The TreeScope::adoptIfNeeded function in WebKit/Source/core/dom/TreeScope.cpp in the DOM implementation in Blink, as used in Google Chrome before 50.0.2661.102, does not prevent script execution during node-adoption operations, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.

Chromium was updated to 51.0.2704.103 to fix three vulnerabilities :

  - CVE-2016-1704: Various fixes from internal audits,     fuzzing and other initiatives (shared identifier)     (boo#985397)

Includes vulnerability fixes from 50.0.2661.102 (boo#979859) :

  - CVE-2016-1667: Same origin bypass in DOM

  - CVE-2016-1668: Same origin bypass in Blink V8 bindings

  - CVE-2016-1669: Buffer overflow in V8

  - CVE-2016-1670: Race condition in loader

Includes vulnerability fixes from 50.0.2661.94 (boo#977830) :

  - CVE-2016-1660: Out-of-bounds write in Blink

  - CVE-2016-1661: Memory corruption in cross-process frames

  - CVE-2016-1662: Use-after-free in extensions

  - CVE-2016-1663: Use-after-free in Blink&rsquo;s V8     bindings

  - CVE-2016-1664: Address bar spoofing

  - CVE-2016-1665: Information leak in V8

  - CVE-2016-1666: Various fixes from internal audits,     fuzzing and other initiatives

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2016-1667     Mariusz Mylinski discovered a cross-origin bypass.

  - CVE-2016-1668     Mariusz Mylinski discovered a cross-origin bypass in     bindings to v8.

  - CVE-2016-1669     Choongwoo Han discovered a buffer overflow in the v8     JavaScript library.

  - CVE-2016-1670     A race condition was found that could cause the renderer     process to reuse ids that should have been unique.

  - CVE-2016-1672     Mariusz Mylinski discovered a cross-origin bypass in     extension bindings.

  - CVE-2016-1673     Mariusz Mylinski discovered a cross-origin bypass in     Blink/Webkit.

  - CVE-2016-1674     Mariusz Mylinski discovered another cross-origin bypass     in extension bindings.

  - CVE-2016-1675     Mariusz Mylinski discovered another cross-origin bypass     in Blink/Webkit.

  - CVE-2016-1676     Rob Wu discovered a cross-origin bypass in extension     bindings.

  - CVE-2016-1677     Guang Gong discovered a type confusion issue in the v8     JavaScript library.

  - CVE-2016-1678     Christian Holler discovered an overflow issue in the v8     JavaScript library.

  - CVE-2016-1679     Rob Wu discovered a use-after-free issue in the bindings     to v8.

  - CVE-2016-1680     Atte Kettunen discovered a use-after-free issue in the     skia library.

  - CVE-2016-1681     Aleksandar Nikolic discovered an overflow issue in the     pdfium library.

  - CVE-2016-1682     KingstonTime discovered a way to bypass the Content     Security Policy.

  - CVE-2016-1683     Nicolas Gregoire discovered an out-of-bounds write issue     in the libxslt library.

  - CVE-2016-1684     Nicolas Gregoire discovered an integer overflow issue in     the libxslt library.

  - CVE-2016-1685     Ke Liu discovered an out-of-bounds read issue in the     pdfium library.

  - CVE-2016-1686     Ke Liu discovered another out-of-bounds read issue in     the pdfium library.

  - CVE-2016-1687     Rob Wu discovered an information leak in the handling of     extensions.

  - CVE-2016-1688     Max Korenko discovered an out-of-bounds read issue in     the v8 JavaScript library.

  - CVE-2016-1689     Rob Wu discovered a buffer overflow issue.

  - CVE-2016-1690     Rob Wu discovered a use-after-free issue.

  - CVE-2016-1691     Atte Kettunen discovered a buffer overflow issue in the     skia library.

  - CVE-2016-1692     Til Jasper Ullrich discovered a cross-origin bypass     issue.

  - CVE-2016-1693     Khalil Zhani discovered that the Software Removal Tool     download was done over an HTTP connection.

  - CVE-2016-1694     Ryan Lester and Bryant Zadegan discovered that pinned     public keys would be removed when clearing the browser     cache.

  - CVE-2016-1695     The chrome development team found and fixed various     issues during internal auditing.

Google Chrome Releases reports :

5 security fixes in this release, including :

- [605766] High CVE-2016-1667: Same origin bypass in DOM. Credit to Mariusz Mlynski.

- [605910] High CVE-2016-1668: Same origin bypass in Blink V8 bindings. Credit to Mariusz Mlynski.

- [606115] High CVE-2016-1669: Buffer overflow in V8. Credit to Choongwoo Han.

- [578882] Medium CVE-2016-1670: Race condition in loader. Credit to anonymous.

- [586657] Medium CVE-2016-1671: Directory traversal using the file scheme on Android. Credit to Jann Horn.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2960-1 advisory.

    An out of bounds write was discovered in Blink. If a user were tricked in to opening a specially crafted     website, an attacker could potentially exploit this to cause a denial of service via renderer crash, or     execute arbitrary code. (CVE-2016-1660)

    It was discovered that Blink assumes that a frame which passes same-origin checks is local in some cases.
    If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit     this to cause a denial of service via renderer crash, or execute arbitrary code. (CVE-2016-1661)

    A use-after-free was discovered in the V8 bindings in Blink. If a user were tricked in to opening a     specially crafted website, an attacker could potentially exploit this to cause a denial of service via     renderer crash, or execute arbitrary code. (CVE-2016-1663)

    It was discovered that the JSGenericLowering class in V8 mishandles comparison operators. If a user were     tricked in to opening a specially crafted website, an attacker could potentially exploit this to obtain     sensitive information. (CVE-2016-1665)

    Multiple security issues were discovered in Chromium. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial     of service via application crash or execute arbitrary code. (CVE-2016-1666)

    It was discovered that the TreeScope::adoptIfNeeded function in Blink does not prevent script execution     during node-adoption operations. If a user were tricked in to opening a specially crafted website, an     attacker could potentially exploit this to bypass same origin restrictions. (CVE-2016-1667)

    It was discovered that the forEachForBinding in the V8 bindings in Blink uses an improper creation     context. If a user were tricked in to opening a specially crafted website, an attacker could potentially     exploit this to bypass same origin restrictions. (CVE-2016-1668)

    A buffer overflow was discovered in V8. If a user were tricked in to opening a specially crafted website,     an attacker could potentially exploit this to cause a denial of service via renderer crash, or execute     arbitrary code. (CVE-2016-1669)

    A race condition was discovered in ResourceDispatcherHostImpl in Chromium. An attacker could potentially     exploit this to make arbitrary HTTP requests. (CVE-2016-1670)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Chromium was updated to 50.0.2661.102 to fix four vulnerabilities (boo#979859) :

  - CVE-2016-1667: Same origin bypass in DOM

  - CVE-2016-1668: Same origin bypass in Blink V8 bindings

  - CVE-2016-1669: Buffer overflow in V8

  - CVE-2016-1670: Race condition in loader

The remote host is affected by the vulnerability described in GLSA-201605-02 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in the Chromium web       browser. Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information, or bypass security restrictions.
  Workaround :

    There is no known workaround at this time.

An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Chromium is an open source web browser, powered by WebKit (Blink).

This update upgrades Chromium to version 50.0.2661.102.

Security Fix(es) :

* Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when visited by the victim. (CVE-2016-1667, CVE-2016-1668, CVE-2016-1669, CVE-2016-1670)

The version of Google Chrome installed on the remote Mac OS X host is prior to 50.0.2661.102. It is, therefore, affected by multiple vulnerabilities :

  - A same-origin bypass vulnerability exists in DOM due to     scripts being permitted run while a node is being     adopted. A context-dependent attacker can exploit this     to bypass the same-origin policy. (CVE-2016-1667)

  - A same-origin bypass vulnerability exists due to a flaw     in the Blink V8 bindings. A context-dependent attacker     can exploit this to bypass the same-origin policy.
    (CVE-2016-1668)

  - An overflow condition exists in V8 due to improper     validation of user-supplied input. A context-dependent     attacker can exploit this to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2016-1669)

  - A race condition exists in the loader related to the use     of ids. An attacker can exploit this to have an     unspecified impact. (CVE-2016-1670)

  - Multiple type confusion errors exist in the bundled     version of Adobe Flash that allow an attacker to execute     arbitrary code. (CVE-2016-1105, CVE-2016-4117)

  - Multiple use-after-free errors exist in the bundled     version of Adobe Flash that allow an attacker to execute     arbitrary code. (CVE-2016-1097, CVE-2016-1106,     CVE-2016-1107, CVE-2016-1108, CVE-2016-1109,     CVE-2016-1110, CVE-2016-4108, CVE-2016-4110,     CVE-2016-4121)

  - A heap buffer overflow condition exists in the bundled     version of Adobe Flash that allows an attacker to     execute arbitrary code. (CVE-2016-1101)

  - An unspecified buffer overflow exists in the bundled     version of Adobe Flash that allows an attacker to     execute arbitrary code. (CVE-2016-1103)

  - Multiple memory corruption issues exist in the bundled     version of Adobe Flash that allow an attacker to execute     arbitrary code. (CVE-2016-1096, CVE-2016-1098,     CVE-2016-1099, CVE-2016-1100, CVE-2016-1102,     CVE-2016-1104, CVE-2016-4109, CVE-2016-4111,     CVE-2016-4112, CVE-2016-4113, CVE-2016-4114,     CVE-2016-4115, CVE-2016-4120, CVE-2016-4160,     CVE-2016-4161, CVE-2016-4162, CVE-2016-4163)

  - A flaw exists in the bundled version of Adobe Flash when     loading dynamic-link libraries. An attacker can exploit     this, via a specially crafted .dll file, to execute     arbitrary code. (CVE-2016-4116)

The version of Google Chrome installed on the remote Windows host is prior to 50.0.2661.102. It is, therefore, affected by multiple vulnerabilities :

  - A same-origin bypass vulnerability exists in DOM due to     scripts being permitted run while a node is being     adopted. A context-dependent attacker can exploit this     to bypass the same-origin policy. (CVE-2016-1667)

  - A same-origin bypass vulnerability exists due to a flaw     in the Blink V8 bindings. A context-dependent attacker     can exploit this to bypass the same-origin policy.
    (CVE-2016-1668)

  - An overflow condition exists in V8 due to improper     validation of user-supplied input. A context-dependent     attacker can exploit this to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2016-1669)

  - A race condition exists in the loader related to the use     of ids. An attacker can exploit this to have an     unspecified impact. (CVE-2016-1670)

  - Multiple type confusion errors exist in the bundled     version of Adobe Flash that allow an attacker to execute     arbitrary code. (CVE-2016-1105, CVE-2016-4117)

  - Multiple use-after-free errors exist in the bundled     version of Adobe Flash that allow an attacker to execute     arbitrary code. (CVE-2016-1097, CVE-2016-1106,     CVE-2016-1107, CVE-2016-1108, CVE-2016-1109,     CVE-2016-1110, CVE-2016-4108, CVE-2016-4110,     CVE-2016-4121)

  - A heap buffer overflow condition exists in the bundled     version of Adobe Flash that allows an attacker to     execute arbitrary code. (CVE-2016-1101)

  - An unspecified buffer overflow exists in the bundled     version of Adobe Flash that allows an attacker to     execute arbitrary code. (CVE-2016-1103)

  - Multiple memory corruption issues exist in the bundled     version of Adobe Flash that allow an attacker to execute     arbitrary code. (CVE-2016-1096, CVE-2016-1098,     CVE-2016-1099, CVE-2016-1100, CVE-2016-1102,     CVE-2016-1104, CVE-2016-4109, CVE-2016-4111,     CVE-2016-4112, CVE-2016-4113, CVE-2016-4114,     CVE-2016-4115, CVE-2016-4120, CVE-2016-4160,     CVE-2016-4161, CVE-2016-4162, CVE-2016-4163)

  - A flaw exists in the bundled version of Adobe Flash when     loading dynamic-link libraries. An attacker can exploit     this, via a specially crafted .dll file, to execute     arbitrary code. (CVE-2016-4116)

ID	Name	Product	Family	Severity
91848	openSUSE Security Update : Chromium (openSUSE-2016-756)	Nessus	SuSE Local Security Checks	critical
91429	Debian DSA-3590-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	high
91371	FreeBSD : chromium -- multiple vulnerabilities (4dfafa16-24ba-11e6-bd31-3065ec8fd3ec)	Nessus	FreeBSD Local Security Checks	high
91257	Ubuntu 14.04 LTS / 16.04 LTS : Oxide vulnerabilities (USN-2960-1)	Nessus	Ubuntu Local Security Checks	critical
91177	openSUSE Security Update : Chromium (openSUSE-2016-584)	Nessus	SuSE Local Security Checks	high
91176	GLSA-201605-02 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
91157	RHEL 6 : chromium-browser (RHSA-2016:1080)	Nessus	Red Hat Local Security Checks	high
91129	Google Chrome < 50.0.2661.102 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
91128	Google Chrome < 50.0.2661.102 Multiple Vulnerabilities	Nessus	Windows	critical

Detections

Analytics

CVE-2016-1667

high

Tenable Plugins

critical

high

high

critical

high

critical

high

critical

critical