Race condition in gpu/command_buffer/service/gles2_cmd_decoder.cc in Google Chrome before 41.0.2272.118 allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact by manipulating OpenGL ES commands.

The remote host is affected by the vulnerability described in GLSA-201506-04 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker can cause arbitrary remote code execution, Denial of       Service or bypass of security mechanisms.
  Workaround :

    There is no known workaround at this time.

Chromium was updated to 41.0.2272.118 to fix two security issues.

The following vulnerabilities were fixed :

  - A combination of V8, Gamepad and IPC bugs could lead to     remote code execution outside of the sandbox     (CVE-2015-1233, boo#925713)

  - Buffer overflow via race condition in GPU     (CVE-2015-1234, boo#925714)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2556-1 advisory.

    It was discovered that Chromium did not properly handle the interaction of IPC, the gamepad API and V8. If     a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this     to execute arbitrary code with the privileges of the user invoking the program. (CVE-2015-1233)

    A buffer overflow was discovered in the GPU service. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit this to cause a denial of service via application     crash. (CVE-2015-1234)

    It was discovered that Oxide did not correctly manage the lifetime of BrowserContext, resulting in a     potential use-after-free in some circumstances. If a user were tricked in to opening a specially crafted     website, an attacker could potentially exploit this to cause a denial of service via application crash or     execute arbitrary code with the privileges of the user invoking the program. (CVE-2015-1317)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated chromium-browser packages that fix two security issues are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Chromium is an open source web browser, powered by WebKit (Blink).

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash or, potentially, execute arbitrary code with the privileges of the user running Chromium. (CVE-2015-1233, CVE-2015-1234)

All Chromium users should upgrade to these updated packages, which contain Chromium version 41.0.2272.118, which corrects these issues.
After installing the update, Chromium must be restarted for the changes to take effect.

The version of Google Chrome installed on the remote Mac OS X host is prior to 41.0.2272.118. It is, therefore, affected by the following vulnerabilities :

  - A remote code execution vulnerability exists due to bugs     in the V8, Gamepad, and IPC components. (CVE-2015-1233)

  - A buffer overflow vulnerability exists due to a race     condition in the GPU component. (CVE-2015-1234)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 41.0.2272.118. It is, therefore, affected by the following vulnerabilities :

  - A remote code execution vulnerability exists due to bugs     in the V8, Gamepad, and IPC components. (CVE-2015-1233)

  - A buffer overflow vulnerability exists due to a race     condition in the GPU component. (CVE-2015-1234)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
84332	GLSA-201506-04 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
82655	openSUSE Security Update : Chromium (openSUSE-2015-298)	Nessus	SuSE Local Security Checks	high
82642	Ubuntu 14.04 LTS : Oxide vulnerabilities (USN-2556-1)	Nessus	Ubuntu Local Security Checks	critical
82619	RHEL 6 : chromium-browser (RHSA-2015:0778)	Nessus	Red Hat Local Security Checks	high
82535	Google Chrome < 41.0.2272.118 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
82534	Google Chrome < 41.0.2272.118 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2015-1234

high

Tenable Plugins

high

high

critical

high

high

high