap object integrity checks than intended.
 - A flaw exists in the safe browsing feature that is triggered when handling DMG file analysis. This may allow a context-dependent attacker to have an unspecified impact.
 - A dangling reference flaw exists in the PDFiumEngine class in 'pdf/pdfium/pdfium_engine.cc' that is triggered when handling image data while paints are pending. This may allow a context-dependent attacker to have an unspecified impact.
 - A flaw exists in the CPDF_DIBSource class destructor in 'fpdfapi/render/cpdf_dibsource.cpp' that may allow a context-dependent attacker to have an unspecified impact. No further details have been provided.
 - A type confusion flaw exists in multiple JS functions that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to have an unspecified impact. No further details have been provided.
 - A flaw exists in the HTMLMediaElement class in 'blink/renderer/core/html/media/html_media_element.cc' that is triggered when handling media files. This may allow a context-dependent attacker to gain cross-origin access to potentially sensitive information.
 - A flaw exists in the 'ActiveTabPermissionGranter::GrantIfRequested()' function in 'browser/extensions/active_tab_permission_granter.cc' that is triggered as an extension has permission to the file-scheme of a file-URL loaded tab. This may allow a malicious extension to gain unauthorized access to page information 'e.g'. via the 'chrome.tabs'.executeScript API.
 - A flaw exists that is triggered as it is possible to include web content in WebUI documents. This may allow a context-dependent attacker to bypass intended security restrictions.
 - A flaw exists that is triggered as certain input is not properly validated when handling temporary registers during shader compilation. This may allow a context-dependent attacker to crash a process linked against the library.
 - An unspecified flaw exists that is triggered when handling termination garbage collection. This may allow a context-dependent attacker to have an unspecified impact.
 - A use-after-free error exists in the 'vp8_deblock()' function in 'vp8/common/postproc.c' that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in the 'PermissionServiceImpl::RequestPermissions()' function in 'content/browser/permissions/permission_service_impl.cc' that is triggered when handling permission types. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A flaw exists in the HTMLMediaElement class in 'blink/renderer/core/html/media/html_media_element.cc' that is triggered when handling media files. This may allow a context-dependent attacker to bypass cross-origin resource sharing (CORS) configurations.
 - A flaw exists as it does not properly limit certain characters (U+0153, U+00E6, U+04D5, U+0499, and U+0525) before displaying them as Unicode. With a specially crafted IDN domain, a context-dependent attacker can spoof an Omnibox address.
 - A type confusion flaw exists in the 'PacketBuffer::FindFrames()' function in 'modules/video_coding/packet_buffer.

ID	名稱	產品	系列	已發布	已更新	嚴重性
120392	Fedora 28：chromium（2018-499f2dbc96）	Nessus	Fedora Local Security Checks	2019/1/3	2024/7/8	critical
108795	Apple iTunes < 12.7.4 WebKitの複数の脆弱性（資格情報のチェック）	Nessus	Windows	2018/4/3	2024/11/21	high
253322	Linux Distros のパッチ未適用の脆弱性: CVE-2018-4117	Nessus	Misc.	2025/8/21	2025/8/21	medium
118453	openSUSEセキュリティ更新プログラム：webkit2gtk3（openSUSE-2018-1288）	Nessus	SuSE Local Security Checks	2018/10/26	2024/7/29	critical
700548	Apple iOS < 11.3 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	2019/4/17	2019/4/17	critical
700503	Apple Safari < 11.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2019/4/8	2019/4/8	high
700361	Google Chrome < 68.0.3440.75 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2018/8/23	2019/3/6	high

偵測

搜尋 Plugin

critical

high

medium

critical

critical

high

high