Arch Linux Security Advisory ASA-201504-19 ========================================== Severity: Critical Date : 2015-04-18 CVE-ID : CVE-2015-1235 CVE-2015-1236 CVE-2015-1237 CVE-2015-1238 CVE-2015-1240 CVE-2015-1241 CVE-2015-1242 CVE-2015-1244 CVE-2015-1245 CVE-2015-1246 CVE-2015-1247 CVE-2015-1248 CVE-2015-1249 Package : chromium Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chromium before version 42.0.2311.90-1 is vulnerable to multiple issues including but not limited to arbitrary code execution, denial of service, information disclosure, cross-origin bypass and tab-jacking. Resolution ========== Upgrade to 42.0.2311.90-1. # pacman -Syu "chromium>=42.0.2311.90-1" The problems have been fixed upstream in version 42.0.2311.90. Workaround ========== None. Description =========== - CVE-2015-1235 (cross-origin bypass) A vulnerability was discovered that allows cross-origin-bypass in the HTML parser. - CVE-2015-1236 (cross-origin bypass) A vulnerability was discovered that allows cross-origin-bypass in the rendering engine Blink. - CVE-2015-1237 (arbitrary code execution) An use-after-free flaw was discovered in IPC that may lead to arbitrary code execution and denial of service. - CVE-2015-1238 (arbitrary code execution) An out-of-bounds write flaw was discovered in Skia that may lead to arbitrary code execution and denial of service. - CVE-2015-1240 (denial of service) An out-of-bounds read flaw was discovered in WebGL that may lead to information disclosure and denial of service. - CVE-2015-1241 (tap-jacking) A tap-jacking flaw was discovered that allows the hijacking of tabs to show arbitrary content. - CVE-2015-1242 (arbitrary code execution) A Type confusion flaw was discovered in V8 that may lead to arbitrary code execution and denial of service. - CVE-2015-1244 (security policy bypass) A security policy flaw was discovered that allowes HSTS bypass in WebSockets that may lead to downgrade attacks and cookie hijacking. - CVE-2015-1245 (arbitrary code execution) An use-after-free flaw was discovered in PDFium that may lead to arbitrary code execution and denial of service. - CVE-2015-1246 (denial of service) An out-of-bounds read flaw was discovered in the rendering engine Blink that may leads to information disclosure and denial of service. - CVE-2015-1247 (unspecified) A scheme issues flaw was discovered in OpenSearch that is leading to unspecified issues. - CVE-2015-1248 (filter bypass) A flaw was discovered that is leading to SafeBrowsing filter bypass. - CVE-2015-1249 (various) Various vulnerabilities were discovered by internal audits, fuzzing and other initiatives. Impact ====== A remote attacker is able to use specially crafted web content to cause a denial of service, bypass the cross-origin policy, perform tap-jacking or, potentially, execute arbitrary code via various vectors. References ========== http://googlechromereleases.blogspot.fr/2015/04/stable-channel-update_14.htm... https://access.redhat.com/security/cve/CVE-2015-1235 https://access.redhat.com/security/cve/CVE-2015-1236 https://access.redhat.com/security/cve/CVE-2015-1237 https://access.redhat.com/security/cve/CVE-2015-1238 https://access.redhat.com/security/cve/CVE-2015-1240 https://access.redhat.com/security/cve/CVE-2015-1241 https://access.redhat.com/security/cve/CVE-2015-1242 https://access.redhat.com/security/cve/CVE-2015-1244 https://access.redhat.com/security/cve/CVE-2015-1245 https://access.redhat.com/security/cve/CVE-2015-1246 https://access.redhat.com/security/cve/CVE-2015-1247 https://access.redhat.com/security/cve/CVE-2015-1248 https://access.redhat.com/security/cve/CVE-2015-1249