Use-after-free vulnerability in content/browser/web_contents/web_contents_impl.cc in Google Chrome before 49.0.2623.75 allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering an image download after a certain data structure is deleted, as demonstrated by a favicon.ico download.

Chromium was updated to 49.0.2623.75 to fix the following security issues: (boo#969333)

  - CVE-2016-1630: Same-origin bypass in Blink

  - CVE-2016-1631: Same-origin bypass in Pepper Plugin

  - CVE-2016-1632: Bad cast in Extensions

  - CVE-2016-1633: Use-after-free in Blink

  - CVE-2016-1634: Use-after-free in Blink

  - CVE-2016-1635: Use-after-free in Blink

  - CVE-2016-1636: SRI Validation Bypass

  - CVE-2015-8126: Out-of-bounds access in libpng

  - CVE-2016-1637: Information Leak in Skia

  - CVE-2016-1638: WebAPI Bypass

  - CVE-2016-1639: Use-after-free in WebRTC

  - CVE-2016-1640: Origin confusion in Extensions UI

  - CVE-2016-1641: Use-after-free in Favicon

  - CVE-2016-1642: Various fixes from internal audits,     fuzzing and other initiatives

  - Multiple vulnerabilities in V8 fixed at the tip of the     4.9 branch (currently 4.9.385.26)

The remote host is affected by the vulnerability described in GLSA-201603-09 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in the Chromium web       browser. Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information, or bypass security restrictions.
  Workaround :

    There is no known workaround at this time.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2920-1 advisory.

    It was discovered that the ContainerNode::parserRemoveChild function in Blink mishandled widget updates in     some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could     potentially exploit this to bypass same-origin restrictions. (CVE-2016-1630)

    It was discovered that the PPB_Flash_MessageLoop_Impl::InternalRun

    function in Chromium mishandled nested message loops. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit this to bypass same-origin restrictions.
    (CVE-2016-1631)

    Multiple use-after-frees were discovered in Blink. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit these to cause a denial of service via renderer     crash or execute arbitrary code with the privileges of the sandboxed render process. (CVE-2016-1633,     CVE-2016-1634, CVE-2016-1644)

    It was discovered that the PendingScript::notifyFinished function in Blink relied on memory-cache     information about integrity-check occurrences instead of integrity-check successes. If a user were tricked     in to opening a specially crafted website, an attacker could potentially exploit this to bypass     Subresource Integrity (SRI) protections. (CVE-2016-1636)

    It was discovered that the SkATan2_255 function in Skia mishandled arctangent calculations. If a user were     tricked in to opening a specially crafted website, an attacker could potentially exploit this to obtain     sensitive information. (CVE-2016-1637)

    A use-after-free was discovered in Chromium. If a user were tricked in to opening a specially crafted     website, an attacker could potentially exploit this to cause a denial of service via application crash, or     execute arbitrary code with the privileges of the user invoking the program. (CVE-2016-1641)

    Multiple security issues were discovered in Chromium. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial     of service via application crash or execute arbitrary code with the privileges of the user invoking the     program. (CVE-2016-1642)

    A type-confusion bug was discovered in Blink. If a user were tricked in to opening a specially crafted     website, an attacker could potentially exploit this to cause a denial of service via renderer crash or     execute arbitrary code with the privileges of the sandboxed render process. (CVE-2016-1643)

    Multiple security issues were discovered in V8. If a user were tricked in to opening a specially crafted     website, an attacker could potentially exploit these to read uninitialized memory, cause a denial of     service via renderer crash or execute arbitrary code with the privileges of the sandboxed render process.
    (CVE-2016-2843)

    An invalid cast was discovered in Blink. If a user were tricked in to opening a specially crafted website,     an attacker could potentially exploit this to cause a denial of service via renderer crash or execute     arbitrary code with the privileges of the sandboxed render process. (CVE-2016-2844)

    It was discovered that the Content Security Policy (CSP) implementation in Blink did not ignore a URL's     path component in the case of a ServiceWorker fetch. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit this to obtain sensitive information.
    (CVE-2016-2845)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Chromium was updated to 49.0.2623.75 to fix the following security issues: (boo#969333)

  - CVE-2016-1630: Same-origin bypass in Blink

  - CVE-2016-1631: Same-origin bypass in Pepper Plugin

  - CVE-2016-1632: Bad cast in Extensions

  - CVE-2016-1633: Use-after-free in Blink

  - CVE-2016-1634: Use-after-free in Blink

  - CVE-2016-1635: Use-after-free in Blink

  - CVE-2016-1636: SRI Validation Bypass

  - CVE-2015-8126: Out-of-bounds access in libpng

  - CVE-2016-1637: Information Leak in Skia

  - CVE-2016-1638: WebAPI Bypass

  - CVE-2016-1639: Use-after-free in WebRTC

  - CVE-2016-1640: Origin confusion in Extensions UI

  - CVE-2016-1641: Use-after-free in Favicon

  - CVE-2016-1642: Various fixes from internal audits,     fuzzing and other initiatives

  - Multiple vulnerabilities in V8 fixed at the tip of the     4.9 branch (currently 4.9.385.26)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Chromium was updated to 49.0.2623.75 to fix the following security issues: (boo#969333)

  - CVE-2016-1630: Same-origin bypass in Blink

  - CVE-2016-1631: Same-origin bypass in Pepper Plugin

  - CVE-2016-1632: Bad cast in Extensions

  - CVE-2016-1633: Use-after-free in Blink

  - CVE-2016-1634: Use-after-free in Blink

  - CVE-2016-1635: Use-after-free in Blink

  - CVE-2016-1636: SRI Validation Bypass

  - CVE-2015-8126: Out-of-bounds access in libpng

  - CVE-2016-1637: Information Leak in Skia

  - CVE-2016-1638: WebAPI Bypass

  - CVE-2016-1639: Use-after-free in WebRTC

  - CVE-2016-1640: Origin confusion in Extensions UI

  - CVE-2016-1641: Use-after-free in Favicon

  - CVE-2016-1642: Various fixes from internal audits,     fuzzing and other initiatives

  - Multiple vulnerabilities in V8 fixed at the tip of the     4.9 branch (currently 4.9.385.26)

This plugin has been renamed to openSUSE-2016-664.nasl, plugin ID 90107.

Updated chromium-browser packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Chromium is an open source web browser, powered by WebKit (Blink).

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when visited by the victim. (CVE-2016-1630, CVE-2016-1631, CVE-2016-1632, CVE-2016-1633, CVE-2016-1634, CVE-2016-1635, CVE-2016-1636, CVE-2016-1637, CVE-2016-1638, CVE-2016-1639, CVE-2016-1640, CVE-2016-1641, CVE-2016-1642)

All Chromium users should upgrade to these updated packages, which contain Chromium version 49.0.2623.75, which corrects these issues.
After installing the update, Chromium must be restarted for the changes to take effect.

Google Chrome Releases reports :

[560011] High CVE-2016-1630: Same-origin bypass in Blink.

[569496] High CVE-2016-1631: Same-origin bypass in Pepper Plugin.

[549986] High CVE-2016-1632: Bad cast in Extensions.

[572537] High CVE-2016-1633: Use-after-free in Blink.

[559292] High CVE-2016-1634: Use-after-free in Blink.

[585268] High CVE-2016-1635: Use-after-free in Blink.

[584155] High CVE-2016-1636: SRI Validation Bypass.

[555544] Medium CVE-2016-1637: Information Leak in Skia.

[585282] Medium CVE-2016-1638: WebAPI Bypass.

[572224] Medium CVE-2016-1639: Use-after-free in WebRTC.

[550047] Medium CVE-2016-1640: Origin confusion in Extensions UI.

[583718] Medium CVE-2016-1641: Use-after-free in Favicon.

[591402] CVE-2016-1642: Various fixes from internal audits, fuzzing and other initiatives.

Multiple vulnerabilities in V8 fixed.

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2015-8126     Joerg Bornemann discovered multiple buffer overflow     issues in the libpng library.

  - CVE-2016-1630     Mariusz Mlynski discovered a way to bypass the Same     Origin Policy in Blink/Webkit.

  - CVE-2016-1631     Mariusz Mlynski discovered a way to bypass the Same     Origin Policy in the Pepper Plugin API.

  - CVE-2016-1632     A bad cast was discovered.

  - CVE-2016-1633     cloudfuzzer discovered a use-after-free issue in     Blink/Webkit.

  - CVE-2016-1634     cloudfuzzer discovered a use-after-free issue in     Blink/Webkit.

  - CVE-2016-1635     Rob Wu discovered a use-after-free issue in     Blink/Webkit.

  - CVE-2016-1636     A way to bypass SubResource Integrity validation was     discovered.

  - CVE-2016-1637     Keve Nagy discovered an information leak in the skia     library.

  - CVE-2016-1638     Rob Wu discovered a WebAPI bypass issue.

  - CVE-2016-1639     Khalil Zhani discovered a use-after-free issue in the     WebRTC implementation.

  - CVE-2016-1640     Luan Herrera discovered an issue with the Extensions     user interface.

  - CVE-2016-1641     Atte Kettunen discovered a use-after-free issue in the     handling of favorite icons.

  - CVE-2016-1642     The chrome 49 development team found and fixed various     issues during internal auditing. Also multiple issues     were fixed in the v8 JavaScript library, version     4.9.385.26.

The version of Google Chrome installed on the remote Mac OS X host is prior to 49.0.2623.75. It is, therefore, affected by multiple vulnerabilities :

  - Multiple overflow conditions exist in the libpng library     in the png_set_PLTE() and png_get_PLTE() functions due     to improper handling of bit depths less than eight. A     remote attacker can exploit this, via a specially     crafted PNG image, to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2015-8126)

  - An unspecified flaw exists in Blink that allows an     attacker to bypass the same-origin policy.
    (CVE-2016-1630)

  - An unspecified flaw exists in the Pepper plugin that     allows an attacker to bypass the same-origin policy.
    (CVE-2016-1631)

  - A bad cast flaw exists in the Extensions component that     allows an attacker to have an unspecified impact.
    (CVE-2016-1632)

  - Multiple use-after-free errors exist in Blink. A remote     attacker can exploit these issues to dereference already     freed memory, resulting in the execution of arbitrary     code. (CVE-2016-1633, CVE-2016-1634, CVE-2016-1635)

  - An unspecified flaw exists that allows an attacker to     bypass SRI validation. (CVE-2016-1636)

  - An unspecified flaw exists that allows an attacker to     disclose sensitive information. (CVE-2016-1637)

  - An unspecified flaw exists that allows an attacker to     bypass the webAPI. (CVE-2016-1638)

  - A use-after-free error exists in WebRTC. A remote     attacker can exploit this issue to dereference already     freed memory, resulting in the execution of arbitrary     code. (CVE-2016-1639)

  - An unspecified origin confusion flaw exists in the     Extensions UI that allows an attacker to have an     unspecified impact. (CVE-2016-1640)

  - A use-after-free error exists in Favicon. A remote     attacker can exploit this issue to dereference already     freed memory, resulting in the execution of arbitrary     code. (CVE-2016-1641)

  - Multiple flaws exist that allow a remote attacker to     execute arbitrary code. (CVE-2016-1642)

  - Multiple unspecified flaws exist in Google V8 in     runetime-scopes.cc that allows an attacker to cause a     denial of service condition or the execution of     arbitrary code. (CVE-2016-2843)

The version of Google Chrome installed on the remote Windows host is prior to 49.0.2623.75. It is, therefore, affected by multiple vulnerabilities :

  - Multiple overflow conditions exist in the libpng library     in the png_set_PLTE() and png_get_PLTE() functions due     to improper handling of bit depths less than eight. A     remote attacker can exploit this, via a specially     crafted PNG image, to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2015-8126)

  - An unspecified flaw exists in Blink that allows an     attacker to bypass the same-origin policy.
    (CVE-2016-1630)

  - An unspecified flaw exists in the Pepper plugin that     allows an attacker to bypass the same-origin policy.
    (CVE-2016-1631)

  - A bad cast flaw exists in the Extensions component that     allows an attacker to have an unspecified impact.
    (CVE-2016-1632)

  - Multiple use-after-free errors exist in Blink. A remote     attacker can exploit these issues to dereference already     freed memory, resulting in the execution of arbitrary     code. (CVE-2016-1633, CVE-2016-1634, CVE-2016-1635)

  - An unspecified flaw exists that allows an attacker to     bypass SRI validation. (CVE-2016-1636)

  - An unspecified flaw exists that allows an attacker to     disclose sensitive information. (CVE-2016-1637)

  - An unspecified flaw exists that allows an attacker to     bypass the webAPI. (CVE-2016-1638)

  - A use-after-free error exists in WebRTC. A remote     attacker can exploit this issue to dereference already     freed memory, resulting in the execution of arbitrary     code. (CVE-2016-1639)

  - An unspecified origin confusion flaw exists in the     Extensions UI that allows an attacker to have an     unspecified impact. (CVE-2016-1640)

  - A use-after-free error exists in Favicon. A remote     attacker can exploit this issue to dereference already     freed memory, resulting in the execution of arbitrary     code. (CVE-2016-1641)

  - Multiple flaws exist that allow a remote attacker to     execute arbitrary code. (CVE-2016-1642)

  - Multiple unspecified flaws exist in Google V8 in     runetime-scopes.cc that allows an attacker to cause a     denial of service condition or the execution of     arbitrary code. (CVE-2016-2843

ID	Name	Product	Family	Severity
90107	openSUSE Security Update : Chromium (openSUSE-2016-664)	Nessus	SuSE Local Security Checks	critical
89912	openSUSE Security Update : Chromium (openSUSE-2016-330)	Nessus	SuSE Local Security Checks	critical
89902	GLSA-201603-09 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
89865	Ubuntu 14.04 LTS : Oxide vulnerabilities (USN-2920-1)	Nessus	Ubuntu Local Security Checks	critical
89813	openSUSE Security Update : Chromium (openSUSE-2016-316)	Nessus	SuSE Local Security Checks	critical
89775	SUSE SLES12 Security Update : Chromium (SUSE-SU-2016:0665-1)	Nessus	SuSE Local Security Checks	critical
89721	openSUSE Security Update : 4789 (4789-1) (deprecated)	Nessus	SuSE Local Security Checks	critical
89720	RHEL 6 : chromium-browser (RHSA-2016:0359)	Nessus	Red Hat Local Security Checks	critical
89711	FreeBSD : chromium -- multiple vulnerabilities (f85fa236-e2a6-412e-b5c7-c42120892de5)	Nessus	FreeBSD Local Security Checks	critical
89697	Debian DSA-3507-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	critical
89686	Google Chrome < 49.0.2623.75 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
89685	Google Chrome < 49.0.2623.75 Multiple Vulnerabilities	Nessus	Windows	critical

Detections

Analytics

CVE-2016-1641

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical