The OriginCanAccessServiceWorkers function in content/browser/service_worker/service_worker_dispatcher_host.cc in Google Chrome before 40.0.2214.111 on Windows, OS X, and Linux and before 40.0.2214.109 on Android does not properly restrict the URI scheme during a ServiceWorker registration, which allows remote attackers to gain privileges via a filesystem: URI.

chromium was updated to version 40.0.2214.111 to fix 31 vulnerabilities.

These security issues were fixed :

  - CVE-2015-1209: Use-after-free in DOM (bnc#916841).

  - CVE-2015-1210: Cross-origin-bypass in V8 bindings     (bnc#916843).

  - CVE-2015-1211: Privilege escalation using service     workers (bnc#916838).

  - CVE-2015-1212: Various fixes from internal audits,     fuzzing and other initiatives (bnc#916840).

  - CVE-2014-7923: Memory corruption in ICU (bnc#914468).

  - CVE-2014-7924: Use-after-free in IndexedDB (bnc#914468).

  - CVE-2014-7925: Use-after-free in WebAudio (bnc#914468).

  - CVE-2014-7926: Memory corruption in ICU (bnc#914468).

  - CVE-2014-7927: Memory corruption in V8 (bnc#914468).

  - CVE-2014-7928: Memory corruption in V8 (bnc#914468).

  - CVE-2014-7930: Use-after-free in DOM (bnc#914468).

  - CVE-2014-7931: Memory corruption in V8 (bnc#914468).

  - CVE-2014-7929: Use-after-free in DOM (bnc#914468).

  - CVE-2014-7932: Use-after-free in DOM (bnc#914468).

  - CVE-2014-7933: Use-after-free in FFmpeg (bnc#914468).

  - CVE-2014-7934: Use-after-free in DOM (bnc#914468).

  - CVE-2014-7935: Use-after-free in Speech (bnc#914468).

  - CVE-2014-7936: Use-after-free in Views (bnc#914468).

  - CVE-2014-7937: Use-after-free in FFmpeg (bnc#914468).

  - CVE-2014-7938: Memory corruption in Fonts (bnc#914468).

  - CVE-2014-7939: Same-origin-bypass in V8 (bnc#914468).

  - CVE-2014-7940: Uninitialized-value in ICU (bnc#914468).

  - CVE-2014-7941: Out-of-bounds read in UI (bnc#914468).

  - CVE-2014-7942: Uninitialized-value in Fonts     (bnc#914468).

  - CVE-2014-7943: Out-of-bounds read in Skia

  - CVE-2014-7944: Out-of-bounds read in PDFium

  - CVE-2014-7945: Out-of-bounds read in PDFium

  - CVE-2014-7946: Out-of-bounds read in Fonts

  - CVE-2014-7947: Out-of-bounds read in PDFium

  - CVE-2014-7948: Caching error in AppCache

  - CVE-2015-1205: Various fixes from internal audits,     fuzzing and other initiatives

These non-security issues were fixed :

  - Fix using 'echo' command in chromium-browser.sh script

The remote host is affected by the vulnerability described in GLSA-201502-13 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to cause a Denial of Service condition,       gain privileges via a filesystem: URI, or have other unspecified impact.
  Workaround :

    There is no known workaround at this time.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2495-1 advisory.

    A use-after-free bug was discovered in the DOM implementation in Blink. If a user were tricked in to     opening a specially crafted website, an attacker could potentially exploit this to cause a denial of     service via renderer crash or execute arbitrary code with the privileges of the sandboxed render process.
    (CVE-2015-1209)

    It was discovered that V8 did not properly consider frame access restrictions when throwing exceptions in     some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could     potentially exploit this to bypass same origin restrictions. (CVE-2015-1210)

    It was discovered that Chromium did not properly restrict the URI scheme during ServiceWorker     registration. If a user were tricked in to downloading and opening a specially crafted HTML file, an     attacker could potentially exploit this to bypass security restrictions. (CVE-2015-1211)

    Multiple security issues were discovered in Chromium. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial     of service via application crash or execute arbitrary code with the privileges of the user invoking the     program. (CVE-2015-1212)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2015:0163 advisory.

    Chromium is an open-source web browser, powered by WebKit (Blink).

    Several flaws were found in the processing of malformed web content. A web     page containing malicious content could cause Chromium to crash or,     potentially, execute arbitrary code with the privileges of the user running     Chromium. (CVE-2015-1209, CVE-2015-1210, CVE-2015-1211, CVE-2015-1212)

    All Chromium users should upgrade to these updated packages, which contain     Chromium version 40.0.2214.111, which corrects these issues. After     installing the update, Chromium must be restarted for the changes to take     effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Chrome Releases reports :

11 security fixes in this release, including :

- [447906] High CVE-2015-1209: Use-after-free in DOM. Credit to Maksymillian.

- [453979] High CVE-2015-1210: Cross-origin-bypass in V8 bindings.
Credit to anonymous.

- [453982] High CVE-2015-1211: Privilege escalation using service workers. Credit to anonymous.

- [455225] CVE-2015-1212: Various fixes from internal audits, fuzzing and other initiatives.

The version of Google Chrome installed on the remote Mac OS X host is prior to 40.0.2214.111. It is, therefore, affected by the following vulnerabilities :

  - Several use-after-free errors exist that allow arbitrary     code execution. (CVE-2015-0313, CVE-2015-0315,     CVE-2015-0320, CVE-2015-0322)

  - Several memory corruption errors exist that allow     arbitrary code execution. (CVE-2015-0314,     CVE-2015-0316, CVE-2015-0318, CVE-2015-0321,     CVE-2015-0329, CVE-2015-0330)

  - Several type confusion errors exist that allow     arbitrary code execution. (CVE-2015-0317, CVE-2015-0319)

  - Several heap-based buffer-overflow errors exist that     allow arbitrary code execution. (CVE-2015-0323,     CVE-2015-0327)

  - A buffer overflow error exists that allows arbitrary     code execution. (CVE-2015-0324)

  - Several null pointer dereference errors exist that have     unspecified impacts. (CVE-2015-0325, CVE-2015-0326,     CVE-2015-0328).

  - A user-after-free error exists within the processing of     invalid m3u8 playlists. A remote attacker, with a     specially crafted m3u8 playlist file, can force a     dangling pointer to be reused after it has been freed,     allowing the execution of arbitrary code.
    (CVE-2015-0331)

  - A use-after-free error exists related to the DOM     component. (CVE-2015-1209)

  - A cross-origin bypass error exists related to the V8     JavaScript engine bindings. (CVE-2015-1210)

  - A privilege escalation error exists related to service     workers. (CVE-2015-1211)

  - Various, unspecified errors exist. (CVE-2015-1212)

The version of Google Chrome installed on the remote Windows host is prior to 40.0.2214.111. It is, therefore, affected by the following vulnerabilities :

  - Several use-after-free errors exist that allow arbitrary     code execution. (CVE-2015-0313, CVE-2015-0315,     CVE-2015-0320, CVE-2015-0322)

  - Several memory corruption errors exist that allow     arbitrary code execution. (CVE-2015-0314,     CVE-2015-0316, CVE-2015-0318, CVE-2015-0321,     CVE-2015-0329, CVE-2015-0330)

  - Several type confusion errors exist that allow     arbitrary code execution. (CVE-2015-0317, CVE-2015-0319)

  - Several heap-based buffer-overflow errors exist that     allow arbitrary code execution. (CVE-2015-0323,     CVE-2015-0327)

  - A buffer overflow error exists that allows arbitrary     code execution. (CVE-2015-0324)

  - Several null pointer dereference errors exist that have     unspecified impacts. (CVE-2015-0325, CVE-2015-0326,     CVE-2015-0328).

  - A user-after-free error exists within the processing of     invalid m3u8 playlists. A remote attacker, with a     specially crafted m3u8 playlist file, can force a     dangling pointer to be reused after it has been freed,     allowing the execution of arbitrary code.
    (CVE-2015-0331)

  - A use-after-free error exists related to the DOM     component. (CVE-2015-1209)

  - A cross-origin bypass error exists related to the V8     JavaScript engine bindings. (CVE-2015-1210)

  - A privilege escalation error exists related to service     workers. (CVE-2015-1211)

  - Various, unspecified errors exist. (CVE-2015-1212)

ID	Name	Product	Family	Severity
81692	openSUSE Security Update : chromium (openSUSE-2015-204)	Nessus	SuSE Local Security Checks	high
81396	GLSA-201502-13 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
81296	Ubuntu 14.04 LTS : Oxide vulnerabilities (USN-2495-1)	Nessus	Ubuntu Local Security Checks	high
81290	RHEL 6 : chromium-browser (RHSA-2015:0163)	Nessus	Red Hat Local Security Checks	high
81223	FreeBSD : chromium -- multiple vulnerabilities (a6eb239f-adbe-11e4-9fce-080027593b9a)	Nessus	FreeBSD Local Security Checks	high
81208	Google Chrome < 40.0.2214.111 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
81207	Google Chrome < 40.0.2214.111 Multiple Vulnerabilities	Nessus	Windows	critical

Detections

Analytics

CVE-2015-1211

critical

Tenable Plugins

high

high

high

high

high

critical

critical