Array index error in the MidiManagerUsb::DispatchSendMidiData function in media/midi/midi_manager_usb.cc in Google Chrome before 41.0.2272.76 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging renderer access to provide an invalid port index that triggers an out-of-bounds write operation, a different vulnerability than CVE-2015-1212.

The remote host is affected by the vulnerability described in GLSA-201503-12 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to cause a Denial of Service condition,       bypass security restrictions, or have other unspecified impact.
  Workaround :

    There is no known workaround at this time.

The version of Google Chrome installed on the remote Mac OS X host is prior to 41.0.2272.76. It is, therefore, affected by the following vulnerabilities :

  - A security feature bypass vulnerability, known as FREAK     (Factoring attack on RSA-EXPORT Keys), exists due to     the support of weak EXPORT_RSA cipher suites with keys     less than or equal to 512 bits. A man-in-the-middle     attacker may be able to downgrade the SSL/TLS connection     to use EXPORT_RSA cipher suites which can be factored in     a short amount of time, allowing the attacker to     intercept and decrypt the traffic. (CVE-2015-0204)

  - Multiple out-of-bounds write errors exist in skia     filters and media. (CVE-2015-1212, CVE-2015-1213,     CVE-2015-1214, CVE-2015-1215)

  - Multiple use-after-free errors exist in v8 bindings,     DOM, GIF decoder, web databases, and service workers,     which allow arbitrary code execution. (CVE-2015-1216,     CVE-2015-1218, CVE-2015-1220, CVE-2015-1221,     CVE-2015-1222, CVE-2015-1223)

  - Multiple type confusion errors exist in v8 bindings that     allow arbitrary code execution. (CVE-2015-1217,     CVE-2015-1230)

  - An integer overflow error exists in the WebGL that     allows arbitrary code execution. (CVE-2015-1219)

  - Multiple out-of-bounds read errors exist in vpxdecoder     and pdfium that allow unauthorized access to     information. (CVE-2015-1224, CVE-2015-1225)

  - A validation error exists in the debugger.
    (CVE-2015-1226)

  - Multiple uninitialized value errors exist in blink and     rendering. (CVE-2015-1227, CVE-2015-1228)

  - A cookie-injection vulnerability exists due to a failure     to properly handle a 407 HTTP status code accompanied by     a Set-Cookie header. (CVE-2015-1229)

  - Multiple, unspecified errors exist that allow remote     attackers to cause a denial of service condition.
    (CVE-2015-1231)

  - An out-of-bounds write flaw exists due to an array index     error in the DispatchSendMidiData() function that occurs     when handling a port index supplied by a renderer. A     remote attacker can exploit this to cause a denial of     service condition. (CVE-2015-1232)

  - A spoofing vulnerability exists due to improper     interaction between the '1993 search' features and     restore-from-disk RELOAD transitions when Instant     Extended mode is used. A remote attacker can exploit     this to spoof the address bar for a search-results page.
    (CVE-2015-2239)

The version of Google Chrome installed on the remote Windows host is prior to 41.0.2272.76. It is, therefore, affected by the following vulnerabilities :

  - Multiple out-of-bounds write errors exist in skia     filters and media. (CVE-2015-1212, CVE-2015-1213,     CVE-2015-1214, CVE-2015-1215)

  - Multiple use-after-free errors exist in v8 bindings,     DOM, GIF decoder, web databases, and service workers,     which allow arbitrary code execution. (CVE-2015-1216,     CVE-2015-1218, CVE-2015-1220, CVE-2015-1221,     CVE-2015-1222, CVE-2015-1223)

  - Multiple type confusion errors exist in v8 bindings that     allow arbitrary code execution. (CVE-2015-1217,     CVE-2015-1230)

  - An integer overflow error exists in the WebGL that     allows arbitrary code execution. (CVE-2015-1219)

  - Multiple out-of-bounds read errors exist in vpxdecoder     and pdfium that allow unauthorized access to     information. (CVE-2015-1224, CVE-2015-1225)

  - A validation error exists in the debugger.
    (CVE-2015-1226)

  - Multiple uninitialized value errors exist in blink and     rendering. (CVE-2015-1227, CVE-2015-1228)

  - A cookie-injection vulnerability exists due to a failure     to properly handle a 407 HTTP status code accompanied by     a Set-Cookie header. (CVE-2015-1229)

  - Multiple, unspecified errors exist that allow remote     attackers to cause a denial of service condition.
    (CVE-2015-1231)

  - An out-of-bounds write flaw exists due to an array index     error in the DispatchSendMidiData() function that occurs     when handling a port index supplied by a renderer. A     remote attacker can exploit this to cause a denial of     service condition. (CVE-2015-1232)

  - A spoofing vulnerability exists due to improper     interaction between the '1993 search' features and     restore-from-disk RELOAD transitions when Instant     Extended mode is used. A remote attacker can exploit     this to spoof the address bar for a search-results page.
    (CVE-2015-2239

ID	Name	Product	Family	Severity
82011	GLSA-201503-12 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
81648	Google Chrome < 41.0.2272.76 Multiple Vulnerabilities (Mac OS X) (FREAK)	Nessus	MacOS X Local Security Checks	high
81647	Google Chrome < 41.0.2272.76 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2015-1232

critical

Tenable Plugins

high

high

high