Skia, as used in Google Chrome before 51.0.2704.63, mishandles coincidence runs, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted curves, related to SkOpCoincidence.cpp and SkPathOpsCommon.cpp.

The remote host is affected by the vulnerability described in GLSA-201607-07 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in the Chromium web       browser. Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information, or bypass security restrictions.
  Workaround :

    There is no known workaround at this time.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2992-1 advisory.

    An unspecified security issue was discovered in Blink. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit this to bypass same-origin restrictions.
    (CVE-2016-1673)

    An issue was discovered with Document reattachment in Blink in some circumstances. If a user were tricked     in to opening a specially crafted website, an attacker could potentially exploit this to bypass same-     origin restrictions. (CVE-2016-1675)

    A type confusion bug was discovered in V8. If a user were tricked in to opening a specially crafted     website, an attacker could potentially exploit this to obtain sensitive information. (CVE-2016-1677)

    A heap overflow was discovered in V8. If a user were tricked in to opening a specially crafted website, an     attacker could potentially exploit this to cause a denial of service (application crash) or execute     arbitrary code. (CVE-2016-1678)

    A use-after-free was discovered in the V8ValueConverter implementation in Chromium in some circumstances.
    If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit     this to cause a denial of service (application crash) or execute arbitrary code. (CVE-2016-1679)

    A use-after-free was discovered in Skia. If a user were tricked in to opening a specially crafted website,     an attacker could potentially exploit this to cause a denial of service (application crash) or execute     arbitrary code. (CVE-2016-1680)

    A security issue was discovered in ServiceWorker registration in Blink in some circumstances. If a user     were tricked in to opening a specially crafted website, an attacker could potentially exploit this to     bypass Content Security Policy (CSP) protections. (CVE-2016-1682)

    An out-of-bounds memory access was discovered in libxslt. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit this to cause a denial of service (application     crash) or execute arbitrary code. (CVE-2016-1683)

    An integer overflow was discovered in libxslt. If a user were tricked in to opening a specially crafted     website, an attacker could potentially exploit this to cause a denial of service (application crash or     resource consumption). (CVE-2016-1684)

    An out-of-bounds read was discovered in the regular expression implementation in V8. If a user were     tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a     denial of service (application crash). (CVE-2016-1688)

    A heap overflow was discovered in Chromium. If a user were tricked in to opening a specially crafted     website, an attacker could potentially exploit this to cause a denial of service (application crash) or     execute arbitrary code. (CVE-2016-1689)

    A heap overflow was discovered in Skia. If a user were tricked in to opening a specially crafted website,     an attacker could potentially exploit this to cause a denial of service (application crash) or execute     arbitrary code. (CVE-2016-1691)

    It was discovered that Blink permits cross-origin loading of stylesheets by a service worker even when the     stylesheet download has an incorrect MIME type. If a user were tricked in to opening a specially crafted     website, an attacker could potentially exploit this to bypass same-origin restrictions. (CVE-2016-1692)

    Multiple security issues were discovered in Chromium. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial     of service (application crash) or execute arbitrary code. (CVE-2016-1695, CVE-2016-1703)

    It was discovered that Blink does not prevent frame navigation during DocumentLoader detach operations. If     a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this     to bypass same-origin restrictions. (CVE-2016-1697)

    A parameter sanitization bug was discovered in the devtools subsystem in Blink. An attacker could     potentially exploit this to bypass intended access restrictions. (CVE-2016-1699)

    An out-of-bounds read was discovered in Skia. If a user were tricked in to opening a specially crafted     website, an attacker could potentially exploit this to cause a denial of service (application crash).
    (CVE-2016-1702)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Chromium was updated to 51.0.2704.79 to fix the following vulnerabilities :

  - CVE-2016-1696: Cross-origin bypass in Extension bindings

  - CVE-2016-1697: Cross-origin bypass in Blink

  - CVE-2016-1698: Information leak in Extension bindings

  - CVE-2016-1699: Parameter sanitization failure in     DevTools

  - CVE-2016-1700: Use-after-free in Extensions

  - CVE-2016-1701: Use-after-free in Autofill

  - CVE-2016-1702: Out-of-bounds read in Skia

  - CVE-2016-1703: Various fixes from internal audits,     fuzzing and other initiatives Also includes     vulnerabilities fixed in 51.0.2704.63 (boo#981886) :

  - CVE-2016-1672: Cross-origin bypass in extension bindings

  - CVE-2016-1673: Cross-origin bypass in Blink

  - CVE-2016-1674: Cross-origin bypass in extensions

  - CVE-2016-1675: Cross-origin bypass in Blink

  - CVE-2016-1676: Cross-origin bypass in extension bindings

  - CVE-2016-1677: Type confusion in V8

  - CVE-2016-1678: Heap overflow in V8

  - CVE-2016-1679: Heap use-after-free in V8 bindings

  - CVE-2016-1680: Heap use-after-free in Skia

  - CVE-2016-1681: Heap overflow in PDFium

  - CVE-2016-1682: CSP bypass for ServiceWorker

  - CVE-2016-1683: Out-of-bounds access in libxslt

  - CVE-2016-1684: Integer overflow in libxslt

  - CVE-2016-1685: Out-of-bounds read in PDFium

  - CVE-2016-1686: Out-of-bounds read in PDFium

  - CVE-2016-1687: Information leak in extensions

  - CVE-2016-1688: Out-of-bounds read in V8

  - CVE-2016-1689: Heap buffer overflow in media

  - CVE-2016-1690: Heap use-after-free in Autofill

  - CVE-2016-1691: Heap buffer-overflow in Skia

  - CVE-2016-1692: Limited cross-origin bypass in     ServiceWorker

  - CVE-2016-1693: HTTP Download of Software Removal Tool

  - CVE-2016-1694: HPKP pins removed on cache clearance

  - CVE-2016-1695: Various fixes from internal audits,     fuzzing and other initiatives

An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Chromium is an open source web browser, powered by WebKit (Blink).

This update upgrades Chromium to version 51.0.2704.63.

Security Fix(es) :

* Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when visited by the victim. (CVE-2016-1672, CVE-2016-1673, CVE-2016-1674, CVE-2016-1675, CVE-2016-1676, CVE-2016-1678, CVE-2016-1679, CVE-2016-1680, CVE-2016-1681, CVE-2016-1695, CVE-2016-1677, CVE-2016-1682, CVE-2016-1683, CVE-2016-1684, CVE-2016-1685, CVE-2016-1686, CVE-2016-1687, CVE-2016-1688, CVE-2016-1689, CVE-2016-1690, CVE-2016-1691, CVE-2016-1692, CVE-2016-1693, CVE-2016-1694)

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2016-1667     Mariusz Mylinski discovered a cross-origin bypass.

  - CVE-2016-1668     Mariusz Mylinski discovered a cross-origin bypass in     bindings to v8.

  - CVE-2016-1669     Choongwoo Han discovered a buffer overflow in the v8     JavaScript library.

  - CVE-2016-1670     A race condition was found that could cause the renderer     process to reuse ids that should have been unique.

  - CVE-2016-1672     Mariusz Mylinski discovered a cross-origin bypass in     extension bindings.

  - CVE-2016-1673     Mariusz Mylinski discovered a cross-origin bypass in     Blink/Webkit.

  - CVE-2016-1674     Mariusz Mylinski discovered another cross-origin bypass     in extension bindings.

  - CVE-2016-1675     Mariusz Mylinski discovered another cross-origin bypass     in Blink/Webkit.

  - CVE-2016-1676     Rob Wu discovered a cross-origin bypass in extension     bindings.

  - CVE-2016-1677     Guang Gong discovered a type confusion issue in the v8     JavaScript library.

  - CVE-2016-1678     Christian Holler discovered an overflow issue in the v8     JavaScript library.

  - CVE-2016-1679     Rob Wu discovered a use-after-free issue in the bindings     to v8.

  - CVE-2016-1680     Atte Kettunen discovered a use-after-free issue in the     skia library.

  - CVE-2016-1681     Aleksandar Nikolic discovered an overflow issue in the     pdfium library.

  - CVE-2016-1682     KingstonTime discovered a way to bypass the Content     Security Policy.

  - CVE-2016-1683     Nicolas Gregoire discovered an out-of-bounds write issue     in the libxslt library.

  - CVE-2016-1684     Nicolas Gregoire discovered an integer overflow issue in     the libxslt library.

  - CVE-2016-1685     Ke Liu discovered an out-of-bounds read issue in the     pdfium library.

  - CVE-2016-1686     Ke Liu discovered another out-of-bounds read issue in     the pdfium library.

  - CVE-2016-1687     Rob Wu discovered an information leak in the handling of     extensions.

  - CVE-2016-1688     Max Korenko discovered an out-of-bounds read issue in     the v8 JavaScript library.

  - CVE-2016-1689     Rob Wu discovered a buffer overflow issue.

  - CVE-2016-1690     Rob Wu discovered a use-after-free issue.

  - CVE-2016-1691     Atte Kettunen discovered a buffer overflow issue in the     skia library.

  - CVE-2016-1692     Til Jasper Ullrich discovered a cross-origin bypass     issue.

  - CVE-2016-1693     Khalil Zhani discovered that the Software Removal Tool     download was done over an HTTP connection.

  - CVE-2016-1694     Ryan Lester and Bryant Zadegan discovered that pinned     public keys would be removed when clearing the browser     cache.

  - CVE-2016-1695     The chrome development team found and fixed various     issues during internal auditing.

Chromium was updated to 51.0.2704.63 to fix the following vulnerabilities (boo#981886) :

  - CVE-2016-1672: Cross-origin bypass in extension bindings

  - CVE-2016-1673: Cross-origin bypass in Blink

  - CVE-2016-1674: Cross-origin bypass in extensions

  - CVE-2016-1675: Cross-origin bypass in Blink

  - CVE-2016-1676: Cross-origin bypass in extension bindings

  - CVE-2016-1677: Type confusion in V8

  - CVE-2016-1678: Heap overflow in V8

  - CVE-2016-1679: Heap use-after-free in V8 bindings

  - CVE-2016-1680: Heap use-after-free in Skia

  - CVE-2016-1681: Heap overflow in PDFium

  - CVE-2016-1682: CSP bypass for ServiceWorker

  - CVE-2016-1683: Out-of-bounds access in libxslt

  - CVE-2016-1684: Integer overflow in libxslt

  - CVE-2016-1685: Out-of-bounds read in PDFium

  - CVE-2016-1686: Out-of-bounds read in PDFium

  - CVE-2016-1687: Information leak in extensions

  - CVE-2016-1688: Out-of-bounds read in V8

  - CVE-2016-1689: Heap buffer overflow in media

  - CVE-2016-1690: Heap use-after-free in Autofill

  - CVE-2016-1691: Heap buffer-overflow in Skia

  - CVE-2016-1692: Limited cross-origin bypass in     ServiceWorker

  - CVE-2016-1693: HTTP Download of Software Removal Tool

  - CVE-2016-1694: HPKP pins removed on cache clearance

  - CVE-2016-1695: Various fixes from internal audits,     fuzzing and other initiatives

Google Chrome Releases reports :

42 security fixes in this release

Please reference CVE/URL list for details

The version of Google Chrome installed on the remote Mac OS X host is prior to 51.0.2704.63. It is, therefore, affected by multiple vulnerabilities :

  - Multiple unspecified flaws exist in extension bindings     that allow a remote attacker to bypass the same-origin     policy. No other details are available. (CVE-2016-1672,     CVE-2016-1676)

  - Multiple unspecified flaws exist in Blink that allow a     remote attacker to bypass the same-origin policy. No     other details are available. (CVE-2016-1673,     CVE-2016-1675)

  - An unspecified flaw exists in Extensions that allows a     remote attacker to bypass the same-origin policy.
    No other details are available. (CVE-2016-1674)

  - An unspecified type confusion error exists in V8     decodeURI that allows a remote attacker to disclose     potentially sensitive information. (CVE-2016-1677)

  - A heap buffer overflow condition exists in V8 due to     improper validation of user-supplied input. A remote     attacker can exploit this to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2016-1678)

  - A heap use-after-free error exists in V8 bindings that     allows a remote attacker to deference already freed     memory and execute arbitrary code. (CVE-2016-1679)

  - A heap use-after-free error exists in Google Skia that     allows a remote attacker to deference already freed     memory and execute arbitrary code. (CVE-2016-1680)

  - A buffer overflow condition exists in OpenJPEG in the     opj_j2k_read_SPCod_SPCoc() function within file j2k.c     due to improper validation of user-supplied input. A     remote attacker can exploit this to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2016-1681)

  - An unspecified flaw exists in ServiceWorker that allows     a remote attacker to bypass the Content Security Policy     (CSP). No other details are available. (CVE-2016-1682)

  - An unspecified out-of-bounds access error exists in     libxslt that allows a remote attacker to have an     unspecified impact. (CVE-2016-1683)

  - An integer overflow condition exists in libxslt that     allows a remote attacker to have an unspecified impact.
    (CVE-2016-1684)

  - Multiple out-of-bounds read errors exist in PDFium that     allow a remote attacker to cause a denial of service     condition or disclose potentially sensitive information.
    (CVE-2016-1685, CVE-2016-1686)

  - An unspecified flaw exists in Extensions that allows a     remote attacker to disclose potentially sensitive     information. No other details are available.
    (CVE-2016-1687)

  - An out-of-bounds read error exists in V8 that allows a     remote attacker to cause a denial of service condition     or disclose potentially sensitive information.
    (CVE-2016-1688)

  - A heap buffer overflow condition exists in Media due to     improper validation of user-supplied input. A remote     attacker can exploit this to execute arbitrary code.
    (CVE-2016-1689)

  - A heap use-after-free error exists in Autofill that     allows a remote attacker to execute arbitrary code.
    (CVE-2016-1690)

  - A heap buffer overflow condition exists in Google Skia     due to improper validation of user-supplied input. A     remote attacker can exploit this to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2016-1691)

  - An unspecified flaw exists in ServiceWorker that allows     a remote attacker to carry out a limited bypass of the     same-origin policy. No other details are available.
    (CVE-2016-1692)

  - A flaw exists due to the Software Removal Tool being     downloaded over an HTTP connection. A man-in-the-middle     attacker can exploit this to manipulate its contents.
    (CVE-2016-1693)

  - A unspecified flaw exists that is triggered when HTTP     Public Key Pinning (HPKP) pins are removed when clearing     the cache. No other details are available.
    (CVE-2016-1694)

  - Multiple unspecified issues exist that allow a remote     attacker to execute arbitrary code. (CVE-2016-1695)

  - A use-after-free error exists in 'MailboxManagerImpl'     that is triggered when handling GPU commands. A remote     attacker can exploit this to dereference already freed     memory, resulting in the execution of arbitrary code.

The version of Google Chrome installed on the remote Windows host is prior to 51.0.2704.63. It is, therefore, affected by multiple vulnerabilities :

  - Multiple unspecified flaws exist in extension bindings     that allow a remote attacker to bypass the same-origin     policy. No other details are available. (CVE-2016-1672,     CVE-2016-1676)

  - Multiple unspecified flaws exist in Blink that allow a     remote attacker to bypass the same-origin policy. No     other details are available. (CVE-2016-1673,     CVE-2016-1675)

  - An unspecified flaw exists in Extensions that allows a     remote attacker to bypass the same-origin policy.
    No other details are available. (CVE-2016-1674)

  - An unspecified type confusion error exists in V8     decodeURI that allows a remote attacker to disclose     potentially sensitive information. (CVE-2016-1677)

  - A heap buffer overflow condition exists in V8 due to     improper validation of user-supplied input. A remote     attacker can exploit this to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2016-1678)

  - A heap use-after-free error exists in V8 bindings that     allows a remote attacker to deference already freed     memory and execute arbitrary code. (CVE-2016-1679)

  - A heap use-after-free error exists in Google Skia that     allows a remote attacker to deference already freed     memory and execute arbitrary code. (CVE-2016-1680)

  - A buffer overflow condition exists in OpenJPEG in the     opj_j2k_read_SPCod_SPCoc() function within file j2k.c     due to improper validation of user-supplied input. A     remote attacker can exploit this to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2016-1681)

  - An unspecified flaw exists in ServiceWorker that allows     a remote attacker to bypass the Content Security Policy     (CSP). No other details are available. (CVE-2016-1682)

  - An unspecified out-of-bounds access error exists in     libxslt that allows a remote attacker to have an     unspecified impact. (CVE-2016-1683)

  - An integer overflow condition exists in libxslt that     allows a remote attacker to have an unspecified impact.
    (CVE-2016-1684)

  - Multiple out-of-bounds read errors exist in PDFium that     allow a remote attacker to cause a denial of service     condition or disclose potentially sensitive information.
    (CVE-2016-1685, CVE-2016-1686)

  - An unspecified flaw exists in Extensions that allows a     remote attacker to disclose potentially sensitive     information. No other details are available.
    (CVE-2016-1687)

  - An out-of-bounds read error exists in V8 that allows a     remote attacker to cause a denial of service condition     or disclose potentially sensitive information.
    (CVE-2016-1688)

  - A heap buffer overflow condition exists in Media due to     improper validation of user-supplied input. A remote     attacker can exploit this to execute arbitrary code.
    (CVE-2016-1689)

  - A heap use-after-free error exists in Autofill that     allows a remote attacker to execute arbitrary code.
    (CVE-2016-1690)

  - A heap buffer overflow condition exists in Google Skia     due to improper validation of user-supplied input. A     remote attacker can exploit this to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2016-1691)

  - An unspecified flaw exists in ServiceWorker that allows     a remote attacker to carry out a limited bypass of the     same-origin policy. No other details are available.
    (CVE-2016-1692)

  - A flaw exists due to the Software Removal Tool being     downloaded over an HTTP connection. A man-in-the-middle     attacker can exploit this to manipulate its contents.
    (CVE-2016-1693)

  - A unspecified flaw exists that is triggered when HTTP     Public Key Pinning (HPKP) pins are removed when clearing     the cache. No other details are available.
    (CVE-2016-1694)

  - Multiple unspecified issues exist that allow a remote     attacker to execute arbitrary code. (CVE-2016-1695)

  - A use-after-free error exists in 'MailboxManagerImpl'     that is triggered when handling GPU commands. A remote     attacker can exploit this to dereference already freed     memory, resulting in the execution of arbitrary code.

ID	Name	Product	Family	Severity
92351	GLSA-201607-07 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
91498	Ubuntu 14.04 LTS / 16.04 LTS : Oxide vulnerabilities (USN-2992-1)	Nessus	Ubuntu Local Security Checks	high
91485	openSUSE Security Update : Chromium (openSUSE-2016-682)	Nessus	SuSE Local Security Checks	high
91440	RHEL 6 : chromium-browser (RHSA-2016:1190)	Nessus	Red Hat Local Security Checks	high
91429	Debian DSA-3590-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	high
91404	openSUSE Security Update : Chromium (openSUSE-2016-652)	Nessus	SuSE Local Security Checks	high
91370	FreeBSD : chromium -- multiple vulnerabilities (1a6bbb95-24b8-11e6-bd31-3065ec8fd3ec)	Nessus	FreeBSD Local Security Checks	high
91351	Google Chrome < 51.0.2704.63 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
91350	Google Chrome < 51.0.2704.63 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2016-1691

high

Tenable Plugins

high

high

high

high

high

high

high

high

high