[arch-security] [ASA-201607-12] chromium: multiple issues

[Remi Gacogne]

Arch Linux Security Advisory ASA-201607-12
==========================================

Severity: Critical
Date    : 2016-07-24
CVE-ID  : CVE-2016-1705 CVE-2016-1706 CVE-2016-1708 CVE-2016-1709
          CVE-2016-1710 CVE-2016-1711 CVE-2016-5127 CVE-2016-5128
          CVE-2016-5129 CVE-2016-5130 CVE-2016-5131 CVE-2016-5132
          CVE-2016-5133 CVE-2016-5134 CVE-2016-5135 CVE-2016-5136
          CVE-2016-5137
Package : chromium
Type    : multiple issues
Remote  : Yes
Link    : https://wiki.archlinux.org/index.php/CVE

Summary
=======

The package chromium before version 52.0.2743.82-1 is vulnerable to
multiple issues.

Resolution
==========

Upgrade to 52.0.2743.82-1.

# pacman -Syu "chromium>=52.0.2743.82-1"

The problems have been fixed upstream in version 52.0.2743.82.

Workaround
==========

None.

Description
===========

- CVE-2016-1705 (arbitrary code execution)

Various fixes from internal audits, fuzzing and other initiatives.

- CVE-2016-1706 (sandbox escape)

Sandbox escape in PPAPI. Credit to Pinkie Pie.

- CVE-2016-1708 (arbitrary code execution)

Use-after-free in Extensions. Credit to Adam Varsan.

- CVE-2016-1709 (arbitrary code execution)

Heap-buffer-overflow in sfntly. Credit to ChenQin of Topsec Security Team.

- CVE-2016-1710, CVE-2016-1711 (same-origin policy bypass)

Same-origin bypass in Blink. Credit to Mariusz Mlynski.

- CVE-2016-5127 (arbitrary code execution)

Use-after-free in Blink. Credit to cloudfuzzer.

- CVE-2016-5128 (same-origin policy bypass)

Same-origin bypass in V8.

- CVE-2016-5129 (arbitrary code execution)

Memory corruption in V8. Credit to Jeonghoon Shin.

- CVE-2016-5130 (URL spoofing)

URL spoofing. Credit to Wadih Matar.

- CVE-2016-5131 (arbitrary code execution)

Use-after-free in libxml. Credit to Nick Wellnhofer.

- CVE-2016-5132 (same-origin policy bypass)

Limited same-origin bypass in Service Workers. Credit to Ben Kelly.

- CVE-2016-5133 (man-in-the-middle)

Origin confusion in proxy authentication. Credit to Patch Eudor.

- CVE-2016-5134 (information leakage)

URL leakage via PAC script. Credit to Paul Stone.

- CVE-2016-5135 (content security policy bypass)

Content-Security-Policy bypass. Credit to ShenYeYinJiu of  Tencent
Security Response Center, TSRC.

- CVE-2016-5136 (arbitrary code execution)

Use after free in extensions. Credit to Rob Wu.

- CVE-2016-5137 (information leakage)

History sniffing with HSTS and CSP. Credit to Xiaoyin Liu.

Impact
======

A remote attacker can access sensitive information, bypass policies or
execute arbitrary code on the affected host.

References
==========

https://googlechromereleases.blogspot.fr/2016/07/stable-channel-update.html
https://access.redhat.com/security/cve/CVE-2016-1705
https://access.redhat.com/security/cve/CVE-2016-1706
https://access.redhat.com/security/cve/CVE-2016-1708
https://access.redhat.com/security/cve/CVE-2016-1709
https://access.redhat.com/security/cve/CVE-2016-1710
https://access.redhat.com/security/cve/CVE-2016-1711
https://access.redhat.com/security/cve/CVE-2016-5127
https://access.redhat.com/security/cve/CVE-2016-5128
https://access.redhat.com/security/cve/CVE-2016-5129
https://access.redhat.com/security/cve/CVE-2016-5130
https://access.redhat.com/security/cve/CVE-2016-5131
https://access.redhat.com/security/cve/CVE-2016-5132
https://access.redhat.com/security/cve/CVE-2016-5133
https://access.redhat.com/security/cve/CVE-2016-5134
https://access.redhat.com/security/cve/CVE-2016-5135
https://access.redhat.com/security/cve/CVE-2016-5136
https://access.redhat.com/security/cve/CVE-2016-5137

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 801 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20160724/895aef8a/attachment.asc>