huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
NULL pointer dereference with databases with schema corrupted with CREATE TABLE AS allows for denial of service
CVE: CVE-2018-8740
Component: sqlite
CWE: CWE-476
Severity: Low
CVSS v3: 3.4/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2018-03-17T00:00:00+00:00

A NULL pointer dereference vulnerability was found in SQLite. Loading a database whose schema was corrupted using a CREATE TABLE AS statement would result in a SQLite crash.

Statement: Red Hat Product Security has rated this issue as having a security impact of Low. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
deserialization of data in XML and JSON transcoders
CVE: CVE-2018-1131
Component: infinispan
CWE: CWE-349
Severity: Important
CVSS v3: 7.7/CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2018-05-14T14:00:00+00:00

Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects, achieving code execution and possible further attacks. Versions 9.0.3.Final, 9.1.7.Final, 8.2.10.Final, 9.2.2.Final, 9.3.0.Alpha1 are believed to be affected.


Remediation:
Access the download location from the References section of this erratum. You must log in to your Red Hat account to download the update.

Before applying the update, back up your existing Red Hat JBoss Data Grid installation. You should back up databases, configuration files, and so on.
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

Installation instructions are available from the Fuse 7.5.0 product documentation page:
https://access.redhat.com/documentation/en-us/red_hat_fuse/7.5/
heap-based buffer overflow in tjLoadImage
CVE: CVE-2018-20330
Component: libjpeg-turbo
CWE: CWE-122
Severity: Low
CVSS v3: 4.2/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2018-11-25T00:00:00+00:00

The tjLoadImage function in libjpeg-turbo 2.0.1 has an integer overflow with a resultant heap-based buffer overflow via a BMP image because multiplication of pitch and height is mishandled, as demonstrated by tjbench.

Statement: This issue did not affect the versions of libjpeg-turbo as shipped with Red Hat Enterprise Linux 6 and 7.

Remediation:
API exposes power management credentials to administrators
CVE: CVE-2018-1074
Component: ovirt-engine
CWE: CWE-200
Severity: Low
CVSS v3: 7.4/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Release date: 2018-04-26T00:00:00+00:00

The ovirt-engine API and administration web portal exposed Power Management credentials including cleartext passwords to Host Administrators. A Host Administrator could use this flaw to gain access to the power management systems of hosts they control.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/2974891
Out of bounds read in V8
CVE: CVE-2018-18359
Component: chromium-browser
Severity: Moderate
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2018-12-04T00:00:00+00:00

Incorrect handling of Reflect.construct in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
off-by-one error in the CHM chunk number validity checks
CVE: CVE-2018-14680
Component: libmspack
CWE: CWE-193
Severity: Low
CVSS v3: 3.9/CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2018-05-12T00:00:00+00:00

An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. It does not reject blank CHM filenames.

Statement: This issue affects the versions of libmspack as shipped with Red Hat Enterprise Linux 7.

Remediation:
persistent XSS in message display via a "<svg><a xlink:href="
CVE: CVE-2018-14950
Component: squirrelmail
CWE: CWE-79
Severity: Moderate
CVSS v3: 8.6/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Release date: 2018-07-26T00:00:00+00:00

The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<svg><a xlink:href=" attack.

Statement: This issue affects the versions of squirrelmail as shipped with Red Hat Enterprise Linux 5. Red Hat Enterprise Linux 5 is now in Extended Life Phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Remediation:
Heap buffer overflow in WebGL
CVE: CVE-2018-6162
Component: chromium-browser
Severity: Moderate
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2018-07-24T00:00:00+00:00

Improper deserialization in WebGL in Google Chrome on Mac prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
Out-of-bounds read in MP4NameFirstMatches in mp4util.cpp
CVE: CVE-2018-14403
Component: libmp4v2
CVSS v3: 3.6/CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L
Release date: 2018-07-17T00:00:00+00:00

MP4NameFirstMatches in mp4util.cpp in MP4v2 2.0.0 mishandles substrings of atom names, leading to use of an inappropriate data type for associated atoms. The resulting type confusion can cause out-of-bounds memory access.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Information Exposure in posix_get_file_contents function in posix-helpers.c
CVE: CVE-2018-10913
Component: glusterfs
CWE: CWE-209
Severity: Low
CVSS v3: 3.7/CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Release date: 2018-09-04T05:30:00+00:00

An information disclosure vulnerability was discovered in glusterfs server. An attacker could issue a xattr request via glusterfs FUSE to determine the existence of any file.

Statement: This issue did not affect Red Hat Enterprise Linux 6 and 7 as the flaw is present in glusterfs-server, which is not shipped there.

This flaw affects glusterfs versions included in Red Hat Virtualization 4 Hypervisor. However, in recommended configurations, the vulnerability is only exposed to hypervisor administrators and can not be exploited from virtual machines or other hosts on the network.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/2974891
SELinux mitigates this issue on Red Hat Gluster Storage 3. SELinux should be in enforcing mode only as permissive mode does not block attacks.
Mishandled URLs in Utils.py:GetPathPieces() allows attackers to display arbitrary text on trusted sites
CVE: CVE-2018-13796
Component: mailman
CWE: CWE-345
Severity: Moderate
CVSS v3: 4.2/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Release date: 2018-07-23T00:00:00+00:00

An issue was discovered in GNU Mailman before 2.1.28. A crafted URL can cause arbitrary text to be displayed on a web page from a trusted site.


Remediation:
buffer over-read in the function i2ulaw_array in ulaw.c
CVE: CVE-2018-19661
Component: libsndfile
CWE: CWE-125
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2018-11-27T00:00:00+00:00

An issue was discovered in libsndfile 1.0.28. There is a buffer over-read in the function i2ulaw_array in ulaw.c that will lead to a denial of service.


Remediation:
heap-based buffer over-read in ReadSUNImage in coders/sun.c
CVE: CVE-2018-11251
Component: ImageMagick
CWE: CWE-122
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2018-01-23T00:00:00+00:00

In ImageMagick 7.0.7-23 Q16 x86_64 2018-01-24, there is a heap-based buffer over-read in ReadSUNImage in coders/sun.c, which allows attackers to cause a denial of service (application crash in SetGrayscaleImage in MagickCore/quantize.c) via a crafted SUN image file.

Statement: This issue did not affect the versions of ImageMagick shipped with Red Hat Enterprise Linux 5, 6, and 7.

Remediation:
Containers run as non-root users do not drop capabilities
CVE: CVE-2018-10856
Component: podman
CWE: CWE-250
Severity: Moderate
CVSS v3: 5.4/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2018-05-31T00:00:00+00:00

It has been discovered that podman does not drop capabilities when executing a container as a non-root user. This results in unnecessary privileges being granted to the container.


Remediation:
Local file access in DevTools
CVE: CVE-2018-16081
Component: chromium-browser
Severity: Moderate
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2018-09-04T00:00:00+00:00

Allowing the chrome.debugger API to run on file:// URLs in DevTools in Google Chrome prior to 69.0.3497.81 allowed an attacker who convinced a user to install a malicious extension to access files on the local file system without file access permission via a crafted Chrome Extension.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
jason injection exists in web_client_api_request_v1_data in web/api/web_api_v1.c
CVE: CVE-2018-18836
Component: netdata
CVSS v3: 4.2/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Release date: 2018-01-01T00:00:00+00:00

An issue was discovered in Netdata 1.10.0. JSON injection exists via the api/v1/data tqx parameter because of web_client_api_request_v1_data in web/api/web_api_v1.c.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Use After Free - remote code execution vulnerability (APSB18-05)
CVE: CVE-2018-4919
Component: flash-plugin
CWE: CWE-119
Severity: Critical
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2018-03-13T00:00:00+00:00

Adobe Flash Player versions 28.0.0.161 and earlier have an exploitable use after free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.


Remediation:
Cross site request forgery in dirmngr resulting in an information disclosure or denial of service
CVE: CVE-2018-1000858
Component: gnupg2
CWE: CWE-352
Severity: Moderate
CVSS v3: 5.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Release date: 2018-11-23T00:00:00+00:00

GnuPG version 2.1.12 - 2.2.11 contains a Cross ite Request Forgery (CSRF) vulnerability in dirmngr that can result in Attacker controlled CSRF, Information Disclosure, DoS. This attack appear to be exploitable via Victim must perform a WKD request, e.g. enter an email address in the composer window of Thunderbird/Enigmail. This vulnerability appears to have been fixed in after commit 4a4bb874f63741026bd26264c43bb32b1099f060.


Remediation:
out-of-bounds keyOffset and valueOffset values in BinaryDict::NewFromFile in BinaryDict.cpp
CVE: CVE-2018-16982
Component: opencc
CWE: CWE-119
Severity: Low
CVSS v3: 4.6/CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2018-09-13T00:00:00+00:00

Open Chinese Convert (OpenCC) 1.0.5 allows attackers to cause a denial of service (segmentation fault) because BinaryDict::NewFromFile in BinaryDict.cpp may have out-of-bounds keyOffset and valueOffset values via a crafted .ocd file.

Statement: This issue did not affect the versions of opencc as shipped with Red Hat Enterprise Linux 7.

Remediation:
Multiple heap out-of-bound writes in VNC client code
CVE: CVE-2018-20019
Component: libvncserver
CWE: CWE-416
Severity: Moderate
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2018-12-19T00:00:00+00:00

LibVNC before commit a83439b9fbe0f03c48eb94ed05729cb016f8b72f contains multiple heap out-of-bound write vulnerabilities in VNC client code that can result remote code execution


Remediation:
HttpSessions access/hijack in the FileSystem's storage for the FileSessionDataStore.
CVE: CVE-2018-12538
Component: jetty
CWE: CWE-287
Severity: Moderate
CVSS v3: 5.6/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2018-06-18T00:00:00+00:00

In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's storage for the FileSessionDataStore.


Remediation:
reading "callback=" lines in a debugfs file in drivers/dma/qcom/hidma_dbg.c results in information disclosure
CVE: CVE-2018-20449
Component: kernel
CWE: CWE-200
Severity: Low
CVSS v3: 2.3/CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
Release date: 2018-01-01T00:00:00+00:00

The hidma_chan_stats() function in the drivers/dma/qcom/hidma_dbg.c file in the Linux kernel allows local users to obtain sensitive address information by reading "callback=" lines in a debugfs file. By default, the debugfs filesystem access is restricted so only a privileged user can access it.


Remediation:
Improper cleanup of session token can allow attackers to hijack user sessions
CVE: CVE-2018-1127
Component: tendrl-api
CWE: CWE-613
Severity: Low
CVSS v3: 4.1/CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Release date: 2018-05-08T00:00:00+00:00

Tendrl API in Red Hat Gluster Storage before 3.4.0 does not immediately remove session tokens after a user logs out. Session tokens remain active for a few minutes allowing attackers to replay tokens acquired via sniffing/MITM attacks and authenticate as the target user.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
l2tp: Race condition between pppol2tp_session_create() and l2tp_eth_create()
CVE: CVE-2018-9517
Component: kernel
CWE: CWE-367
Severity: Moderate
CVSS v3: 4.7/CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2018-09-14T00:00:00+00:00

A race condition between pppol2tp_session_create() and l2tp_eth_create() in net/l2tp/l2tp_netlink.c was found in the Linux kernel. Calling l2tp_tunnel_find() may result in a new tunnel being created with tunnel id of a previously removed tunnel which wouldn't be protected by the reference counter.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
improper check for length in ReadDCMImage of coders/dcm.c and ReadPICTImage of coders/pict.c
CVE: CVE-2018-16644
Component: ImageMagick
CWE: CWE-20
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2018-08-27T00:00:00+00:00

There is a missing check for length in the functions ReadDCMImage of coders/dcm.c and ReadPICTImage of coders/pict.c in ImageMagick 7.0.8-11, which allows remote attackers to cause a denial of service via a crafted image.

Statement: This issue affects the versions of ImageMagick as shipped with Red Hat Enterprise Linux 5, 6, and 7.

Red Hat Enterprise Linux 5 is now in Extended Life Phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Low, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Remediation:
off-by-one error in the CHM PMGI/PMGL chunk number validity checks
CVE: CVE-2018-14679
Component: libmspack
CWE: CWE-193
Severity: Low
CVSS v3: 3.9/CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2018-05-12T00:00:00+00:00

An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the CHM PMGI/PMGL chunk number validity checks, which could lead to denial of service (uninitialized data dereference and application crash).

Statement: This issue affects the versions of libmspack as shipped with Red Hat Enterprise Linux 7.

Remediation:
CSP not applied to all multipart content sent with multipart/x-mixed-replace
CVE: CVE-2018-5164
Component: Mozilla
CWE: CWE-829
Severity: Moderate
CVSS v3: 6.0/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2018-05-09T00:00:00+00:00

Content Security Policy (CSP) is not applied correctly to all parts of multipart content sent with the "multipart/x-mixed-replace" MIME type. This could allow for script to run where CSP should block it, allowing for cross-site scripting (XSS) and other attacks. This vulnerability affects Firefox < 60.


Remediation:
HTTP parser allowed for spaces inside Content-Length header values
CVE: CVE-2018-7159
Component: nodejs
CWE: CWE-20
Severity: Low
CVSS v3: 5.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Release date: 2018-03-08T00:00:00+00:00

It was found that the http module from Node.js could accept incorrect Content-Length values, containing spaces within the value, in HTTP headers. A specially crafted client could use this flaw to possibly confuse the script, causing unspecified behavior.


Remediation:
open redirect on the login page
CVE: CVE-2018-3819
Component: kibana
CWE: CWE-601
Severity: Moderate
CVSS v3: 4.6/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Release date: 2018-01-30T00:00:00+00:00

The fix in Kibana for ESA-2017-23 was incomplete. With X-Pack security enabled, Kibana versions before 6.1.3 and 5.6.7 have an open redirect vulnerability on the login page that would enable an attacker to craft a link that redirects to an arbitrary website.

Statement: This issue affects the versions of kibana as shipped with Red Hat OpenShift Enterprise Linux. Red Hat Product Security has rated this issue as having security impact of Moderate. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
CVE: CVE-2018-1000634
Component: CVE-2018-1000634
Release date: 2018-01-01T00:00:00+00:00

The Open Microscopy Environment OMERO.server version 5.4.0 to 5.4.6 contains an Improper Access Control vulnerability in User management that can result in administrative user with privilege restrictions logging in as a more powerful administrator. This attack appear to be exploitable via Use user administration privilege to set the password of a more powerful administrator. This vulnerability appears to have been fixed in 5.4.7.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
memory leak in the XMagickCommand function in MagickCore/animate.c
CVE: CVE-2018-13153
Component: ImageMagick
CWE: CWE-400
Severity: Low
CVSS v3: 3.7/CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
Release date: 2018-07-04T00:00:00+00:00

A memory leak was discovered in ImageMagick in the XMagickCommand function in animate.c file. An array of strings, named filelist, is allocated on the heap but not released in case the function ExpandFilenames returns an error code.


Remediation:
heap buffer overflow using crafted certificates
CVE: CVE-2018-17540
Component: strongswan
CWE: CWE-122
Severity: Low
CVSS v3: 3.0/CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2018-10-02T00:00:00+00:00

The gmp plugin in strongSwan before 5.7.1 has a Buffer Overflow via a crafted certificate.


Remediation:
When Wipe After Delete (WAD) and Enable Discard are both enabled for a VM disk, discarded data might not be wiped after the disk is removed.
CVE: CVE-2018-1062
Component: ovirt-engine
CWE: CWE-212
Severity: Low
CVSS v3: 4.5/CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N
Release date: 2018-03-06T00:00:00+00:00

It was discovered that the combination of Enable Discard and Wipe After Delete flags for VM disks managed by oVirt, could cause a disk to be incompletely zeroed when removed from a VM. If the same storage blocks happen to be later allocated to a new disk attached to another VM, potentially sensitive data could be revealed to privileged users of that VM.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
Reachable assertion in FIRFilter.cpp causing denial of service
CVE: CVE-2018-14045
Component: soundtouch
CWE: CWE-400
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2018-07-13T00:00:00+00:00

The FIRFilter::evaluateFilterMulti function in FIRFilter.cpp in libSoundTouch.a in Olli Parviainen SoundTouch 2.0 allows remote attackers to cause a denial of service (assertion failure and application exit), as demonstrated by SoundStretch.

Statement: This issue did not affect the versions of soundtouch as shipped with Red Hat Enterprise Linux 7 as they did not include the vulnerable code.

Remediation:
Credit card information leak in Autofill
CVE: CVE-2018-16078
Component: chromium-browser
Severity: Moderate
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2018-09-04T00:00:00+00:00

Unsafe handling of credit card details in Autofill in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.