Use-after-free vulnerability in the RenderFrameImpl::OnMessageReceived function in content/renderer/render_frame_impl.cc in Google Chrome before 42.0.2311.90 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger renderer IPC messages during a detach operation.

The remote host is affected by the vulnerability described in GLSA-201506-04 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker can cause arbitrary remote code execution, Denial of       Service or bypass of security mechanisms.
  Workaround :

    There is no known workaround at this time.

Several vulnerabilities were discovered in the chromium web browser.

  - CVE-2015-1235     A Same Origin Policy bypass issue was discovered in the     HTML parser.

  - CVE-2015-1236     Amitay Dobo discovered a Same Origin Policy bypass in     the Web Audio API.

  - CVE-2015-1237     Khalil Zhani discovered a use-after-free issue in IPC.

  - CVE-2015-1238     'cloudfuzzer' discovered an out-of-bounds write in the     skia library.

  - CVE-2015-1240     'w3bd3vil' discovered an out-of-bounds read in the WebGL     implementation.

  - CVE-2015-1241     Phillip Moon and Matt Weston discovered a way to trigger     local user interface actions remotely via a crafted     website.

  - CVE-2015-1242     A type confusion issue was discovered in the v8     JavaScript library.

  - CVE-2015-1244     Mike Ruddy discovered a way to bypass the HTTP Strict     Transport Security policy.

  - CVE-2015-1245     Khalil Zhani discovered a use-after-free issue in the     pdfium library.

  - CVE-2015-1246     Atte Kettunen discovered an out-of-bounds read issue in     webkit/blink.

  - CVE-2015-1247     Jann Horn discovered that 'file:' URLs in OpenSearch     documents were not sanitized, which could allow local     files to be read remotely when using the OpenSearch     feature from a crafted website.

  - CVE-2015-1248     Vittorio Gambaletta discovered a way to bypass the     SafeBrowsing feature, which could allow the remote     execution of a downloaded executable file.

  - CVE-2015-1249     The chrome 41 development team found various issues from     internal fuzzing, audits, and other studies.

  - CVE-2015-3333     Multiple issues were discovered and fixed in v8     4.2.7.14.

  - CVE-2015-3334     It was discovered that remote websites could capture     video data from attached web cameras without permission.

  - CVE-2015-3336     It was discovered that remote websites could cause user     interface disruptions like window fullscreening and     mouse pointer locking.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2570-1 advisory.

    An issue was discovered in the HTML parser in Blink. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit this to bypass same-origin restrictions.
    (CVE-2015-1235)

    An issue was discovered in the Web Audio API implementation in Blink. If a user were tricked in to opening     a specially crafted website, an attacker could potentially exploit this to bypass same-origin     restrictions. (CVE-2015-1236)

    A use-after-free was discovered in Chromium. If a user were tricked in to opening a specially crafted     website, an attacker could potentially exploit this to cause a denial of service via renderer crash, or     execute arbitrary code with the privileges of the sandboxed render process. (CVE-2015-1237)

    An out-of-bounds write was discovered in Skia. If a user were tricked in to opening a specially crafted     website, an attacker could potentially exploit this to cause a denial of service via application crash or     execute arbitrary code with the privileges of the user invoking the program. (CVE-2015-1238)

    An out-of-bounds read was discovered in the WebGL implementation. If a user were tricked in to opening a     specially crafted website, an attacker could potentially exploit this to cause a denial of service via     renderer crash. (CVE-2015-1240)

    An issue was discovered with the interaction of page navigation and touch event handling. If a user were     tricked in to opening a specially crafted website, an attacker could potentially exploit this to conduct     tap jacking attacks. (CVE-2015-1241)

    A type confusion bug was discovered in V8. If a user were tricked in to opening a specially crafted     website, an attacker could potentially exploit this to cause a denial of service via renderer crash, or     execute arbitrary code with the privileges of the sandboxed render process. (CVE-2015-1242)

    It was discovered that websocket connections were not upgraded whenever a HSTS policy is active. A remote     attacker could potentially exploit this to conduct a machine-in-the-middle (MITM) attack. (CVE-2015-1244)

    An out-of-bounds read was discovered in Blink. If a user were tricked in to opening a specially crafted     website, an attacker could potentially exploit this to cause a denial of service via renderer crash.
    (CVE-2015-1246)

    Multiple security issues were discovered in Chromium. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial     of service via application crash or execute arbitrary code with the privileges of the user invoking the     program. (CVE-2015-1249)

    A use-after-free was discovered in the file picker implementation. If a user were tricked in to opening a     specially crafted website, an attacker could potentially exploit this to cause a denial of service via     application crash or execute arbitrary code with the privileges of the user invoking the program.
    (CVE-2015-1321)

    Multiple security issues were discovered in V8. If a user were tricked in to opening a specially crafted     website, an attacker could potentially exploit these to read uninitialized memory, cause a denial of     service via renderer crash or execute arbitrary code with the privileges of the sandboxed render process.
    (CVE-2015-3333)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Google Chrome Releases reports :

45 new security fixes, including :

- [456518] High CVE-2015-1235: Cross-origin-bypass in HTML parser.
Credit to anonymous.

- [313939] Medium CVE-2015-1236: Cross-origin-bypass in Blink. Credit to Amitay Dobo.

- [461191] High CVE-2015-1237: Use-after-free in IPC. Credit to Khalil Zhani.

- [445808] High CVE-2015-1238: Out-of-bounds write in Skia. Credit to cloudfuzzer.

- [463599] Medium CVE-2015-1240: Out-of-bounds read in WebGL. Credit to w3bd3vil.

- [418402] Medium CVE-2015-1241: Tap-Jacking. Credit to Phillip Moon and Matt Weston of Sandfield Information Systems.

- [460917] High CVE-2015-1242: Type confusion in V8. Credit to fcole@onshape.com.

- [455215] Medium CVE-2015-1244: HSTS bypass in WebSockets. Credit to Mike Ruddy.

- [444957] Medium CVE-2015-1245: Use-after-free in PDFium. Credit to Khalil Zhani.

- [437399] Medium CVE-2015-1246: Out-of-bounds read in Blink. Credit to Atte Kettunen of OUSPG.

- [429838] Medium CVE-2015-1247: Scheme issues in OpenSearch. Credit to Jann Horn.

- [380663] Medium CVE-2015-1248: SafeBrowsing bypass. Credit to Vittorio Gambaletta (VittGam).

- [476786] CVE-2015-1249: Various fixes from internal audits, fuzzing and other initiatives. Multiple vulnerabilities in V8 fixed at the tip of the 4.2 branch (currently 4.2.77.14).

Chromium was updated to latest stable release 42.0.2311.90 to fix security issues and bugs. The following vulnerabilities were fixed :

  - CVE-2015-1235: Cross-origin-bypass in HTML parser.

  - CVE-2015-1236: Cross-origin-bypass in Blink.

  - CVE-2015-1237: Use-after-free in IPC.

  - CVE-2015-1238: Out-of-bounds write in Skia.

  - CVE-2015-1240: Out-of-bounds read in WebGL.

  - CVE-2015-1241: Tap-Jacking.

  - CVE-2015-1242: Type confusion in V8.

  - CVE-2015-1244: HSTS bypass in WebSockets.

  - CVE-2015-1245: Use-after-free in PDFium.

  - CVE-2015-1246: Out-of-bounds read in Blink.

  - CVE-2015-1247: Scheme issues in OpenSearch.

  - CVE-2015-1248: SafeBrowsing bypass.

  - CVE-2015-1249: Various fixes from internal audits,     fuzzing and other initiatives.

  - CVE-2015-3333: Multiple vulnerabilities in V8 fixed at     the tip of the 4.2 branch (currently 4.2.77.14).

  - CVE-2015-3336: fullscreen and UI locking without user     confirmeation

  - CVE-2015-3335: unspecified impact of crafed programs     running in NaCl sandbox 

  - CVE-2015-3334: 'Media: Allowed by you' sometimes not     shown in a permissions table

New functionality added :

  - A number of new apps, extension and Web Platform APIs     (including the Push API!)

  - Lots of under the hood changes for stability and     performance

Updated chromium-browser packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Chromium is an open source web browser, powered by WebKit (Blink).

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash or, potentially, execute arbitrary code with the privileges of the user running Chromium.(CVE-2015-1235, CVE-2015-1236, CVE-2015-1237, CVE-2015-1238, CVE-2015-1240, CVE-2015-1241, CVE-2015-1242, CVE-2015-1244, CVE-2015-1245, CVE-2015-1246, CVE-2015-1247, CVE-2015-1248, CVE-2015-1249)

All Chromium users should upgrade to these updated packages, which contain Chromium version 42.0.2311.90, which corrects these issues.
After installing the update, Chromium must be restarted for the changes to take effect.

The version of Google Chrome installed on the remote Mac OS X host is prior to 42.0.2311.90. It is, therefore, affected by multiple vulnerabilities :

  - A cross-origin bypass vulnerability exists due to an     unspecified flaw in the HTML parser. (CVE-2015-1235)

  - A cross-origin bypass vulnerability exists due to a flaw     in MediaElementAudioSourceNode.cpp when handling audio     content. (CVE-2015-1236)

  - A use-after-free error exists in render_frame_impl.cc     due to improper handling of a frame when it receives     messages while detaching. An attacker can exploit this     flaw to dereference already freed memory and execute     arbitrary code. (CVE-2015-1237)

  - An unspecified out-of-bounds write flaw exists in the     Skia filters. (CVE-2015-1238)

  - An out-of-bounds read flaw exists in WebGL due to     improper handling of ES3 commands. An attacker can     exploit this flaw to disclose memory contents.
    (CVE-2015-1240)

  - An unspecified tap-jacking flaw exists when certain tap     events aren't preceded by TapDown events. An attacker     can exploit this to direct taps to cross-pages and     cross-domains. (CVE-2015-1241)

  - A type confusion error exists in the     ReduceTransitionElementsKind() function in     hydrogen-check-elimination.cc. An attacker can exploit     this error to execute arbitrary code. (CVE-2015-1242)

  - A flaw exists related to WebSocket connections due to     HTTP Strict Transport Security (HSTS) not being strictly     enforced. A man-in-the-middle attacker can exploit this     flaw to view and manipulate protected communication.
    (CVE-2015-1244)

  - A use-after-free error exists in     open_pdf_in_reader_view.cc due to improper handling     handling the 'Open PDF in Reader' bubble on navigations.
    An attacker can exploit this flaw to dereference already     freed memory and execute arbitrary code. (CVE-2015-1245)

  - An unspecified out-of-bounds read flaw exists in Blink.
    An attacker can exploit this to disclose memory     contents. (CVE-2015-1246)

  - A flaw exists in the OnPageHasOSDD() function in     search_engine_tab_helper.cc due to improper handling     of URLs for the OpenSearch descriptor. An attacker can     exploit this flaw to disclose sensitive information.
    (CVE-2015-1247)

  - An unspecified flaw exists that allows an attacker to     bypass SafeBrowsing. (CVE-2015-1248)

  - Multiple unspecified vulnerabilities exist that allow an     attacker to have an unspecified impact. (CVE-2015-1249)

  - Multiple unspecified vulnerabilities exist in V8 that     allow an attacker to cause a denial of service and     other unspecified impacts.
    (CVE-2015-3333)

  - A media permission handling weakness exists due to     camera and microphone permissions being merged into a     single 'Media' permission. An attacker can exploit this,     via a specially crafted website, to turn on a victim's     camera while the victim believes camera access is     prohibited. (CVE-2015-3334)

  - A flaw exists due to missing address space usage     limitation (RLIMIT_AS and RLIMIT_DATA) in the Native     Client (NaCl) process. This allows a remote attacker to     run a crafted program in the NaCl sandbox and to conduct     row-hammer attacks. (CVE-2015-3335)     Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 42.0.2311.90. It is, therefore, affected by multiple vulnerabilities :

  - A cross-origin bypass vulnerability exists due to an     unspecified flaw in the HTML parser. (CVE-2015-1235)

  - A cross-origin bypass vulnerability exists due to a flaw     in MediaElementAudioSourceNode.cpp when handling audio     content. (CVE-2015-1236)

  - A use-after-free error exists in render_frame_impl.cc     due to improper handling of a frame when it receives     messages while detaching. An attacker can exploit this     flaw to dereference already freed memory and execute     arbitrary code. (CVE-2015-1237)

  - An unspecified out-of-bounds write flaw exists in the     Skia filters. (CVE-2015-1238)

  - An out-of-bounds read flaw exists in WebGL due to     improper handling of ES3 commands. An attacker can     exploit this flaw to disclose memory contents.
    (CVE-2015-1240)

  - An unspecified tap-jacking flaw exists when certain tap     events aren't preceded by TapDown events. An attacker     can exploit this to direct taps to cross-pages and     cross-domains. (CVE-2015-1241)

  - A type confusion error exists in the     ReduceTransitionElementsKind() function in     hydrogen-check-elimination.cc. An attacker can exploit     this error to execute arbitrary code. (CVE-2015-1242)

  - A flaw exists related to WebSocket connections due to     HTTP Strict Transport Security (HSTS) not being strictly     enforced. A man-in-the-middle attacker can exploit this     flaw to view and manipulate protected communication.
    (CVE-2015-1244)

  - A use-after-free error exists in     open_pdf_in_reader_view.cc due to improper handling     handling the 'Open PDF in Reader' bubble on navigations.
    An attacker can exploit this flaw to dereference already     freed memory and execute arbitrary code. (CVE-2015-1245)

  - An unspecified out-of-bounds read flaw exists in Blink.
    An attacker can exploit this to disclose memory     contents. (CVE-2015-1246)

  - A flaw exists in the OnPageHasOSDD() function in     search_engine_tab_helper.cc due to improper handling     of URLs for the OpenSearch descriptor. An attacker can     exploit this flaw to disclose sensitive information.
    (CVE-2015-1247)

  - An unspecified flaw exists that allows an attacker to     bypass SafeBrowsing. (CVE-2015-1248)

  - Multiple unspecified vulnerabilities exist that allow an     attacker to have an unspecified impact. (CVE-2015-1249)

  - Multiple unspecified vulnerabilities exist in V8 that     allow an attacker to cause a denial of service and     other unspecified impacts.
    (CVE-2015-3333)

  - A media permission handling weakness exists due to     camera and microphone permissions being merged into a     single 'Media' permission. An attacker can exploit this,     via a specially crafted website, to turn on a victim's     camera while the victim believes camera access is     prohibited. (CVE-2015-3334)

  - A flaw exists due to missing address space usage     limitation (RLIMIT_AS and RLIMIT_DATA) in the Native     Client (NaCl) process. This allows a remote attacker to     run a crafted program in the NaCl sandbox and to conduct     row-hammer attacks. (CVE-2015-3335)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
84332	GLSA-201506-04 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
83120	Debian DSA-3238-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	high
83109	Ubuntu 14.04 LTS : Oxide vulnerabilities (USN-2570-1)	Nessus	Ubuntu Local Security Checks	high
83095	FreeBSD : chromium -- multiple vulnerabilities (b57f690e-ecc9-11e4-876c-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	high
83025	openSUSE Security Update : Chromium (openSUSE-2015-320)	Nessus	SuSE Local Security Checks	high
82846	RHEL 6 : chromium-browser (RHSA-2015:0816)	Nessus	Red Hat Local Security Checks	high
82826	Google Chrome < 42.0.2311.90 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
82825	Google Chrome < 42.0.2311.90 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2015-1237

high

Tenable Plugins

high

high

high

high

high

high

high

high