WebKit/Source/core/layout/LayoutObject.cpp in Blink, as used in Google Chrome before 49.0.2623.87, does not properly restrict relayout scheduling, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted HTML document.

Google Chrome Releases reports :

[589838] High CVE-2016-1643: Type confusion in Blink.

[590620] High CVE-2016-1644: Use-after-free in Blink.

[587227] High CVE-2016-1645: Out-of-bounds write in PDFium.

This update contains Chromium 49.0.2623.87 to fix the following issues :

  - CVE-2016-1643: Type confusion in Blink (boo#970514)

  - CVE-2016-1644: Use-after-free in Blink (boo#970509)

  - CVE-2016-1645: Out-of-bounds write in PDFium     (boo#970511)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2920-1 advisory.

    It was discovered that the ContainerNode::parserRemoveChild function in Blink mishandled widget updates in     some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could     potentially exploit this to bypass same-origin restrictions. (CVE-2016-1630)

    It was discovered that the PPB_Flash_MessageLoop_Impl::InternalRun

    function in Chromium mishandled nested message loops. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit this to bypass same-origin restrictions.
    (CVE-2016-1631)

    Multiple use-after-frees were discovered in Blink. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit these to cause a denial of service via renderer     crash or execute arbitrary code with the privileges of the sandboxed render process. (CVE-2016-1633,     CVE-2016-1634, CVE-2016-1644)

    It was discovered that the PendingScript::notifyFinished function in Blink relied on memory-cache     information about integrity-check occurrences instead of integrity-check successes. If a user were tricked     in to opening a specially crafted website, an attacker could potentially exploit this to bypass     Subresource Integrity (SRI) protections. (CVE-2016-1636)

    It was discovered that the SkATan2_255 function in Skia mishandled arctangent calculations. If a user were     tricked in to opening a specially crafted website, an attacker could potentially exploit this to obtain     sensitive information. (CVE-2016-1637)

    A use-after-free was discovered in Chromium. If a user were tricked in to opening a specially crafted     website, an attacker could potentially exploit this to cause a denial of service via application crash, or     execute arbitrary code with the privileges of the user invoking the program. (CVE-2016-1641)

    Multiple security issues were discovered in Chromium. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial     of service via application crash or execute arbitrary code with the privileges of the user invoking the     program. (CVE-2016-1642)

    A type-confusion bug was discovered in Blink. If a user were tricked in to opening a specially crafted     website, an attacker could potentially exploit this to cause a denial of service via renderer crash or     execute arbitrary code with the privileges of the sandboxed render process. (CVE-2016-1643)

    Multiple security issues were discovered in V8. If a user were tricked in to opening a specially crafted     website, an attacker could potentially exploit these to read uninitialized memory, cause a denial of     service via renderer crash or execute arbitrary code with the privileges of the sandboxed render process.
    (CVE-2016-2843)

    An invalid cast was discovered in Blink. If a user were tricked in to opening a specially crafted website,     an attacker could potentially exploit this to cause a denial of service via renderer crash or execute     arbitrary code with the privileges of the sandboxed render process. (CVE-2016-2844)

    It was discovered that the Content Security Policy (CSP) implementation in Blink did not ignore a URL's     path component in the case of a ServiceWorker fetch. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit this to obtain sensitive information.
    (CVE-2016-2845)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2016-1643     cloudfuzzer discovered a type confusion issue in     Blink/Webkit.

  - CVE-2016-1644     Atte Kettunen discovered a use-after-free issue in     Blink/Webkit.

  - CVE-2016-1645     An out-of-bounds write issue was discovered in the     pdfium library.

Updated chromium-browser packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Chromium is an open source web browser, powered by WebKit (Blink).

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when visited by the victim. (CVE-2016-1643, CVE-2016-1644, CVE-2016-1645)

All Chromium users should upgrade to these updated packages, which contain Chromium version 49.0.2623.87, which corrects these issues.
After installing the update, Chromium must be restarted for the changes to take effect.

The version of Google Chrome installed on the remote Mac OS X host is prior to 49.0.2623.87. It is, therefore, affected by multiple vulnerabilities :

  - A type confusion error exists in the Blink rendering     engine that allows a remote attacker, via a malicious     website, to execute arbitrary code. (CVE-2016-1643)

  - A use-after-free error exists in the Blink rendering     engine that allows a remote attacker, via a malicious     website, to deference already freed memory, resulting     in the execution of arbitrary code. (CVE-2016-1644)

  - An out-of-bounds write error exists in PDFium, the PDF     rendering library, that allows a remote attacker to     manipulate the system memory, resulting the execution     of arbitrary code. (CVE-2016-1645)

The version of Google Chrome installed on the remote Windows host is prior to 49.0.2623.87. It is, therefore, affected by multiple vulnerabilities :

  - A type confusion error exists in the Blink rendering     engine that allows a remote attacker, via a malicious     website, to execute arbitrary code. (CVE-2016-1643)

  - A use-after-free error exists in the Blink rendering     engine that allows a remote attacker, via a malicious     website, to deference already freed memory, resulting     in the execution of arbitrary code. (CVE-2016-1644)

  - An out-of-bounds write error exists in PDFium, the PDF     rendering library, that allows a remote attacker to     manipulate the system memory, resulting the execution     of arbitrary code. (CVE-2016-1645)

ID	Name	Product	Family	Severity
90288	FreeBSD : chromium -- multiple vulnerabilities (5c288f68-c7ca-4c0d-b7dc-1ec6295200b3)	Nessus	FreeBSD Local Security Checks	high
90056	openSUSE Security Update : Chromium (openSUSE-2016-364)	Nessus	SuSE Local Security Checks	high
90055	openSUSE Security Update : Chromium (openSUSE-2016-362)	Nessus	SuSE Local Security Checks	high
89865	Ubuntu 14.04 LTS : Oxide vulnerabilities (USN-2920-1)	Nessus	Ubuntu Local Security Checks	critical
89851	Debian DSA-3513-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	high
89821	RHEL 6 : chromium-browser (RHSA-2016:0429)	Nessus	Red Hat Local Security Checks	high
89787	Google Chrome < 49.0.2623.87 Multiple RCE	Nessus	MacOS X Local Security Checks	high
89786	Google Chrome < 49.0.2623.87 Multiple RCE	Nessus	Windows	high

Detections

Analytics

CVE-2016-1644

high

Tenable Plugins

high

high

high

critical

high

high

high

high