Arch Linux Security Advisory ASA-201509-11 ========================================== Severity: High Date : 2015-09-28 CVE-ID : CVE-2015-1303 CVE-2015-1304 Package : chromium Type : cross-origin bypass Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chromium before version 45.0.2454.101-1 is vulnerable to cross-origin bypass. Resolution ========== Upgrade to 45.0.2454.101-1. # pacman -Syu "chromium>=45.0.2454.101-1" The problem has been fixed upstream in version 45.0.2454.101. Workaround ========== None. Description =========== - CVE-2015-1303: Cross-origin bypass in DOM. Credit to Mariusz Mlynski. - CVE-2015-1304: Cross-origin bypass in V8. Credit to Mariusz Mlynski. Impact ====== A remote attacker can bypass the cross-origin resource sharing policy, thus getting access to sensitive data. References ========== http://googlechromereleases.blogspot.fr/2015/09/stable-channel-update_24.htm... https://access.redhat.com/security/cve/CVE-2015-1303 https://access.redhat.com/security/cve/CVE-2015-1304