Multiple unspecified vulnerabilities in Google V8 before 4.9.385.26, as used in Google Chrome before 49.0.2623.75, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2920-1 advisory.

    It was discovered that the ContainerNode::parserRemoveChild function in Blink mishandled widget updates in     some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could     potentially exploit this to bypass same-origin restrictions. (CVE-2016-1630)

    It was discovered that the PPB_Flash_MessageLoop_Impl::InternalRun

    function in Chromium mishandled nested message loops. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit this to bypass same-origin restrictions.
    (CVE-2016-1631)

    Multiple use-after-frees were discovered in Blink. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit these to cause a denial of service via renderer     crash or execute arbitrary code with the privileges of the sandboxed render process. (CVE-2016-1633,     CVE-2016-1634, CVE-2016-1644)

    It was discovered that the PendingScript::notifyFinished function in Blink relied on memory-cache     information about integrity-check occurrences instead of integrity-check successes. If a user were tricked     in to opening a specially crafted website, an attacker could potentially exploit this to bypass     Subresource Integrity (SRI) protections. (CVE-2016-1636)

    It was discovered that the SkATan2_255 function in Skia mishandled arctangent calculations. If a user were     tricked in to opening a specially crafted website, an attacker could potentially exploit this to obtain     sensitive information. (CVE-2016-1637)

    A use-after-free was discovered in Chromium. If a user were tricked in to opening a specially crafted     website, an attacker could potentially exploit this to cause a denial of service via application crash, or     execute arbitrary code with the privileges of the user invoking the program. (CVE-2016-1641)

    Multiple security issues were discovered in Chromium. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial     of service via application crash or execute arbitrary code with the privileges of the user invoking the     program. (CVE-2016-1642)

    A type-confusion bug was discovered in Blink. If a user were tricked in to opening a specially crafted     website, an attacker could potentially exploit this to cause a denial of service via renderer crash or     execute arbitrary code with the privileges of the sandboxed render process. (CVE-2016-1643)

    Multiple security issues were discovered in V8. If a user were tricked in to opening a specially crafted     website, an attacker could potentially exploit these to read uninitialized memory, cause a denial of     service via renderer crash or execute arbitrary code with the privileges of the sandboxed render process.
    (CVE-2016-2843)

    An invalid cast was discovered in Blink. If a user were tricked in to opening a specially crafted website,     an attacker could potentially exploit this to cause a denial of service via renderer crash or execute     arbitrary code with the privileges of the sandboxed render process. (CVE-2016-2844)

    It was discovered that the Content Security Policy (CSP) implementation in Blink did not ignore a URL's     path component in the case of a ServiceWorker fetch. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit this to obtain sensitive information.
    (CVE-2016-2845)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Mac OS X host is prior to 49.0.2623.75. It is, therefore, affected by multiple vulnerabilities :

  - Multiple overflow conditions exist in the libpng library     in the png_set_PLTE() and png_get_PLTE() functions due     to improper handling of bit depths less than eight. A     remote attacker can exploit this, via a specially     crafted PNG image, to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2015-8126)

  - An unspecified flaw exists in Blink that allows an     attacker to bypass the same-origin policy.
    (CVE-2016-1630)

  - An unspecified flaw exists in the Pepper plugin that     allows an attacker to bypass the same-origin policy.
    (CVE-2016-1631)

  - A bad cast flaw exists in the Extensions component that     allows an attacker to have an unspecified impact.
    (CVE-2016-1632)

  - Multiple use-after-free errors exist in Blink. A remote     attacker can exploit these issues to dereference already     freed memory, resulting in the execution of arbitrary     code. (CVE-2016-1633, CVE-2016-1634, CVE-2016-1635)

  - An unspecified flaw exists that allows an attacker to     bypass SRI validation. (CVE-2016-1636)

  - An unspecified flaw exists that allows an attacker to     disclose sensitive information. (CVE-2016-1637)

  - An unspecified flaw exists that allows an attacker to     bypass the webAPI. (CVE-2016-1638)

  - A use-after-free error exists in WebRTC. A remote     attacker can exploit this issue to dereference already     freed memory, resulting in the execution of arbitrary     code. (CVE-2016-1639)

  - An unspecified origin confusion flaw exists in the     Extensions UI that allows an attacker to have an     unspecified impact. (CVE-2016-1640)

  - A use-after-free error exists in Favicon. A remote     attacker can exploit this issue to dereference already     freed memory, resulting in the execution of arbitrary     code. (CVE-2016-1641)

  - Multiple flaws exist that allow a remote attacker to     execute arbitrary code. (CVE-2016-1642)

  - Multiple unspecified flaws exist in Google V8 in     runetime-scopes.cc that allows an attacker to cause a     denial of service condition or the execution of     arbitrary code. (CVE-2016-2843)

The version of Google Chrome installed on the remote Windows host is prior to 49.0.2623.75. It is, therefore, affected by multiple vulnerabilities :

  - Multiple overflow conditions exist in the libpng library     in the png_set_PLTE() and png_get_PLTE() functions due     to improper handling of bit depths less than eight. A     remote attacker can exploit this, via a specially     crafted PNG image, to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2015-8126)

  - An unspecified flaw exists in Blink that allows an     attacker to bypass the same-origin policy.
    (CVE-2016-1630)

  - An unspecified flaw exists in the Pepper plugin that     allows an attacker to bypass the same-origin policy.
    (CVE-2016-1631)

  - A bad cast flaw exists in the Extensions component that     allows an attacker to have an unspecified impact.
    (CVE-2016-1632)

  - Multiple use-after-free errors exist in Blink. A remote     attacker can exploit these issues to dereference already     freed memory, resulting in the execution of arbitrary     code. (CVE-2016-1633, CVE-2016-1634, CVE-2016-1635)

  - An unspecified flaw exists that allows an attacker to     bypass SRI validation. (CVE-2016-1636)

  - An unspecified flaw exists that allows an attacker to     disclose sensitive information. (CVE-2016-1637)

  - An unspecified flaw exists that allows an attacker to     bypass the webAPI. (CVE-2016-1638)

  - A use-after-free error exists in WebRTC. A remote     attacker can exploit this issue to dereference already     freed memory, resulting in the execution of arbitrary     code. (CVE-2016-1639)

  - An unspecified origin confusion flaw exists in the     Extensions UI that allows an attacker to have an     unspecified impact. (CVE-2016-1640)

  - A use-after-free error exists in Favicon. A remote     attacker can exploit this issue to dereference already     freed memory, resulting in the execution of arbitrary     code. (CVE-2016-1641)

  - Multiple flaws exist that allow a remote attacker to     execute arbitrary code. (CVE-2016-1642)

  - Multiple unspecified flaws exist in Google V8 in     runetime-scopes.cc that allows an attacker to cause a     denial of service condition or the execution of     arbitrary code. (CVE-2016-2843

ID	Name	Product	Family	Severity
89865	Ubuntu 14.04 LTS : Oxide vulnerabilities (USN-2920-1)	Nessus	Ubuntu Local Security Checks	critical
89686	Google Chrome < 49.0.2623.75 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
89685	Google Chrome < 49.0.2623.75 Multiple Vulnerabilities	Nessus	Windows	critical

Detections

Analytics

CVE-2016-2843

critical

Tenable Plugins

critical

critical

critical