Inappropriate use of JIT optimisation in V8 in Google Chrome prior to 61.0.3163.100 for Linux, Windows, and Mac allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page, related to the escape analysis phase.

The version of Google Chrome installed on the remote host is prior to 61.0.3163.100, and is affected by multiple vulnerabilities :

 - A flaw exists that is triggered as the JIT escape analysis pass may optimize out the initialization of certain local variables. With specially crafted JavaScript, a context-dependent attacker can execute arbitrary code.
 - An out-of-bounds access flaw exists in WASM that is triggered when handling table sizes. This may allow a context-dependent attacker to potentially execute arbitrary code.
 - An off-by-one out-of-bounds access flaw exists in the 'Typer::Visitor::JSCallTyper()' function in 'compiler/typer.cc' that is triggered when handling range optimization for the 'String.indexOf()' and 'String.lastIndexOf()' JavaScript methods. This may allow a context-dependent attacker to execute arbitrary code.

Update to 61.0.3163.100. Security fix for CVE-2017-5111, CVE-2017-5112, CVE-2017-5113, CVE-2017-5114, CVE-2017-5115, CVE-2017-5116, CVE-2017-5117, CVE-2017-5118, CVE-2017-5119, CVE-2017-5120, CVE-2017-5121, CVE-2017-5122

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2017-5111     Luat Nguyen discovered a use-after-free issue in the     pdfium library.

  - CVE-2017-5112     Tobias Klein discovered a buffer overflow issue in the     webgl library.

  - CVE-2017-5113     A buffer overflow issue was discovered in the skia     library.

  - CVE-2017-5114     Ke Liu discovered a memory issue in the pdfium library.

  - CVE-2017-5115     Marco Giovannini discovered a type confusion issue in     the v8 JavaScript library.

  - CVE-2017-5116     Guang Gong discovered a type confusion issue in the v8     JavaScript library.

  - CVE-2017-5117     Tobias Klein discovered an uninitialized value in the     skia library.

  - CVE-2017-5118     WenXu Wu discovered a way to bypass the Content Security     Policy.

  - CVE-2017-5119     Another uninitialized value was discovered in the skia     library.

  - CVE-2017-5120     Xiaoyin Liu discovered a way downgrade HTTPS connections     during redirection.

  - CVE-2017-5121     Jordan Rabet discovered an out-of-bounds memory access     in the v8 JavaScript library.

  - CVE-2017-5122     Choongwoo Han discovered an out-of-bounds memory access     in the v8 JavaScript library.

An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Chromium is an open source web browser, powered by WebKit (Blink).

This update upgrades Chromium to version 61.0.3163.100.

Security Fix(es) :

* Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when visited by the victim. (CVE-2017-5121, CVE-2017-5122)

The remote host is affected by the vulnerability described in GLSA-201709-25 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium. Please review       the referenced CVE identifiers for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This update to Chromium 61.0.3163.100 fixes the following vulnerabilities :

  - CVE-2017-5121: Out-of-bounds access in V8

  - CVE-2017-5122: Out-of-bounds access in V8

  - Various fixes from internal audits, fuzzing and other     initiatives

Google Chrome releases reports :

3 security fixes in this release, including :

- [765433] High CVE-2017-5121: Out-of-bounds access in V8. Reported by Jordan Rabet, Microsoft Offensive Security Research and Microsoft ChakraCore team on 2017-09-14

- [752423] High CVE-2017-5122: Out-of-bounds access in V8. Reported by Choongwoo Han of Naver Corporation on 2017-08-04

- [767508] Various fixes from internal audits, fuzzing and other initiatives

The version of Google Chrome installed on the remote macOS or Mac OS X host is prior to 61.0.3163.100. It is, therefore, affected by two out-of- bounds access flaws related to the V8 JavaScript engine that have unspecified impact.

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 61.0.3163.100. It is, therefore, affected by two out-of- bounds access flaws related to the V8 JavaScript engine that have unspecified impact.

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
700344	Google Chrome < 61.0.3163.100 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
105815	Fedora 27 : chromium (2017-109f8db088)	Nessus	Fedora Local Security Checks	high
103907	Fedora 26 : chromium (2017-efeb59171d)	Nessus	Fedora Local Security Checks	high
103539	Debian DSA-3985-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	high
103465	RHEL 6 : chromium-browser (RHSA-2017:2792)	Nessus	Red Hat Local Security Checks	high
103464	GLSA-201709-25 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
103451	openSUSE Security Update : Chromium (openSUSE-2017-1085)	Nessus	SuSE Local Security Checks	high
103441	FreeBSD : chromium -- multiple vulnerabilities (917e5519-9fdd-11e7-8b58-e8e0b747a45a)	Nessus	FreeBSD Local Security Checks	high
103422	Google Chrome < 61.0.3163.100 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	high
103421	Google Chrome < 61.0.3163.100 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2017-5121

high

Tenable Plugins

medium

high

high

high

high

high

high

high

high

high