Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.3
CVE-2019-13762: Chromium on Debian could let local attacker fake downloaded files
CVE-2019-13762 · published 6 years ago
Summary
On Debian systems running Chromium versions before 79.0.3945.79, the browser does not properly enforce download policies. This weakness allows someone with access to the computer to make a downloaded file appear as something else, potentially leading to confusion or misuse. Update Chromium to the latest version to ensure proper download verification.
What to do
- Update debian chromium to version 79.0.3945.79-1.
- Update google chrome to version 79.0.3945.79 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | chromium |
< 79.0.3945.79-1 Fix: upgrade to 79.0.3945.79-1
|
| Debian:13 | debian | chromium |
< 79.0.3945.79-1 Fix: upgrade to 79.0.3945.79-1
|
| Debian:14 | debian | chromium |
< 79.0.3945.79-1 Fix: upgrade to 79.0.3945.79-1
|
| – | chrome |
< 79.0.3945.79 cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* |
|
| – | debian | debian_linux |
9.0 10.0 cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
| – | fedoraproject | fedora |
30 31 cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* |
| – | redhat | enterprise_linux_desktop |
6.0 cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:x64:* |
| – | redhat | enterprise_linux_for_scientific_computing |
6.0 cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:6.0:*:*:*:*:*:x64:* |
| – | redhat | enterprise_linux_server |
6.0 cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:x64:* |
| – | redhat | enterprise_linux_workstation |
6.0 cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:x64:* |
Original advisory text
Insufficient policy enforcement in downloads in Google Chrome on Windows prior to 79.0.3945.79 allowed a local attacker to spoof downloaded files via local code.
Insufficient policy enforcement in downloads in Google Chrome on Windows prior to 79.0.3945.79 allowed a local attacker to spoof downloaded files via local code.
References
- https://security-tracker.debian.org/tracker/CVE-2019-13762 Vendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html Mailing List Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00036.html Mailing List Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:4238 Third Party Advisory
- https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.... Vendor Advisory
- https://crbug.com/1004212 Permissions Required
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
- https://seclists.org/bugtraq/2020/Jan/27 Mailing List Third Party Advisory
- https://security.gentoo.org/glsa/202003-08 Third Party Advisory
- https://www.debian.org/security/2020/dsa-4606 Third Party Advisory
Severity
3.3
Low
Type
CWE-667Improper Locking
Timeline
Published10 Dec 2019
Updated26 Oct 2026
First seen21 Sep 2026
Track software like this
Free during beta