Google Chrome Releases reports :

[589838] High CVE-2016-1643: Type confusion in Blink.

[590620] High CVE-2016-1644: Use-after-free in Blink.

[587227] High CVE-2016-1645: Out-of-bounds write in PDFium.

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2016-1643     cloudfuzzer discovered a type confusion issue in     Blink/Webkit.

  - CVE-2016-1644     Atte Kettunen discovered a use-after-free issue in     Blink/Webkit.

  - CVE-2016-1645     An out-of-bounds write issue was discovered in the     pdfium library.

This update contains Chromium 49.0.2623.87 to fix the following issues :

  - CVE-2016-1643: Type confusion in Blink (boo#970514)

  - CVE-2016-1644: Use-after-free in Blink (boo#970509)

  - CVE-2016-1645: Out-of-bounds write in PDFium     (boo#970511)

The version of Google Chrome installed on the remote Windows host is prior to 49.0.2623.87. It is, therefore, affected by multiple vulnerabilities :

  - A type confusion error exists in the Blink rendering     engine that allows a remote attacker, via a malicious     website, to execute arbitrary code. (CVE-2016-1643)

  - A use-after-free error exists in the Blink rendering     engine that allows a remote attacker, via a malicious     website, to deference already freed memory, resulting     in the execution of arbitrary code. (CVE-2016-1644)

  - An out-of-bounds write error exists in PDFium, the PDF     rendering library, that allows a remote attacker to     manipulate the system memory, resulting the execution     of arbitrary code. (CVE-2016-1645)

The version of Google Chrome installed on the remote Mac OS X host is prior to 49.0.2623.87. It is, therefore, affected by multiple vulnerabilities :

  - A type confusion error exists in the Blink rendering     engine that allows a remote attacker, via a malicious     website, to execute arbitrary code. (CVE-2016-1643)

  - A use-after-free error exists in the Blink rendering     engine that allows a remote attacker, via a malicious     website, to deference already freed memory, resulting     in the execution of arbitrary code. (CVE-2016-1644)

  - An out-of-bounds write error exists in PDFium, the PDF     rendering library, that allows a remote attacker to     manipulate the system memory, resulting the execution     of arbitrary code. (CVE-2016-1645)

Updated chromium-browser packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Chromium is an open source web browser, powered by WebKit (Blink).

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when visited by the victim. (CVE-2016-1643, CVE-2016-1644, CVE-2016-1645)

All Chromium users should upgrade to these updated packages, which contain Chromium version 49.0.2623.87, which corrects these issues.
After installing the update, Chromium must be restarted for the changes to take effect.

ID	Name	Product	Family	Published	Updated	Severity
90288	FreeBSD : chromium -- multiple vulnerabilities (5c288f68-c7ca-4c0d-b7dc-1ec6295200b3)	Nessus	FreeBSD Local Security Checks	4/1/2016	1/4/2021	high
89851	Debian DSA-3513-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	3/11/2016	1/11/2021	high
90055	openSUSE Security Update : Chromium (openSUSE-2016-362)	Nessus	SuSE Local Security Checks	3/21/2016	1/19/2021	high
90056	openSUSE Security Update : Chromium (openSUSE-2016-364)	Nessus	SuSE Local Security Checks	3/21/2016	1/19/2021	high
89786	Google Chrome < 49.0.2623.87 Multiple RCE	Nessus	Windows	3/9/2016	4/11/2022	high
89787	Google Chrome < 49.0.2623.87 Multiple RCE	Nessus	MacOS X Local Security Checks	3/9/2016	11/20/2019	high
89821	RHEL 6 : chromium-browser (RHSA-2016:0429)	Nessus	Red Hat Local Security Checks	3/10/2016	5/29/2020	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high