Multiple integer signedness errors in the opj_j2k_update_image_data function in j2k.c in OpenJPEG, as used in PDFium in Google Chrome before 49.0.2623.87, allow remote attackers to cause a denial of service (incorrect cast and out-of-bounds write) or possibly have unspecified other impact via crafted JPEG 2000 data.

Google Chrome Releases reports :

[589838] High CVE-2016-1643: Type confusion in Blink.

[590620] High CVE-2016-1644: Use-after-free in Blink.

[587227] High CVE-2016-1645: Out-of-bounds write in PDFium.

This update contains Chromium 49.0.2623.87 to fix the following issues :

  - CVE-2016-1643: Type confusion in Blink (boo#970514)

  - CVE-2016-1644: Use-after-free in Blink (boo#970509)

  - CVE-2016-1645: Out-of-bounds write in PDFium     (boo#970511)

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2016-1643     cloudfuzzer discovered a type confusion issue in     Blink/Webkit.

  - CVE-2016-1644     Atte Kettunen discovered a use-after-free issue in     Blink/Webkit.

  - CVE-2016-1645     An out-of-bounds write issue was discovered in the     pdfium library.

Updated chromium-browser packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Chromium is an open source web browser, powered by WebKit (Blink).

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when visited by the victim. (CVE-2016-1643, CVE-2016-1644, CVE-2016-1645)

All Chromium users should upgrade to these updated packages, which contain Chromium version 49.0.2623.87, which corrects these issues.
After installing the update, Chromium must be restarted for the changes to take effect.

The version of Google Chrome installed on the remote Mac OS X host is prior to 49.0.2623.87. It is, therefore, affected by multiple vulnerabilities :

  - A type confusion error exists in the Blink rendering     engine that allows a remote attacker, via a malicious     website, to execute arbitrary code. (CVE-2016-1643)

  - A use-after-free error exists in the Blink rendering     engine that allows a remote attacker, via a malicious     website, to deference already freed memory, resulting     in the execution of arbitrary code. (CVE-2016-1644)

  - An out-of-bounds write error exists in PDFium, the PDF     rendering library, that allows a remote attacker to     manipulate the system memory, resulting the execution     of arbitrary code. (CVE-2016-1645)

The version of Google Chrome installed on the remote Windows host is prior to 49.0.2623.87. It is, therefore, affected by multiple vulnerabilities :

  - A type confusion error exists in the Blink rendering     engine that allows a remote attacker, via a malicious     website, to execute arbitrary code. (CVE-2016-1643)

  - A use-after-free error exists in the Blink rendering     engine that allows a remote attacker, via a malicious     website, to deference already freed memory, resulting     in the execution of arbitrary code. (CVE-2016-1644)

  - An out-of-bounds write error exists in PDFium, the PDF     rendering library, that allows a remote attacker to     manipulate the system memory, resulting the execution     of arbitrary code. (CVE-2016-1645)

ID	Name	Product	Family	Severity
90288	FreeBSD : chromium -- multiple vulnerabilities (5c288f68-c7ca-4c0d-b7dc-1ec6295200b3)	Nessus	FreeBSD Local Security Checks	high
90056	openSUSE Security Update : Chromium (openSUSE-2016-364)	Nessus	SuSE Local Security Checks	high
90055	openSUSE Security Update : Chromium (openSUSE-2016-362)	Nessus	SuSE Local Security Checks	high
89851	Debian DSA-3513-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	high
89821	RHEL 6 : chromium-browser (RHSA-2016:0429)	Nessus	Red Hat Local Security Checks	high
89787	Google Chrome < 49.0.2623.87 Multiple RCE	Nessus	MacOS X Local Security Checks	high
89786	Google Chrome < 49.0.2623.87 Multiple RCE	Nessus	Windows	high

Detections

Analytics

CVE-2016-1645

high

Tenable Plugins

high

high

high

high

high

high

high