Debian DSA-3039-1 : chromium-browser - security update

critical Nessus Plugin ID 77973

Language:

Synopsis

The remote Debian host is missing a security-related update.

Description

Several vulnerabilities were discovered in the chromium web browser.

- CVE-2014-3160 Christian Schneider discovered a same origin bypass issue in SVG file resource fetching.

- CVE-2014-3162 The Google Chrome development team addressed multiple issues with potential security impact for chromium 36.0.1985.125.

- CVE-2014-3165 Colin Payne discovered a use-after-free issue in the Web Sockets implementation.

- CVE-2014-3166 Antoine Delignat-Lavaud discovered an information leak in the SPDY protocol implementation.

- CVE-2014-3167 The Google Chrome development team addressed multiple issues with potential security impact for chromium 36.0.1985.143.

- CVE-2014-3168 cloudfuzzer discovered a use-after-free issue in SVG image file handling.

- CVE-2014-3169 Andrzej Dyjak discovered a use-after-free issue in the Webkit/Blink Document Object Model implementation.

- CVE-2014-3170 Rob Wu discovered a way to spoof the url of chromium extensions.

- CVE-2014-3171 cloudfuzzer discovered a use-after-free issue in chromium's v8 bindings.

- CVE-2014-3172 Eli Grey discovered a way to bypass access restrictions using chromium's Debugger extension API.

- CVE-2014-3173 jmuizelaar discovered an uninitialized read issue in WebGL.

- CVE-2014-3174 Atte Kettunen discovered an uninitialized read issue in Web Audio.

- CVE-2014-3175 The Google Chrome development team addressed multiple issues with potential security impact for chromium 37.0.2062.94.

- CVE-2014-3176 lokihardt@asrt discovered a combination of flaws that can lead to remote code execution outside of chromium's sandbox.

- CVE-2014-3177 lokihardt@asrt discovered a combination of flaws that can lead to remote code execution outside of chromium's sandbox.

- CVE-2014-3178 miaubiz discovered a use-after-free issue in the Document Object Model implementation in Blink/Webkit.

- CVE-2014-3179 The Google Chrome development team addressed multiple issues with potential security impact for chromium 37.0.2062.120.

Solution

Upgrade the chromium-browser packages.

For the stable distribution (wheezy), these problems have been fixed in version 37.0.2062.120-1~deb7u1.

Plugin Details

Severity: Critical

ID: 77973

File Name: debian_DSA-3039.nasl

Version: 1.14

Type: local

Agent: unix

Family: Debian Local Security Checks

Published: 9/30/2014

Updated: 1/11/2021

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:chromium-browser, cpe:/o:debian:debian_linux:7.0

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Ease: No known exploits are available

Patch Publication Date: 9/28/2014

Vulnerability Publication Date: 7/20/2014

Reference Information

CVE: CVE-2014-3160, CVE-2014-3162, CVE-2014-3165, CVE-2014-3166, CVE-2014-3167, CVE-2014-3168, CVE-2014-3169, CVE-2014-3170, CVE-2014-3171, CVE-2014-3172, CVE-2014-3173, CVE-2014-3174, CVE-2014-3175, CVE-2014-3176, CVE-2014-3177, CVE-2014-3178, CVE-2014-3179

BID: 68677, 69201, 69202, 69203, 69398, 69400, 69401, 69402, 69403, 69404, 69405, 69406, 69407, 69709, 69710

DSA: 3039

Detections

Analytics