Arch Linux Security Advisory ASA-201607-12 ========================================== Severity: Critical Date : 2016-07-24 CVE-ID : CVE-2016-1705 CVE-2016-1706 CVE-2016-1708 CVE-2016-1709 CVE-2016-1710 CVE-2016-1711 CVE-2016-5127 CVE-2016-5128 CVE-2016-5129 CVE-2016-5130 CVE-2016-5131 CVE-2016-5132 CVE-2016-5133 CVE-2016-5134 CVE-2016-5135 CVE-2016-5136 CVE-2016-5137 Package : chromium Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chromium before version 52.0.2743.82-1 is vulnerable to multiple issues. Resolution ========== Upgrade to 52.0.2743.82-1. # pacman -Syu "chromium>=52.0.2743.82-1" The problems have been fixed upstream in version 52.0.2743.82. Workaround ========== None. Description =========== - CVE-2016-1705 (arbitrary code execution) Various fixes from internal audits, fuzzing and other initiatives. - CVE-2016-1706 (sandbox escape) Sandbox escape in PPAPI. Credit to Pinkie Pie. - CVE-2016-1708 (arbitrary code execution) Use-after-free in Extensions. Credit to Adam Varsan. - CVE-2016-1709 (arbitrary code execution) Heap-buffer-overflow in sfntly. Credit to ChenQin of Topsec Security Team. - CVE-2016-1710, CVE-2016-1711 (same-origin policy bypass) Same-origin bypass in Blink. Credit to Mariusz Mlynski. - CVE-2016-5127 (arbitrary code execution) Use-after-free in Blink. Credit to cloudfuzzer. - CVE-2016-5128 (same-origin policy bypass) Same-origin bypass in V8. - CVE-2016-5129 (arbitrary code execution) Memory corruption in V8. Credit to Jeonghoon Shin. - CVE-2016-5130 (URL spoofing) URL spoofing. Credit to Wadih Matar. - CVE-2016-5131 (arbitrary code execution) Use-after-free in libxml. Credit to Nick Wellnhofer. - CVE-2016-5132 (same-origin policy bypass) Limited same-origin bypass in Service Workers. Credit to Ben Kelly. - CVE-2016-5133 (man-in-the-middle) Origin confusion in proxy authentication. Credit to Patch Eudor. - CVE-2016-5134 (information leakage) URL leakage via PAC script. Credit to Paul Stone. - CVE-2016-5135 (content security policy bypass) Content-Security-Policy bypass. Credit to ShenYeYinJiu of Tencent Security Response Center, TSRC. - CVE-2016-5136 (arbitrary code execution) Use after free in extensions. Credit to Rob Wu. - CVE-2016-5137 (information leakage) History sniffing with HSTS and CSP. Credit to Xiaoyin Liu. Impact ====== A remote attacker can access sensitive information, bypass policies or execute arbitrary code on the affected host. References ========== https://googlechromereleases.blogspot.fr/2016/07/stable-channel-update.html https://access.redhat.com/security/cve/CVE-2016-1705 https://access.redhat.com/security/cve/CVE-2016-1706 https://access.redhat.com/security/cve/CVE-2016-1708 https://access.redhat.com/security/cve/CVE-2016-1709 https://access.redhat.com/security/cve/CVE-2016-1710 https://access.redhat.com/security/cve/CVE-2016-1711 https://access.redhat.com/security/cve/CVE-2016-5127 https://access.redhat.com/security/cve/CVE-2016-5128 https://access.redhat.com/security/cve/CVE-2016-5129 https://access.redhat.com/security/cve/CVE-2016-5130 https://access.redhat.com/security/cve/CVE-2016-5131 https://access.redhat.com/security/cve/CVE-2016-5132 https://access.redhat.com/security/cve/CVE-2016-5133 https://access.redhat.com/security/cve/CVE-2016-5134 https://access.redhat.com/security/cve/CVE-2016-5135 https://access.redhat.com/security/cve/CVE-2016-5136 https://access.redhat.com/security/cve/CVE-2016-5137