Rapid7 Vulnerability & Exploit Database

FreeBSD: VID-F00B65D8-7CCB-11EB-B3BE-E09467587C17 (CVE-2021-21161): chromium -- multiple vulnerabilities

Back to Search

FreeBSD: VID-F00B65D8-7CCB-11EB-B3BE-E09467587C17 (CVE-2021-21161): chromium -- multiple vulnerabilities

Severity
7
CVSS
(AV:N/AC:M/Au:N/C:P/I:P/A:P)
Published
03/02/2021
Created
03/09/2021
Added
03/05/2021
Modified
03/15/2021

Description

Details for this vulnerability have not been published by NIST at this point. Descriptions from software vendor advisories for this issue are provided below.

From VID-F00B65D8-7CCB-11EB-B3BE-E09467587C17:

Chrome Releases reports:

This release includes 47 security fixes, including the below.

Google is aware of reports that an exploit for CVE-2021-21166 exists

in the wild.

[1171049] High CVE-2021-21159: Heap buffer overflow in

TabStrip. Reported by Khalil Zhani on 2021-01-27

[1170531] High CVE-2021-21160: Heap buffer overflow in

WebAudio. Reported by Marcin 'Icewall' Noga of Cisco Talos on

2021-01-25

[1173702] High CVE-2021-21161: Heap buffer overflow in

TabStrip. Reported by Khalil Zhani on 2021-02-02

[1172054] High CVE-2021-21162: Use after free in WebRTC.

Reported by Anonymous on 2021-01-29

[1111239] High CVE-2021-21163: Insufficient data validation in

Reader Mode. Reported by Alison Huffman, Microsoft Browser

Vulnerability Research on 2020-07-30

[1164846] High CVE-2021-21164: Insufficient data validation in

Chrome for iOS. Reported by Muneaki Nishimura (nishimunea) on

2021-01-11

[1174582] High CVE-2021-21165: Object lifecycle issue in audio.

Reported by Alison Huffman, Microsoft Browser Vulnerability

Research on 2021-02-04

[1177465] High CVE-2021-21166: Object lifecycle issue in audio.

Reported by Alison Huffman, Microsoft Browser Vulnerability

Research on 2021-02-11

[1161144] Medium CVE-2021-21167: Use after free in bookmarks.

Reported by Leecraso and Guang Gong of 360 Alpha Lab on

2020-12-22

[1152226] Medium CVE-2021-21168: Insufficient policy

enforcement in appcache. Reported by Luan Herrera (@lbherrera_)

on 2020-11-24

[1166138] Medium CVE-2021-21169: Out of bounds memory access in

V8. Reported by Bohan Liu (@P4nda20371774) and Moon Liang of

Tencent Security Xuanwu Lab on 2021-01-13

[1111646] Medium CVE-2021-21170: Incorrect security UI in

Loader. Reported by David Erceg on 2020-07-31

[1152894] Medium CVE-2021-21171: Incorrect security UI in

TabStrip and Navigation. Reported by Irvan Kurniawan (sourc7) on

2020-11-25

[1150810] Medium CVE-2021-21172: Insufficient policy

enforcement in File System API. Reported by Maciej Pulikowski on

2020-11-19

[1154250] Medium CVE-2021-21173: Side-channel information

leakage in Network Internals. Reported by Tom Van Goethem from

imec-DistriNet, KU Leuven on 2020-12-01

[1158010] Medium CVE-2021-21174: Inappropriate implementation

in Referrer. Reported by Ashish Gautam Kamble on 2020-12-11

[1146651] Medium CVE-2021-21175: Inappropriate implementation

in Site isolation. Reported by Jun Kokatsu, Microsoft Browser

Vulnerability Research on 2020-11-07

[1170584] Medium CVE-2021-21176: Inappropriate implementation

in full screen mode. Reported by Luan Herrera (@lbherrera_) on

2021-01-26

[1173879] Medium CVE-2021-21177: Insufficient policy

enforcement in Autofill. Reported by Abdulrahman Alqabandi,

Microsoft Browser Vulnerability Research on 2021-02-03

[1174186] Medium CVE-2021-21178: Inappropriate implementation

in Compositing. Reported by Japong on 2021-02-03

[1174943] Medium CVE-2021-21179: Use after free in Network

Internals. Reported by Anonymous on 2021-02-05

[1175507] Medium CVE-2021-21180: Use after free in tab search.

Reported by Abdulrahman Alqabandi, Microsoft Browser

Vulnerability Research on 2021-02-07

[1177875] Medium CVE-2020-27844: Heap buffer overflow in

OpenJPEG. Reported by Sean Campbell at Tableau on 2021-02-12

[1182767] Medium CVE-2021-21181: Side-channel information

leakage in autofill. Reported by Xu Lin (University of Illinois

at Chicago), Panagiotis Ilia (University of Illinois at Chicago),

Jason Polakis (University of Illinois at Chicago) on

2021-02-26

[1049265] Low CVE-2021-21182: Insufficient policy enforcement

in navigations. Reported by Luan Herrera (@lbherrera_) on

2020-02-05

[1105875] Low CVE-2021-21183: Inappropriate implementation in

performance APIs. Reported by Takashi Yoneuchi (@y0n3uchy) on

2020-07-15

[1131929] Low CVE-2021-21184: Inappropriate implementation in

performance APIs. Reported by James Hartig on 2020-09-24

[1100748] Low CVE-2021-21185: Insufficient policy enforcement

in extensions. Reported by David Erceg on 2020-06-30

[1153445] Low CVE-2021-21186: Insufficient policy enforcement

in QR scanning. Reported by dhirajkumarnifty on 2020-11-28

[1155516] Low CVE-2021-21187: Insufficient data validation in

URL formatting. Reported by Kirtikumar Anandrao Ramchandani on

2020-12-04

[1161739] Low CVE-2021-21188: Use after free in Blink. Reported

by Woojin Oh(@pwn_expoit) of STEALIEN on 2020-12-24

[1165392] Low CVE-2021-21189: Insufficient policy enforcement

in payments. Reported by Khalil Zhani on 2021-01-11

[1166091] Low CVE-2021-21190: Uninitialized Use in PDFium.

Reported by Zhou Aiting(@zhouat1) of Qihoo 360 Vulcan Team on

2021-01-13

Solution(s)

  • freebsd-upgrade-package-chromium

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;