The ContainerNode::parserInsertBefore function in core/dom/ContainerNode.cpp in Blink, as used in Google Chrome before 46.0.2490.71, proceeds with a DOM tree insertion in certain cases where a parent node no longer contains a child node, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code.

The remote host is affected by the vulnerability described in GLSA-201603-09 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in the Chromium web       browser. Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information, or bypass security restrictions.
  Workaround :

    There is no known workaround at this time.

The version of Google Chrome installed on the remote host is prior to 46.0.2490.71 and is affected by multiple vulnerabilities :

 - Google Chrome contains an unspecified high severity flaw that may allow a context-dependent attacker to have an unspecified impact. No further details have been provided by the vendor. (CVE-2015-6763) 
 - Google Chrome contains a use-after-free error in 'service_worker/embedded_worker_instance.cc' that is triggered when handling 'EmbeddedWorkerInstance' startup sequence failures. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2015-6757)
 - Google Chrome contains a flaw in the ContainerNode::parserInsertBefore() function in 'dom/ContainerNode.cpp' that is triggered when removing a specific child during reparenting. This may allow a context-dependent attacker to bypass the same-origin policy. (CVE-2015-6755)
 - Google Chrome contains a flaw in the shouldTreatAsUniqueOrigin() function in 'weborigin/SecurityOrigin.cpp' that is triggered when handling the origin of a LocalStorage resource. This may allow a context-dependent attacker to disclose potentially sensitive information. (CVE-2015-6759)
 - Google Chrome contains a flaw in the CSSFontFaceSrcValue::fetch() function in 'css/CSSFontFaceSrcValue.cpp' that is triggered when handling CSS fonts. This may allow a context-dependent attacker to bypass Cross-Origin Resource Sharing (CORS) restrictions. (CVE-2015-6762)
 - Google V8 contains a use-after-free error in the SlotsBuffer::RemoveInvalidSlots() function in heap/mark-compact.cc. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2015-7834)
 - Google PDFium contains a use-after-free error in the CPDFSDK_Annot::GetPDFAnnot() function. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code (CVE-2015-6768).
 - Google PDFium contains a type-casting flaw in the CPDF_Document::GetPage() function in fpdfapi/fpdf_parser/fpdf_parser_document.cpp. This may allow a context-dependent attacker to potentially execute arbitrary code. (CVE-2015-6758)
 - ANGLE contains a flaw in the Image11::map() function in libANGLE/renderer/d3d/d3d11/Image11.cpp that is triggered when handling mapping failures after device-lost events. This may allow a context-dependent attacker to have an unspecified impact in an application linked against the library. (CVE-2015-6760)
 - FFmpeg contains a race condition in the update_dimensions() function in libavcodec/vp8.c. The issue is triggered when handling multi-threaded operations based on the coefficient-partition count. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2015-6761)

Chromium was update do the stable release 46.0.2490.71 to fix security issues.

The following vulnerabilities were fixed :

  - CVE-2015-6755: Cross-origin bypass in Blink

  - CVE-2015-6756: Use-after-free in PDFium

  - CVE-2015-6757: Use-after-free in ServiceWorker

  - CVE-2015-6758: Bad-cast in PDFium

  - CVE-2015-6759: Information leakage in LocalStorage

  - CVE-2015-6760: Improper error handling in libANGLE

  - CVE-2015-6761: Memory corruption in FFMpeg

  - CVE-2015-6762: CORS bypass via CSS fonts

  - CVE-2015-6763: Various fixes from internal audits,     fuzzing and other initiatives.

  - CVE-2015-7834: Multiple vulnerabilities in V8 fixed at     the tip of the 4.6 branch

USN-2770-1 fixed vulnerabilities in Oxide in Ubuntu 14.04 LTS and Ubuntu 15.04. This update provides the corresponding updates for Ubuntu 15.10.

It was discovered that ContainerNode::parserInsertBefore in Blink would incorrectly proceed with a DOM tree insertion in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass same origin restrictions. (CVE-2015-6755)

A use-after-free was discovered in the service worker implementation in Chromium. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking the program. (CVE-2015-6757)

It was discovered that Blink did not ensure that the origin of LocalStorage resources are considered unique. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to obtain sensitive information. (CVE-2015-6759)

A race condition and memory corruption was discovered in FFmpeg. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via renderer crash, or execute arbitrary code with the privileges of the sandboxed render process. (CVE-2015-6761)

It was discovered that CSSFontFaceSrcValue::fetch in Blink did not use CORS in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass same origin restrictions. (CVE-2015-6762)

Multiple security issues were discovered in Chromium. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking the program. (CVE-2015-6763)

Multiple security issues were discovered in V8. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial of service via renderer crash or execute arbitrary code with the privileges of the sandboxed render process. (CVE-2015-7834).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2770-1 advisory.

    It was discovered that ContainerNode::parserInsertBefore in Blink would incorrectly proceed with a DOM     tree insertion in some circumstances. If a user were tricked in to opening a specially crafted website, an     attacker could potentially exploit this to bypass same origin restrictions. (CVE-2015-6755)

    A use-after-free was discovered in the service worker implementation in Chromium. If a user were tricked     in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of     service via application crash, or execute arbitrary code with the privileges of the user invoking the     program. (CVE-2015-6757)

    It was discovered that Blink did not ensure that the origin of LocalStorage resources are considered     unique. If a user were tricked in to opening a specially crafted website, an attacker could potentially     exploit this to obtain sensitive information. (CVE-2015-6759)

    A race condition and memory corruption was discovered in FFmpeg. If a user were tricked in to opening a     specially crafted website, an attacker could potentially exploit this to cause a denial of service via     renderer crash, or execute arbitrary code with the privileges of the sandboxed render process.
    (CVE-2015-6761)

    It was discovered that CSSFontFaceSrcValue::fetch in Blink did not use CORS in some circumstances. If a     user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to     bypass same origin restrictions. (CVE-2015-6762)

    Multiple security issues were discovered in Chromium. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial     of service via application crash or execute arbitrary code with the privileges of the user invoking the     program. (CVE-2015-6763)

    Multiple security issues were discovered in V8. If a user were tricked in to opening a specially crafted     website, an attacker could potentially exploit these to read uninitialized memory, cause a denial of     service via renderer crash or execute arbitrary code with the privileges of the sandboxed render process.
    (CVE-2015-7834)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2015-1303     Mariusz Mlynski discovered a way to bypass the Same     Origin Policy in the DOM implementation.

  - CVE-2015-1304     Mariusz Mlynski discovered a way to bypass the Same     Origin Policy in the v8 JavaScript library.

  - CVE-2015-6755     Mariusz Mlynski discovered a way to bypass the Same     Origin Policy in blink/webkit.

  - CVE-2015-6756     A use-after-free issue was found in the pdfium library.

  - CVE-2015-6757     Collin Payne found a use-after-free issue in the     ServiceWorker implementation.

  - CVE-2015-6758     Atte Kettunen found an issue in the pdfium library.

  - CVE-2015-6759     Muneaki Nishimura discovered an information leak.

  - CVE-2015-6760     Ronald Crane discovered a logic error in the ANGLE     library involving lost device events.

  - CVE-2015-6761     Aki Helin and Khalil Zhani discovered a memory     corruption issue in the ffmpeg library.

  - CVE-2015-6762     Muneaki Nishimura discovered a way to bypass the Same     Origin Policy in the CSS implementation.

  - CVE-2015-6763     The chrome 46 development team found and fixed various     issues during internal auditing. Also multiple issues     were fixed in the v8 JavaScript library, version     4.6.85.23.

Updated chromium-browser packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Chromium is an open source web browser, powered by WebKit (Blink).

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when visited by the victim. (CVE-2015-6755, CVE-2015-6756, CVE-2015-6757, CVE-2015-6758, CVE-2015-6759, CVE-2015-6760, CVE-2015-6761, CVE-2015-6762, CVE-2015-6763)

All Chromium users should upgrade to these updated packages, which contain Chromium version 46.0.2490.71, which corrects these issues.
After installing the update, Chromium must be restarted for the changes to take effect.

The version of Google Chrome installed on the remote Mac OS X host is prior to 46.0.2490.71. It is, therefore, affected by multiple vulnerabilities :

  - A same-origin bypass vulnerability exists in Blink that     allows an attacker to bypass the same-origin policy.
    (CVE-2015-6755)

  - A use-after-free error exists in PDFium. A remote     attacker can exploit this to dereference already freed     memory, potentially resulting in the execution of     arbitrary code or a denial of service condition.
    (CVE-2015-6756)

  - A use-after-free error exists in ServiceWorker. A remote     attacker can exploit this to dereference already freed     memory, potentially resulting in the execution of     arbitrary code. (CVE-2015-6757)

  - An unspecified bad cast issue exists in PDFium that a     remote attacker can exploit to have an unspecified     impact. (CVE-2015-6758)

  - An unspecified flaw exists in LocalStorage that allows     an attacker to disclose sensitive information.
    (CVE-2015-6759)

  - An unspecified flaw exists when handling errors that     allows an attacker to have an unspecified impact.
    (CVE-2015-6760)

  - A memory corruption issues exists in FFMpeg due to     improper validation of user-supplied input. A remote     attacker can exploit this to execute arbitrary code.
    (CVE-2015-6761)

  - An unspecified flaw exists when handling CSS fonts. An     attacker can exploit this to bypass cross-origin     resource sharing (CORS) restrictions. (CVE-2015-6762)

  - Multiple unspecified high severity issues exist that     allow an attacker to have an unspecified impact.
    (CVE-2015-6763)

The version of Google Chrome installed on the remote Windows host is prior to 46.0.2490.71. It is, therefore, affected by multiple vulnerabilities :

  - A same-origin bypass vulnerability exists in Blink that     allows an attacker to bypass the same-origin policy.
    (CVE-2015-6755)

  - A use-after-free error exists in PDFium. A remote     attacker can exploit this to dereference already freed     memory, potentially resulting in the execution of     arbitrary code or a denial of service condition.
    (CVE-2015-6756)

  - A use-after-free error exists in ServiceWorker. A remote     attacker can exploit this to dereference already freed     memory, potentially resulting in the execution of     arbitrary code. (CVE-2015-6757)

  - An unspecified bad cast issue exists in PDFium that a     remote attacker can exploit to have an unspecified     impact. (CVE-2015-6758)

  - An unspecified flaw exists in LocalStorage that allows     an attacker to disclose sensitive information.
    (CVE-2015-6759)

  - An unspecified flaw exists when handling errors that     allows an attacker to have an unspecified impact.
    (CVE-2015-6760)

  - A memory corruption issues exists in FFMpeg due to     improper validation of user-supplied input. A remote     attacker can exploit this to execute arbitrary code.
    (CVE-2015-6761)

  - An unspecified flaw exists when handling CSS fonts. An     attacker can exploit this to bypass cross-origin     resource sharing (CORS) restrictions. (CVE-2015-6762)

  - Multiple unspecified high severity issues exist that     allow an attacker to have an unspecified impact.
    (CVE-2015-6763)

Google Chrome Releases reports :

24 security fixes in this release, including :

- [519558] High CVE-2015-6755: Cross-origin bypass in Blink. Credit to Mariusz Mlynski.

- [507316] High CVE-2015-6756: Use-after-free in PDFium. Credit to anonymous.

- [529520] High CVE-2015-6757: Use-after-free in ServiceWorker. Credit to Collin Payne.

- [522131] High CVE-2015-6758: Bad-cast in PDFium. Credit to Atte Kettunen of OUSPG.

- [514076] Medium CVE-2015-6759: Information leakage in LocalStorage.
Credit to Muneaki Nishimura (nishimunea).

- [519642] Medium CVE-2015-6760: Improper error handling in libANGLE.
Credit to lastland.net.

- [447860,532967] Medium CVE-2015-6761: Memory corruption in FFMpeg.
Credit to Aki Helin of OUSPG and anonymous.

- [512678] Low CVE-2015-6762: CORS bypass via CSS fonts. Credit to Muneaki Nishimura (nishimunea).

- [542517] CVE-2015-6763: Various fixes from internal audits, fuzzing and other initiatives.

- Multiple vulnerabilities in V8 fixed at the tip of the 4.6 branch (currently 4.6.85.23).

ID	Name	Product	Family	Severity
89902	GLSA-201603-09 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
9016	Google Chrome < 46.0.2490.71 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
86596	openSUSE Security Update : Chromium (openSUSE-2015-679)	Nessus	SuSE Local Security Checks	high
86565	Ubuntu 15.10 : oxide-qt vulnerabilities (USN-2770-2)	Nessus	Ubuntu Local Security Checks	high
86491	Ubuntu 14.04 LTS : Oxide vulnerabilities (USN-2770-1)	Nessus	Ubuntu Local Security Checks	high
86486	Debian DSA-3376-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	high
86414	RHEL 6 : chromium-browser (RHSA-2015:1912)	Nessus	Red Hat Local Security Checks	high
86381	Google Chrome < 46.0.2490.71 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
86380	Google Chrome < 46.0.2490.71 Multiple Vulnerabilities	Nessus	Windows	high
86377	FreeBSD : chromium -- multiple vulnerabilities (8301c04d-71df-11e5-9fcb-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2015-6755

high

Tenable Plugins

critical

high

high

high

high

high

high

high

high

high