The regular-expression implementation in Google V8, as used in Google Chrome before 44.0.2403.89, mishandles interrupts, which allows remote attackers to cause a denial of service (application crash) via crafted JavaScript code, as demonstrated by an error in garbage collection during allocation of a stack-overflow exception message.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2677-1 advisory.

    An uninitialized value issue was discovered in ICU. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit this to cause a denial of service. (CVE-2015-1270)

    A use-after-free was discovered in the GPU process implementation in Chromium. If a user were tricked in     to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of     service via application crash, or execute arbitrary code with the privileges of the user invoking the     program. (CVE-2015-1272)

    A use-after-free was discovered in the IndexedDB implementation in Chromium. If a user were tricked in to     opening a specially crafted website, an attacker could potentially exploit this to cause a denial of     service via application crash, or execute arbitrary code with the privileges of the user invoking the     program. (CVE-2015-1276)

    A use-after-free was discovered in the accessibility implemetation in Chromium. If a user were tricked in     to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of     service via application crash, or execute arbitrary code with the privileges of the user invoking the     program. (CVE-2015-1277)

    A memory corruption issue was discovered in Skia. If a user were tricked in to opening a specially crafted     website, an attacker could potentially exploit this to cause a denial of service via renderer crash, or     execute arbitrary code with the privileges of the sandboxed render process. (CVE-2015-1280)

    It was discovered that Blink did not properly determine the V8 context of a microtask in some     circumstances. If a user were tricked in to opening a specially crafted website, an attacker could     potentially exploit this to bypass Content Security Policy (CSP) restrictions. (CVE-2015-1281)

    Multiple integer overflows were discovered in Expat. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit this to cause a denial of service via application     crash, or execute arbitrary code with the privileges of the user invoking the program. (CVE-2015-1283)

    It was discovered that Blink did not enforce a page's maximum number of

    frames in some circumstances, resulting in a use-after-free. If a user were tricked in to opening a     specially crafted website, an attacker could potentially exploit this to cause a denial of service via     renderer crash, or execute arbitrary code with the privileges of the sandboxed render process.
    (CVE-2015-1284)

    It was discovered that the XSS auditor in Blink did not properly choose a truncation point. If a user were     tricked in to opening a specially crafted website, an attacker could potentially exploit this to obtain     sensitive information. (CVE-2015-1285)

    An issue was discovered in the CSS implementation in Blink. If a user were tricked in to opening a     specially crafted website, an attacker could potentially exploit this to bypass same-origin restrictions.
    (CVE-2015-1287)

    Multiple security issues were discovered in Chromium. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial     of service via application crash or execute arbitrary code with the privileges of the user invoking the     program. (CVE-2015-1289)

    A use-after-free was discovered in oxide::qt::URLRequestDelegatedJob in some circumstances. If a user were     tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a     denial of service via application crash, or execute arbitrary code with the privileges of the user     invoking the program. (CVE-2015-1329)

    A crash was discovered in the regular expression implementation in V8 in some circumstances. If a user     were tricked in to opening a specially crafted website, an attacker could potentially exploit this to     cause a denial of service. (CVE-2015-5605)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated chromium-browser packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Chromium is an open source web browser, powered by WebKit (Blink).

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash or, potentially, execute arbitrary code with the privileges of the user running Chromium. (CVE-2015-1271, CVE-2015-1270, CVE-2015-1272, CVE-2015-1273, CVE-2015-1274, CVE-2015-1276, CVE-2015-1277, CVE-2015-1278, CVE-2015-1279, CVE-2015-1281, CVE-2015-1282, CVE-2015-1283, CVE-2015-1284, CVE-2015-1285, CVE-2015-1286, CVE-2015-1287, CVE-2015-1288, CVE-2015-1289, CVE-2015-5605)

All Chromium users should upgrade to these updated packages, which contain Chromium version 44.0.2403.89, which corrects these issues.
After installing the update, Chromium must be restarted for the changes to take effect.

Chromium was updated to 44.0.2403.89 to fix multiple security issues.

The following vulnerabilities were fixed :

  - CVE-2015-1271: Heap-buffer-overflow in pdfium

  - CVE-2015-1273: Heap-buffer-overflow in pdfium

  - CVE-2015-1274: Settings allowed executable files to run     immediately after download

  - CVE-2015-1275: UXSS in Chrome for Android

  - CVE-2015-1276: Use-after-free in IndexedDB

  - CVE-2015-1279: Heap-buffer-overflow in pdfium

  - CVE-2015-1280: Memory corruption in skia

  - CVE-2015-1281: CSP bypass

  - CVE-2015-1282: Use-after-free in pdfium

  - CVE-2015-1283: Heap-buffer-overflow in expat

  - CVE-2015-1284: Use-after-free in blink

  - CVE-2015-1286: UXSS in blink

  - CVE-2015-1287: SOP bypass with CSS

  - CVE-2015-1270: Uninitialized memory read in ICU

  - CVE-2015-1272: Use-after-free related to unexpected GPU     process termination

  - CVE-2015-1277: Use-after-free in accessibility

  - CVE-2015-1278: URL spoofing using pdf files

  - CVE-2015-1285: Information leak in XSS auditor

  - CVE-2015-1288: Spell checking dictionaries fetched over     HTTP

  - CVE-2015-1289: Various fixes from internal audits,     fuzzing and other initiatives

  - CVE-2015-5605: Rgular-expression implementation     mishandles interrupts, DoS via JS

The following non-security changes are included :

  - A number of new apps/extension APIs

  - Lots of under the hood changes for stability and     performance

  - Pepper Flash plugin updated to 18.0.0.209

ID	Name	Product	Family	Severity
85240	Ubuntu 14.04 LTS : Oxide vulnerabilities (USN-2677-1)	Nessus	Ubuntu Local Security Checks	critical
85039	RHEL 6 : chromium-browser (RHSA-2015:1499)	Nessus	Red Hat Local Security Checks	critical
85003	openSUSE Security Update : Chromium (openSUSE-2015-513)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2015-5605

high

Tenable Plugins

critical

critical

critical