Google Chrome Releases reports :

48 security fixes in this release, including :

- [610600] High CVE-2016-1706: Sandbox escape in PPAPI. Credit to Pinkie Pie xisigr of Tencent's Xuanwu Lab

- [613949] High CVE-2016-1708: Use-after-free in Extensions. Credit to Adam Varsan

- [614934] High CVE-2016-1709: Heap-buffer-overflow in sfntly. Credit to ChenQin of Topsec Security Team

- [616907] High CVE-2016-1710: Same-origin bypass in Blink. Credit to Mariusz Mlynski

- [617495] High CVE-2016-1711: Same-origin bypass in Blink. Credit to Mariusz Mlynski

- [618237] High CVE-2016-5127: Use-after-free in Blink. Credit to cloudfuzzer

- [619166] High CVE-2016-5128: Same-origin bypass in V8. Credit to Anonymous

- [620553] High CVE-2016-5129: Memory corruption in V8. Credit to Jeonghoon Shin

- [623319] High CVE-2016-5130: URL spoofing. Credit to Wadih Matar

- [623378] High CVE-2016-5131: Use-after-free in libxml. Credit to Nick Wellnhofer

- [607543] Medium CVE-2016-5132: Limited same-origin bypass in Service Workers. Credit to Ben Kelly

- [613626] Medium CVE-2016-5133: Origin confusion in proxy authentication. Credit to Patch Eudor

- [593759] Medium CVE-2016-5134: URL leakage via PAC script. Credit to Paul Stone

- [605451] Medium CVE-2016-5135: Content-Security-Policy bypass.
Credit to kingxwy

- [625393] Medium CVE-2016-5136: Use after free in extensions. Credit to Rob Wu

- [625945] Medium CVE-2016-5137: History sniffing with HSTS and CSP.
Credit to Xiaoyin Liu

- [629852] CVE-2016-1705: Various fixes from internal audits, fuzzing and other initiatives.

The version of Google Chrome installed on the remote Mac OS X host is prior to 52.0.2743.82. It is, therefore, affected by multiple vulnerabilities :

  - Multiple unspecified vulnerabilities exist that allow a     remote attacker to cause a denial of service condition     or possibly have other impact via unknown vectors.
    (CVE-2016-1705)

  - A sandbox protection bypass vulnerability exists in     PPAPI due to a failure to validate the origin of IPC     messages to the plugin broker process. An     unauthenticated, remote attacker can exploit this to     bypass the sandbox. (CVE-2016-1706)

  - A use-after-free error exists in Extensions due to a     failure to consider object lifetimes during progress     observation. An unauthenticated, remote attacker can     exploit this to dereference already freed memory,     resulting in the execution of arbitrary code.
    (CVE-2016-1708)

  - An array indexing error exists in the ByteArray::Get()     function in data/byte_array.cc due to improper     validation of user-supplied input. An unauthenticated,     remote attacker can exploit this to cause a heap-based     buffer overflow, resulting in a denial of service     condition or the execution of arbitrary code.
    (CVE-2016-1709)

  - A same-origin bypass vulnerability exists in Blink due     to a failure to prevent window creation by a deferred     frame. A remote attacker can exploit this to bypass the     same-origin policy. (CVE-2016-1710)

  - A same-origin bypass vulnerability exists in Blink due     to a failure to disable frame navigation during a detach     operation on a DocumentLoader object. A remote attacker     can exploit this to bypass the same-origin policy.
    (CVE-2016-1711)

  - A use-after-free error exists in Blink in the     previousLinePosition() function. An unauthenticated,     remote attacker can exploit this, via crafted JavaScript     code involving an @import at-rule in a Cascading Style     Sheets (CSS) token sequence in conjunction with a     rel=import attribute of a LINK element, to cause a     denial of service condition or the execution of     arbitrary code. (CVE-2016-5127)

  - A same-origin bypass vulnerability exists in Google V8     due to a failure to prevent API interceptors from     modifying a store target without setting a property. A     remote attacker can exploit this to bypass the     same-origin policy. (CVE-2016-5128)

  - A flaw exists in V8 due to improper processing of     left-trimmed objects. An unauthenticated, remote     attacker can exploit this, via crafted JavaScript code,     to cause a denial of service condition or the execution     of arbitrary code. (CVE-2016-5129)

  - A flaw exists that is triggered when handling two     forward navigations that compete in different frames. A     remote attacker can exploit this to conduct a URL     spoofing attack. (CVE-2016-5130)

  - A use-after-free error exists in libxml2 in the     xmlXPtrRangeToFunction() function. An unauthenticated,     remote attacker can exploit this to dereference already     freed memory, resulting in the execution of arbitrary     code. (CVE-2016-5131)

  - A same-origin bypass vulnerability exists in the Service     Workers subsystem due to a failure to properly implement     the Secure Contexts specification during decisions about     whether to control a subframe. A remote attacker can     exploit this to bypass the same-origin policy.
    (CVE-2016-5132)

  - A flaw exists in the handling of origin information     during proxy authentication that allows a     man-in-the-middle attacker to spoof a     proxy-authentication login prompt or trigger incorrect     credential storage by modifying the client-server data     stream. (CVE-2016-5133)

  - A validation flaw exists in the Proxy Auto-Config (PAC)     feature due to a failure to ensure that URL information     is restricted to a scheme, host, and port. A remote     attacker can exploit this to disclose credentials by     operating a server with a PAC script. (CVE-2016-5134)

  - A cross-origin bypass vulnerability exists in Blink due     to a failure to consider referrer-policy information     inside an HTML document during a preload request. A     remote attacker can exploit this to bypass the Content     Security Policy (CSP) protection mechanism.
    (CVE-2016-5135)

  - A use-after-free error exists in Extensions that allows     a remote attacker to dereference already freed memory,     resulting in the execution of arbitrary code with     elevated privileges. (CVE-2016-5136)

  - An information disclosure vulnerability exists in Blink     when handling HTTP vs HTTPs ports in source expressions.
    An unauthenticated, remote attacker can exploit this to     determine whether a specific HTTP Strict Transport     Security (HSTS) web site has been visited by reading a     CSP report. (CVE-2016-5137)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Chromium was updated to 52.0.2743.82 to fix the following security issues (boo#989901) :

  - CVE-2016-1706: Sandbox escape in PPAPI

  - CVE-2016-1707: URL spoofing on iOS

  - CVE-2016-1708: Use-after-free in Extensions

  - CVE-2016-1709: Heap-buffer-overflow in sfntly

  - CVE-2016-1710: Same-origin bypass in Blink

  - CVE-2016-1711: Same-origin bypass in Blink

  - CVE-2016-5127: Use-after-free in Blink

  - CVE-2016-5128: Same-origin bypass in V8

  - CVE-2016-5129: Memory corruption in V8

  - CVE-2016-5130: URL spoofing

  - CVE-2016-5131: Use-after-free in libxml

  - CVE-2016-5132: Limited same-origin bypass in Service     Workers

  - CVE-2016-5133: Origin confusion in proxy authentication

  - CVE-2016-5134: URL leakage via PAC script

  - CVE-2016-5135: Content-Security-Policy bypass

  - CVE-2016-5136: Use after free in extensions

  - CVE-2016-5137: History sniffing with HSTS and CSP

  - CVE-2016-1705: Various fixes from internal audits,     fuzzing and other initiatives

The version of Google Chrome installed on the remote Windows host is prior to 52.0.2743.82. It is, therefore, affected by multiple vulnerabilities :

  - Multiple unspecified vulnerabilities exist that allow a     remote attacker to cause a denial of service condition     or possibly have other impact via unknown vectors.
    (CVE-2016-1705)

  - A sandbox protection bypass vulnerability exists in     PPAPI due to a failure to validate the origin of IPC     messages to the plugin broker process. An     unauthenticated, remote attacker can exploit this to     bypass the sandbox. (CVE-2016-1706)

  - A use-after-free error exists in Extensions due to a     failure to consider object lifetimes during progress     observation. An unauthenticated, remote attacker can     exploit this to dereference already freed memory,     resulting in the execution of arbitrary code.
    (CVE-2016-1708)

  - An array indexing error exists in the ByteArray::Get()     function in data/byte_array.cc due to improper     validation of user-supplied input. An unauthenticated,     remote attacker can exploit this to cause a heap-based     buffer overflow, resulting in a denial of service     condition or the execution of arbitrary code.
    (CVE-2016-1709)

  - A same-origin bypass vulnerability exists in Blink due     to a failure to prevent window creation by a deferred     frame. A remote attacker can exploit this to bypass the     same-origin policy. (CVE-2016-1710)

  - A same-origin bypass vulnerability exists in Blink due     to a failure to disable frame navigation during a detach     operation on a DocumentLoader object. A remote attacker     can exploit this to bypass the same-origin policy.
    (CVE-2016-1711)

  - A use-after-free error exists in Blink in the     previousLinePosition() function. An unauthenticated,     remote attacker can exploit this, via crafted JavaScript     code involving an @import at-rule in a Cascading Style     Sheets (CSS) token sequence in conjunction with a     rel=import attribute of a LINK element, to cause a     denial of service condition or the execution of     arbitrary code. (CVE-2016-5127)

  - A same-origin bypass vulnerability exists in Google V8     due to a failure to prevent API interceptors from     modifying a store target without setting a property. A     remote attacker can exploit this to bypass the     same-origin policy. (CVE-2016-5128)

  - A flaw exists in V8 due to improper processing of     left-trimmed objects. An unauthenticated, remote     attacker can exploit this, via crafted JavaScript code,     to cause a denial of service condition or the execution     of arbitrary code. (CVE-2016-5129)

  - A flaw exists that is triggered when handling two     forward navigations that compete in different frames. A     remote attacker can exploit this to conduct a URL     spoofing attack. (CVE-2016-5130)

  - A use-after-free error exists in libxml2 in the     xmlXPtrRangeToFunction() function. An unauthenticated,     remote attacker can exploit this to dereference already     freed memory, resulting in the execution of arbitrary     code. (CVE-2016-5131)

  - A same-origin bypass vulnerability exists in the Service     Workers subsystem due to a failure to properly implement     the Secure Contexts specification during decisions about     whether to control a subframe. A remote attacker can     exploit this to bypass the same-origin policy.
    (CVE-2016-5132)

  - A flaw exists in the handling of origin information     during proxy authentication that allows a     man-in-the-middle attacker to spoof a     proxy-authentication login prompt or trigger incorrect     credential storage by modifying the client-server data     stream. (CVE-2016-5133)

  - A validation flaw exists in the Proxy Auto-Config (PAC)     feature due to a failure to ensure that URL information     is restricted to a scheme, host, and port. A remote     attacker can exploit this to disclose credentials by     operating a server with a PAC script. (CVE-2016-5134)

  - A cross-origin bypass vulnerability exists in Blink due     to a failure to consider referrer-policy information     inside an HTML document during a preload request. A     remote attacker can exploit this to bypass the Content     Security Policy (CSP) protection mechanism.
    (CVE-2016-5135)

  - A use-after-free error exists in Extensions that allows     a remote attacker to dereference already freed memory,     resulting in the execution of arbitrary code with     elevated privileges. (CVE-2016-5136)

  - An information disclosure vulnerability exists in Blink     when handling HTTP vs HTTPs ports in source expressions.
    An unauthenticated, remote attacker can exploit this to     determine whether a specific HTTP Strict Transport     Security (HSTS) web site has been visited by reading a     CSP report. (CVE-2016-5137)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2016-1704     The chrome development team found and fixed various     issues during internal auditing.

  - CVE-2016-1705     The chrome development team found and fixed various     issues during internal auditing.

  - CVE-2016-1706     Pinkie Pie discovered a way to escape the Pepper Plugin     API sandbox.

  - CVE-2016-1707     xisigr discovered a URL spoofing issue.

  - CVE-2016-1708     Adam Varsan discovered a use-after-free issue.

  - CVE-2016-1709     ChenQin discovered a buffer overflow issue in the sfntly     library.

  - CVE-2016-1710     Mariusz Mlynski discovered a same-origin bypass.

  - CVE-2016-1711     Mariusz Mlynski discovered another same-origin bypass.

  - CVE-2016-5127     cloudfuzzer discovered a use-after-free issue.

  - CVE-2016-5128     A same-origin bypass issue was discovered in the v8     JavaScript library.

  - CVE-2016-5129     Jeonghoon Shin discovered a memory corruption issue in     the v8 JavaScript library.

  - CVE-2016-5130     Widih Matar discovered a URL spoofing issue.

  - CVE-2016-5131     Nick Wellnhofer discovered a use-after-free issue in the     libxml2 library.

  - CVE-2016-5132     Ben Kelly discovered a same-origin bypass.

  - CVE-2016-5133     Patch Eudor discovered an issue in proxy authentication.

  - CVE-2016-5134     Paul Stone discovered an information leak in the Proxy     Auto-Config feature.

  - CVE-2016-5135     ShenYeYinJiu discovered a way to bypass the Content     Security Policy.

  - CVE-2016-5136     Rob Wu discovered a use-after-free issue.

  - CVE-2016-5137     Xiaoyin Liu discovered a way to discover whether an HSTS     website had been visited.

The remote host is affected by the vulnerability described in GLSA-201610-09 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in the Chromium web       browser. Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information, or bypass security restrictions.
  Workaround :

    There is no known workaround at this time.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2016:1485 advisory.

  - chromium-browser: various fixes from internal audits (CVE-2016-1705)

  - chromium-browser: sandbox escape in ppapi (CVE-2016-1706)

  - chromium-browser: use-after-free in extensions (CVE-2016-1708)

  - chromium-browser: heap-buffer-overflow in sfntly (CVE-2016-1709)

  - chromium-browser: same-origin bypass in blink (CVE-2016-1710, CVE-2016-1711)

  - chromium-browser: use-after-free in blink (CVE-2016-5127)

  - chromium-browser: same-origin bypass in v8 (CVE-2016-5128)

  - chromium-browser: memory corruption in v8 (CVE-2016-5129)

  - chromium-browser: url spoofing (CVE-2016-5130)

  - libxml2: Use after free triggered by XPointer paths beginning with range-to (CVE-2016-5131)

  - chromium-browser: limited same-origin bypass in service workers (CVE-2016-5132)

  - chromium-browser: origin confusion in proxy authentication (CVE-2016-5133)

  - chromium-browser: url leakage via pac script (CVE-2016-5134)

  - chromium-browser: content-security-policy bypass (CVE-2016-5135)

  - chromium-browser: use after free in extensions (CVE-2016-5136)

  - chromium-browser: history sniffing with hsts and csp (CVE-2016-5137)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The specific version of Chrome that the system is running is reportedly affected by the following vulnerabilities:

- Google Chrome contains a flaw in PPAPI that is triggered when handling certain messages not sent by the browser in the plugin broker process. This may allow a context-dependent attacker to bypass the sandbox. (CVE-2016-1706)

- Google Chrome for iOS contains a flaw in web/web_state/ui/crw_web_controller.mm that is triggered when handling invalid URLs. This may allow a context-dependent attacker to conduct URL spoofing attacks. (CVE-2016-1707)

- Google Chrome contains a use-after-free error related to extensions that may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 (CVE-2016-1708)

- Google sfntly contains an array indexing error in the ByteArray::Get() function in data/byte_array.cc that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to cause a heap-based buffer overflow, crashing a process linked against the library or potentially allowing the execution of arbitrary code. (CVE-2016-1709)

- Google Chrome contains a flaw in web/ChromeClientImpl.cpp that is triggered when handling creation of new windows by deferred frames. This may allow a context-dependent attacker to bypass the same-origin policy. (CVE-2016-1710)

- Google Chrome contains a flaw in core/loader/FrameLoader.cpp that is triggered when handling frame navigations during DocumentLoader detach. This may allow a context-dependent attacker to bypass the same-origin policy. (CVE-2016-1711)

- Google Chrome contains a use-after-free error in the previousLinePosition() function in core/editing/VisibleUnits.cpp. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-5127)

- Google V8 contains an unspecified flaw which may allow a context-dependent attacker to bypass the same-origin policy. No further details have been provided by the vendor. (CVE-2016-5128)

- Google V8 contains a flaw that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and cause a denial of service in a process linked against the library or potentially execute arbitrary code. (CVE-2016-5129)

- Google Chrome contains a flaw in the HistoryController::UpdateForCommit() function in content/renderer/history_controller.cc. The issue is triggered when handling two forward navigations that compete in different frames. This may allow a context-dependent attacker to perform URL spoofing attacks. (CVE-2016-5130)

- Libxml2 contains a use-after-free error in the xmlXPtrRangeToFunction() function in xpointer.c. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-5131)

- Google Chrome contains a flaw related to Service Workers that is triggered when handling subframes of an insecure context. This may allow a context-dependent attacker to perform a limited bypass of the same-origin policy. (CVE-2016-5132)

- Google Chrome contains a flaw related to proxy authentication that is triggere when handling origins. This may allow a context-dependent attacker to spoof the proxy server origin. (CVE-2016-5133)

- Google Chrome contains a flaw that is triggered as https:// URLs are not properly sanitized before being sent to PAC scripts. This may allow a context-dependent attacker to leak URLs. (CVE-2016-5134)

- Google Chrome contains a flaw in html/parser/HTMLPreloadScanner.cpp related to the handling of referrer policies. This may allow a context-dependent attacker to bypass the content security policy (CSP). (CVE-2016-5135)

- Google Chrome contains a use-after-free error in extensions/renderer/user_script_injector.cc that is triggered when handling UserScript pointers. This may allow a malicious extension to dereference already freed memory and potentially execute arbitrary code with elevated privileges. (CVE-2016-5136)

- Google Chrome contains a flaw in the CSPSource::portMatches() function in frame/csp/CSPSource.cpp related to HSTS and CSP when handling HTTP vs HTTPS ports in source expressions. This may allow a context-dependent attacker to disclose browsing history information. (CVE-2016-5137)

- Google Chrome contains a flaw in the LayoutBox::removeFloatingOrPositionedChildFromBlockLists() function in core/layout/LayoutBox.cpp that is triggered when handling LayoutView floats. This may allow a context-dependent attacker to potentially execute arbitrary code. (CVE-2016-1705)

- Google Chrome contains a flaw in the Resource::canUseCacheValidator() function in core/fetch/Resource.cpp that is triggered when revalidating Resource with redirects. This may allow a context-dependent attacker to have an unspecified impact. (CVE-2016-1705)

- Google Chrome contains a flaw in the Resource::willFollowRedirect() function in core/fetch/Resource.cpp that is triggered when handling redirect responses while revalidating resources. This may allow a context-dependent attacker to have an unspecified impact. (CVE-2016-1705)

- Google Chrome contains a flaw in net/url_request/sdch_dictionary_fetcher.cc that is triggered when handling dictionary requests failing after receiving data. This may allow a context-dependent attacker to have an unspecified impact. (CVE-2016-1705)

- Google Chrome contains a flaw in the ShapeResultSpacing::computeSpacing() function in platform/fonts/shaping/ShapeResultSpacing.cpp that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to potentially execute arbitrary code. (CVE-2016-1705)

- Google Chrome contains a flaw in the Channel::Message::Deserialize() function in mojo/edk/system/channel.cc that is triggered when handling header sizes in channel messages. This may allow a context-dependent attacker to potentially execute arbitrary code. (CVE-2016-1705)

- Google Chrome contains an unspecified flaw in Font::individualCharacterRanges() function in platform/fonts/Font.cpp, which may allow a context-dependent attacker to have an unspecified impact. (CVE-2016-1705)

- Google WebRTC contains an out-of-bounds read flaw in the WebRtcIsacfix_PitchFilter() and WebRtcIsacfix_PitchFilterGains() functions in modules/audio_coding/codecs/isac/fix/source/pitch_filter.c that may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents. (CVE-2016-1705)

- Google Chrome contains a flaw in org/chromium/chrome/browser/toolbar/CustomTabToolbarAnimationDelegate.java that is due to the program failing to properly load security icons on custom HTTP connection tabs. This may allow a context-dependent attacker to spoof valid icons. (CVE-2016-1705)

- Google Skia contains an integer overflow condition in the SkLinearGradient::LinearGradientContext::shade4_dx_clamp() function in effects/gradients/SkLinearGradient.cpp . The issue is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to have an unspecified impact. (CVE-2016-1705)

- libvpx contains an invalid read flaw in the setup_frame_size_with_refs() function in vp9/decoder/vp9_decodeframe.c that may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents.

- Google Chrome contains an unspecified flaw in extensions that is triggered during the handling of NativeMessaging IDs. This may allow a context-dependent attacker to have an unspecified impact. (CVE-2016-1705)

- Google Chrome contains an out-of-bounds read flaw in the HTMLMenuItemElement::defaultEventHandler() function in core/html/HTMLMenuItemElement.cpp that may allow a context-dependent attacker to potentially disclose memory contents. (CVE-2016-1705)

- Google Chrome contains an unspecified flaw in the GURL::ReplaceComponents() function in url/gurl.cc that is triggered during inner URL creation. This may allow a context-dependent attacker to have an unspecified impact. No further details have been provided. (CVE-2016-1705)

- Google V8 contains an unspecified flaw that may allow a context-dependent attacker to have an unspecified impact. No further details have been provided by the vendor. (CVE-2016-1705)

ID	Name	Product	Family	Published	Updated	Severity
92537	FreeBSD : chromium -- multiple vulnerabilities (6fae9fe1-5048-11e6-8aa7-3065ec8fd3ec)	Nessus	FreeBSD Local Security Checks	7/25/2016	1/4/2021	critical
92629	Google Chrome < 52.0.2743.82 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	7/29/2016	7/14/2018	critical
92551	openSUSE Security Update : Chromium (openSUSE-2016-901)	Nessus	SuSE Local Security Checks	7/26/2016	1/19/2021	critical
92628	Google Chrome < 52.0.2743.82 Multiple Vulnerabilities	Nessus	Windows	7/29/2016	4/11/2022	critical
92666	Debian DSA-3637-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	8/2/2016	1/11/2021	critical
94420	GLSA-201610-09 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	10/31/2016	1/11/2021	critical
92550	openSUSE Security Update : Chromium (openSUSE-2016-900)	Nessus	SuSE Local Security Checks	7/26/2016	1/19/2021	critical
92655	openSUSE Security Update : Chromium (openSUSE-2016-919)	Nessus	SuSE Local Security Checks	8/1/2016	1/19/2021	critical
92552	RHEL 6 : chromium-browser (RHSA-2016:1485)	Nessus	Red Hat Local Security Checks	7/26/2016	4/24/2024	critical
802027	Chrome < 52.0.2743.82 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	9/6/2016		high

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

critical

high