Cross-site scripting (XSS) vulnerability in org/chromium/chrome/browser/UrlUtilities.java in Google Chrome before 44.0.2403.89 on Android allows remote attackers to inject arbitrary web script or HTML via a crafted intent: URL, as demonstrated by a trailing alert(document.cookie);// substring, aka "Universal XSS (UXSS)."

The remote host is affected by the vulnerability described in GLSA-201603-09 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in the Chromium web       browser. Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information, or bypass security restrictions.
  Workaround :

    There is no known workaround at this time.

Chromium was updated to 44.0.2403.89 to fix multiple security issues.

The following vulnerabilities were fixed :

  - CVE-2015-1271: Heap-buffer-overflow in pdfium

  - CVE-2015-1273: Heap-buffer-overflow in pdfium

  - CVE-2015-1274: Settings allowed executable files to run     immediately after download

  - CVE-2015-1275: UXSS in Chrome for Android

  - CVE-2015-1276: Use-after-free in IndexedDB

  - CVE-2015-1279: Heap-buffer-overflow in pdfium

  - CVE-2015-1280: Memory corruption in skia

  - CVE-2015-1281: CSP bypass

  - CVE-2015-1282: Use-after-free in pdfium

  - CVE-2015-1283: Heap-buffer-overflow in expat

  - CVE-2015-1284: Use-after-free in blink

  - CVE-2015-1286: UXSS in blink

  - CVE-2015-1287: SOP bypass with CSS

  - CVE-2015-1270: Uninitialized memory read in ICU

  - CVE-2015-1272: Use-after-free related to unexpected GPU     process termination

  - CVE-2015-1277: Use-after-free in accessibility

  - CVE-2015-1278: URL spoofing using pdf files

  - CVE-2015-1285: Information leak in XSS auditor

  - CVE-2015-1288: Spell checking dictionaries fetched over     HTTP

  - CVE-2015-1289: Various fixes from internal audits,     fuzzing and other initiatives

  - CVE-2015-5605: Rgular-expression implementation     mishandles interrupts, DoS via JS

The following non-security changes are included :

  - A number of new apps/extension APIs

  - Lots of under the hood changes for stability and     performance

  - Pepper Flash plugin updated to 18.0.0.209

Google Chrome Releases reports :

43 security fixes in this release, including :

- [446032] High CVE-2015-1271: Heap-buffer-overflow in pdfium. Credit to cloudfuzzer.

- [459215] High CVE-2015-1273: Heap-buffer-overflow in pdfium. Credit to makosoft.

- [461858] High CVE-2015-1274: Settings allowed executable files to run immediately after download. Credit to andrewm.bpi.

- [462843] High CVE-2015-1275: UXSS in Chrome for Android. Credit to WangTao(neobyte) of Baidu X-Team.

- [472614] High CVE-2015-1276: Use-after-free in IndexedDB. Credit to Collin Payne.

- [483981] High CVE-2015-1279: Heap-buffer-overflow in pdfium. Credit to mlafon.

- [486947] High CVE-2015-1280: Memory corruption in skia. Credit to cloudfuzzer.

- [487155] High CVE-2015-1281: CSP bypass. Credit to Masato Kinugawa.

- [487928] High CVE-2015-1282: Use-after-free in pdfium. Credit to Chamal de Silva.

- [492052] High CVE-2015-1283: Heap-buffer-overflow in expat. Credit to sidhpurwala.huzaifa.

- [493243] High CVE-2015-1284: Use-after-free in blink. Credit to Atte Kettunen of OUSPG.

- [504011] High CVE-2015-1286: UXSS in blink. Credit to anonymous.

- [505374] High CVE-2015-1290: Memory corruption in V8. Credit to Yongjun Liu of NSFOCUS Security Team.

- [419383] Medium CVE-2015-1287: SOP bypass with CSS. Credit to filedescriptor.

- [444573] Medium CVE-2015-1270: Uninitialized memory read in ICU.
Credit to Atte Kettunen of OUSPG.

- [451456] Medium CVE-2015-1272: Use-after-free related to unexpected GPU process termination. Credit to Chamal de Silva.

- [479743] Medium CVE-2015-1277: Use-after-free in accessibility.
Credit to SkyLined.

- [482380] Medium CVE-2015-1278: URL spoofing using pdf files. Credit to Chamal de Silva.

- [498982] Medium CVE-2015-1285: Information leak in XSS auditor.
Credit to gazheyes.

- [479162] Low CVE-2015-1288: Spell checking dictionaries fetched over HTTP. Credit to mike@michaelruddy.com.

- [512110] CVE-2015-1289: Various fixes from internal audits, fuzzing and other initiatives.

The version of Google Chrome installed on the remote Mac OS X host is prior to 44.0.2403.89. It is, therefore, affected by multiple vulnerabilities :

  - An uninitialized memory read flaw exists in ICU that an     attacker can exploit to have unspecified impact.
    (CVE-2015-1270)

  - A heap buffer overflow condition exists in PDFium due to     improper validation of user-supplied input. An attacker     can exploit this to execute arbitrary code or cause a     denial of service. (CVE-2015-1271, CVE-2015-1273)

  - A use-after-free memory error exists when the GPU     process is unexpectedly terminated. An attacker can     exploit this to have an unspecified impact.
    (CVE-2015-1272)

  - The settings for automatic downloading of files allows     EXE files to be auto-opened, which can result in the     execution of malicious code. (CVE-2015-1274)

  - A universal cross-site scripting (UXSS) vulnerability     exists in Google Chrome for Android due to improper     validation of 'intent://' URLs. An attacker, using a     specially crafted request, can exploit this to execute     arbitrary script code. (CVE-2015-1275)

  - A use-after-free memory error exists in IndexedDB that     can allow an attacker to execute arbitrary code.
    (CVE-2015-1276)

  - A denial of service vulnerability exists due to a     use-after-free memory error in the method     ui::AXTree::Unserialize. An attacker can exploit this to     cause a crash. (CVE-2015-1277)

  - An unspecified flaw exists when handling PDF files that     allows an attacker to spoof URLs. (CVE-2015-1278)

  - An integer overflow condition exists in the method     CJBig2_Image::expand() in file JBig2_Image.cpp due to     improper validation of user-supplied input. An attacker     can exploit this to cause a heap-based buffer overflow,     resulting in a denial of service or the execution of     arbitrary code. (CVE-2015-1279)

  - A flaw exists in Google Skia due to improper validation     of user-supplied input, which an attacker can exploit to     corrupt memory or execute arbitrary code.
    (CVE-2015-1280)

  - An unspecified flaw exists that allows an attacker to     bypass the Content Security Policy. (CVE-2015-1281)

  - A use-after-free memory error exists in PDFium in the     file javascript/Document.cpp. An attacker, using a     crafted file, can exploit this to execute arbitrary     code. (CVE-2015-1282)

  - A heap buffer overflow condition exists in 'expat'.
    No other information is available. (CVE-2015-1283)

  - A use-after-free memory error exists in Blink that can     allow an attacker to execute arbitrary code.
    (CVE-2015-1284)

  - An unspecified flaw exists in the XSS auditor that     allows an attacker to gain access to sensitive     information. (CVE-2015-1285)

  - A universal cross-site scripting (UXSS) vulnerability     exists in Blink due to improper validation of     unspecified input. An attacker, using a crafted request,     can exploit this to execute arbitrary script code.
    (CVE-2015-1286)

  - A flaw exists in WebKit related to the handling of     the quirks-mode exception for CSS MIME types, which     allows an attacker to bypass the cross-origin policy.
    (CVE-2015-1287)

  - A flaw exists in file spellcheck_hunspell_dictionary.cc,     related to the downloading of spellchecker dictionaries     over HTTP, which allows a man-in-the-middle to corrupt     the downloaded dictionaries. (CVE-2015-1288)

  - Multiple vulnerabilities exist that were disclosed by     internal auditing, fuzzing, and other initiatives,     which can result in a denial of service, execution of     arbitrary code, or other moderate to severe impact.
    (CVE-2015-1289)

The version of Google Chrome installed on the remote Windows host is prior to 44.0.2403.89. It is, therefore, affected by multiple vulnerabilities  :

  - An uninitialized memory read flaw exists in ICU that an     attacker can exploit to have unspecified impact.
    (CVE-2015-1270)

  - A heap buffer overflow condition exists in PDFium due to     improper validation of user-supplied input. An attacker     can exploit this to execute arbitrary code or cause a     denial of service. (CVE-2015-1271, CVE-2015-1273)

  - A use-after-free memory error exists when the GPU     process is unexpectedly terminated. An attacker can     exploit this to have an unspecified impact.
    (CVE-2015-1272)

  - The settings for automatic downloading of files allows     EXE files to be auto-opened, which can result in the     execution of malicious code. (CVE-2015-1274)

  - A universal cross-site scripting (UXSS) vulnerability     exists in Google Chrome for Android due to improper     validation of 'intent://' URLs. An attacker, using a     specially crafted request, can exploit this to execute     arbitrary script code. (CVE-2015-1275)

  - A use-after-free memory error exists in IndexedDB that     can allow an attacker to execute arbitrary code.
    (CVE-2015-1276)

  - A denial of service vulnerability exists due to a     use-after-free memory error in the method     ui::AXTree::Unserialize. An attacker can exploit this to     cause a crash. (CVE-2015-1277)

  - An unspecified flaw exists when handling PDF files that     allows an attacker to spoof URLs. (CVE-2015-1278)

  - An integer overflow condition exists in the method     CJBig2_Image::expand() in file JBig2_Image.cpp due to     improper validation of user-supplied input. An attacker     can exploit this to cause a heap-based buffer overflow,     resulting in a denial of service or the execution of     arbitrary code. (CVE-2015-1279)

  - A flaw exists in Google Skia due to improper validation     of user-supplied input, which an attacker can exploit to     corrupt memory or execute arbitrary code.
    (CVE-2015-1280)

  - An unspecified flaw exists that allows an attacker to     bypass the Content Security Policy. (CVE-2015-1281)

  - A use-after-free memory error exists in PDFium in the     file javascript/Document.cpp. An attacker, using a     crafted file, can exploit this to execute arbitrary     code. (CVE-2015-1282)

  - A heap buffer overflow condition exists in 'expat'.
    No other information is available. (CVE-2015-1283)

  - A use-after-free memory error exists in Blink that can     allow an attacker to execute arbitrary code.
    (CVE-2015-1284)

  - An unspecified flaw exists in the XSS auditor that     allows an attacker to gain access to sensitive     information. (CVE-2015-1285)

  - A universal cross-site scripting (UXSS) vulnerability     exists in Blink due to improper validation of     unspecified input. An attacker, using a crafted request,     can exploit this to execute arbitrary script code.
    (CVE-2015-1286)

  - A flaw exists in WebKit related to the handling of     the quirks-mode exception for CSS MIME types, which     allows an attacker to bypass the cross-origin policy.
    (CVE-2015-1287)

  - A flaw exists in file spellcheck_hunspell_dictionary.cc,     related to the downloading of spellchecker dictionaries     over HTTP, which allows a man-in-the-middle to corrupt     the downloaded dictionaries. (CVE-2015-1288)

  - Multiple vulnerabilities exist that were disclosed by     internal auditing, fuzzing, and other initiatives,     which can result in a denial of service, execution of     arbitrary code, or other moderate to severe impact.
    (CVE-2015-1289)

ID	Name	Product	Family	Severity
89902	GLSA-201603-09 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
85003	openSUSE Security Update : Chromium (openSUSE-2015-513)	Nessus	SuSE Local Security Checks	critical
84994	FreeBSD : chromium -- multiple vulnerabilities (9d732078-32c7-11e5-b263-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	critical
84922	Google Chrome < 44.0.2403.89 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
84921	Google Chrome < 44.0.2403.89 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2015-1275

medium

Tenable Plugins

critical

critical

critical

high

high