The LocalFrame::isURLAllowed function in core/frame/LocalFrame.cpp in Blink, as used in Google Chrome before 44.0.2403.89, does not properly check for a page's maximum number of frames, which allows remote attackers to cause a denial of service (invalid count value and use-after-free) or possibly have unspecified other impact via crafted JavaScript code that makes many createElement calls for IFRAME elements.

The remote host is affected by the vulnerability described in GLSA-201603-09 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in the Chromium web       browser. Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information, or bypass security restrictions.
  Workaround :

    There is no known workaround at this time.

Qt 5 was updated to the 5.5.1 release to deliver upstream improvements and fixes to Qt functionality.

The following Security fixes are contained in QtWebEngineCore :

  - ICU: CVE-2014-8146, CVE-2014-8147

  - Blink: CVE-2015-1284, CVE-2015-1291, CVE-2015-1292

  - Skia: CVE-2015-1294

  - V8: CVE-2015-1290

The following packages were rebuilt because they use private headers :

  - calibre

  - fcitx-qt5

  - frameworkintegration

  - kwayland

  - kwin5,

  - lxqt-powermanagement

  - lxqt-qtplugin

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2677-1 advisory.

    An uninitialized value issue was discovered in ICU. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit this to cause a denial of service. (CVE-2015-1270)

    A use-after-free was discovered in the GPU process implementation in Chromium. If a user were tricked in     to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of     service via application crash, or execute arbitrary code with the privileges of the user invoking the     program. (CVE-2015-1272)

    A use-after-free was discovered in the IndexedDB implementation in Chromium. If a user were tricked in to     opening a specially crafted website, an attacker could potentially exploit this to cause a denial of     service via application crash, or execute arbitrary code with the privileges of the user invoking the     program. (CVE-2015-1276)

    A use-after-free was discovered in the accessibility implemetation in Chromium. If a user were tricked in     to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of     service via application crash, or execute arbitrary code with the privileges of the user invoking the     program. (CVE-2015-1277)

    A memory corruption issue was discovered in Skia. If a user were tricked in to opening a specially crafted     website, an attacker could potentially exploit this to cause a denial of service via renderer crash, or     execute arbitrary code with the privileges of the sandboxed render process. (CVE-2015-1280)

    It was discovered that Blink did not properly determine the V8 context of a microtask in some     circumstances. If a user were tricked in to opening a specially crafted website, an attacker could     potentially exploit this to bypass Content Security Policy (CSP) restrictions. (CVE-2015-1281)

    Multiple integer overflows were discovered in Expat. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit this to cause a denial of service via application     crash, or execute arbitrary code with the privileges of the user invoking the program. (CVE-2015-1283)

    It was discovered that Blink did not enforce a page's maximum number of

    frames in some circumstances, resulting in a use-after-free. If a user were tricked in to opening a     specially crafted website, an attacker could potentially exploit this to cause a denial of service via     renderer crash, or execute arbitrary code with the privileges of the sandboxed render process.
    (CVE-2015-1284)

    It was discovered that the XSS auditor in Blink did not properly choose a truncation point. If a user were     tricked in to opening a specially crafted website, an attacker could potentially exploit this to obtain     sensitive information. (CVE-2015-1285)

    An issue was discovered in the CSS implementation in Blink. If a user were tricked in to opening a     specially crafted website, an attacker could potentially exploit this to bypass same-origin restrictions.
    (CVE-2015-1287)

    Multiple security issues were discovered in Chromium. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial     of service via application crash or execute arbitrary code with the privileges of the user invoking the     program. (CVE-2015-1289)

    A use-after-free was discovered in oxide::qt::URLRequestDelegatedJob in some circumstances. If a user were     tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a     denial of service via application crash, or execute arbitrary code with the privileges of the user     invoking the program. (CVE-2015-1329)

    A crash was discovered in the regular expression implementation in V8 in some circumstances. If a user     were tricked in to opening a specially crafted website, an attacker could potentially exploit this to     cause a denial of service. (CVE-2015-5605)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated chromium-browser packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Chromium is an open source web browser, powered by WebKit (Blink).

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash or, potentially, execute arbitrary code with the privileges of the user running Chromium. (CVE-2015-1271, CVE-2015-1270, CVE-2015-1272, CVE-2015-1273, CVE-2015-1274, CVE-2015-1276, CVE-2015-1277, CVE-2015-1278, CVE-2015-1279, CVE-2015-1281, CVE-2015-1282, CVE-2015-1283, CVE-2015-1284, CVE-2015-1285, CVE-2015-1286, CVE-2015-1287, CVE-2015-1288, CVE-2015-1289, CVE-2015-5605)

All Chromium users should upgrade to these updated packages, which contain Chromium version 44.0.2403.89, which corrects these issues.
After installing the update, Chromium must be restarted for the changes to take effect.

Chromium was updated to 44.0.2403.89 to fix multiple security issues.

The following vulnerabilities were fixed :

  - CVE-2015-1271: Heap-buffer-overflow in pdfium

  - CVE-2015-1273: Heap-buffer-overflow in pdfium

  - CVE-2015-1274: Settings allowed executable files to run     immediately after download

  - CVE-2015-1275: UXSS in Chrome for Android

  - CVE-2015-1276: Use-after-free in IndexedDB

  - CVE-2015-1279: Heap-buffer-overflow in pdfium

  - CVE-2015-1280: Memory corruption in skia

  - CVE-2015-1281: CSP bypass

  - CVE-2015-1282: Use-after-free in pdfium

  - CVE-2015-1283: Heap-buffer-overflow in expat

  - CVE-2015-1284: Use-after-free in blink

  - CVE-2015-1286: UXSS in blink

  - CVE-2015-1287: SOP bypass with CSS

  - CVE-2015-1270: Uninitialized memory read in ICU

  - CVE-2015-1272: Use-after-free related to unexpected GPU     process termination

  - CVE-2015-1277: Use-after-free in accessibility

  - CVE-2015-1278: URL spoofing using pdf files

  - CVE-2015-1285: Information leak in XSS auditor

  - CVE-2015-1288: Spell checking dictionaries fetched over     HTTP

  - CVE-2015-1289: Various fixes from internal audits,     fuzzing and other initiatives

  - CVE-2015-5605: Rgular-expression implementation     mishandles interrupts, DoS via JS

The following non-security changes are included :

  - A number of new apps/extension APIs

  - Lots of under the hood changes for stability and     performance

  - Pepper Flash plugin updated to 18.0.0.209

Google Chrome Releases reports :

43 security fixes in this release, including :

- [446032] High CVE-2015-1271: Heap-buffer-overflow in pdfium. Credit to cloudfuzzer.

- [459215] High CVE-2015-1273: Heap-buffer-overflow in pdfium. Credit to makosoft.

- [461858] High CVE-2015-1274: Settings allowed executable files to run immediately after download. Credit to andrewm.bpi.

- [462843] High CVE-2015-1275: UXSS in Chrome for Android. Credit to WangTao(neobyte) of Baidu X-Team.

- [472614] High CVE-2015-1276: Use-after-free in IndexedDB. Credit to Collin Payne.

- [483981] High CVE-2015-1279: Heap-buffer-overflow in pdfium. Credit to mlafon.

- [486947] High CVE-2015-1280: Memory corruption in skia. Credit to cloudfuzzer.

- [487155] High CVE-2015-1281: CSP bypass. Credit to Masato Kinugawa.

- [487928] High CVE-2015-1282: Use-after-free in pdfium. Credit to Chamal de Silva.

- [492052] High CVE-2015-1283: Heap-buffer-overflow in expat. Credit to sidhpurwala.huzaifa.

- [493243] High CVE-2015-1284: Use-after-free in blink. Credit to Atte Kettunen of OUSPG.

- [504011] High CVE-2015-1286: UXSS in blink. Credit to anonymous.

- [505374] High CVE-2015-1290: Memory corruption in V8. Credit to Yongjun Liu of NSFOCUS Security Team.

- [419383] Medium CVE-2015-1287: SOP bypass with CSS. Credit to filedescriptor.

- [444573] Medium CVE-2015-1270: Uninitialized memory read in ICU.
Credit to Atte Kettunen of OUSPG.

- [451456] Medium CVE-2015-1272: Use-after-free related to unexpected GPU process termination. Credit to Chamal de Silva.

- [479743] Medium CVE-2015-1277: Use-after-free in accessibility.
Credit to SkyLined.

- [482380] Medium CVE-2015-1278: URL spoofing using pdf files. Credit to Chamal de Silva.

- [498982] Medium CVE-2015-1285: Information leak in XSS auditor.
Credit to gazheyes.

- [479162] Low CVE-2015-1288: Spell checking dictionaries fetched over HTTP. Credit to mike@michaelruddy.com.

- [512110] CVE-2015-1289: Various fixes from internal audits, fuzzing and other initiatives.

Several vulnerabilities were discovered in the chromium web browser.

  - CVE-2015-1266     Intended access restrictions could be bypassed for     certain URLs like chrome://gpu.

  - CVE-2015-1267     A way to bypass the Same Origin Policy was discovered.

  - CVE-2015-1268     Mariusz Mlynski also discovered a way to bypass the Same     Origin Policy.

  - CVE-2015-1269     Mike Rudy discovered that hostnames were not properly     compared in the HTTP Strict Transport Policy and HTTP     Public Key Pinning features, which could allow those     access restrictions to be bypassed.

  - CVE-2015-1270     Atte Kettunen discovered an uninitialized memory read in     the ICU library.

  - CVE-2015-1271     cloudfuzzer discovered a buffer overflow in the pdfium     library.

  - CVE-2015-1272     Chamal de Silva discovered race conditions in the GPU     process implementation.

  - CVE-2015-1273     makosoft discovered a buffer overflow in openjpeg, which     is used by the pdfium library embedded in chromium.

  - CVE-2015-1274     andrewm.bpi discovered that the auto-open list allowed     certain file types to be executed immediately after     download.

  - CVE-2015-1276     Colin Payne discovered a use-after-free issue in the     IndexedDB implementation.

  - CVE-2015-1277     SkyLined discovered a use-after-free issue in chromium's     accessibility implementation.

  - CVE-2015-1278     Chamal de Silva discovered a way to use PDF documents to     spoof a URL.

  - CVE-2015-1279     mlafon discovered a buffer overflow in the pdfium     library.

  - CVE-2015-1280     cloudfuzzer discovered a memory corruption issue in the     SKIA library.

  - CVE-2015-1281     Masato Knugawa discovered a way to bypass the Content     Security Policy.

  - CVE-2015-1282     Chamal de Silva discovered multiple use-after-free     issues in the pdfium library.

  - CVE-2015-1283     Huzaifa Sidhpurwala discovered a buffer overflow in the     expat library.

  - CVE-2015-1284     Atte Kettunen discovered that the maximum number of page     frames was not correctly checked.

  - CVE-2015-1285     gazheyes discovered an information leak in the XSS     auditor, which normally helps to prevent certain classes     of cross-site scripting problems.

  - CVE-2015-1286     A cross-site scripting issue was discovered in the     interface to the v8 JavaScript library.

  - CVE-2015-1287     filedescriptor discovered a way to bypass the Same     Origin Policy.

  - CVE-2015-1288     Mike Ruddy discovered that the spellchecking     dictionaries could still be downloaded over plain HTTP     (related to CVE-2015-1263 ).

  - CVE-2015-1289     The chrome 44 development team found and fixed various     issues during internal auditing.

In addition to the above issues, Google disabled the hotword extension by default in this version, which if enabled downloads files without the user's intervention.

The version of Google Chrome installed on the remote Mac OS X host is prior to 44.0.2403.89. It is, therefore, affected by multiple vulnerabilities :

  - An uninitialized memory read flaw exists in ICU that an     attacker can exploit to have unspecified impact.
    (CVE-2015-1270)

  - A heap buffer overflow condition exists in PDFium due to     improper validation of user-supplied input. An attacker     can exploit this to execute arbitrary code or cause a     denial of service. (CVE-2015-1271, CVE-2015-1273)

  - A use-after-free memory error exists when the GPU     process is unexpectedly terminated. An attacker can     exploit this to have an unspecified impact.
    (CVE-2015-1272)

  - The settings for automatic downloading of files allows     EXE files to be auto-opened, which can result in the     execution of malicious code. (CVE-2015-1274)

  - A universal cross-site scripting (UXSS) vulnerability     exists in Google Chrome for Android due to improper     validation of 'intent://' URLs. An attacker, using a     specially crafted request, can exploit this to execute     arbitrary script code. (CVE-2015-1275)

  - A use-after-free memory error exists in IndexedDB that     can allow an attacker to execute arbitrary code.
    (CVE-2015-1276)

  - A denial of service vulnerability exists due to a     use-after-free memory error in the method     ui::AXTree::Unserialize. An attacker can exploit this to     cause a crash. (CVE-2015-1277)

  - An unspecified flaw exists when handling PDF files that     allows an attacker to spoof URLs. (CVE-2015-1278)

  - An integer overflow condition exists in the method     CJBig2_Image::expand() in file JBig2_Image.cpp due to     improper validation of user-supplied input. An attacker     can exploit this to cause a heap-based buffer overflow,     resulting in a denial of service or the execution of     arbitrary code. (CVE-2015-1279)

  - A flaw exists in Google Skia due to improper validation     of user-supplied input, which an attacker can exploit to     corrupt memory or execute arbitrary code.
    (CVE-2015-1280)

  - An unspecified flaw exists that allows an attacker to     bypass the Content Security Policy. (CVE-2015-1281)

  - A use-after-free memory error exists in PDFium in the     file javascript/Document.cpp. An attacker, using a     crafted file, can exploit this to execute arbitrary     code. (CVE-2015-1282)

  - A heap buffer overflow condition exists in 'expat'.
    No other information is available. (CVE-2015-1283)

  - A use-after-free memory error exists in Blink that can     allow an attacker to execute arbitrary code.
    (CVE-2015-1284)

  - An unspecified flaw exists in the XSS auditor that     allows an attacker to gain access to sensitive     information. (CVE-2015-1285)

  - A universal cross-site scripting (UXSS) vulnerability     exists in Blink due to improper validation of     unspecified input. An attacker, using a crafted request,     can exploit this to execute arbitrary script code.
    (CVE-2015-1286)

  - A flaw exists in WebKit related to the handling of     the quirks-mode exception for CSS MIME types, which     allows an attacker to bypass the cross-origin policy.
    (CVE-2015-1287)

  - A flaw exists in file spellcheck_hunspell_dictionary.cc,     related to the downloading of spellchecker dictionaries     over HTTP, which allows a man-in-the-middle to corrupt     the downloaded dictionaries. (CVE-2015-1288)

  - Multiple vulnerabilities exist that were disclosed by     internal auditing, fuzzing, and other initiatives,     which can result in a denial of service, execution of     arbitrary code, or other moderate to severe impact.
    (CVE-2015-1289)

The version of Google Chrome installed on the remote Windows host is prior to 44.0.2403.89. It is, therefore, affected by multiple vulnerabilities  :

  - An uninitialized memory read flaw exists in ICU that an     attacker can exploit to have unspecified impact.
    (CVE-2015-1270)

  - A heap buffer overflow condition exists in PDFium due to     improper validation of user-supplied input. An attacker     can exploit this to execute arbitrary code or cause a     denial of service. (CVE-2015-1271, CVE-2015-1273)

  - A use-after-free memory error exists when the GPU     process is unexpectedly terminated. An attacker can     exploit this to have an unspecified impact.
    (CVE-2015-1272)

  - The settings for automatic downloading of files allows     EXE files to be auto-opened, which can result in the     execution of malicious code. (CVE-2015-1274)

  - A universal cross-site scripting (UXSS) vulnerability     exists in Google Chrome for Android due to improper     validation of 'intent://' URLs. An attacker, using a     specially crafted request, can exploit this to execute     arbitrary script code. (CVE-2015-1275)

  - A use-after-free memory error exists in IndexedDB that     can allow an attacker to execute arbitrary code.
    (CVE-2015-1276)

  - A denial of service vulnerability exists due to a     use-after-free memory error in the method     ui::AXTree::Unserialize. An attacker can exploit this to     cause a crash. (CVE-2015-1277)

  - An unspecified flaw exists when handling PDF files that     allows an attacker to spoof URLs. (CVE-2015-1278)

  - An integer overflow condition exists in the method     CJBig2_Image::expand() in file JBig2_Image.cpp due to     improper validation of user-supplied input. An attacker     can exploit this to cause a heap-based buffer overflow,     resulting in a denial of service or the execution of     arbitrary code. (CVE-2015-1279)

  - A flaw exists in Google Skia due to improper validation     of user-supplied input, which an attacker can exploit to     corrupt memory or execute arbitrary code.
    (CVE-2015-1280)

  - An unspecified flaw exists that allows an attacker to     bypass the Content Security Policy. (CVE-2015-1281)

  - A use-after-free memory error exists in PDFium in the     file javascript/Document.cpp. An attacker, using a     crafted file, can exploit this to execute arbitrary     code. (CVE-2015-1282)

  - A heap buffer overflow condition exists in 'expat'.
    No other information is available. (CVE-2015-1283)

  - A use-after-free memory error exists in Blink that can     allow an attacker to execute arbitrary code.
    (CVE-2015-1284)

  - An unspecified flaw exists in the XSS auditor that     allows an attacker to gain access to sensitive     information. (CVE-2015-1285)

  - A universal cross-site scripting (UXSS) vulnerability     exists in Blink due to improper validation of     unspecified input. An attacker, using a crafted request,     can exploit this to execute arbitrary script code.
    (CVE-2015-1286)

  - A flaw exists in WebKit related to the handling of     the quirks-mode exception for CSS MIME types, which     allows an attacker to bypass the cross-origin policy.
    (CVE-2015-1287)

  - A flaw exists in file spellcheck_hunspell_dictionary.cc,     related to the downloading of spellchecker dictionaries     over HTTP, which allows a man-in-the-middle to corrupt     the downloaded dictionaries. (CVE-2015-1288)

  - Multiple vulnerabilities exist that were disclosed by     internal auditing, fuzzing, and other initiatives,     which can result in a denial of service, execution of     arbitrary code, or other moderate to severe impact.
    (CVE-2015-1289)

ID	Name	Product	Family	Severity
89902	GLSA-201603-09 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
87627	openSUSE Security Update : Qt 5 (openSUSE-2015-953)	Nessus	SuSE Local Security Checks	high
85240	Ubuntu 14.04 LTS : Oxide vulnerabilities (USN-2677-1)	Nessus	Ubuntu Local Security Checks	critical
85039	RHEL 6 : chromium-browser (RHSA-2015:1499)	Nessus	Red Hat Local Security Checks	critical
85003	openSUSE Security Update : Chromium (openSUSE-2015-513)	Nessus	SuSE Local Security Checks	critical
84994	FreeBSD : chromium -- multiple vulnerabilities (9d732078-32c7-11e5-b263-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	critical
84992	Debian DSA-3315-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	critical
84922	Google Chrome < 44.0.2403.89 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
84921	Google Chrome < 44.0.2403.89 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2015-1284

high

Tenable Plugins

critical

high

critical

critical

critical

critical

critical

high

high