The PDF viewer in Google Chrome before 46.0.2490.86 does not properly restrict scripting messages and API exposure, which allows remote attackers to bypass the Same Origin Policy via an unintended embedder or unintended plugin loading, related to pdf.js and out_of_process_instance.cc.

The remote host is affected by the vulnerability described in GLSA-201603-09 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in the Chromium web       browser. Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information, or bypass security restrictions.
  Workaround :

    There is no known workaround at this time.

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2015-1302     Rub Wu discovered an information leak in the pdfium     library.

  - CVE-2015-6764     Guang Gong discovered an out-of-bounds read issue in the     v8 JavaScript library.

  - CVE-2015-6765     A use-after-free issue was discovered in AppCache.

  - CVE-2015-6766     A use-after-free issue was discovered in AppCache.

  - CVE-2015-6767     A use-after-free issue was discovered in AppCache.

  - CVE-2015-6768     Mariusz Mlynski discovered a way to bypass the Same     Origin Policy.

  - CVE-2015-6769     Mariusz Mlynski discovered a way to bypass the Same     Origin Policy.

  - CVE-2015-6770     Mariusz Mlynski discovered a way to bypass the Same     Origin Policy.

  - CVE-2015-6771     An out-of-bounds read issue was discovered in the v8     JavaScript library.

  - CVE-2015-6772     Mariusz Mlynski discovered a way to bypass the Same     Origin Policy.

  - CVE-2015-6773     cloudfuzzer discovered an out-of-bounds read issue in     the skia library.

  - CVE-2015-6774     A use-after-free issue was found in extensions binding.

  - CVE-2015-6775     Atte Kettunen discovered a type confusion issue in the     pdfium library.

  - CVE-2015-6776     Hanno Bock dicovered an out-of-bounds access issue in     the openjpeg library, which is used by pdfium.

  - CVE-2015-6777     Long Liu found a use-after-free issue.

  - CVE-2015-6778     Karl Skomski found an out-of-bounds read issue in the     pdfium library.

  - CVE-2015-6779     Til Jasper Ullrich discovered that the pdfium library     does not sanitize 'chrome:' URLs.

  - CVE-2015-6780     Khalil Zhani discovered a use-after-free issue.

  - CVE-2015-6781     miaubiz discovered an integer overflow issue in the     sfntly library.

  - CVE-2015-6782     Luan Herrera discovered a URL spoofing issue.

  - CVE-2015-6784     Inti De Ceukelaire discovered a way to inject HTML into     serialized web pages.

  - CVE-2015-6785     Michael Ficarra discovered a way to bypass the Content     Security Policy.

  - CVE-2015-6786     Michael Ficarra discovered another way to bypass the     Content Security Policy.

The version of Google Chrome on the remote host is prior to 46.0.2490.86 and is affected by the following vulnerabilities :

 - An information disclosure vulnerability exists in the PDF viewer that allows an attacker to disclose sensitive information. (CVE-2015-1302)
 - A type confusion error exists that allows an attacker to execute arbitrary code. (CVE-2015-7659)
 - A security bypass vulnerability exists that allows an attacker to write arbitrary data to the file system under user permissions. (CVE-2015-7662)
 - Multiple use-after-free vulnerabilities exist that allow an attacker to execute arbitrary code. (CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, CVE-2015-8046)

Chromium was updated to 46.0.2490.86 to fix one security issue and bugs.

The following vulnerability was fixed :

  - CVE-2015-1302: Information leak in PDF viewer     (boo#954579)

The following bug fix udpates are included :

  - boo#950957: Change the default homepage based on the new     landing page for the openSUSE Project.

Google Chrome Releases reports :

[520422] High CVE-2015-1302: Information leak in PDF viewer. Credit to Rob Wu.

The version of Google Chrome installed on the remote Mac OS X host is prior to 46.0.2490.86. It is, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability exists in the     PDF viewer that allows an attacker to disclose sensitive     information. (CVE-2015-1302)

  - A type confusion error exists that allows an attacker to     execute arbitrary code. (CVE-2015-7659)

  - A security bypass vulnerability exists that allows an     attacker to write arbitrary data to the file system     under user permissions. (CVE-2015-7662)

  - Multiple use-after-free vulnerabilities exist that allow     an attacker to execute arbitrary code. (CVE-2015-7651,     CVE-2015-7652, CVE-2015-7653, CVE-2015-7654,     CVE-2015-7655, CVE-2015-7656, CVE-2015-7657,     CVE-2015-7658, CVE-2015-7660, CVE-2015-7661,     CVE-2015-7663, CVE-2015-8042, CVE-2015-8043,     CVE-2015-8044, CVE-2015-8046)

The version of Google Chrome installed on the remote Windows host is prior to 46.0.2490.86. It is, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability exists in the     PDF viewer that allows an attacker to disclose sensitive     information. (CVE-2015-1302)

  - A type confusion error exists that allows an attacker to     execute arbitrary code. (CVE-2015-7659)

  - A security bypass vulnerability exists that allows an     attacker to write arbitrary data to the file system     under user permissions. (CVE-2015-7662)

  - Multiple use-after-free vulnerabilities exist that allow     an attacker to execute arbitrary code. (CVE-2015-7651,     CVE-2015-7652, CVE-2015-7653, CVE-2015-7654,     CVE-2015-7655, CVE-2015-7656, CVE-2015-7657,     CVE-2015-7658, CVE-2015-7660, CVE-2015-7661,     CVE-2015-7663, CVE-2015-8042, CVE-2015-8043,     CVE-2015-8044, CVE-2015-8046)

Updated chromium-browser packages that fix two security issues are now available for Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Chromium is an open source web browser, powered by WebKit (Blink).

Two flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to bypass cross origin restrictions, and access or modify data from an unrelated website. (CVE-2015-1303, CVE-2015-1304)

All Chromium users should upgrade to these updated packages, which contain Chromium version 45.0.2454.101, which corrects these issues.
After installing the update, Chromium must be restarted for the changes to take effect.

ID	Name	Product	Family	Severity
89902	GLSA-201603-09 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
87289	Debian DSA-3415-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	critical
9014	Google Chrome < 46.0.2490.86 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
87005	openSUSE Security Update : Chromium (openSUSE-2015-788)	Nessus	SuSE Local Security Checks	high
86860	FreeBSD : chromium -- multiple vulnerabilities (f0b9049f-88c4-11e5-aed7-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	high
86855	Google Chrome < 46.0.2490.86 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
86852	Google Chrome < 46.0.2490.86 Multiple Vulnerabilities	Nessus	Windows	critical
86201	RHEL 6 : chromium-browser (RHSA-2015:1841)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2015-1302

high

Tenable Plugins

critical

critical

medium

high

high

critical

critical

high