android/java/src/org/chromium/chrome/browser/WebsiteSettingsPopup.java in Google Chrome before 43.0.2357.65 on Android does not properly restrict use of a URL's fragment identifier during construction of a page-info popup, which allows remote attackers to spoof the URL bar or deliver misleading popup content via crafted text.

Chromium was updated to 43.0.2357.65 to fix security issues and bugs.

The following vulnerabilities were fixed :

  - CVE-2015-1251: Use-after-free in Speech (boo#931659)

  - CVE-2015-1252: Sandbox escape in Chrome (boo#931671)

  - CVE-2015-1253: Cross-origin bypass in DOM (boo#931670)

  - CVE-2015-1254: Cross-origin bypass in Editing     (boo#931669)

  - CVE-2015-1255: Use-after-free in WebAudio (boo#931674)

  - CVE-2015-1256: Use-after-free in SVG (boo#931664)

  - CVE-2015-1257: Container-overflow in SVG (boo#931665)

  - CVE-2015-1258: Negative-size parameter in Libvpx     (boo#931666)

  - CVE-2015-1259: Uninitialized value in PDFium     (boo#931667)

  - CVE-2015-1260: Use-after-free in WebRTC (boo#931668)

  - CVE-2015-1261: URL bar spoofing (boo#931673)

  - CVE-2015-1262: Uninitialized value in Blink (boo#931672)

  - CVE-2015-1263: Insecure download of spellcheck     dictionary (boo#931663)

  - CVE-2015-1264: Cross-site scripting in bookmarks     (boo#931661)

  - CVE-2015-1265: Various fixes from internal audits,     fuzzing and other initiatives (boo#931660)

  - Multiple vulnerabilities in V8 fixed at the tip of the     4.3 branch (currently 4.3.61.21)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2015:1023 advisory.

    Chromium is an open-source web browser, powered by WebKit (Blink).

    Several flaws were found in the processing of malformed web content. A web     page containing malicious content could cause Chromium to crash or,     potentially, execute arbitrary code with the privileges of the user running     Chromium. (CVE-2015-1251, CVE-2015-1252, CVE-2015-1253, CVE-2015-1254,     CVE-2015-1255, CVE-2015-1256, CVE-2015-1257, CVE-2015-1258, CVE-2015-1259,     CVE-2015-1260, CVE-2015-1261, CVE-2015-1262, CVE-2015-1263, CVE-2015-1264,     CVE-2015-1265)

    All Chromium users should upgrade to these updated packages, which contain     Chromium version 43.0.2357.65, which corrects these issues. After     installing the update, Chromium must be restarted for the changes to take     effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities were discovered in the chromium web browser.

  - CVE-2015-1251     SkyLined discovered a use-after-free issue in speech     recognition.

  - CVE-2015-1252     An out-of-bounds write issue was discovered that could     be used to escape from the sandbox.

  - CVE-2015-1253     A cross-origin bypass issue was discovered in the DOM     parser.

  - CVE-2015-1254     A cross-origin bypass issue was discovered in the DOM     editing feature.

  - CVE-2015-1255     Khalil Zhani discovered a use-after-free issue in     WebAudio.

  - CVE-2015-1256     Atte Kettunen discovered a use-after-free issue in the     SVG implementation.

  - CVE-2015-1257     miaubiz discovered an overflow issue in the SVG     implementation.

  - CVE-2015-1258     cloudfuzzer discovered an invalid size parameter used in     the libvpx library.

  - CVE-2015-1259     Atte Kettunen discovered an uninitialized memory issue     in the pdfium library.

  - CVE-2015-1260     Khalil Zhani discovered multiple use-after-free issues     in chromium's interface to the WebRTC library.

  - CVE-2015-1261     Juho Nurminen discovered a URL bar spoofing issue.

  - CVE-2015-1262     miaubiz discovered the use of an uninitialized class     member in font handling.

  - CVE-2015-1263     Mike Ruddy discovered that downloading the spellcheck     dictionary was not done over HTTPS.

  - CVE-2015-1264     K0r3Ph1L discovered a cross-site scripting issue that     could be triggered by bookmarking a site.

  - CVE-2015-1265     The chrome 43 development team found and fixed various     issues during internal auditing. Also multiple issues     were fixed in the libv8 library, version 4.3.61.21.

Google Chrome Releases reports :

37 security fixes in this release, including :

- [474029] High CVE-2015-1252: Sandbox escape in Chrome. Credit to anonymous.

- [464552] High CVE-2015-1253: Cross-origin bypass in DOM. Credit to anonymous.

- [444927] High CVE-2015-1254: Cross-origin bypass in Editing. Credit to armin@rawsec.net.

- [473253] High CVE-2015-1255: Use-after-free in WebAudio. Credit to Khalil Zhani.

- [478549] High CVE-2015-1256: Use-after-free in SVG. Credit to Atte Kettunen of OUSPG.

- [481015] High CVE-2015-1251: Use-after-free in Speech. Credit to SkyLined working with HP's Zero Day Initiative.

- [468519] Medium CVE-2015-1257: Container-overflow in SVG. Credit to miaubiz.

- [450939] Medium CVE-2015-1258: Negative-size parameter in libvpx.
Credit to cloudfuzzer

- [468167] Medium CVE-2015-1259: Uninitialized value in PDFium. Credit to Atte Kettunen of OUSPG

- [474370] Medium CVE-2015-1260: Use-after-free in WebRTC. Credit to Khalil Zhani.

- [466351] Medium CVE-2015-1261: URL bar spoofing. Credit to Juho Nurminen.

- [476647] Medium CVE-2015-1262: Uninitialized value in Blink. Credit to miaubiz.

- [479162] Low CVE-2015-1263: Insecure download of spellcheck dictionary. Credit to Mike Ruddy.

- [481015] Low CVE-2015-1264: Cross-site scripting in bookmarks.
Credit to K0r3Ph1L.

- [489518] CVE-2015-1265: Various fixes from internal audits, fuzzing and other initiatives.

- Multiple vulnerabilities in V8 fixed at the tip of the 4.3 branch (currently 4.3.61.21).

ID	Name	Product	Family	Severity
83915	openSUSE Security Update : Chromium (openSUSE-2015-390)	Nessus	SuSE Local Security Checks	high
83808	RHEL 6 : chromium-browser (RHSA-2015:1023)	Nessus	Red Hat Local Security Checks	medium
83784	Debian DSA-3267-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	high
83556	FreeBSD : chromium -- multiple vulnerabilities (a9d456b4-fe4c-11e4-ad15-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2015-1261

medium

Tenable Plugins

high

medium

high

high