[arch-security] [ASA-201504-19] chromium: multiple issues
Levente Polyak
anthraxx at archlinux.org
Sat Apr 18 01:25:29 UTC 2015
Arch Linux Security Advisory ASA-201504-19
==========================================
Severity: Critical
Date : 2015-04-18
CVE-ID : CVE-2015-1235 CVE-2015-1236 CVE-2015-1237 CVE-2015-1238
CVE-2015-1240 CVE-2015-1241 CVE-2015-1242 CVE-2015-1244
CVE-2015-1245 CVE-2015-1246 CVE-2015-1247 CVE-2015-1248
CVE-2015-1249
Package : chromium
Type : multiple issues
Remote : Yes
Link : https://wiki.archlinux.org/index.php/CVE
Summary
=======
The package chromium before version 42.0.2311.90-1 is vulnerable to
multiple issues including but not limited to arbitrary code execution,
denial of service, information disclosure, cross-origin bypass and
tab-jacking.
Resolution
==========
Upgrade to 42.0.2311.90-1.
# pacman -Syu "chromium>=42.0.2311.90-1"
The problems have been fixed upstream in version 42.0.2311.90.
Workaround
==========
None.
Description
===========
- CVE-2015-1235 (cross-origin bypass)
A vulnerability was discovered that allows cross-origin-bypass in the
HTML parser.
- CVE-2015-1236 (cross-origin bypass)
A vulnerability was discovered that allows cross-origin-bypass in the
rendering engine Blink.
- CVE-2015-1237 (arbitrary code execution)
An use-after-free flaw was discovered in IPC that may lead to arbitrary
code execution and denial of service.
- CVE-2015-1238 (arbitrary code execution)
An out-of-bounds write flaw was discovered in Skia that may lead to
arbitrary code execution and denial of service.
- CVE-2015-1240 (denial of service)
An out-of-bounds read flaw was discovered in WebGL that may lead to
information disclosure and denial of service.
- CVE-2015-1241 (tap-jacking)
A tap-jacking flaw was discovered that allows the hijacking of tabs to
show arbitrary content.
- CVE-2015-1242 (arbitrary code execution)
A Type confusion flaw was discovered in V8 that may lead to arbitrary
code execution and denial of service.
- CVE-2015-1244 (security policy bypass)
A security policy flaw was discovered that allowes HSTS bypass in
WebSockets that may lead to downgrade attacks and cookie hijacking.
- CVE-2015-1245 (arbitrary code execution)
An use-after-free flaw was discovered in PDFium that may lead to
arbitrary code execution and denial of service.
- CVE-2015-1246 (denial of service)
An out-of-bounds read flaw was discovered in the rendering engine Blink
that may leads to information disclosure and denial of service.
- CVE-2015-1247 (unspecified)
A scheme issues flaw was discovered in OpenSearch that is leading to
unspecified issues.
- CVE-2015-1248 (filter bypass)
A flaw was discovered that is leading to SafeBrowsing filter bypass.
- CVE-2015-1249 (various)
Various vulnerabilities were discovered by internal audits, fuzzing and
other initiatives.
Impact
======
A remote attacker is able to use specially crafted web content to cause
a denial of service, bypass the cross-origin policy, perform tap-jacking
or, potentially, execute arbitrary code via various vectors.
References
==========
http://googlechromereleases.blogspot.fr/2015/04/stable-channel-update_14.html
https://access.redhat.com/security/cve/CVE-2015-1235
https://access.redhat.com/security/cve/CVE-2015-1236
https://access.redhat.com/security/cve/CVE-2015-1237
https://access.redhat.com/security/cve/CVE-2015-1238
https://access.redhat.com/security/cve/CVE-2015-1240
https://access.redhat.com/security/cve/CVE-2015-1241
https://access.redhat.com/security/cve/CVE-2015-1242
https://access.redhat.com/security/cve/CVE-2015-1244
https://access.redhat.com/security/cve/CVE-2015-1245
https://access.redhat.com/security/cve/CVE-2015-1246
https://access.redhat.com/security/cve/CVE-2015-1247
https://access.redhat.com/security/cve/CVE-2015-1248
https://access.redhat.com/security/cve/CVE-2015-1249
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20150418/1f147e3e/attachment.asc>
More information about the arch-security
mailing list