The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3236-1 advisory.

    Multiple vulnerabilities were discovered in Chromium. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit these to obtain sensitive information, spoof     application UI by causing the security status API or webview URL to indicate the wrong values, bypass     security restrictions, cause a denial of service via application crash, or execute arbitrary code.
    (CVE-2017-5029, CVE-2017-5030, CVE-2017-5031, CVE-2017-5033, CVE-2017-5035, CVE-2017-5037, CVE-2017-5040,     CVE-2017-5041, CVE-2017-5044, CVE-2017-5045, CVE-2017-5046)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Chromium is an open source web browser, powered by WebKit (Blink).

This update upgrades Chromium to version 57.0.2987.98.

Security Fix(es) :

* Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when visited by the victim. (CVE-2017-5029, CVE-2017-5030, CVE-2017-5031, CVE-2017-5032, CVE-2017-5034, CVE-2017-5035, CVE-2017-5036, CVE-2017-5037, CVE-2017-5039, CVE-2017-5033, CVE-2017-5038, CVE-2017-5040, CVE-2017-5041, CVE-2017-5042, CVE-2017-5043, CVE-2017-5044, CVE-2017-5045, CVE-2017-5046)

Chromium was updated to 57.0.2987.98 to fix security issues and bugs.

The following vulnerabilities were fixed (bsc#1028848) :

  - CVE-2017-5030: Memory corruption in V8

  - CVE-2017-5031: Use after free in ANGLE

  - CVE-2017-5032: Out of bounds write in PDFium

  - CVE-2017-5029: Integer overflow in libxslt

  - CVE-2017-5034: Use after free in PDFium

  - CVE-2017-5035: Incorrect security UI in Omnibox

  - CVE-2017-5036: Use after free in PDFium

  - CVE-2017-5037: Multiple out of bounds writes in     ChunkDemuxer

  - CVE-2017-5039: Use after free in PDFium

  - CVE-2017-5040: Information disclosure in V8

  - CVE-2017-5041: Address spoofing in Omnibox

  - CVE-2017-5033: Bypass of Content Security Policy in     Blink

  - CVE-2017-5042: Incorrect handling of cookies in Cast

  - CVE-2017-5038: Use after free in GuestView

  - CVE-2017-5043: Use after free in GuestView

  - CVE-2017-5044: Heap overflow in Skia

  - CVE-2017-5045: Information disclosure in XSS Auditor

  - CVE-2017-5046: Information disclosure in Blink

The following non-security changes are included :

  - Address broken rendering on non-intel cards

Google Chrome Releases reports :

36 security fixes in this release

Please reference CVE/URL list for details

The version of Google Chrome installed on the remote Windows host is prior to 57.0.2987.98. It is, therefore, affected by the following vulnerabilities :

  - An integer overflow condition condition exists in     libxslt in the xsltAddTextString() function in     transform.c due to improper validation of user-supplied     input. An unauthenticated, remote attacker can exploit     this to cause an out-of-bounds write error, resulting in     the execution of arbitrary code. (CVE-2017-5029)

  - A flaw exists in Google V8 in the ArrayConcatVisitor     class in builtins-array.cc due to improper handling of     JSProxy species. An unauthenticated, remote attacker can     exploit this to corrupt memory, resulting in a denial of     service condition or the execution of arbitrary code.
    (CVE-2017-5030)

  - A use-after-free error exists in the ANGLE component due     to improper handling of buffer storage operations. An     unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2017-5031)

  - An overflow condition exists in Google PDFium in the     GetTextRunInfo() function in pdfium_page.cc that is     triggered when processing text runs. An unauthenticated,     remote attacker can exploit this, via a specially     crafted PDF file, to execute arbitrary code.
    (CVE-2017-5032)

  - A security bypass vulnerability exists in the     initContentSecurityPolicy() function in Document.cpp due     to local schemes not inheriting the content security     policy. An unauthenticated, remote attacker can exploit     this to bypass the content security policy.
    (CVE-2017-5033)

  - A flaw exists in the OpenJPEG component in the     m_mct_records() function in j2k.c due to improper     handling of specially crafted JPEG2000 files. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition. (CVE-2017-5034)

  - An unspecified flaw exists in the     RendererDidNavigateToExistingPage() function in     navigation_controller_impl.cc that occurs when handling     data from the renderer process. An unauthenticated,     remote attacker can exploit this to have an unspecified     impact on the security UI. (CVE-2017-5035)

  - A use-after-free error exists in Google PDFium in the     Document class in Document.h due to improper handling of     'm_Icons' properties. An unauthenticated, remote     attacker can exploit this to dereference already freed     memory, resulting in the execution of arbitrary code.
    (CVE-2017-5036)

  - Multiple integer overflow conditions exists in the     TrackFragmentRun::Parse() function in box_definitions.cc     due to improper parsing of track fragments in MP4     content. An unauthenticated, remote attacker can exploit     this to execute arbitrary code. (CVE-2017-5037)

  - An unspecified use-after-free error occurs when     GuestView objects inherit the prototypes from the global     JS object. An unauthenticated, remote attacker can     exploit this to execute arbitrary code. (CVE-2017-5038)

  - A use-after-free error exists in Google PDFium in the     GlobalTimer() function in app.cpp due to improper     handling of timers. An unauthenticated, remote attacker     can exploit this to execute arbitrary code.
    (CVE-2017-5039)

  - An unspecified flaw exists in Google V8 that allows an     unauthenticated, remote attacker to disclose sensitive     information. (CVE-2017-5040)

  - A flaw exists in the Omnibox address bar that allows an     unauthenticated, remote attacker to spoof an address.
    (CVE-2017-5041)

  - An unspecified flaw exists in the Cast feature that is     triggered when handling cookies. An unauthenticated,     remote attacker can exploit this to have an unspecified     impact. (CVE-2017-5042)

  - A use-after-free error exists in     guest_view_internal_custom_bindings.cc due to improper     handling of the GuestViewContainer pointer during a     GuestView attach operation. An unauthenticated, remote     attacker can exploit this to execute arbitrary code.
    (CVE-2017-5043)

  - A heap-based overflow condition exists in Google Skia     that occurs when deserializing SkRegion objects. An     unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2017-5044)

  - An unspecified flaw exists in the XSS auditor that     allows an unauthenticated, remote attacker to disclose     sensitive information. (CVE-2017-5045)

  - An unspecified flaw exists in interface_base.cpp.tmpl     that occurs when handling author scripts interacting     with Symbol.toPrimitive properties of Location objects.
    An unauthenticated, remote attacker can exploit this to     disclose sensitive information. (CVE-2017-5046)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote macOS or Mac OS X host is prior to 57.0.2987.98. It is, therefore, affected by the following vulnerabilities :

  - An integer overflow condition condition exists in     libxslt in the xsltAddTextString() function in     transform.c due to improper validation of user-supplied     input. An unauthenticated, remote attacker can exploit     this to cause an out-of-bounds write error, resulting in     the execution of arbitrary code. (CVE-2017-5029)

  - A flaw exists in Google V8 in the ArrayConcatVisitor     class in builtins-array.cc due to improper handling of     JSProxy species. An unauthenticated, remote attacker can     exploit this to corrupt memory, resulting in a denial of     service condition or the execution of arbitrary code.
    (CVE-2017-5030)

  - A use-after-free error exists in the ANGLE component due     to improper handling of buffer storage operations. An     unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2017-5031)

  - An overflow condition exists in Google PDFium in the     GetTextRunInfo() function in pdfium_page.cc that is     triggered when processing text runs. An unauthenticated,     remote attacker can exploit this, via a specially     crafted PDF file, to execute arbitrary code.
    (CVE-2017-5032)

  - A security bypass vulnerability exists in the     initContentSecurityPolicy() function in Document.cpp due     to local schemes not inheriting the content security     policy. An unauthenticated, remote attacker can exploit     this to bypass the content security policy.
    (CVE-2017-5033)

  - A flaw exists in the OpenJPEG component in the     m_mct_records() function in j2k.c due to improper     handling of specially crafted JPEG2000 files. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition. (CVE-2017-5034)

  - An unspecified flaw exists in the     RendererDidNavigateToExistingPage() function in     navigation_controller_impl.cc that occurs when handling     data from the renderer process. An unauthenticated,     remote attacker can exploit this to have an unspecified     impact on the security UI. (CVE-2017-5035)

  - A use-after-free error exists in Google PDFium in the     Document class in Document.h due to improper handling of     'm_Icons' properties. An unauthenticated, remote     attacker can exploit this to dereference already freed     memory, resulting in the execution of arbitrary code.
    (CVE-2017-5036)

  - Multiple integer overflow conditions exists in the     TrackFragmentRun::Parse() function in box_definitions.cc     due to improper parsing of track fragments in MP4     content. An unauthenticated, remote attacker can exploit     this to execute arbitrary code. (CVE-2017-5037)

  - An unspecified use-after-free error occurs when     GuestView objects inherit the prototypes from the global     JS object. An unauthenticated, remote attacker can     exploit this to execute arbitrary code. (CVE-2017-5038)

  - A use-after-free error exists in Google PDFium in the     GlobalTimer() function in app.cpp due to improper     handling of timers. An unauthenticated, remote attacker     can exploit this to execute arbitrary code.
    (CVE-2017-5039)

  - An unspecified flaw exists in Google V8 that allows an     unauthenticated, remote attacker to disclose sensitive     information. (CVE-2017-5040)

  - A flaw exists in the Omnibox address bar that allows an     unauthenticated, remote attacker to spoof an address.
    (CVE-2017-5041)

  - An unspecified flaw exists in the Cast feature that is     triggered when handling cookies. An unauthenticated,     remote attacker can exploit this to have an unspecified     impact. (CVE-2017-5042)

  - A use-after-free error exists in     guest_view_internal_custom_bindings.cc due to improper     handling of the GuestViewContainer pointer during a     GuestView attach operation. An unauthenticated, remote     attacker can exploit this to execute arbitrary code.
    (CVE-2017-5043)

  - A heap-based overflow condition exists in Google Skia     that occurs when deserializing SkRegion objects. An     unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2017-5044)

  - An unspecified flaw exists in the XSS auditor that     allows an unauthenticated, remote attacker to disclose     sensitive information. (CVE-2017-5045)

  - An unspecified flaw exists in interface_base.cpp.tmpl     that occurs when handling author scripts interacting     with Symbol.toPrimitive properties of Location objects.
    An unauthenticated, remote attacker can exploit this to     disclose sensitive information. (CVE-2017-5046)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201704-02 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in the Chromium web       browser. Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information, or bypass security restrictions.
  Workaround :

    There is no known workaround at this time.

This update updates QtWebEngine to the 5.9.0 release. QtWebEngine 5.9.0 is part of the Qt 5.9.0 release, but only the QtWebEngine component is included in this update.

The update fixes the following security issues in QtWebEngine 5.8.0:
CVE-2017-5006, CVE-2017-5007, CVE-2017-5008, CVE-2017-5009, CVE-2017-5010, CVE-2017-5011, CVE-2017-5012, CVE-2017-5013, CVE-2017-5014, CVE-2017-5015, CVE-2017-5016, CVE-2017-5017, CVE-2017-5018, CVE-2017-5019, CVE-2017-5020, CVE-2017-5021, CVE-2017-5022, CVE-2017-5023, CVE-2017-5024, CVE-2017-5025, CVE-2017-5026, CVE-2017-5027, CVE-2017-5029, CVE-2017-5032, CVE-2017-5033, CVE-2017-5034, CVE-2017-5036, CVE-2017-5039, CVE-2017-5040, CVE-2017-5044, CVE-2017-5045, CVE-2017-5046, CVE-2017-5052, CVE-2017-5053, CVE-2017-5055, CVE-2017-5057, CVE-2017-5058, CVE-2017-5059, CVE-2017-5060, CVE-2017-5061, CVE-2017-5062, CVE-2017-5065, CVE-2017-5066, CVE-2017-5067, CVE-2017-5068, and CVE-2017-5069.

Other important changes include :

  - Based on Chromium 56.0.2924.122 with security fixes from     Chromium up to version 58.0.3029.96. (5.8.0 was based on     Chromium 53.0.2785.148 with security fixes from Chromium     up to version 55.0.2883.75.)

  - [QTBUG-54650, QTBUG-59922] Accessibility is now disabled     by default on Linux, like it is in Chrome, due to poor     options for enabling it conditionally and its heavy     performance impact. Set the environment variable     `QTWEBENGINE_ENABLE_LINUX_ACCESSIBILITY` to enable it     again.

  - [QTBUG-56531] Enabled `filesystem:` protocol handler.

  - [QTBUG-57720] Optimized incremental scene-graph     rendering in particular for software rendering.

  - [QTBUG-60049] Enabled brotli support.

  - Many bug fixes, see     https://code.qt.io/cgit/qt/qtwebengine.git/tree/dist/cha     nges-5.9.0?h=5.9 for details.

In addition, this build includes a fix for https://bugreports.qt.io/browse/QTBUG-61521 , a binary incompatibility in QtWebEngine 5.9.0 compared to 5.8.0.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update updates QtWebEngine to a snapshot from the Qt 5.6 LTS (long-term support) branch. This is a snapshot of the QtWebEngine that will be included in the bugfix and security release Qt 5.6.3, but only the QtWebEngine component is included in this update.

The update fixes the following security issues in QtWebEngine 5.6.2:
CVE-2016-5133, CVE-2016-5147, CVE-2016-5153, CVE-2016-5155, CVE-2016-5161, CVE-2016-5166, CVE-2016-5170, CVE-2016-5171, CVE-2016-5172, CVE-2016-5181, CVE-2016-5185, CVE-2016-5186, CVE-2016-5187, CVE-2016-5188, CVE-2016-5192, CVE-2016-5198, CVE-2016-5205, CVE-2016-5207, CVE-2016-5208, CVE-2016-5214, CVE-2016-5215, CVE-2016-5221, CVE-2016-5222, CVE-2016-5224, CVE-2016-5225, CVE-2016-9650, CVE-2016-9651, CVE-2016-9652, CVE-2017-5006, CVE-2017-5007, CVE-2017-5008, CVE-2017-5009, CVE-2017-5010, CVE-2017-5012, CVE-2017-5015, CVE-2017-5016, CVE-2017-5017, CVE-2017-5019, CVE-2017-5023, CVE-2017-5024, CVE-2017-5025, CVE-2017-5026, CVE-2017-5027, CVE-2017-5029, CVE-2017-5033, CVE-2017-5037, CVE-2017-5044, CVE-2017-5046, CVE-2017-5047, CVE-2017-5048, CVE-2017-5049, CVE-2017-5050, CVE-2017-5051, CVE-2017-5059, CVE-2017-5061, CVE-2017-5062, CVE-2017-5065, CVE-2017-5067, CVE-2017-5069, CVE-2017-5070, CVE-2017-5071, CVE-2017-5075, CVE-2017-5076, CVE-2016-5078, CVE-2017-5083, and CVE-2017-5089.

Other important changes include :

  - Based on Chromium 49.0.2623.111 (the version used in     QtWebEngine 5.7.x) with security fixes from Chromium up     to version 59.0.3071.104. (5.6.2 was based on Chromium     45.0.2554.101 with security fixes from Chromium up to     version 52.0.2743.116.)

  - All other bug fixes from QtWebEngine 5.7.1 have been     backported.

See http://code.qt.io/cgit/qt/qtwebengine.git/tree/dist/changes-5.6.3?h=5.
6 for details. (Please note that at the time of this writing, not all security backports are listed in that file yet. The list above is accurate.)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2017-5029     Holger Fuhrmannek discovered an integer overflow issue     in the libxslt library.

  - CVE-2017-5030     Brendon Tiszka discovered a memory corruption issue in     the v8 JavaScript library.

  - CVE-2017-5031     Looben Yang discovered a use-after-free issue in the     ANGLE library.

  - CVE-2017-5032     Ashfaq Ansari discovered an out-of-bounds write in the     pdfium library.

  - CVE-2017-5033     Nicolai Grodum discovered a way to bypass the Content     Security Policy.

  - CVE-2017-5034     Ke Liu discovered an integer overflow issue in the     pdfium library.

  - CVE-2017-5035     Enzo Aguado discovered an issue with the omnibox.

  - CVE-2017-5036     A use-after-free issue was discovered in the pdfium     library.

  - CVE-2017-5037     Yongke Wang discovered multiple out-of-bounds write     issues.

  - CVE-2017-5038     A use-after-free issue was discovered in the guest view.

  - CVE-2017-5039     jinmo123 discovered a use-after-free issue in the pdfium     library.

  - CVE-2017-5040     Choongwoo Han discovered an information disclosure issue     in the v8 JavaScript library.

  - CVE-2017-5041     Jordi Chancel discovered an address spoofing issue.

  - CVE-2017-5042     Mike Ruddy discovered incorrect handling of cookies.

  - CVE-2017-5043     Another use-after-free issue was discovered in the guest     view.

  - CVE-2017-5044     Kushal Arvind Shah discovered a heap overflow issue in     the skia library.

  - CVE-2017-5045     Dhaval Kapil discovered an information disclosure issue.

  - CVE-2017-5046     Masato Kinugawa discovered an information disclosure     issue.

The version of Google Chrome installed on the remote host is prior to 57.0.2987.98, and is affected by multiple vulnerabilities :

 - An unspecified flaw exists that may allow a context-dependent attacker to have an unspecified, high severity impact. No further details have been provided by the vendor.
 - Integer overflow conditions exist in the 'TrackFragmentRun::Parse()' function in 'media/formats/mp4/box_definitions.cc' that are triggered when parsing track fragments in MP4 content. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - A use-after-free condition exists that is triggered as GuestView objects inherit the prototypes from the global JS object. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists in 'guest_view_internal_custom_bindings.cc' that is triggered when handling the GuestViewContainer pointer during a GuestView attach operation. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - An unspecified flaw exists in the XSS auditor that may allow a context-dependent attacker to disclose information. No further details have been provided by the vendor.
 - A flaw exists in the 'Document::initContentSecurityPolicy()' function in 'dom/Document.cpp' that is triggered as local schemes do not inherit the content security policy when using e.g. 'window.open()'. This may allow a context-dependent attacker to bypass the content security policy.
 - A flaw exists in 'bindings/templates/interface_base.cpp.tmpl' that is triggered when handling author scripts interacting with 'Symbol.toPrimitive' properties of Location objects. This may allow a context-dependent attacker to disclose information.
 - A flaw exists in the Omnibox address bar that may allow a context-dependent attacker to spoof an address. No further details have been provided by the vendor.
 - An unspecified flaw exists in the Cast feature that is triggered when handling cookies. This may allow a context-dependent attacker to have an unspecified impact.
 - A flaw exists in the 'SVGInlineTextBoxPainter::shouldPaintSelection()' function in 'paint/SVGInlineTextBoxPainter.cpp' that is triggered when painting selections and rendering a mask, clip-path, pattern, or feImage.

ID	Name	Product	Family	Published	Updated	Severity
99093	Ubuntu 14.04 LTS / 16.04 LTS : Oxide vulnerabilities (USN-3236-1)	Nessus	Ubuntu Local Security Checks	3/30/2017	8/27/2024	high
97718	RHEL 6 : chromium-browser (RHSA-2017:0499)	Nessus	Red Hat Local Security Checks	3/14/2017	6/8/2022	high
97817	openSUSE Security Update : Chromium (openSUSE-2017-353)	Nessus	SuSE Local Security Checks	3/20/2017	6/8/2022	high
97689	FreeBSD : chromium -- multiple vulnerabilities (a505d397-0758-11e7-8d8b-e8e0b747a45a)	Nessus	FreeBSD Local Security Checks	3/13/2017	6/8/2022	high
97724	Google Chrome < 57.0.2987.98 Multiple Vulnerabilities	Nessus	Windows	3/14/2017	6/8/2022	high
97725	Google Chrome < 57.0.2987.98 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	3/14/2017	6/8/2022	high
99275	GLSA-201704-02 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	4/11/2017	6/8/2022	critical
101504	Fedora 25 : qt5-qtwebengine (2017-58cde32413)	Nessus	Fedora Local Security Checks	7/13/2017	1/6/2021	critical
101920	Fedora 24 : qt5-qtwebengine (2017-98bed96d12)	Nessus	Fedora Local Security Checks	7/24/2017	6/8/2022	critical
101740	Fedora 26 : qt5-qtwebengine (2017-e83c26a8c9)	Nessus	Fedora Local Security Checks	7/17/2017	1/6/2021	critical
97783	Debian DSA-3810-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	3/17/2017	6/18/2024	high
9991	Google Chrome < 57.0.2987.98 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	3/10/2017	3/6/2019	critical

Detections

Analytics

Plugins Search

high

high

high

high

high

high

critical

critical

critical

critical

high

critical