Use-after-free vulnerability in the VisibleSelection::nonBoundaryShadowTreeRootNode function in core/editing/VisibleSelection.cpp in the DOM implementation in Blink, as used in Google Chrome before 40.0.2214.111 on Windows, OS X, and Linux and before 40.0.2214.109 on Android, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers improper handling of a shadow-root anchor.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - WebKit: Improper handling of data types from event objects (CVE-2010-4205)

  - webkitgtk: heap-based buffer overflow (WSA-2015-0001) (CVE-2014-1303)

  - Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and     Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a     denial of service (application crash) via vectors involving HTML document subtrees. (CVE-2010-1761)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - webkitgtk: heap-based buffer overflow (WSA-2015-0001) (CVE-2014-1303)

  - webkitgtk: Processing web content may lead to arbitrary code execution (CVE-2023-40414)

  - Use-after-free vulnerability in Google Chrome before 28.0.1500.71 allows remote attackers to cause a     denial of service or possibly have unspecified other impact via vectors related to the handling of input.
    (CVE-2013-2871)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

chromium was updated to version 40.0.2214.111 to fix 31 vulnerabilities.

These security issues were fixed :

  - CVE-2015-1209: Use-after-free in DOM (bnc#916841).

  - CVE-2015-1210: Cross-origin-bypass in V8 bindings     (bnc#916843).

  - CVE-2015-1211: Privilege escalation using service     workers (bnc#916838).

  - CVE-2015-1212: Various fixes from internal audits,     fuzzing and other initiatives (bnc#916840).

  - CVE-2014-7923: Memory corruption in ICU (bnc#914468).

  - CVE-2014-7924: Use-after-free in IndexedDB (bnc#914468).

  - CVE-2014-7925: Use-after-free in WebAudio (bnc#914468).

  - CVE-2014-7926: Memory corruption in ICU (bnc#914468).

  - CVE-2014-7927: Memory corruption in V8 (bnc#914468).

  - CVE-2014-7928: Memory corruption in V8 (bnc#914468).

  - CVE-2014-7930: Use-after-free in DOM (bnc#914468).

  - CVE-2014-7931: Memory corruption in V8 (bnc#914468).

  - CVE-2014-7929: Use-after-free in DOM (bnc#914468).

  - CVE-2014-7932: Use-after-free in DOM (bnc#914468).

  - CVE-2014-7933: Use-after-free in FFmpeg (bnc#914468).

  - CVE-2014-7934: Use-after-free in DOM (bnc#914468).

  - CVE-2014-7935: Use-after-free in Speech (bnc#914468).

  - CVE-2014-7936: Use-after-free in Views (bnc#914468).

  - CVE-2014-7937: Use-after-free in FFmpeg (bnc#914468).

  - CVE-2014-7938: Memory corruption in Fonts (bnc#914468).

  - CVE-2014-7939: Same-origin-bypass in V8 (bnc#914468).

  - CVE-2014-7940: Uninitialized-value in ICU (bnc#914468).

  - CVE-2014-7941: Out-of-bounds read in UI (bnc#914468).

  - CVE-2014-7942: Uninitialized-value in Fonts     (bnc#914468).

  - CVE-2014-7943: Out-of-bounds read in Skia

  - CVE-2014-7944: Out-of-bounds read in PDFium

  - CVE-2014-7945: Out-of-bounds read in PDFium

  - CVE-2014-7946: Out-of-bounds read in Fonts

  - CVE-2014-7947: Out-of-bounds read in PDFium

  - CVE-2014-7948: Caching error in AppCache

  - CVE-2015-1205: Various fixes from internal audits,     fuzzing and other initiatives

These non-security issues were fixed :

  - Fix using 'echo' command in chromium-browser.sh script

The remote host is affected by the vulnerability described in GLSA-201502-13 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to cause a Denial of Service condition,       gain privileges via a filesystem: URI, or have other unspecified impact.
  Workaround :

    There is no known workaround at this time.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2495-1 advisory.

    A use-after-free bug was discovered in the DOM implementation in Blink. If a user were tricked in to     opening a specially crafted website, an attacker could potentially exploit this to cause a denial of     service via renderer crash or execute arbitrary code with the privileges of the sandboxed render process.
    (CVE-2015-1209)

    It was discovered that V8 did not properly consider frame access restrictions when throwing exceptions in     some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could     potentially exploit this to bypass same origin restrictions. (CVE-2015-1210)

    It was discovered that Chromium did not properly restrict the URI scheme during ServiceWorker     registration. If a user were tricked in to downloading and opening a specially crafted HTML file, an     attacker could potentially exploit this to bypass security restrictions. (CVE-2015-1211)

    Multiple security issues were discovered in Chromium. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial     of service via application crash or execute arbitrary code with the privileges of the user invoking the     program. (CVE-2015-1212)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2015:0163 advisory.

    Chromium is an open-source web browser, powered by WebKit (Blink).

    Several flaws were found in the processing of malformed web content. A web     page containing malicious content could cause Chromium to crash or,     potentially, execute arbitrary code with the privileges of the user running     Chromium. (CVE-2015-1209, CVE-2015-1210, CVE-2015-1211, CVE-2015-1212)

    All Chromium users should upgrade to these updated packages, which contain     Chromium version 40.0.2214.111, which corrects these issues. After     installing the update, Chromium must be restarted for the changes to take     effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Chrome Releases reports :

11 security fixes in this release, including :

- [447906] High CVE-2015-1209: Use-after-free in DOM. Credit to Maksymillian.

- [453979] High CVE-2015-1210: Cross-origin-bypass in V8 bindings.
Credit to anonymous.

- [453982] High CVE-2015-1211: Privilege escalation using service workers. Credit to anonymous.

- [455225] CVE-2015-1212: Various fixes from internal audits, fuzzing and other initiatives.

The version of Google Chrome installed on the remote Mac OS X host is prior to 40.0.2214.111. It is, therefore, affected by the following vulnerabilities :

  - Several use-after-free errors exist that allow arbitrary     code execution. (CVE-2015-0313, CVE-2015-0315,     CVE-2015-0320, CVE-2015-0322)

  - Several memory corruption errors exist that allow     arbitrary code execution. (CVE-2015-0314,     CVE-2015-0316, CVE-2015-0318, CVE-2015-0321,     CVE-2015-0329, CVE-2015-0330)

  - Several type confusion errors exist that allow     arbitrary code execution. (CVE-2015-0317, CVE-2015-0319)

  - Several heap-based buffer-overflow errors exist that     allow arbitrary code execution. (CVE-2015-0323,     CVE-2015-0327)

  - A buffer overflow error exists that allows arbitrary     code execution. (CVE-2015-0324)

  - Several null pointer dereference errors exist that have     unspecified impacts. (CVE-2015-0325, CVE-2015-0326,     CVE-2015-0328).

  - A user-after-free error exists within the processing of     invalid m3u8 playlists. A remote attacker, with a     specially crafted m3u8 playlist file, can force a     dangling pointer to be reused after it has been freed,     allowing the execution of arbitrary code.
    (CVE-2015-0331)

  - A use-after-free error exists related to the DOM     component. (CVE-2015-1209)

  - A cross-origin bypass error exists related to the V8     JavaScript engine bindings. (CVE-2015-1210)

  - A privilege escalation error exists related to service     workers. (CVE-2015-1211)

  - Various, unspecified errors exist. (CVE-2015-1212)

The version of Google Chrome installed on the remote Windows host is prior to 40.0.2214.111. It is, therefore, affected by the following vulnerabilities :

  - Several use-after-free errors exist that allow arbitrary     code execution. (CVE-2015-0313, CVE-2015-0315,     CVE-2015-0320, CVE-2015-0322)

  - Several memory corruption errors exist that allow     arbitrary code execution. (CVE-2015-0314,     CVE-2015-0316, CVE-2015-0318, CVE-2015-0321,     CVE-2015-0329, CVE-2015-0330)

  - Several type confusion errors exist that allow     arbitrary code execution. (CVE-2015-0317, CVE-2015-0319)

  - Several heap-based buffer-overflow errors exist that     allow arbitrary code execution. (CVE-2015-0323,     CVE-2015-0327)

  - A buffer overflow error exists that allows arbitrary     code execution. (CVE-2015-0324)

  - Several null pointer dereference errors exist that have     unspecified impacts. (CVE-2015-0325, CVE-2015-0326,     CVE-2015-0328).

  - A user-after-free error exists within the processing of     invalid m3u8 playlists. A remote attacker, with a     specially crafted m3u8 playlist file, can force a     dangling pointer to be reused after it has been freed,     allowing the execution of arbitrary code.
    (CVE-2015-0331)

  - A use-after-free error exists related to the DOM     component. (CVE-2015-1209)

  - A cross-origin bypass error exists related to the V8     JavaScript engine bindings. (CVE-2015-1210)

  - A privilege escalation error exists related to service     workers. (CVE-2015-1211)

  - Various, unspecified errors exist. (CVE-2015-1212)

ID	Name	Product	Family	Severity
199473	RHEL 6 : webkitgtk (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199451	RHEL 7 : webkitgtk (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
81692	openSUSE Security Update : chromium (openSUSE-2015-204)	Nessus	SuSE Local Security Checks	high
81396	GLSA-201502-13 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
81296	Ubuntu 14.04 LTS : Oxide vulnerabilities (USN-2495-1)	Nessus	Ubuntu Local Security Checks	high
81290	RHEL 6 : chromium-browser (RHSA-2015:0163)	Nessus	Red Hat Local Security Checks	high
81223	FreeBSD : chromium -- multiple vulnerabilities (a6eb239f-adbe-11e4-9fce-080027593b9a)	Nessus	FreeBSD Local Security Checks	high
81208	Google Chrome < 40.0.2214.111 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
81207	Google Chrome < 40.0.2214.111 Multiple Vulnerabilities	Nessus	Windows	critical

Detections

Analytics

CVE-2015-1209

high

Tenable Plugins

critical

critical

high

high

high

high

high

critical

critical