The xsltAddTextString function in transform.c in libxslt 1.1.29, as used in Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android, lacked a check for integer overflow during a size calculation, which allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.2.2. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-23 advisory. Several of the third-party components were found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Nessus Network Monitor 6.2.2 updates the following components:

  - c-ares from version 1.10.0 to version 1.19.1.
  - curl from version 7.79.1 to version 8.1.2.
  - libbzip2 from version 1.0.6 to version 1.0.8.
  - libpcre from version 8.42 to version 8.44.
  - libxml2 from version 2.7.7 to version 2.11.1.
  - libxslt from version 1.1.26 to version 1.1.37.
  - libxmlsec from version 1.2.18 to version 1.2.37.
  - sqlite from version 3.27.2 to version 3.40.1.
  - jQuery Cookie from version 1.3.1 to version 1.4.1.
  - jQuery UI from version 1.13.0 to version 1.13.2.
  - OpenSSL from version 3.0.8 to version 3.0.9.

The remote host is affected by the vulnerability described in GLSA-201804-01 (libxslt: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libxslt. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker, via a crafted HTML page, could possibly execute       arbitrary code, cause a Denial of Service condition or leak information.
  Workaround :

    There is no known workaround at this time.

GitLab reports :

Please reference CVE/URL list for details

This update updates QtWebEngine to a snapshot from the Qt 5.6 LTS (long-term support) branch. This is a snapshot of the QtWebEngine that will be included in the bugfix and security release Qt 5.6.3, but only the QtWebEngine component is included in this update.

The update fixes the following security issues in QtWebEngine 5.6.2:
CVE-2016-5133, CVE-2016-5147, CVE-2016-5153, CVE-2016-5155, CVE-2016-5161, CVE-2016-5166, CVE-2016-5170, CVE-2016-5171, CVE-2016-5172, CVE-2016-5181, CVE-2016-5185, CVE-2016-5186, CVE-2016-5187, CVE-2016-5188, CVE-2016-5192, CVE-2016-5198, CVE-2016-5205, CVE-2016-5207, CVE-2016-5208, CVE-2016-5214, CVE-2016-5215, CVE-2016-5221, CVE-2016-5222, CVE-2016-5224, CVE-2016-5225, CVE-2016-9650, CVE-2016-9651, CVE-2016-9652, CVE-2017-5006, CVE-2017-5007, CVE-2017-5008, CVE-2017-5009, CVE-2017-5010, CVE-2017-5012, CVE-2017-5015, CVE-2017-5016, CVE-2017-5017, CVE-2017-5019, CVE-2017-5023, CVE-2017-5024, CVE-2017-5025, CVE-2017-5026, CVE-2017-5027, CVE-2017-5029, CVE-2017-5033, CVE-2017-5037, CVE-2017-5044, CVE-2017-5046, CVE-2017-5047, CVE-2017-5048, CVE-2017-5049, CVE-2017-5050, CVE-2017-5051, CVE-2017-5059, CVE-2017-5061, CVE-2017-5062, CVE-2017-5065, CVE-2017-5067, CVE-2017-5069, CVE-2017-5070, CVE-2017-5071, CVE-2017-5075, CVE-2017-5076, CVE-2016-5078, CVE-2017-5083, and CVE-2017-5089.

Other important changes include :

  - Based on Chromium 49.0.2623.111 (the version used in     QtWebEngine 5.7.x) with security fixes from Chromium up     to version 59.0.3071.104. (5.6.2 was based on Chromium     45.0.2554.101 with security fixes from Chromium up to     version 52.0.2743.116.)

  - All other bug fixes from QtWebEngine 5.7.1 have been     backported.

See http://code.qt.io/cgit/qt/qtwebengine.git/tree/dist/changes-5.6.3?h=5.
6 for details. (Please note that at the time of this writing, not all security backports are listed in that file yet. The list above is accurate.)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update updates QtWebEngine to the 5.9.0 release. QtWebEngine 5.9.0 is part of the Qt 5.9.0 release, but only the QtWebEngine component is included in this update.

The update fixes the following security issues in QtWebEngine 5.8.0:
CVE-2017-5006, CVE-2017-5007, CVE-2017-5008, CVE-2017-5009, CVE-2017-5010, CVE-2017-5011, CVE-2017-5012, CVE-2017-5013, CVE-2017-5014, CVE-2017-5015, CVE-2017-5016, CVE-2017-5017, CVE-2017-5018, CVE-2017-5019, CVE-2017-5020, CVE-2017-5021, CVE-2017-5022, CVE-2017-5023, CVE-2017-5024, CVE-2017-5025, CVE-2017-5026, CVE-2017-5027, CVE-2017-5029, CVE-2017-5032, CVE-2017-5033, CVE-2017-5034, CVE-2017-5036, CVE-2017-5039, CVE-2017-5040, CVE-2017-5044, CVE-2017-5045, CVE-2017-5046, CVE-2017-5052, CVE-2017-5053, CVE-2017-5055, CVE-2017-5057, CVE-2017-5058, CVE-2017-5059, CVE-2017-5060, CVE-2017-5061, CVE-2017-5062, CVE-2017-5065, CVE-2017-5066, CVE-2017-5067, CVE-2017-5068, and CVE-2017-5069.

Other important changes include :

  - Based on Chromium 56.0.2924.122 with security fixes from     Chromium up to version 58.0.3029.96. (5.8.0 was based on     Chromium 53.0.2785.148 with security fixes from Chromium     up to version 55.0.2883.75.)

  - [QTBUG-54650, QTBUG-59922] Accessibility is now disabled     by default on Linux, like it is in Chrome, due to poor     options for enabling it conditionally and its heavy     performance impact. Set the environment variable     `QTWEBENGINE_ENABLE_LINUX_ACCESSIBILITY` to enable it     again.

  - [QTBUG-56531] Enabled `filesystem:` protocol handler.

  - [QTBUG-57720] Optimized incremental scene-graph     rendering in particular for software rendering.

  - [QTBUG-60049] Enabled brotli support.

  - Many bug fixes, see     https://code.qt.io/cgit/qt/qtwebengine.git/tree/dist/cha     nges-5.9.0?h=5.9 for details.

In addition, this build includes a fix for https://bugreports.qt.io/browse/QTBUG-61521 , a binary incompatibility in QtWebEngine 5.9.0 compared to 5.8.0.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libxslt fixes the following security issues :

  - CVE-2017-5029: The xsltAddTextString function in     transform.c lacked a check for integer overflow during a     size calculation, which allowed a remote attacker to     perform an out of bounds memory write via a crafted HTML     page (bsc#1035905).

  - CVE-2016-4738: Fix heap overread in     xsltFormatNumberConversion: An empty decimal-separator     could cause a heap overread. This can be exploited to     leak a couple of bytes after the buffer that holds the     pattern string (bsc#1005591).

  - CVE-2015-9019: Properly initialize random generator     (bsc#934119).

  - CVE-2015-7995: Vulnerability in function     xsltStylePreCompute' in preproc.c could cause a type     confusion leading to DoS. (bsc#952474) This update was     imported from the SUSE:SLE-12:Update update project.

This update for libxslt fixes the following issues :

  - CVE-2017-5029: The xsltAddTextString function in     transform.c lacked a check for integer overflow during a     size calculation, which allowed a remote attacker to     perform an out of bounds memory write via a crafted HTML     page (bsc#1035905).

  - CVE-2016-4738: Fix heap overread in     xsltFormatNumberConversion: An empty decimal-separator     could cause a heap overread. This can be exploited to     leak a couple of bytes after the buffer that holds the     pattern string (bsc#1005591).

  - CVE-2015-9019: Properly initialize random generator     (bsc#934119).

  - CVE-2015-7995: Vulnerability in function     xsltStylePreCompute' in preproc.c could cause a type     confusion leading to DoS. (bsc#952474)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Apple iTunes running on the remote host is prior to 12.6. It is, therefore, affected by multiple vulnerabilities :

  - Multiple vulnerabilities exist in the expat component,     the most severe of which are remote code execution     vulnerabilities. An unauthenticated, remote attacker can     exploit these vulnerabilities to cause a denial of     service condition or the execution of arbitrary code in     the context of the current user. (CVE-2009-3270,     CVE-2009-3560, CVE-2009-3720, CVE-2012-1147,     CVE-2012-1148, CVE-2012-6702, CVE-2015-1283,     CVE-2016-0718, CVE-2016-4472, CVE-2016-5300)

  - Multiple vulnerabilities exist in the SQLite component,     the most severe of which are remote code execution     vulnerabilities. An unauthenticated, remote attacker can     exploit these vulnerabilities by convincing a user to     open a specially crafted file, to cause a denial of     service condition or the execution of arbitrary code in     the context of the current user. (CVE-2013-7443,     CVE-2015-3414, CVE-2015-3415, CVE-2015-3416,     CVE-2015-3717, CVE-2015-6607, CVE-2016-6153)

  - An information disclosure vulnerability exists in the     APNs server component due to client certificates being     transmitted in cleartext. A man-in-the-middle attacker     can exploit this to disclose sensitive information.
    (CVE-2017-2383)

  - A use-after-free error exists in the WebKit component     due to improper handling of RenderBox objects. An     unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2017-2463)

  - Multiple universal cross-site scripting (XSS)     vulnerabilities exist in the WebKit component due to     improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit these     vulnerabilities, by convincing a user to visit a     specially crafted web page, to execute arbitrary script     code in a user's browser session. (CVE-2017-2479,     CVE-2017-2480, CVE-2017-2493)

  - An integer overflow condition exists in the libxslt     component in the xsltAddTextString() function in     transform.c due to improper validation of user-supplied     input. An unauthenticated, remote attacker can exploit     this to cause an out-of-bounds write, resulting in the     execution of arbitrary code. (CVE-2017-5029)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apple iTunes installed on the remote Windows host is prior to 12.6. It is, therefore, affected by multiple vulnerabilities :

  - Multiple vulnerabilities exist in the expat component,     the most severe of which are remote code execution     vulnerabilities. An unauthenticated, remote attacker can     exploit these vulnerabilities to cause a denial of     service condition or the execution of arbitrary code in     the context of the current user. (CVE-2009-3270,     CVE-2009-3560, CVE-2009-3720, CVE-2012-1147,     CVE-2012-1148, CVE-2012-6702, CVE-2015-1283,     CVE-2016-0718, CVE-2016-4472, CVE-2016-5300)

  - Multiple vulnerabilities exist in the SQLite component,     the most severe of which are remote code execution     vulnerabilities. An unauthenticated, remote attacker can     exploit these vulnerabilities by convincing a user to     open a specially crafted file, to cause a denial of     service condition or the execution of arbitrary code in     the context of the current user. (CVE-2013-7443,     CVE-2015-3414, CVE-2015-3415, CVE-2015-3416,     CVE-2015-3717, CVE-2015-6607, CVE-2016-6153)

  - An information disclosure vulnerability exists in the     APNs server component due to client certificates being     transmitted in cleartext. A man-in-the-middle attacker     can exploit this to disclose sensitive information.
    (CVE-2017-2383)

  - A use-after-free error exists in the WebKit component     due to improper handling of RenderBox objects. An     unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2017-2463)

  - Multiple universal cross-site scripting (XSS)     vulnerabilities exist in the WebKit component due to     improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit these     vulnerabilities, by convincing a user to visit a     specially crafted web page, to execute arbitrary script     code in a user's browser session. (CVE-2017-2479,     CVE-2017-2480, CVE-2017-2493)

  - An integer overflow condition exists in the libxslt     component in the xsltAddTextString() function in     transform.c due to improper validation of user-supplied     input. An unauthenticated, remote attacker can exploit     this to cause an out-of-bounds write, resulting in the     execution of arbitrary code. (CVE-2017-5029)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3271-1 advisory.

    Holger Fuhrmannek discovered an integer overflow in the xsltAddTextString() function in Libxslt. An     attacker could use this to craft a malicious document that, when opened, could cause a denial of service     (application crash) or possible execute arbitrary code. (CVE-2017-5029)

    Nicolas Gregoire discovered that Libxslt mishandled namespace nodes. An attacker could use this to craft a     malicious document that, when opened, could cause a denial of service (application crash) or possibly     execute arbtrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 14.04 LTS, and Ubuntu 12.04 LTS.
    (CVE-2016-1683)

    Sebastian Apelt discovered that a use-after-error existed in the xsltDocumentFunctionLoadDocument()     function in Libxslt. An attacker could use this to craft a malicious document that, when opened, could     cause a denial of service (application crash) or possibly execute arbitrary code. This issue only affected     Ubuntu 16.04 LTS, Ubuntu 14.04 LTS, and Ubuntu 12.04 LTS. (CVE-2016-1841)

    It was discovered that a type confusion error existed in the xsltStylePreCompute() function in Libxslt. An     attacker could use this to craft a malicious XML file that, when opened, caused a denial of service     (application crash). This issue only affected Ubuntu 14.04 LTS and Ubuntu 12.04 LTS. (CVE-2015-7995)

    Nicolas Gregoire discovered the Libxslt mishandled the 'i' and 'a' format tokens for xsl:number data. An     attacker could use this to craft a malicious document that, when opened, could cause a denial of service     (application crash). This issue only affected Ubuntu 16.04 LTS, Ubuntu 14.04 LTS, and Ubuntu 12.04 LTS.
    (CVE-2016-1684)

    It was discovered that the xsltFormatNumberConversion() function in Libxslt did not properly handle empty     decimal separators. An attacker could use this to craft a malicious document that, when opened, could     cause a denial of service (application crash). This issue only affected Ubuntu 16.10, Ubuntu 16.04 LTS,     Ubuntu 14.04 LTS, and Ubuntu 12.04 LTS. (CVE-2016-4738)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is running a version of Mac OS X 10.10.5 or 10.11.6 that is missing a security update. It is therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability exists in the     LibreSSL component due to a flaw in the ECDSA     implementation that is triggered when not properly     setting a flag in ECDSA signing nonces to indicate that     only constant-time code paths should be followed. An     unauthenticated, remote attacker can exploit this to     conduct side-channel cache-timing attacks, allowing the     attacker to recover the  modular inversion state     sequences and the ECDSA private keys. Note that this     vulnerability does not affect Mac OS X 10.10.5.
    (CVE-2016-7056)

  - An integer overflow condition exists in the ImageIO     component due to improper validation of user-supplied     input. An unauthenticated, remote attacker can exploit     this, by convincing a user to open a specially crafted     JPEG file, to cause a denial of service condition or the     execution of arbitrary code. (CVE-2017-2432)

  - Multiple memory corruption issues exist in the libxslt     component that allow an unauthenticated, remote attacker     to cause a denial of service condition or the execution     of arbitrary code. (CVE-2017-2477)

  - An integer overflow condition exists in the libxslt     component in the xsltAddTextString() function in     transform.c. An unauthenticated, remote attacker can     exploit this, by convincing a user to open a specially     crafted file, to cause an out-of-bounds write,     potentially allowing the execution of arbitrary code.
    (CVE-2017-5029)

The remote host is running a version of macOS that is 10.12.x prior to 10.12.4. It is, therefore, affected by multiple vulnerabilities in multiple components, some of which are remote code execution vulnerabilities. An unauthenticated, remote attacker can exploit these remote code execution vulnerabilities by convincing a user to visit a specially crafted website, resulting in the execution of arbitrary code in the context of the current user. The affected components are as follows :

  - apache
  - apache_mod_php
  - AppleGraphicsPowerManagement
  - AppleRAID
  - Audio
  - Bluetooth
  - Carbon
  - CoreGraphics
  - CoreMedia
  - CoreText
  - curl
  - EFI
  - FinderKit
  - FontParser
  - HTTPProtocol
  - Hypervisor
  - iBooks
  - ImageIO
  - Intel Graphics Driver
  - IOATAFamily
  - IOFireWireAVC
  - IOFireWireFamily
  - Kernel
  - Keyboards
  - libarchive
  - libc++abi
  - LibreSSL
  - MCX Client
  - Menus
  - Multi-Touch
  - OpenSSH
  - OpenSSL
  - Printing
  - python
  - QuickTime
  - Security
  - SecurityFoundation
  - sudo
  - System Integrity Protection
  - tcpdump
  - tiffutil
  - WebKit

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3236-1 advisory.

    Multiple vulnerabilities were discovered in Chromium. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit these to obtain sensitive information, spoof     application UI by causing the security status API or webview URL to indicate the wrong values, bypass     security restrictions, cause a denial of service via application crash, or execute arbitrary code.
    (CVE-2017-5029, CVE-2017-5030, CVE-2017-5031, CVE-2017-5033, CVE-2017-5035, CVE-2017-5037, CVE-2017-5040,     CVE-2017-5041, CVE-2017-5044, CVE-2017-5045, CVE-2017-5046)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

libxslt is vulnerable to an integer overflow in the xsltAddTextString function that can be exploited to trigger an out of bounds write on 64-bit systems.

For Debian 7 'Wheezy', this problem has been fixed in version 1.1.26-14.1+deb7u3.

We recommend that you upgrade your libxslt packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Chromium was updated to 57.0.2987.98 to fix security issues and bugs.

The following vulnerabilities were fixed (bsc#1028848) :

  - CVE-2017-5030: Memory corruption in V8

  - CVE-2017-5031: Use after free in ANGLE

  - CVE-2017-5032: Out of bounds write in PDFium

  - CVE-2017-5029: Integer overflow in libxslt

  - CVE-2017-5034: Use after free in PDFium

  - CVE-2017-5035: Incorrect security UI in Omnibox

  - CVE-2017-5036: Use after free in PDFium

  - CVE-2017-5037: Multiple out of bounds writes in     ChunkDemuxer

  - CVE-2017-5039: Use after free in PDFium

  - CVE-2017-5040: Information disclosure in V8

  - CVE-2017-5041: Address spoofing in Omnibox

  - CVE-2017-5033: Bypass of Content Security Policy in     Blink

  - CVE-2017-5042: Incorrect handling of cookies in Cast

  - CVE-2017-5038: Use after free in GuestView

  - CVE-2017-5043: Use after free in GuestView

  - CVE-2017-5044: Heap overflow in Skia

  - CVE-2017-5045: Information disclosure in XSS Auditor

  - CVE-2017-5046: Information disclosure in Blink

The following non-security changes are included :

  - Address broken rendering on non-intel cards

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2017-5029     Holger Fuhrmannek discovered an integer overflow issue     in the libxslt library.

  - CVE-2017-5030     Brendon Tiszka discovered a memory corruption issue in     the v8 JavaScript library.

  - CVE-2017-5031     Looben Yang discovered a use-after-free issue in the     ANGLE library.

  - CVE-2017-5032     Ashfaq Ansari discovered an out-of-bounds write in the     pdfium library.

  - CVE-2017-5033     Nicolai Grodum discovered a way to bypass the Content     Security Policy.

  - CVE-2017-5034     Ke Liu discovered an integer overflow issue in the     pdfium library.

  - CVE-2017-5035     Enzo Aguado discovered an issue with the omnibox.

  - CVE-2017-5036     A use-after-free issue was discovered in the pdfium     library.

  - CVE-2017-5037     Yongke Wang discovered multiple out-of-bounds write     issues.

  - CVE-2017-5038     A use-after-free issue was discovered in the guest view.

  - CVE-2017-5039     jinmo123 discovered a use-after-free issue in the pdfium     library.

  - CVE-2017-5040     Choongwoo Han discovered an information disclosure issue     in the v8 JavaScript library.

  - CVE-2017-5041     Jordi Chancel discovered an address spoofing issue.

  - CVE-2017-5042     Mike Ruddy discovered incorrect handling of cookies.

  - CVE-2017-5043     Another use-after-free issue was discovered in the guest     view.

  - CVE-2017-5044     Kushal Arvind Shah discovered a heap overflow issue in     the skia library.

  - CVE-2017-5045     Dhaval Kapil discovered an information disclosure issue.

  - CVE-2017-5046     Masato Kinugawa discovered an information disclosure     issue.

The version of Google Chrome installed on the remote macOS or Mac OS X host is prior to 57.0.2987.98. It is, therefore, affected by the following vulnerabilities :

  - An integer overflow condition condition exists in     libxslt in the xsltAddTextString() function in     transform.c due to improper validation of user-supplied     input. An unauthenticated, remote attacker can exploit     this to cause an out-of-bounds write error, resulting in     the execution of arbitrary code. (CVE-2017-5029)

  - A flaw exists in Google V8 in the ArrayConcatVisitor     class in builtins-array.cc due to improper handling of     JSProxy species. An unauthenticated, remote attacker can     exploit this to corrupt memory, resulting in a denial of     service condition or the execution of arbitrary code.
    (CVE-2017-5030)

  - A use-after-free error exists in the ANGLE component due     to improper handling of buffer storage operations. An     unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2017-5031)

  - An overflow condition exists in Google PDFium in the     GetTextRunInfo() function in pdfium_page.cc that is     triggered when processing text runs. An unauthenticated,     remote attacker can exploit this, via a specially     crafted PDF file, to execute arbitrary code.
    (CVE-2017-5032)

  - A security bypass vulnerability exists in the     initContentSecurityPolicy() function in Document.cpp due     to local schemes not inheriting the content security     policy. An unauthenticated, remote attacker can exploit     this to bypass the content security policy.
    (CVE-2017-5033)

  - A flaw exists in the OpenJPEG component in the     m_mct_records() function in j2k.c due to improper     handling of specially crafted JPEG2000 files. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition. (CVE-2017-5034)

  - An unspecified flaw exists in the     RendererDidNavigateToExistingPage() function in     navigation_controller_impl.cc that occurs when handling     data from the renderer process. An unauthenticated,     remote attacker can exploit this to have an unspecified     impact on the security UI. (CVE-2017-5035)

  - A use-after-free error exists in Google PDFium in the     Document class in Document.h due to improper handling of     'm_Icons' properties. An unauthenticated, remote     attacker can exploit this to dereference already freed     memory, resulting in the execution of arbitrary code.
    (CVE-2017-5036)

  - Multiple integer overflow conditions exists in the     TrackFragmentRun::Parse() function in box_definitions.cc     due to improper parsing of track fragments in MP4     content. An unauthenticated, remote attacker can exploit     this to execute arbitrary code. (CVE-2017-5037)

  - An unspecified use-after-free error occurs when     GuestView objects inherit the prototypes from the global     JS object. An unauthenticated, remote attacker can     exploit this to execute arbitrary code. (CVE-2017-5038)

  - A use-after-free error exists in Google PDFium in the     GlobalTimer() function in app.cpp due to improper     handling of timers. An unauthenticated, remote attacker     can exploit this to execute arbitrary code.
    (CVE-2017-5039)

  - An unspecified flaw exists in Google V8 that allows an     unauthenticated, remote attacker to disclose sensitive     information. (CVE-2017-5040)

  - A flaw exists in the Omnibox address bar that allows an     unauthenticated, remote attacker to spoof an address.
    (CVE-2017-5041)

  - An unspecified flaw exists in the Cast feature that is     triggered when handling cookies. An unauthenticated,     remote attacker can exploit this to have an unspecified     impact. (CVE-2017-5042)

  - A use-after-free error exists in     guest_view_internal_custom_bindings.cc due to improper     handling of the GuestViewContainer pointer during a     GuestView attach operation. An unauthenticated, remote     attacker can exploit this to execute arbitrary code.
    (CVE-2017-5043)

  - A heap-based overflow condition exists in Google Skia     that occurs when deserializing SkRegion objects. An     unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2017-5044)

  - An unspecified flaw exists in the XSS auditor that     allows an unauthenticated, remote attacker to disclose     sensitive information. (CVE-2017-5045)

  - An unspecified flaw exists in interface_base.cpp.tmpl     that occurs when handling author scripts interacting     with Symbol.toPrimitive properties of Location objects.
    An unauthenticated, remote attacker can exploit this to     disclose sensitive information. (CVE-2017-5046)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 57.0.2987.98. It is, therefore, affected by the following vulnerabilities :

  - An integer overflow condition condition exists in     libxslt in the xsltAddTextString() function in     transform.c due to improper validation of user-supplied     input. An unauthenticated, remote attacker can exploit     this to cause an out-of-bounds write error, resulting in     the execution of arbitrary code. (CVE-2017-5029)

  - A flaw exists in Google V8 in the ArrayConcatVisitor     class in builtins-array.cc due to improper handling of     JSProxy species. An unauthenticated, remote attacker can     exploit this to corrupt memory, resulting in a denial of     service condition or the execution of arbitrary code.
    (CVE-2017-5030)

  - A use-after-free error exists in the ANGLE component due     to improper handling of buffer storage operations. An     unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2017-5031)

  - An overflow condition exists in Google PDFium in the     GetTextRunInfo() function in pdfium_page.cc that is     triggered when processing text runs. An unauthenticated,     remote attacker can exploit this, via a specially     crafted PDF file, to execute arbitrary code.
    (CVE-2017-5032)

  - A security bypass vulnerability exists in the     initContentSecurityPolicy() function in Document.cpp due     to local schemes not inheriting the content security     policy. An unauthenticated, remote attacker can exploit     this to bypass the content security policy.
    (CVE-2017-5033)

  - A flaw exists in the OpenJPEG component in the     m_mct_records() function in j2k.c due to improper     handling of specially crafted JPEG2000 files. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition. (CVE-2017-5034)

  - An unspecified flaw exists in the     RendererDidNavigateToExistingPage() function in     navigation_controller_impl.cc that occurs when handling     data from the renderer process. An unauthenticated,     remote attacker can exploit this to have an unspecified     impact on the security UI. (CVE-2017-5035)

  - A use-after-free error exists in Google PDFium in the     Document class in Document.h due to improper handling of     'm_Icons' properties. An unauthenticated, remote     attacker can exploit this to dereference already freed     memory, resulting in the execution of arbitrary code.
    (CVE-2017-5036)

  - Multiple integer overflow conditions exists in the     TrackFragmentRun::Parse() function in box_definitions.cc     due to improper parsing of track fragments in MP4     content. An unauthenticated, remote attacker can exploit     this to execute arbitrary code. (CVE-2017-5037)

  - An unspecified use-after-free error occurs when     GuestView objects inherit the prototypes from the global     JS object. An unauthenticated, remote attacker can     exploit this to execute arbitrary code. (CVE-2017-5038)

  - A use-after-free error exists in Google PDFium in the     GlobalTimer() function in app.cpp due to improper     handling of timers. An unauthenticated, remote attacker     can exploit this to execute arbitrary code.
    (CVE-2017-5039)

  - An unspecified flaw exists in Google V8 that allows an     unauthenticated, remote attacker to disclose sensitive     information. (CVE-2017-5040)

  - A flaw exists in the Omnibox address bar that allows an     unauthenticated, remote attacker to spoof an address.
    (CVE-2017-5041)

  - An unspecified flaw exists in the Cast feature that is     triggered when handling cookies. An unauthenticated,     remote attacker can exploit this to have an unspecified     impact. (CVE-2017-5042)

  - A use-after-free error exists in     guest_view_internal_custom_bindings.cc due to improper     handling of the GuestViewContainer pointer during a     GuestView attach operation. An unauthenticated, remote     attacker can exploit this to execute arbitrary code.
    (CVE-2017-5043)

  - A heap-based overflow condition exists in Google Skia     that occurs when deserializing SkRegion objects. An     unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2017-5044)

  - An unspecified flaw exists in the XSS auditor that     allows an unauthenticated, remote attacker to disclose     sensitive information. (CVE-2017-5045)

  - An unspecified flaw exists in interface_base.cpp.tmpl     that occurs when handling author scripts interacting     with Symbol.toPrimitive properties of Location objects.
    An unauthenticated, remote attacker can exploit this to     disclose sensitive information. (CVE-2017-5046)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Chromium is an open source web browser, powered by WebKit (Blink).

This update upgrades Chromium to version 57.0.2987.98.

Security Fix(es) :

* Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when visited by the victim. (CVE-2017-5029, CVE-2017-5030, CVE-2017-5031, CVE-2017-5032, CVE-2017-5034, CVE-2017-5035, CVE-2017-5036, CVE-2017-5037, CVE-2017-5039, CVE-2017-5033, CVE-2017-5038, CVE-2017-5040, CVE-2017-5041, CVE-2017-5042, CVE-2017-5043, CVE-2017-5044, CVE-2017-5045, CVE-2017-5046)

Google Chrome Releases reports :

36 security fixes in this release

Please reference CVE/URL list for details

ID	Name	Product	Family	Severity
177842	Nessus Network Monitor < 6.2.2 Multiple Vulnerabilities (TNS-2023-23)	Nessus	Misc.	critical
108821	GLSA-201804-01 : libxslt: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
103237	FreeBSD : GitLab -- multiple vulnerabilities (6a177c87-9933-11e7-93f7-d43d7e971a1b)	Nessus	FreeBSD Local Security Checks	high
101920	Fedora 24 : qt5-qtwebengine (2017-98bed96d12)	Nessus	Fedora Local Security Checks	critical
101740	Fedora 26 : qt5-qtwebengine (2017-e83c26a8c9)	Nessus	Fedora Local Security Checks	critical
101504	Fedora 25 : qt5-qtwebengine (2017-58cde32413)	Nessus	Fedora Local Security Checks	critical
100367	openSUSE Security Update : libxslt (openSUSE-2017-609)	Nessus	SuSE Local Security Checks	high
100243	SUSE SLED12 / SLES12 Security Update : libxslt (SUSE-SU-2017:1313-1)	Nessus	SuSE Local Security Checks	high
100208	SUSE SLES11 Security Update : libxslt (SUSE-SU-2017:1282-1)	Nessus	SuSE Local Security Checks	high
100026	Apple iTunes < 12.6 Multiple Vulnerabilities (uncredentialed check)	Nessus	Peer-To-Peer File Sharing	critical
100025	Apple iTunes < 12.6 Multiple Vulnerabilities (credentialed check)	Nessus	Windows	critical
99725	Ubuntu 14.04 LTS / 16.04 LTS : Libxslt vulnerabilities (USN-3271-1)	Nessus	Ubuntu Local Security Checks	high
99135	Mac OS X Multiple Vulnerabilities (Security Update 2017-001	Nessus	MacOS X Local Security Checks	critical
99134	macOS 10.12.x < 10.12.4 Multiple Vulnerabilities (httpoxy)	Nessus	MacOS X Local Security Checks	critical
99093	Ubuntu 14.04 LTS / 16.04 LTS : Oxide vulnerabilities (USN-3236-1)	Nessus	Ubuntu Local Security Checks	high
97920	Debian DLA-866-1 : libxslt security update	Nessus	Debian Local Security Checks	high
97817	openSUSE Security Update : Chromium (openSUSE-2017-353)	Nessus	SuSE Local Security Checks	high
97783	Debian DSA-3810-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	high
97725	Google Chrome < 57.0.2987.98 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	high
97724	Google Chrome < 57.0.2987.98 Multiple Vulnerabilities	Nessus	Windows	high
97718	RHEL 6 : chromium-browser (RHSA-2017:0499)	Nessus	Red Hat Local Security Checks	high
97689	FreeBSD : chromium -- multiple vulnerabilities (a505d397-0758-11e7-8d8b-e8e0b747a45a)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2017-5029

high

Tenable Plugins

critical

high

high

critical

critical

critical

high

high

high

critical

critical

high

critical

critical

high

high

high

high

high

high

high

high