Detections
Analytics

FreeBSD : chromium -- multiple vulnerabilities (9d732078-32c7-11e5-b263-00262d5ed8ee)

critical Nessus Plugin ID 84994

Language:

Synopsis

The remote FreeBSD host is missing one or more security-related updates.

Description

Google Chrome Releases reports :

43 security fixes in this release, including :

- [446032] High CVE-2015-1271: Heap-buffer-overflow in pdfium. Credit to cloudfuzzer.

- [459215] High CVE-2015-1273: Heap-buffer-overflow in pdfium. Credit to makosoft.

- [461858] High CVE-2015-1274: Settings allowed executable files to run immediately after download. Credit to andrewm.bpi.

- [462843] High CVE-2015-1275: UXSS in Chrome for Android. Credit to WangTao(neobyte) of Baidu X-Team.

- [472614] High CVE-2015-1276: Use-after-free in IndexedDB. Credit to Collin Payne.

- [483981] High CVE-2015-1279: Heap-buffer-overflow in pdfium. Credit to mlafon.

- [486947] High CVE-2015-1280: Memory corruption in skia. Credit to cloudfuzzer.

- [487155] High CVE-2015-1281: CSP bypass. Credit to Masato Kinugawa.

- [487928] High CVE-2015-1282: Use-after-free in pdfium. Credit to Chamal de Silva.

- [492052] High CVE-2015-1283: Heap-buffer-overflow in expat. Credit to sidhpurwala.huzaifa.

- [493243] High CVE-2015-1284: Use-after-free in blink. Credit to Atte Kettunen of OUSPG.

- [504011] High CVE-2015-1286: UXSS in blink. Credit to anonymous.

- [505374] High CVE-2015-1290: Memory corruption in V8. Credit to Yongjun Liu of NSFOCUS Security Team.

- [419383] Medium CVE-2015-1287: SOP bypass with CSS. Credit to filedescriptor.

- [444573] Medium CVE-2015-1270: Uninitialized memory read in ICU.
Credit to Atte Kettunen of OUSPG.

- [451456] Medium CVE-2015-1272: Use-after-free related to unexpected GPU process termination. Credit to Chamal de Silva.

- [479743] Medium CVE-2015-1277: Use-after-free in accessibility.
Credit to SkyLined.

- [482380] Medium CVE-2015-1278: URL spoofing using pdf files. Credit to Chamal de Silva.

- [498982] Medium CVE-2015-1285: Information leak in XSS auditor.
Credit to gazheyes.

- [479162] Low CVE-2015-1288: Spell checking dictionaries fetched over HTTP. Credit to [email protected].

- [512110] CVE-2015-1289: Various fixes from internal audits, fuzzing and other initiatives.

Solution

Update the affected packages.

See Also

https://chromereleases.googleblog.com/

http://www.nessus.org/u?49fbd5e3

Plugin Details

Severity: Critical

ID: 84994

File Name: freebsd_pkg_9d73207832c711e5b26300262d5ed8ee.nasl

Version: 2.11

Type: local

Published: 7/27/2015

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 9.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:chromium, p-cpe:/a:freebsd:freebsd:chromium-npapi, p-cpe:/a:freebsd:freebsd:chromium-pulse, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Patch Publication Date: 7/25/2015

Vulnerability Publication Date: 7/21/2015

Reference Information

CVE: CVE-2015-1270, CVE-2015-1271, CVE-2015-1272, CVE-2015-1273, CVE-2015-1274, CVE-2015-1275, CVE-2015-1276, CVE-2015-1277, CVE-2015-1278, CVE-2015-1279, CVE-2015-1280, CVE-2015-1281, CVE-2015-1282, CVE-2015-1283, CVE-2015-1284, CVE-2015-1285, CVE-2015-1286, CVE-2015-1287, CVE-2015-1288, CVE-2015-1289, CVE-2015-1290