Debian DSA-3731-1 : chromium-browser - security update

critical Nessus Plugin ID 95667

Language:

Synopsis

The remote Debian host is missing a security-related update.

Description

Several vulnerabilities have been discovered in the chromium web browser.

- CVE-2016-5181 A cross-site scripting issue was discovered.

- CVE-2016-5182 Giwan Go discovered a heap overflow issue.

- CVE-2016-5183 A use-after-free issue was discovered in the pdfium library.

- CVE-2016-5184 Another use-after-free issue was discovered in the pdfium library.

- CVE-2016-5185 cloudfuzzer discovered a use-after-free issue in Blink/Webkit.

- CVE-2016-5186 Abdulrahman Alqabandi discovered an out-of-bounds read issue in the developer tools.

- CVE-2016-5187 Luan Herrera discovered a URL spoofing issue.

- CVE-2016-5188 Luan Herrera discovered that some drop down menus can be used to hide parts of the user interface.

- CVE-2016-5189 xisigr discovered a URL spoofing issue.

- CVE-2016-5190 Atte Kettunen discovered a use-after-free issue.

- CVE-2016-5191 Gareth Hughes discovered a cross-site scripting issue.

- CVE-2016-5192 [email protected] discovered a same-origin bypass.

- CVE-2016-5193 Yuyang Zhou discovered a way to pop open a new window.

- CVE-2016-5194 The chrome development team found and fixed various issues during internal auditing.

- CVE-2016-5198 Tencent Keen Security Lab discovered an out-of-bounds memory access issue in the v8 JavaScript library.

- CVE-2016-5199 A heap corruption issue was discovered in the ffmpeg library.

- CVE-2016-5200 Choongwoo Han discovered an out-of-bounds memory access issue in the v8 JavaScript library.

- CVE-2016-5201 Rob Wu discovered an information leak.

- CVE-2016-5202 The chrome development team found and fixed various issues during internal auditing.

- CVE-2016-5203 A use-after-free issue was discovered in the pdfium library.

- CVE-2016-5204 Mariusz Mlynski discovered a cross-site scripting issue in SVG image handling.

- CVE-2016-5205 A cross-site scripting issue was discovered.

- CVE-2016-5206 Rob Wu discovered a same-origin bypass in the pdfium library.

- CVE-2016-5207 Mariusz Mlynski discovered a cross-site scripting issue.

- CVE-2016-5208 Mariusz Mlynski discovered another cross-site scripting issue.

- CVE-2016-5209 Giwan Go discovered an out-of-bounds write issue in Blink/Webkit.

- CVE-2016-5210 Ke Liu discovered an out-of-bounds write in the pdfium library.

- CVE-2016-5211 A use-after-free issue was discovered in the pdfium library.

- CVE-2016-5212 Khalil Zhani discovered an information disclosure issue in the developer tools.

- CVE-2016-5213 Khalil Zhani discovered a use-after-free issue in the v8 JavaScript library.

- CVE-2016-5214 Jonathan Birch discovered a file download protection bypass.

- CVE-2016-5215 Looben Yang discovered a use-after-free issue.

- CVE-2016-5216 A use-after-free issue was discovered in the pdfium library.

- CVE-2016-5217 Rob Wu discovered a condition where data was not validated by the pdfium library.

- CVE-2016-5218 Abdulrahman Alqabandi discovered a URL spoofing issue.

- CVE-2016-5219 Rob Wu discovered a use-after-free issue in the v8 JavaScript library.

- CVE-2016-5220 Rob Wu discovered a way to access files on the local system.

- CVE-2016-5221 Tim Becker discovered an integer overflow issue in the angle library.

- CVE-2016-5222 xisigr discovered a URL spoofing issue.

- CVE-2016-5223 Hwiwon Lee discovered an integer overflow issue in the pdfium library.

- CVE-2016-5224 Roeland Krak discovered a same-origin bypass in SVG image handling.

- CVE-2016-5225 Scott Helme discovered a Content Security Protection bypass.

- CVE-2016-5226 Jun Kokatsu discovered a cross-scripting issue.

- CVE-2016-9650 Jakub Zoczek discovered a Content Security Protection information disclosure.

- CVE-2016-9651 Guang Gong discovered a way to access private data in the v8 JavaScript library.

- CVE-2016-9652 The chrome development team found and fixed various issues during internal auditing.

Solution

Upgrade the chromium-browser packages.

For the stable distribution (jessie), these problems have been fixed in version 55.0.2883.75-1~deb8u1.

Plugin Details

Severity: Critical

ID: 95667

File Name: debian_DSA-3731.nasl

Version: 3.20

Type: local

Agent: unix

Family: Debian Local Security Checks

Published: 12/12/2016

Updated: 6/8/2022

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 8.9

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 9.4

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:debian:debian_linux:8.0, p-cpe:/a:debian:debian_linux:chromium-browser

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 12/11/2016

Vulnerability Publication Date: 12/18/2016

CISA Known Exploited Vulnerability Due Dates: 6/22/2022

Reference Information

CVE: CVE-2016-5181, CVE-2016-5182, CVE-2016-5183, CVE-2016-5184, CVE-2016-5185, CVE-2016-5186, CVE-2016-5187, CVE-2016-5188, CVE-2016-5189, CVE-2016-5190, CVE-2016-5191, CVE-2016-5192, CVE-2016-5193, CVE-2016-5194, CVE-2016-5198, CVE-2016-5199, CVE-2016-5200, CVE-2016-5201, CVE-2016-5202, CVE-2016-5203, CVE-2016-5204, CVE-2016-5205, CVE-2016-5206, CVE-2016-5207, CVE-2016-5208, CVE-2016-5209, CVE-2016-5210, CVE-2016-5211, CVE-2016-5212, CVE-2016-5213, CVE-2016-5214, CVE-2016-5215, CVE-2016-5216, CVE-2016-5217, CVE-2016-5218, CVE-2016-5219, CVE-2016-5220, CVE-2016-5221, CVE-2016-5222, CVE-2016-5223, CVE-2016-5224, CVE-2016-5225, CVE-2016-5226, CVE-2016-9650, CVE-2016-9651, CVE-2016-9652

DSA: 3731

Detections

Analytics