Google Chrome before 53.0.2785.113 allows remote attackers to bypass the SafeBrowsing protection mechanism via unspecified vectors.

An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Chromium is an open source web browser, powered by WebKit (Blink).

This update upgrades Chromium to version 53.0.2785.113.

Security Fix(es) :

* Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when visited by the victim. (CVE-2016-5170, CVE-2016-5171, CVE-2016-5175, CVE-2016-5172, CVE-2016-5173, CVE-2016-5174)

The version of Google Chrome installed on the remote Mac OS X host is prior to 53.0.2785.113. It is, therefore, affected by multiple vulnerabilities :

  - A use-after-free error exists in the file     bindings/modules/v8/V8BindingForModules.cpp that allows     an unauthenticated, remote attacker to execute arbitrary     code. (CVE-2016-5170)

  - A use-after-free error exists in Blink that is related     to window constructors being callable. An     unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2016-5171)

  - An arbitrary memory read error exists in V8 that allows     an unauthenticated, remote attacker to disclose     sensitive memory information. (CVE-2016-5172)

  - A flaw exists due to improper handling of specially     crafted web pages. An unauthenticated, remote attacker     can exploit this to load JavaScript extension resources,     which may then be used to perform unauthorized actions.
    (CVE-2016-5173)

  - A flaw exists that is triggered when in fullscreen mode,     in file ui/cocoa/browser_window_controller_private.mm,     that results in a failure to suppress popups.
    (CVE-2016-5174)

  - An unspecified flaw exists that allows an attacker to     impact confidentiality, integrity, and availability.
    (CVE-2016-5175)

  - A flaw exists due to improper handling of IPC messages     for dead routing IDs. An authenticated, remote attacker     can exploit this to execute arbitrary code.
    (CVE-2016-5175)

  - An unspecified flaw exists that allows an     unauthenticated, remote attacker to bypass the     SafeBrowsing protection mechanism. (CVE-2016-5176)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 53.0.2785.113. It is, therefore, affected by multiple vulnerabilities :

  - A use-after-free error exists in the file     bindings/modules/v8/V8BindingForModules.cpp that allows     an unauthenticated, remote attacker to execute arbitrary     code. (CVE-2016-5170)

  - A use-after-free error exists in Blink that is related     to window constructors being callable. An     unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2016-5171)

  - An arbitrary memory read error exists in V8 that allows     an unauthenticated, remote attacker to disclose     sensitive memory information. (CVE-2016-5172)

  - A flaw exists due to improper handling of specially     crafted web pages. An unauthenticated, remote attacker     can exploit this to load JavaScript extension resources,     which may then be used to perform unauthorized actions.
    (CVE-2016-5173)

  - A flaw exists that is triggered when in fullscreen mode,     in file ui/cocoa/browser_window_controller_private.mm,     that results in a failure to suppress popups.
    (CVE-2016-5174)

  - An unspecified flaw exists that allows an attacker to     impact confidentiality, integrity, and availability.
    (CVE-2016-5175)

  - A flaw exists due to improper handling of IPC messages     for dead routing IDs. An authenticated, remote attacker     can exploit this to execute arbitrary code.
    (CVE-2016-5175)

  - An unspecified flaw exists that allows an     unauthenticated, remote attacker to bypass the     SafeBrowsing protection mechanism. (CVE-2016-5176)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number

ID	Name	Product	Family	Severity
93586	RHEL 6 : chromium-browser (RHSA-2016:1905)	Nessus	Red Hat Local Security Checks	high
93477	Google Chrome < 53.0.2785.113 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
93476	Google Chrome < 53.0.2785.113 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2016-5176

medium

Tenable Plugins

high

high

high