[arch-security] [ASA-201605-28] chromium: multiple issues

[Remi Gacogne]

Arch Linux Security Advisory ASA-201605-28
==========================================

Severity: High
Date    : 2016-05-28
CVE-ID  : CVE-2016-1672 CVE-2016-1673 CVE-2016-1674 CVE-2016-1675
          CVE-2016-1676 CVE-2016-1677 CVE-2016-1678 CVE-2016-1679
          CVE-2016-1680 CVE-2016-1681 CVE-2016-1682 CVE-2016-1683
          CVE-2016-1684 CVE-2016-1685 CVE-2016-1686 CVE-2016-1687
          CVE-2016-1688 CVE-2016-1689 CVE-2016-1690 CVE-2016-1691
          CVE-2016-1692 CVE-2016-1693 CVE-2016-1694 CVE-2016-1695
Package : chromium
Type    : multiple issues
Remote  : Yes
Link    : https://wiki.archlinux.org/index.php/CVE

Summary
=======

The package chromium before version 51.0.2704.63-1 is vulnerable to
multiple issues including but not limited to policy bypass, denial of
service, information leak and arbitrary code execution.

Resolution
==========

Upgrade to 51.0.2704.63-1.

# pacman -Syu "chromium>=51.0.2704.63-1"

The problem has been fixed upstream in version 51.0.2704.63.

Workaround
==========

None.

Description
===========

- CVE-2016-1672:

Cross-origin bypass in extension bindings. Credit to Mariusz Mlynski.

- CVE-2016-1673:

Cross-origin bypass in Blink. Credit to Mariusz Mlynski.

- CVE-2016-1674:

Cross-origin bypass in extensions. Credit to Mariusz Mlynski.

- CVE-2016-1675:

Cross-origin bypass in Blink. Credit to Mariusz Mlynski.

- CVE-2016-1676:

Cross-origin bypass in extension bindings. Credit to Rob Wu.

- CVE-2016-1677:

Type confusion in V8. Credit to Guang Gong of Qihoo 360.

- CVE-2016-1678:

Heap overflow in V8. Credit to Christian Holler.

- CVE-2016-1679:

Heap use-after-free in V8 bindings. Credit to Rob Wu.

- CVE-2016-1680:

Heap use-after-free in Skia. Credit to Atte Kettunen of OUSPG.

- CVE-2016-1681:

Heap overflow in PDFium. Credit to Aleksandar Nikolic of Cisco Talos.

- CVE-2016-1682:

CSP bypass for ServiceWorker. Credit to KingstonTime.

- CVE-2016-1683:

Out-of-bounds access in libxslt. Credit to Nicolas Gregoire.

- CVE-2016-1684:

Integer overflow in libxslt. Credit to Nicolas Gregoire.

- CVE-2016-1685:

Out-of-bounds read in PDFium. Credit to Ke Liu of Tencent's Xuanwu LAB.

- CVE-2016-1686:

Out-of-bounds read in PDFium. Credit to Ke Liu of Tencent's Xuanwu LAB.

- CVE-2016-1687:

Information leak in extensions. Credit to Rob Wu.

- CVE-2016-1688:

Out-of-bounds read in V8. Credit to Max Korenko.

- CVE-2016-1689:

Heap buffer overflow in media. Credit to Atte Kettunen of OUSPG.

- CVE-2016-1690:

Heap use-after-free in Autofill. Credit to Rob Wu.

- CVE-2016-1691:

Heap buffer-overflow in Skia. Credit to Atte Kettunen of OUSPG.

- CVE-2016-1692:

Limited cross-origin bypass in ServiceWorker. Credit to Til Jasper Ullrich.

- CVE-2016-1693:

HTTP Download of Software Removal Tool. Credit to Khalil Zhani.

- CVE-2016-1694:

HPKP pins removed on cache clearance. Credit to Ryan Lester and Bryant
Zadegan.

- CVE-2016-1695:

Various fixes from internal audits, fuzzing and other initiatives.


Impact
======

A remote attacker can access sensitive information, cause a denial of
service by application crash or possibly execute arbitrary code on the
affected host.

References
==========

http://googlechromereleases.blogspot.fr/2016/05/stable-channel-update_25.html
https://access.redhat.com/security/cve/CVE-2016-1672
https://access.redhat.com/security/cve/CVE-2016-1673
https://access.redhat.com/security/cve/CVE-2016-1674
https://access.redhat.com/security/cve/CVE-2016-1675
https://access.redhat.com/security/cve/CVE-2016-1676
https://access.redhat.com/security/cve/CVE-2016-1677
https://access.redhat.com/security/cve/CVE-2016-1678
https://access.redhat.com/security/cve/CVE-2016-1679
https://access.redhat.com/security/cve/CVE-2016-1680
https://access.redhat.com/security/cve/CVE-2016-1681
https://access.redhat.com/security/cve/CVE-2016-1682
https://access.redhat.com/security/cve/CVE-2016-1683
https://access.redhat.com/security/cve/CVE-2016-1684
https://access.redhat.com/security/cve/CVE-2016-1685
https://access.redhat.com/security/cve/CVE-2016-1686
https://access.redhat.com/security/cve/CVE-2016-1687
https://access.redhat.com/security/cve/CVE-2016-1688
https://access.redhat.com/security/cve/CVE-2016-1689
https://access.redhat.com/security/cve/CVE-2016-1690
https://access.redhat.com/security/cve/CVE-2016-1691
https://access.redhat.com/security/cve/CVE-2016-1692
https://access.redhat.com/security/cve/CVE-2016-1693
https://access.redhat.com/security/cve/CVE-2016-1694
https://access.redhat.com/security/cve/CVE-2016-1695

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 801 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20160528/99694085/attachment.asc>