Multiple unspecified vulnerabilities in Google Chrome before 51.0.2704.103 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2016-1704     The chrome development team found and fixed various     issues during internal auditing.

  - CVE-2016-1705     The chrome development team found and fixed various     issues during internal auditing.

  - CVE-2016-1706     Pinkie Pie discovered a way to escape the Pepper Plugin     API sandbox.

  - CVE-2016-1707     xisigr discovered a URL spoofing issue.

  - CVE-2016-1708     Adam Varsan discovered a use-after-free issue.

  - CVE-2016-1709     ChenQin discovered a buffer overflow issue in the sfntly     library.

  - CVE-2016-1710     Mariusz Mlynski discovered a same-origin bypass.

  - CVE-2016-1711     Mariusz Mlynski discovered another same-origin bypass.

  - CVE-2016-5127     cloudfuzzer discovered a use-after-free issue.

  - CVE-2016-5128     A same-origin bypass issue was discovered in the v8     JavaScript library.

  - CVE-2016-5129     Jeonghoon Shin discovered a memory corruption issue in     the v8 JavaScript library.

  - CVE-2016-5130     Widih Matar discovered a URL spoofing issue.

  - CVE-2016-5131     Nick Wellnhofer discovered a use-after-free issue in the     libxml2 library.

  - CVE-2016-5132     Ben Kelly discovered a same-origin bypass.

  - CVE-2016-5133     Patch Eudor discovered an issue in proxy authentication.

  - CVE-2016-5134     Paul Stone discovered an information leak in the Proxy     Auto-Config feature.

  - CVE-2016-5135     ShenYeYinJiu discovered a way to bypass the Content     Security Policy.

  - CVE-2016-5136     Rob Wu discovered a use-after-free issue.

  - CVE-2016-5137     Xiaoyin Liu discovered a way to discover whether an HSTS     website had been visited.

The version of Google Chrome installed on the remote host is prior to 51.0.2704.103, and is affected by multiple vulnerabilities :

 - A flaw exists in the 'individualCharacterRanges()' function in 'CachingWordShaper.cpp' that is triggered when handling invalid glyph shaping results. A remote attacker can exploit this issue to corrupt memory, resulting in the execution of code.
 - A use-after-free error exists in the 'OnChannelMessage()' function in 'node_channel.cc' that allows a remote attacker to dereference already freed memory, resulting in the execution of code.
 - An unspecified flaw exists in the 'shared_worker_devtools_manager.cc' file that allows a remote attacker to have an unspecified impact.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3015-1 advisory.

    Multiple security issues were discovered in Chromium. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial     of service via application crash, or execute arbitrary code. (CVE-2016-1704)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Chromium was updated to 51.0.2704.103 to fix three vulnerabilities :

  - CVE-2016-1704: Various fixes from internal audits,     fuzzing and other initiatives (shared identifier)     (boo#985397)

Includes vulnerability fixes from 50.0.2661.102 (boo#979859) :

  - CVE-2016-1667: Same origin bypass in DOM

  - CVE-2016-1668: Same origin bypass in Blink V8 bindings

  - CVE-2016-1669: Buffer overflow in V8

  - CVE-2016-1670: Race condition in loader

Includes vulnerability fixes from 50.0.2661.94 (boo#977830) :

  - CVE-2016-1660: Out-of-bounds write in Blink

  - CVE-2016-1661: Memory corruption in cross-process frames

  - CVE-2016-1662: Use-after-free in extensions

  - CVE-2016-1663: Use-after-free in Blink&rsquo;s V8     bindings

  - CVE-2016-1664: Address bar spoofing

  - CVE-2016-1665: Information leak in V8

  - CVE-2016-1666: Various fixes from internal audits,     fuzzing and other initiatives

An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Chromium is an open source web browser, powered by WebKit (Blink).

This update upgrades Chromium to version 51.0.2704.103.

Security Fix(es) :

* Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when visited by the victim. (CVE-2016-1704)

The version of Google Chrome installed on the remote Mac OS X host is prior to 51.0.2704.103. It is, therefore, affected by multiple vulnerabilities :

  - A flaw exists in the individualCharacterRanges()     function in CachingWordShaper.cpp that is triggered when     handling invalid glyph shaping results. A remote     attacker can exploit this issue to corrupt memory,     resulting in the execution of code.

  - A use-after-free error exists in the OnChannelMessage()     function in node_channel.cc that allows a remote     attacker to dereference already freed memory, resulting     in the execution of arbitrary code.

  - An unspecified flaw exists in     shared_worker_devtools_manager.cc that allows a remote     attacker to have an unspecified impact.

The version of Google Chrome installed on the remote Windows host is prior to 51.0.2704.103. It is, therefore, affected by multiple vulnerabilities :

  - A flaw exists in the individualCharacterRanges()     function in CachingWordShaper.cpp that is triggered when     handling invalid glyph shaping results. A remote     attacker can exploit this issue to corrupt memory,     resulting in the execution of code.

  - A use-after-free error exists in the OnChannelMessage()     function in node_channel.cc that allows a remote     attacker to dereference already freed memory, resulting     in the execution of arbitrary code.

  - An unspecified flaw exists in     shared_worker_devtools_manager.cc that allows a remote     attacker to have an unspecified impact.

Chromium was updated to 51.0.2704.103 to fix three vulnerabilities :

  - CVE-2016-1704: Various fixes from internal audits,     fuzzing and other initiatives (shared identifier)     (boo#985397)

Google Chrome Releases reports :

3 security fixes in this release, including :

- [620742] CVE-2016-1704: Various fixes from internal audits, fuzzing and other initiatives.

ID	Name	Product	Family	Severity
92666	Debian DSA-3637-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	critical
9386	Google Chrome < 51.0.2704.103 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
91914	Ubuntu 14.04 LTS / 16.04 LTS : Oxide vulnerabilities (USN-3015-1)	Nessus	Ubuntu Local Security Checks	high
91848	openSUSE Security Update : Chromium (openSUSE-2016-756)	Nessus	SuSE Local Security Checks	critical
91724	RHEL 6 : chromium-browser (RHSA-2016:1262)	Nessus	Red Hat Local Security Checks	high
91717	Google Chrome < 51.0.2704.103 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
91716	Google Chrome < 51.0.2704.103 Multiple Vulnerabilities	Nessus	Windows	high
91709	openSUSE Security Update : Chromium (openSUSE-2016-744)	Nessus	SuSE Local Security Checks	high
91707	openSUSE Security Update : Chromium (openSUSE-2016-741)	Nessus	SuSE Local Security Checks	high
91700	FreeBSD : chromium -- multiple vulnerabilities (d59ebed4-34be-11e6-be25-3065ec8fd3ec)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2016-1704

high

Tenable Plugins

critical

high

high

critical

high

high

high

high

high

high