Multiple unspecified vulnerabilities in HarfBuzz before 1.0.6, as used in Google Chrome before 48.0.2564.82, allow attackers to cause a denial of service or possibly have other impact via crafted data, as demonstrated by a buffer over-read resulting from an inverted length check in hb-ot-font.cc, a different issue than CVE-2015-8947.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - chromium-browser: Multiple unspecified vulnerabilities in HarfBuzz before 1.0.6 (CVE-2015-8947,     CVE-2016-2052)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

LibreOffice was updated to version 5.3.5.2, bringing new features and enhancements :

Writer :

  - New 'Go to Page' dialog for quickly jumping to another     page.

  - Support for 'Table Styles'.

  - New drawing tools were added.

  - Improvements in the toolbar.

  - Borderless padding is displayed.

Calc :

  - New drawing tools were added.

  - In new installations the default setting for new     documents is now 'Enable wildcards in formulas' instead     of regular expressions.

  - Improved compatibility with ODF 1.2

Impress :

  - Images inserted via 'Photo Album' can now be linked     instead of embedded in the document.

  - When launching Impress, a Template Selector allows you     to choose a Template to start with.

  - Two new default templates: Vivid and Pencil.

  - All existing templates have been improved.

Draw :

  - New arrow endings, including Crow's foot notation's     ones.

Base :

  - Firebird has been upgraded to version 3.0.0. It is     unable to read back Firebird 2.5 data, so embedded     Firebird odb files created in LibreOffice version up to     5.2 cannot be opened with LibreOffice 5.3.

Some security issues have also been fixed :

  - CVE-2017-7870: An out-of-bounds write caused by a     heap-based buffer overflow related to the     tools::Polygon::Insert function.

  - CVE-2017-7882: An out-of-bounds write related to the     HWPFile::TagsRead function.

  - CVE-2017-8358: an out-of-bounds write caused by a     heap-based buffer overflow related to the ReadJPEG     function.

  - CVE-2016-10327: An out-of-bounds write caused by a     heap-based buffer overflow related to the     EnhWMFReader::ReadEnhWMF function.

  - CVE-2017-9433: An out-of-bounds write caused by a     heap-based buffer overflow related to the     MsWrd1Parser::readFootnoteCorrespondance function in     libmwaw.

A comprehensive list of new features and changes in this release is available at: https://wiki.documentfoundation.org/ReleaseNotes/5.3

This update contains binaries for the ports architectures only. This update was imported from the SUSE:SLE-12:Update update project.

LibreOffice was updated to version 5.3.5.2, bringing new features and enhancements: Writer :

  - New 'Go to Page' dialog for quickly jumping to another     page.

  - Support for 'Table Styles'.

  - New drawing tools were added.

  - Improvements in the toolbar.

  - Borderless padding is displayed. Calc :

  - New drawing tools were added.

  - In new installations the default setting for new     documents is now 'Enable wildcards in formulas' instead     of regular expressions.

  - Improved compatibility with ODF 1.2 Impress :

  - Images inserted via 'Photo Album' can now be linked     instead of embedded in the document.

  - When launching Impress, a Template Selector allows you     to choose a Template to start with.

  - Two new default templates: Vivid and Pencil.

  - All existing templates have been improved. Draw :

  - New arrow endings, including Crow's foot notation's     ones. Base :

  - Firebird has been upgraded to version 3.0.0. It is     unable to read back Firebird 2.5 data, so embedded     Firebird odb files created in LibreOffice version up to     5.2 cannot be opened with LibreOffice 5.3. Some security     issues have also been fixed :

  - CVE-2017-7870: An out-of-bounds write caused by a     heap-based buffer overflow related to the     tools::Polygon::Insert function.

  - CVE-2017-7882: An out-of-bounds write related to the     HWPFile::TagsRead function.

  - CVE-2017-8358: an out-of-bounds write caused by a     heap-based buffer overflow related to the ReadJPEG     function.

  - CVE-2016-10327: An out-of-bounds write caused by a     heap-based buffer overflow related to the     EnhWMFReader::ReadEnhWMF function.

  - CVE-2017-9433: An out-of-bounds write caused by a     heap-based buffer overflow related to the     MsWrd1Parser::readFootnoteCorrespondance function in     libmwaw. A comprehensive list of new features and     changes in this release is available at:
    https://wiki.documentfoundation.org/ReleaseNotes/5.3

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

LibreOffice was updated to version 5.3.3.2, bringing new features and enhancements: Writer :

  - New 'Go to Page' dialog for quickly jumping to another     page.

  - Support for 'Table Styles'.

  - New drawing tools were added.

  - Improvements in the toolbar.

  - Borderless padding is displayed. Calc :

  - New drawing tools were added.

  - In new installations the default setting for new     documents is now 'Enable wildcards in formulas' instead     of regular expressions.

  - Improved compatibility with ODF 1.2 Impress :

  - Images inserted via 'Photo Album' can now be linked     instead of embedded in the document.

  - When launching Impress, a Template Selector allows you     to choose a Template to start with.

  - Two new default templates: Vivid and Pencil.

  - All existing templates have been improved. Draw :

  - New arrow endings, including Crow's foot notation's     ones. Base :

  - Firebird has been upgraded to version 3.0.0. It is     unable to read back Firebird 2.5 data, so embedded     Firebird odb files created in LibreOffice version up to     5.2 cannot be opened with LibreOffice 5.3. Some security     issues have also been fixed :

  - CVE-2017-7870: An out-of-bounds write caused by a     heap-based buffer overflow related to the     tools::Polygon::Insert function.

  - CVE-2017-7882: An out-of-bounds write related to the     HWPFile::TagsRead function.

  - CVE-2017-8358: an out-of-bounds write caused by a     heap-based buffer overflow related to the ReadJPEG     function.

  - CVE-2016-10327: An out-of-bounds write caused by a     heap-based buffer overflow related to the     EnhWMFReader::ReadEnhWMF function.

  - CVE-2017-9433: An out-of-bounds write caused by a     heap-based buffer overflow related to the     MsWrd1Parser::readFootnoteCorrespondance function in     libmwaw. A comprehensive list of new features and     changes in this release is available at:
    https://wiki.documentfoundation.org/ReleaseNotes/5.3

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201701-76 (HarfBuzz: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in HarfBuzz. Please review       the CVE identifiers referenced below for details.
  Impact :

    Remote attackers, through the use of crafted data, could cause a Denial       of Service condition or have other unspecified impacts.
  Workaround :

    There is no known workaround at this time.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3067-1 advisory.

    Kostya Serebryany discovered that HarfBuzz incorrectly handled memory. A remote attacker could use this     issue to cause HarfBuzz to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2015-8947)

    It was discovered that HarfBuzz incorrectly handled certain length checks. A remote attacker could use     this issue to cause HarfBuzz to crash, resulting in a denial of service, or possibly execute arbitrary     code. This issue only applied to Ubuntu 16.04 LTS. (CVE-2016-2052)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for harfbuzz fixes the following security issues :

  - CVE-2016-2052: harfbuzz: Multiple unspecified     vulnerabilities in HarfBuzz before 1.0.6 (boo#963436)

  - CVE-2015-8947: harfbuzz: hb-ot-layout-gpos-table.hh     buffer over-read (boo#989564)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2877-1 advisory.

    A bad cast was discovered in V8. If a user were tricked in to opening a specially crafted website, an     attacker could potentially exploit this to cause a denial of service via renderer crash or execute     arbitrary code with the privileges of the sandboxed render process. (CVE-2016-1612)

    An issue was discovered when initializing the UnacceleratedImageBufferSurface class in Blink. If a user     were tricked in to opening a specially crafted website, an attacker could potentially exploit this to     obtain sensitive information. (CVE-2016-1614)

    An issue was discovered with the CSP implementation in Blink. If a user were tricked in to opening a     specially crafted website, an attacker could potentially exploit this to determine whether specific HSTS     sites had been visited by reading a CSP report. (CVE-2016-1617)

    An issue was discovered with random number generator in Blink. An attacker could potentially exploit this     to defeat cryptographic protection mechanisms. (CVE-2016-1618)

    Multiple security issues were discovered in Chromium. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial     of service via application crash or execute arbitrary code with the privileges of the user invoking the     program. (CVE-2016-1620)

    Multiple security issues were discovered in V8. If a user were tricked in to opening a specially crafted     website, an attacker could potentially exploit these to read uninitialized memory, cause a denial of     service via renderer crash or execute arbitrary code with the privileges of the sandboxed render process.
    (CVE-2016-2051)

    Multiple security issues were discovered in Harfbuzz. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit these to cause a denial of service via renderer     crash or execute arbitrary code with the privileges of the sandboxed render process. (CVE-2016-2052)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated chromium-browser packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Chromium is an open source web browser, powered by WebKit (Blink).

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when visited by the victim. (CVE-2016-1612, CVE-2016-1613, CVE-2016-1614, CVE-2016-1615, CVE-2016-1616, CVE-2016-1617, CVE-2016-1618, CVE-2016-1619, CVE-2016-1620, CVE-2016-2051, CVE-2016-2052)

All Chromium users should upgrade to these updated packages, which contain Chromium version 48.0.2564.82, which corrects these issues.
After installing the update, Chromium must be restarted for the changes to take effect.

ID	Name	Product	Family	Severity
200006	RHEL 7 : harfbuzz (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
103284	openSUSE Security Update : libreoffice (openSUSE-2017-1048)	Nessus	SuSE Local Security Checks	critical
102911	SUSE SLED12 Security Update : libreoffice (SUSE-SU-2017:2315-1)	Nessus	SuSE Local Security Checks	critical
101353	SUSE SLED12 Security Update : libreoffice (SUSE-SU-2017:1821-1)	Nessus	SuSE Local Security Checks	critical
96914	GLSA-201701-76 : HarfBuzz: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
93106	Ubuntu 14.04 LTS / 16.04 LTS : HarfBuzz vulnerabilities (USN-3067-1)	Nessus	Ubuntu Local Security Checks	high
92993	openSUSE Security Update : harfbuzz (openSUSE-2016-986)	Nessus	SuSE Local Security Checks	high
88455	Ubuntu 14.04 LTS : Oxide vulnerabilities (USN-2877-1)	Nessus	Ubuntu Local Security Checks	critical
88447	RHEL 6 : chromium-browser (RHSA-2016:0072)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2016-2052

high

Tenable Plugins

high

critical

critical

critical

high

high

high

critical

critical