Use-after-free vulnerability in the SVG implementation in Blink, as used in Google Chrome before 43.0.2357.65, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document that leverages improper handling of a shadow tree for a use element.

The remote host is affected by the vulnerability described in GLSA-201506-04 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker can cause arbitrary remote code execution, Denial of       Service or bypass of security mechanisms.
  Workaround :

    There is no known workaround at this time.

Chromium was updated to 43.0.2357.65 to fix security issues and bugs.

The following vulnerabilities were fixed :

  - CVE-2015-1251: Use-after-free in Speech (boo#931659)

  - CVE-2015-1252: Sandbox escape in Chrome (boo#931671)

  - CVE-2015-1253: Cross-origin bypass in DOM (boo#931670)

  - CVE-2015-1254: Cross-origin bypass in Editing     (boo#931669)

  - CVE-2015-1255: Use-after-free in WebAudio (boo#931674)

  - CVE-2015-1256: Use-after-free in SVG (boo#931664)

  - CVE-2015-1257: Container-overflow in SVG (boo#931665)

  - CVE-2015-1258: Negative-size parameter in Libvpx     (boo#931666)

  - CVE-2015-1259: Uninitialized value in PDFium     (boo#931667)

  - CVE-2015-1260: Use-after-free in WebRTC (boo#931668)

  - CVE-2015-1261: URL bar spoofing (boo#931673)

  - CVE-2015-1262: Uninitialized value in Blink (boo#931672)

  - CVE-2015-1263: Insecure download of spellcheck     dictionary (boo#931663)

  - CVE-2015-1264: Cross-site scripting in bookmarks     (boo#931661)

  - CVE-2015-1265: Various fixes from internal audits,     fuzzing and other initiatives (boo#931660)

  - Multiple vulnerabilities in V8 fixed at the tip of the     4.3 branch (currently 4.3.61.21)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2015:1023 advisory.

    Chromium is an open-source web browser, powered by WebKit (Blink).

    Several flaws were found in the processing of malformed web content. A web     page containing malicious content could cause Chromium to crash or,     potentially, execute arbitrary code with the privileges of the user running     Chromium. (CVE-2015-1251, CVE-2015-1252, CVE-2015-1253, CVE-2015-1254,     CVE-2015-1255, CVE-2015-1256, CVE-2015-1257, CVE-2015-1258, CVE-2015-1259,     CVE-2015-1260, CVE-2015-1261, CVE-2015-1262, CVE-2015-1263, CVE-2015-1264,     CVE-2015-1265)

    All Chromium users should upgrade to these updated packages, which contain     Chromium version 43.0.2357.65, which corrects these issues. After     installing the update, Chromium must be restarted for the changes to take     effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities were discovered in the chromium web browser.

  - CVE-2015-1251     SkyLined discovered a use-after-free issue in speech     recognition.

  - CVE-2015-1252     An out-of-bounds write issue was discovered that could     be used to escape from the sandbox.

  - CVE-2015-1253     A cross-origin bypass issue was discovered in the DOM     parser.

  - CVE-2015-1254     A cross-origin bypass issue was discovered in the DOM     editing feature.

  - CVE-2015-1255     Khalil Zhani discovered a use-after-free issue in     WebAudio.

  - CVE-2015-1256     Atte Kettunen discovered a use-after-free issue in the     SVG implementation.

  - CVE-2015-1257     miaubiz discovered an overflow issue in the SVG     implementation.

  - CVE-2015-1258     cloudfuzzer discovered an invalid size parameter used in     the libvpx library.

  - CVE-2015-1259     Atte Kettunen discovered an uninitialized memory issue     in the pdfium library.

  - CVE-2015-1260     Khalil Zhani discovered multiple use-after-free issues     in chromium's interface to the WebRTC library.

  - CVE-2015-1261     Juho Nurminen discovered a URL bar spoofing issue.

  - CVE-2015-1262     miaubiz discovered the use of an uninitialized class     member in font handling.

  - CVE-2015-1263     Mike Ruddy discovered that downloading the spellcheck     dictionary was not done over HTTPS.

  - CVE-2015-1264     K0r3Ph1L discovered a cross-site scripting issue that     could be triggered by bookmarking a site.

  - CVE-2015-1265     The chrome 43 development team found and fixed various     issues during internal auditing. Also multiple issues     were fixed in the libv8 library, version 4.3.61.21.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2610-1 advisory.

    Several security issues were discovered in the DOM implementation in Blink. If a user were tricked in to     opening a specially crafted website, an attacker could potentially exploit these to bypass Same Origin     Policy restrictions. (CVE-2015-1253, CVE-2015-1254)

    A use-after-free was discovered in the WebAudio implementation in Chromium. If a user were tricked in to     opening a specially crafted website, an attacker could potentially exploit this to cause a denial of     service via renderer crash, or execute arbitrary code with the privileges of the sandboxed render process.
    (CVE-2015-1255)

    A use-after-free was discovered in the SVG implementation in Blink. If a user were tricked in to opening a     specially crafted website, an attacker could potentially exploit this to cause a denial of service via     renderer crash, or execute arbitrary code with the privileges of the sandboxed render process.
    (CVE-2015-1256)

    A security issue was discovered in the SVG implementation in Blink. If a user were tricked in to opening a     specially crafted website, an attacker could potentially exploit this to cause a denial of service via     renderer crash. (CVE-2015-1257)

    An issue was discovered with the build of libvpx. If a user were tricked in to opening a specially crafted     website, an attacker could potentially exploit this to cause a denial of service via renderer crash, or     execute arbitrary code with the privileges of the sandboxed render process. (CVE-2015-1258)

    Multiple use-after-free issues were discovered in the WebRTC implementation in Chromium. If a user were     tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a     denial of service via renderer crash, or execute arbitrary code with the privileges of the sandboxed     render process. (CVE-2015-1260)

    An uninitialized value bug was discovered in the font shaping code in Blink. If a user were tricked in to     opening a specially crafted website, an attacker could potentially exploit this to cause a denial of     service via renderer crash. (CVE-2015-1262)

    Multiple security issues were discovered in Chromium. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial     of service via application crash or execute arbitrary code with the privileges of the user invoking the     program. (CVE-2015-1265)

    Multiple security issues were discovered in V8. If a user were tricked in to opening a specially crafted     website, an attacker could potentially exploit these to read uninitialized memory, cause a denial of     service via renderer crash or execute arbitrary code with the privileges of the sandboxed render process.
    (CVE-2015-3910)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Mac OS X host is prior to 43.0.2357.65. It is, therefore, affected by multiple vulnerabilities :

  - A Use-after-free memory error exists in the     SpeechRecognitionClient implementation that allows     remote attackers, using a crafted document, to execute     arbitrary code. (CVE-2015-1251)

  - The Write() and DoWrite() methods of the class     PartialCircularBuffer do not properly handle wraps.
    A remote attacker, by using write operations with a     large amount of data, can exploit this to bypass the     sandbox protection or cause a denial of service.
    (CVE-2015-1252)

  - The DOM implementation in Blink does not properly     handle SCRIPT elements during adjustment of DOM node     locations. A remote attacker, using crafted JavaScript     code that appends a child to a SCRIPT element, can     exploit this flaw to bypass the same origin policy.
    (CVE-2015-1253)

  - The 'core/dom/Document.cpp' in Blink enables the     inheritance of the 'designMode' attribute. A remote     attacker, using a crafted web page, can utilize this to     bypass the same origin policy via the availability of     editing. (CVE-2015-1254)

  - A use-after-free memory error exists in the WebAudio     implementation when handling the stop action for an     audio track. A remote attacker can exploit this to     cause a denial of service or possibly execute     arbitrary code. (CVE-2015-1255)

  - A use-after-free memory error exists in the SVG     implementation in Blink, related to the improper     handling of a shadow tree for a use element. A remote     attacker, using a crafted document, can exploit this     to cause a denial of service or possibly execute     arbitrary code. (CVE-2015-1256)

  - The SVG implementation in Blink does not properly handle     an insufficient number of values in an feColorMatrix     filter. A remote attacker, using a crafted document, can     exploit this to cause a denial of service via a     container overflow. (CVE-2015-1257)

  - The libvpx library code was not compiled with an     appropriate '--size-limit' value. This allows a remote     attacker, using a crafted frame size in VP9 video data,     to trigger a negative value for a size field, thus     causing a denial of service or possibly having other     impact. (CVE-2015-1258)

  - Google PDFium does not properly initialize memory. A     remote attacker can exploit this to cause a denial of     service or possibly have other unspecified impact.
    (CVE-2015-1259)

  - Multiple use-after-free memory errors exist the WebRTC     implementation. A remote attacker can exploit these, by     using a crafted JavaScript code that executes upon     completion of a getUserMedia request, to cause a denial     of service or possibly have other unspecified impact.
    (CVE-2015-1260)

  - The file 'HarfBuzzShaper.cpp' in Blink does not properly     initialize a certain width field. A remote attacker,     using crafted Unicode text, can exploit this to cause a     denial of service or have other unspecified impact.
    (CVE-2015-1262)

  - The Spellcheck API implementation does not use an HTTPS     session for downloading a Hunspell dictionary. A     man-in-the-middle attacker, using a crafted file, can     exploit this flaw to deliver incorrect spelling     suggestions or possibly have other unspecified impact.
    (CVE-2015-1263)

  - A cross-site scripting (XSS) vulnerability exists that     is related to the Bookmarks feature. A remote attacker,     using crafted data, can exploit this to inject arbitrary     web script or HTML. (CVE-2015-1264)

  - Multiple unspecified vulnerabilities exist that allow an     attacker to cause a denial of service or possibly have     other impact via unknown vectors. (CVE-2015-1265)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 43.0.2357.65. It is, therefore, affected by multiple vulnerabilities :

  - A Use-after-free memory error exists in the     SpeechRecognitionClient implementation that allows     remote attackers, using a crafted document, to execute     arbitrary code. (CVE-2015-1251)

  - The Write() and DoWrite() methods of the class     PartialCircularBuffer do not properly handle wraps.
    A remote attacker, by using write operations with a     large amount of data, can exploit this to bypass the     sandbox protection or cause a denial of service.
    (CVE-2015-1252)

  - The DOM implementation in Blink does not properly     handle SCRIPT elements during adjustment of DOM node     locations. A remote attacker, using crafted JavaScript     code that appends a child to a SCRIPT element, can     exploit this flaw to bypass the same origin policy.
    (CVE-2015-1253)

  - The 'core/dom/Document.cpp' in Blink enables the     inheritance of the 'designMode' attribute. A remote     attacker, using a crafted web page, can utilize this to     bypass the same origin policy via the availability of     editing. (CVE-2015-1254)

  - A use-after-free memory error exists in the WebAudio     implementation when handling the stop action for an     audio track. A remote attacker can exploit this to     cause a denial of service or possibly execute     arbitrary code. (CVE-2015-1255)

  - A use-after-free memory error exists in the SVG     implementation in Blink, related to the improper     handling of a shadow tree for a use element. A remote     attacker, using a crafted document, can exploit this     to cause a denial of service or possibly execute     arbitrary code. (CVE-2015-1256)

  - The SVG implementation in Blink does not properly handle     an insufficient number of values in an feColorMatrix     filter. A remote attacker, using a crafted document, can     exploit this to cause a denial of service via a     container overflow. (CVE-2015-1257)

  - The libvpx library code was not compiled with an     appropriate '--size-limit' value. This allows a remote     attacker, using a crafted frame size in VP9 video data,     to trigger a negative value for a size field, thus     causing a denial of service or possibly having other     impact. (CVE-2015-1258)

  - Google PDFium does not properly initialize memory. A     remote attacker can exploit this to cause a denial of     service or possibly have other unspecified impact.
    (CVE-2015-1259)

  - Multiple use-after-free memory errors exist the WebRTC     implementation. A remote attacker can exploit these, by     using a crafted JavaScript code that executes upon     completion of a getUserMedia request, to cause a denial     of service or possibly have other unspecified impact.
    (CVE-2015-1260)

  - The file 'HarfBuzzShaper.cpp' in Blink does not properly     initialize a certain width field. A remote attacker,     using crafted Unicode text, can exploit this to cause a     denial of service or have other unspecified impact.
    (CVE-2015-1262)

  - The Spellcheck API implementation does not use an HTTPS     session for downloading a Hunspell dictionary. A     man-in-the-middle attacker, using a crafted file, can     exploit this flaw to deliver incorrect spelling     suggestions or possibly have other unspecified impact.
    (CVE-2015-1263)

  - A cross-site scripting (XSS) vulnerability exists that     is related to the Bookmarks feature. A remote attacker,     using crafted data, can exploit this to inject arbitrary     web script or HTML. (CVE-2015-1264)

  - Multiple unspecified vulnerabilities exist that allow an     attacker to cause a denial of service or possibly have     other impact via unknown vectors. (CVE-2015-1265)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Google Chrome Releases reports :

37 security fixes in this release, including :

- [474029] High CVE-2015-1252: Sandbox escape in Chrome. Credit to anonymous.

- [464552] High CVE-2015-1253: Cross-origin bypass in DOM. Credit to anonymous.

- [444927] High CVE-2015-1254: Cross-origin bypass in Editing. Credit to armin@rawsec.net.

- [473253] High CVE-2015-1255: Use-after-free in WebAudio. Credit to Khalil Zhani.

- [478549] High CVE-2015-1256: Use-after-free in SVG. Credit to Atte Kettunen of OUSPG.

- [481015] High CVE-2015-1251: Use-after-free in Speech. Credit to SkyLined working with HP's Zero Day Initiative.

- [468519] Medium CVE-2015-1257: Container-overflow in SVG. Credit to miaubiz.

- [450939] Medium CVE-2015-1258: Negative-size parameter in libvpx.
Credit to cloudfuzzer

- [468167] Medium CVE-2015-1259: Uninitialized value in PDFium. Credit to Atte Kettunen of OUSPG

- [474370] Medium CVE-2015-1260: Use-after-free in WebRTC. Credit to Khalil Zhani.

- [466351] Medium CVE-2015-1261: URL bar spoofing. Credit to Juho Nurminen.

- [476647] Medium CVE-2015-1262: Uninitialized value in Blink. Credit to miaubiz.

- [479162] Low CVE-2015-1263: Insecure download of spellcheck dictionary. Credit to Mike Ruddy.

- [481015] Low CVE-2015-1264: Cross-site scripting in bookmarks.
Credit to K0r3Ph1L.

- [489518] CVE-2015-1265: Various fixes from internal audits, fuzzing and other initiatives.

- Multiple vulnerabilities in V8 fixed at the tip of the 4.3 branch (currently 4.3.61.21).

ID	Name	Product	Family	Severity
84332	GLSA-201506-04 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
83915	openSUSE Security Update : Chromium (openSUSE-2015-390)	Nessus	SuSE Local Security Checks	high
83808	RHEL 6 : chromium-browser (RHSA-2015:1023)	Nessus	Red Hat Local Security Checks	medium
83784	Debian DSA-3267-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	high
83778	Ubuntu 14.04 LTS : Oxide vulnerabilities (USN-2610-1)	Nessus	Ubuntu Local Security Checks	high
83746	Google Chrome < 43.0.2357.65 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
83745	Google Chrome < 43.0.2357.65 Multiple Vulnerabilities	Nessus	Windows	high
83556	FreeBSD : chromium -- multiple vulnerabilities (a9d456b4-fe4c-11e4-ad15-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2015-1256

high

Tenable Plugins

high

high

medium

high

high

high

high

high