Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2019-5798: Chromium, Firefox ESR, Thunderbird can leak data via web page
CVE-2019-5798 · published 7 years ago
Summary
A flaw in the graphics library used by Chromium, Firefox ESR and Thunderbird on Debian may let a specially crafted web page read memory it shouldn't. This could expose sensitive information from the browser or email client. Update to the latest versions provided by Debian to protect against this risk.
What to do
- Update debian chromium to version 73.0.3683.75-1.
- Update debian firefox-esr to version 60.7.0esr-1.
- Update debian thunderbird to version 1:60.7.0-1.
- Update google chrome to version 73.0.3683.75 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | chromium |
< 73.0.3683.75-1 Fix: upgrade to 73.0.3683.75-1
|
| Debian:13 | debian | chromium |
< 73.0.3683.75-1 Fix: upgrade to 73.0.3683.75-1
|
| Debian:14 | debian | chromium |
< 73.0.3683.75-1 Fix: upgrade to 73.0.3683.75-1
|
| Debian:12 | debian | firefox-esr |
< 60.7.0esr-1 Fix: upgrade to 60.7.0esr-1
|
| Debian:13 | debian | firefox-esr |
< 60.7.0esr-1 Fix: upgrade to 60.7.0esr-1
|
| Debian:14 | debian | firefox-esr |
< 60.7.0esr-1 Fix: upgrade to 60.7.0esr-1
|
| Debian:12 | debian | thunderbird |
< 1:60.7.0-1 Fix: upgrade to 1:60.7.0-1
|
| Debian:13 | debian | thunderbird |
< 1:60.7.0-1 Fix: upgrade to 1:60.7.0-1
|
| Debian:14 | debian | thunderbird |
< 1:60.7.0-1 Fix: upgrade to 1:60.7.0-1
|
| – | chrome |
< 73.0.3683.75 cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* |
|
| – | debian | debian_linux |
8.0 9.0 cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* |
| – | suse | package_hub |
All versions
cpe:2.3:a:suse:package_hub:-:*:*:*:*:*:*:* |
| – | canonical | ubuntu_linux |
16.04 18.04 18.10 19.04 cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* |
| – | opensuse | backports |
sle-15 cpe:2.3:o:opensuse:backports:sle-15:*:*:*:*:*:*:* |
| – | opensuse | leap |
15.0 15.1 42.3 cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* |
| – | redhat | enterprise_linux |
6.0 7.0 8.0 cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* |
Original advisory text
Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
References
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00002.html
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00029.html
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00084.html
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00085.html
- https://access.redhat.com/errata/RHSA-2019:1308
- https://access.redhat.com/errata/RHSA-2019:1309
- https://access.redhat.com/errata/RHSA-2019:1310
- https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_...
- https://crbug.com/883596
- https://lists.debian.org/debian-lts-announce/2019/05/msg00038.html
- https://seclists.org/bugtraq/2019/May/67
- https://usn.ubuntu.com/3997-1/
- https://www.debian.org/security/2019/dsa-4451
- https://security-tracker.debian.org/tracker/CVE-2019-5798 Vendor Advisory
Severity
6.5
Medium
Type
CWE-125Out-of-bounds Read
Timeline
Published23 May 2019
Updated31 Oct 2026
First seen21 Sep 2026
Track software like this
Free during beta