The Regular Expressions package in International Components for Unicode (ICU) 52 before SVN revision 292944, as used in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via vectors related to a zero-length quantifier.

According to the versions of the icu package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Unspecified vulnerability in the Java SE and Java SE     Embedded components in Oracle Java SE 6u105, 7u91, and     8u66 and Java SE Embedded 8u65 allows remote attackers     to affect confidentiality, integrity, and availability     via unknown vectors related to 2D.(CVE-2016-0494)

  - Unspecified vulnerability in Oracle Java SE 6u101,     7u85, and 8u60, and Java SE Embedded 8u51, allows     remote attackers to affect confidentiality, integrity,     and availability via unknown vectors related to     2D.(CVE-2015-4844)

  - International Components for Unicode (ICU) for C/C++     before 2017-02-13 has an out-of-bounds write caused by     a heap-based buffer overflow related to the     utf8TextAccess function in common/utext.cpp and the     utext_moveIndex32* function.(CVE-2017-7868)

  - International Components for Unicode (ICU) for C/C++     before 2017-02-13 has an out-of-bounds write caused by     a heap-based buffer overflow related to the     utf8TextAccess function in common/utext.cpp and the     utext_setNativeIndex* function.(CVE-2017-7867)

  - The Regular Expressions package in International     Components for Unicode (ICU) for C/C++ before     2014-12-03, as used in Google Chrome before     40.0.2214.91, calculates certain values without     ensuring that they can be represented in a 24-bit     field, which allows remote attackers to cause a denial     of service (memory corruption) or possibly have     unspecified other impact via a crafted string, a     related issue to CVE-2014-7923.(CVE-2014-9654)

  - Stack-based buffer overflow in the Locale class in     common/locid.cpp in International Components for     Unicode (ICU) through 57.1 for C/C++ allows remote     attackers to cause a denial of service (application     crash) or possibly have unspecified other impact via a     long locale string.(CVE-2016-7415)

  - The uloc_acceptLanguageFromHTTP function in     common/uloc.cpp in International Components for Unicode     (ICU) through 57.1 for C/C++ does not ensure that there     is a '\0' character at the end of a certain temporary     array, which allows remote attackers to cause a denial     of service (out-of-bounds read) or possibly have     unspecified other impact via a call with a long     httpAcceptLanguage argument.(CVE-2016-6293)

  - The collator implementation in i18n/ucol.cpp in     International Components for Unicode (ICU) 52 through     SVN revision 293126, as used in Google Chrome before     40.0.2214.91, does not initialize memory for a data     structure, which allows remote attackers to cause a     denial of service or possibly have unspecified other     impact via a crafted character sequence.(CVE-2014-7940)

  - The Regular Expressions package in International     Components for Unicode (ICU) 52 before SVN revision     292944, as used in Google Chrome before 40.0.2214.91,     allows remote attackers to cause a denial of service     (memory corruption) or possibly have unspecified other     impact via vectors related to a zero-length     quantifier.(CVE-2014-7926)

  - The Regular Expressions package in International     Components for Unicode (ICU) 52 before SVN revision     292944, as used in Google Chrome before 40.0.2214.91,     allows remote attackers to cause a denial of service     (memory corruption) or possibly have unspecified other     impact via vectors related to a look-behind     expression.(CVE-2014-7923)

  - Integer overflow in international date handling in     International Components for Unicode (ICU) for C/C++     before 60.1, as used in V8 in Google Chrome prior to     63.0.3239.84 and other products, allowed a remote     attacker to perform an out of bounds memory read via a     crafted HTML page.(CVE-2017-15422)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the icu package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - International Components for Unicode (ICU) for C/C++     before 2017-02-13 has an out-of-bounds write caused by     a heap-based buffer overflow related to the     utf8TextAccess function in common/utext.cpp and the     utext_moveIndex32* function.(CVE-2017-7868)

  - A vulnerability was found in the International     Components for Unicode (ICU). Specially crafted invalid     utf-8 text, when parsed or manipulated using particular     functions in libicu, could cause out-of-bounds heap     reads and writes potentially leading to a crash, memory     disclosure, or possibly code execution.(CVE-2017-7867)

  - The Regular Expressions package in International     Components for Unicode (ICU) for C/C++ before     2014-12-03, as used in Google Chrome before     40.0.2214.91, calculates certain values without     ensuring that they can be represented in a 24-bit     field, which allows remote attackers to cause a denial     of service (memory corruption) or possibly have     unspecified other impact via a crafted string, a     related issue to CVE-2014-7923.(CVE-2014-9654)

  - Stack-based buffer overflow in the Locale class in     common/locid.cpp in International Components for     Unicode (ICU) through 57.1 for C/C++ allows remote     attackers to cause a denial of service (application     crash) or possibly have unspecified other impact via a     long locale string.(CVE-2016-7415)

  - The uloc_acceptLanguageFromHTTP function in     common/uloc.cpp in International Components for Unicode     (ICU) through 57.1 for C/C++ does not ensure that there     is a '\\0' character at the end of a certain temporary     array, which allows remote attackers to cause a denial     of service (out-of-bounds read) or possibly have     unspecified other impact via a call with a long     httpAcceptLanguage argument.(CVE-2016-6293)

  - The collator implementation in i18n/ucol.cpp in     International Components for Unicode (ICU) 52 through     SVN revision 293126, as used in Google Chrome before     40.0.2214.91, does not initialize memory for a data     structure, which allows remote attackers to cause a     denial of service or possibly have unspecified other     impact via a crafted character sequence.(CVE-2014-7940)

  - The Regular Expressions package in International     Components for Unicode (ICU) 52 before SVN revision     292944, as used in Google Chrome before 40.0.2214.91,     allows remote attackers to cause a denial of service     (memory corruption) or possibly have unspecified other     impact via vectors related to a zero-length     quantifier.(CVE-2014-7926)

  - The Regular Expressions package in International     Components for Unicode (ICU) 52 before SVN revision     292944, as used in Google Chrome before 40.0.2214.91,     allows remote attackers to cause a denial of service     (memory corruption) or possibly have unspecified other     impact via vectors related to a look-behind     expression.(CVE-2014-7923)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the icu packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - International Components for Unicode (ICU) for C/C++     before 2017-02-13 has an out-of-bounds write caused by     a heap-based buffer overflow related to the     utf8TextAccess function in common/utext.cpp and the     utext_moveIndex32* function.(CVE-2017-7868)

  - International Components for Unicode (ICU) for C/C++     before 2017-02-13 has an out-of-bounds write caused by     a heap-based buffer overflow related to the     utf8TextAccess function in common/utext.cpp and the     utext_setNativeIndex* function.(CVE-2017-7867)

  - Stack-based buffer overflow in the Locale class in     common/locid.cpp in International Components for     Unicode (ICU) through 57.1 for C/C++ allows remote     attackers to cause a denial of service (application     crash) or possibly have unspecified other impact via a     long locale string.(CVE-2016-7415)

  - The Regular Expressions package in International     Components for Unicode (ICU) 52 before SVN revision     292944, as used in Google Chrome before 40.0.2214.91,     allows remote attackers to cause a denial of service     (memory corruption) or possibly have unspecified other     impact via vectors related to a look-behind     expression.(CVE-2014-7923)

  - The Regular Expressions package in International     Components for Unicode (ICU) 52 before SVN revision     292944, as used in Google Chrome before 40.0.2214.91,     allows remote attackers to cause a denial of service     (memory corruption) or possibly have unspecified other     impact via vectors related to a zero-length     quantifier.(CVE-2014-7926)

  - The Regular Expressions package in International     Components for Unicode (ICU) for C/C++ before     2014-12-03, as used in Google Chrome before     40.0.2214.91, calculates certain values without     ensuring that they can be represented in a 24-bit     field, which allows remote attackers to cause a denial     of service (memory corruption) or possibly have     unspecified other impact via a crafted string, a     related issue to CVE-2014-7923.(CVE-2014-9654)

  - The uloc_acceptLanguageFromHTTP function in     common/uloc.cpp in International Components for Unicode     (ICU) through 57.1 for C/C++ does not ensure that there     is a '\0' character at the end of a certain temporary     array, which allows remote attackers to cause a denial     of service (out-of-bounds read) or possibly have     unspecified other impact via a call with a long     httpAcceptLanguage argument.(CVE-2016-6293)

  - Unspecified vulnerability in Oracle Java SE 6u101,     7u85, and 8u60, and Java SE Embedded 8u51, allows     remote attackers to affect confidentiality, integrity,     and availability via unknown vectors related to     2D.(CVE-2015-4844)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the icu packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Stack-based buffer overflow in the Locale class in     common/locid.cpp in International Components for     Unicode (ICU) through 57.1 for C/C++ allows remote     attackers to cause a denial of service (application     crash) or possibly have unspecified other impact via a     long locale string.(CVE-2016-7415)

  - Integer overflow in international date handling in     International Components for Unicode (ICU) for C/C++     before 60.1, as used in V8 in Google Chrome prior to     63.0.3239.84 and other products, allowed a remote     attacker to perform an out of bounds memory read via a     crafted HTML page.(CVE-2017-15422)

  - The Regular Expressions package in International     Components for Unicode (ICU) 52 before SVN revision     292944, as used in Google Chrome before 40.0.2214.91,     allows remote attackers to cause a denial of service     (memory corruption) or possibly have unspecified other     impact via vectors related to a look-behind     expression.(CVE-2014-7923)

  - The Regular Expressions package in International     Components for Unicode (ICU) 52 before SVN revision     292944, as used in Google Chrome before 40.0.2214.91,     allows remote attackers to cause a denial of service     (memory corruption) or possibly have unspecified other     impact via vectors related to a zero-length     quantifier.(CVE-2014-7926)

  - The collator implementation in i18n/ucol.cpp in     International Components for Unicode (ICU) 52 through     SVN revision 293126, as used in Google Chrome before     40.0.2214.91, does not initialize memory for a data     structure, which allows remote attackers to cause a     denial of service or possibly have unspecified other     impact via a crafted character sequence.(CVE-2014-7940)

  - The Regular Expressions package in International     Components for Unicode (ICU) for C/C++ before     2014-12-03, as used in Google Chrome before     40.0.2214.91, calculates certain values without     ensuring that they can be represented in a 24-bit     field, which allows remote attackers to cause a denial     of service (memory corruption) or possibly have     unspecified other impact via a crafted string, a     related issue to CVE-2014-7923.(CVE-2014-9654)

  - Unspecified vulnerability in Oracle Java SE 6u101,     7u85, and 8u60, and Java SE Embedded 8u51, allows     remote attackers to affect confidentiality, integrity,     and availability via unknown vectors related to     2D.(CVE-2015-4844)

  - The uloc_acceptLanguageFromHTTP function in     common/uloc.cpp in International Components for Unicode     (ICU) through 57.1 for C/C++ does not ensure that there     is a '\0' character at the end of a certain temporary     array, which allows remote attackers to cause a denial     of service (out-of-bounds read) or possibly have     unspecified other impact via a call with a long     httpAcceptLanguage argument.(CVE-2016-6293)

  - International Components for Unicode (ICU) for C/C++     before 2017-02-13 has an out-of-bounds write caused by     a heap-based buffer overflow related to the     utf8TextAccess function in common/utext.cpp and the     utext_setNativeIndex* function.(CVE-2017-7867)

  - International Components for Unicode (ICU) for C/C++     before 2017-02-13 has an out-of-bounds write caused by     a heap-based buffer overflow related to the     utf8TextAccess function in common/utext.cpp and the     utext_moveIndex32* function.(CVE-2017-7868)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the icu packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The Regular Expressions package in International     Components for Unicode (ICU) 52 before SVN revision     292944, as used in Google Chrome before 40.0.2214.91,     allows remote attackers to cause a denial of service     (memory corruption) or possibly have unspecified other     impact via vectors related to a zero-length     quantifier.(CVE-2014-7926)

  - The Regular Expressions package in International     Components for Unicode (ICU) 52 before SVN revision     292944, as used in Google Chrome before 40.0.2214.91,     allows remote attackers to cause a denial of service     (memory corruption) or possibly have unspecified other     impact via vectors related to a look-behind     expression.(CVE-2014-7923)

  - The collator implementation in i18n/ucol.cpp in     International Components for Unicode (ICU) 52 through     SVN revision 293126, as used in Google Chrome before     40.0.2214.91, does not initialize memory for a data     structure, which allows remote attackers to cause a     denial of service or possibly have unspecified other     impact via a crafted character sequence.(CVE-2014-7940)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2014-6585 CVE-2014-6591 CVE-2014-7923 CVE-2014-7926 CVE-2014-9654

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in the International Components for Unicode (ICU) library :

CVE-2013-1569

Glyph table issue.

CVE-2013-2383

Glyph table issue.

CVE-2013-2384

Font layout issue.

CVE-2013-2419

Font processing issue.

CVE-2014-6585

Out-of-bounds read.

CVE-2014-6591

Additional out-of-bounds reads.

CVE-2014-7923

Memory corruption in regular expression comparison.

CVE-2014-7926

Memory corruption in regular expression comparison.

CVE-2014-7940

Uninitialized memory.

CVE-2014-9654

More regular expression flaws.

For Debian 6 'Squeeze', these issues have been fixed in icu version 4.4.1-8+squeeze3.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2014-9654, CVE-2014-7923, CVE-2014-7926

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated icu packages fix security vulnerabilities :

The Regular Expressions package in International Components for Unicode (ICU) 52 before SVN revision 292944 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via vectors related to a zero-length quantifier or look-behind expression (CVE-2014-7923, CVE-2014-7926).

The collator implementation in i18n/ucol.cpp in International Components for Unicode (ICU) 52 through SVN revision 293126 does not initialize memory for a data structure, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted character sequence (CVE-2014-7940).

It was discovered that ICU incorrectly handled memory operations when processing fonts. If an application using ICU processed crafted data, an attacker could cause it to crash or potentially execute arbitrary code with the privileges of the user invoking the program (CVE-2014-6585, CVE-2014-6591).

The remote host is affected by the vulnerability described in GLSA-201503-06 (ICU: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in ICU. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker can cause Denial of Service.
  Workaround :

    There is no known workaround at this time.

Several vulnerabilities were discovered in the International Components for Unicode (ICU) library.

  - CVE-2013-1569     Glyph table issue.

  - CVE-2013-2383     Glyph table issue.

  - CVE-2013-2384     Font layout issue.

  - CVE-2013-2419     Font processing issue.

  - CVE-2014-6585     Out-of-bounds read.

  - CVE-2014-6591     Additional out-of-bounds reads.

  - CVE-2014-7923     Memory corruption in regular expression comparison.

  - CVE-2014-7926     Memory corruption in regular expression comparison.

  - CVE-2014-7940     Uninitialized memory.

  - CVE-2014-9654     More regular expression flaws.

USN-2522-1 fixed vulnerabilities in ICU. On Ubuntu 12.04 LTS, the font patches caused a regression when using LibreOffice Calc. The patches have now been updated to fix the regression.

We apologize for the inconvenience.

It was discovered that ICU incorrectly handled memory operations when processing fonts. If an application using ICU processed crafted data, an attacker could cause it to crash or potentially execute arbitrary code with the privileges of the user invoking the program. This issue only affected Ubuntu 12.04 LTS. (CVE-2013-1569, CVE-2013-2383, CVE-2013-2384, CVE-2013-2419)

It was discovered that ICU incorrectly handled memory operations when processing fonts. If an application using ICU processed crafted data, an attacker could cause it to crash or potentially execute arbitrary code with the privileges of the user invoking the program. (CVE-2014-6585, CVE-2014-6591)

It was discovered that ICU incorrectly handled memory operations when processing regular expressions. If an application using ICU processed crafted data, an attacker could cause it to crash or potentially execute arbitrary code with the privileges of the user invoking the program.
(CVE-2014-7923, CVE-2014-7926, CVE-2014-9654)

It was discovered that ICU collator implementation incorrectly handled memory operations. If an application using ICU processed crafted data, an attacker could cause it to crash or potentially execute arbitrary code with the privileges of the user invoking the program. (CVE-2014-7940).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-2522-1 fixed vulnerabilities in ICU. On Ubuntu 12.04 LTS, the font patches caused a regression when using LibreOffice Calc. The patches have been temporarily backed out until the regression is investigated.

We apologize for the inconvenience.

It was discovered that ICU incorrectly handled memory operations when processing fonts. If an application using ICU processed crafted data, an attacker could cause it to crash or potentially execute arbitrary code with the privileges of the user invoking the program. This issue only affected Ubuntu 12.04 LTS. (CVE-2013-1569, CVE-2013-2383, CVE-2013-2384, CVE-2013-2419)

It was discovered that ICU incorrectly handled memory operations when processing fonts. If an application using ICU processed crafted data, an attacker could cause it to crash or potentially execute arbitrary code with the privileges of the user invoking the program. (CVE-2014-6585, CVE-2014-6591)

It was discovered that ICU incorrectly handled memory operations when processing regular expressions. If an application using ICU processed crafted data, an attacker could cause it to crash or potentially execute arbitrary code with the privileges of the user invoking the program.
(CVE-2014-7923, CVE-2014-7926, CVE-2014-9654)

It was discovered that ICU collator implementation incorrectly handled memory operations. If an application using ICU processed crafted data, an attacker could cause it to crash or potentially execute arbitrary code with the privileges of the user invoking the program. (CVE-2014-7940).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

chromium was updated to version 40.0.2214.111 to fix 31 vulnerabilities.

These security issues were fixed :

  - CVE-2015-1209: Use-after-free in DOM (bnc#916841).

  - CVE-2015-1210: Cross-origin-bypass in V8 bindings     (bnc#916843).

  - CVE-2015-1211: Privilege escalation using service     workers (bnc#916838).

  - CVE-2015-1212: Various fixes from internal audits,     fuzzing and other initiatives (bnc#916840).

  - CVE-2014-7923: Memory corruption in ICU (bnc#914468).

  - CVE-2014-7924: Use-after-free in IndexedDB (bnc#914468).

  - CVE-2014-7925: Use-after-free in WebAudio (bnc#914468).

  - CVE-2014-7926: Memory corruption in ICU (bnc#914468).

  - CVE-2014-7927: Memory corruption in V8 (bnc#914468).

  - CVE-2014-7928: Memory corruption in V8 (bnc#914468).

  - CVE-2014-7930: Use-after-free in DOM (bnc#914468).

  - CVE-2014-7931: Memory corruption in V8 (bnc#914468).

  - CVE-2014-7929: Use-after-free in DOM (bnc#914468).

  - CVE-2014-7932: Use-after-free in DOM (bnc#914468).

  - CVE-2014-7933: Use-after-free in FFmpeg (bnc#914468).

  - CVE-2014-7934: Use-after-free in DOM (bnc#914468).

  - CVE-2014-7935: Use-after-free in Speech (bnc#914468).

  - CVE-2014-7936: Use-after-free in Views (bnc#914468).

  - CVE-2014-7937: Use-after-free in FFmpeg (bnc#914468).

  - CVE-2014-7938: Memory corruption in Fonts (bnc#914468).

  - CVE-2014-7939: Same-origin-bypass in V8 (bnc#914468).

  - CVE-2014-7940: Uninitialized-value in ICU (bnc#914468).

  - CVE-2014-7941: Out-of-bounds read in UI (bnc#914468).

  - CVE-2014-7942: Uninitialized-value in Fonts     (bnc#914468).

  - CVE-2014-7943: Out-of-bounds read in Skia

  - CVE-2014-7944: Out-of-bounds read in PDFium

  - CVE-2014-7945: Out-of-bounds read in PDFium

  - CVE-2014-7946: Out-of-bounds read in Fonts

  - CVE-2014-7947: Out-of-bounds read in PDFium

  - CVE-2014-7948: Caching error in AppCache

  - CVE-2015-1205: Various fixes from internal audits,     fuzzing and other initiatives

These non-security issues were fixed :

  - Fix using 'echo' command in chromium-browser.sh script

It was discovered that ICU incorrectly handled memory operations when processing fonts. If an application using ICU processed crafted data, an attacker could cause it to crash or potentially execute arbitrary code with the privileges of the user invoking the program. This issue only affected Ubuntu 12.04 LTS. (CVE-2013-1569, CVE-2013-2383, CVE-2013-2384, CVE-2013-2419)

It was discovered that ICU incorrectly handled memory operations when processing fonts. If an application using ICU processed crafted data, an attacker could cause it to crash or potentially execute arbitrary code with the privileges of the user invoking the program.
(CVE-2014-6585, CVE-2014-6591)

It was discovered that ICU incorrectly handled memory operations when processing regular expressions. If an application using ICU processed crafted data, an attacker could cause it to crash or potentially execute arbitrary code with the privileges of the user invoking the program. (CVE-2014-7923, CVE-2014-7926, CVE-2014-9654)

It was discovered that ICU collator implementation incorrectly handled memory operations. If an application using ICU processed crafted data, an attacker could cause it to crash or potentially execute arbitrary code with the privileges of the user invoking the program.
(CVE-2014-7940).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201502-13 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to cause a Denial of Service condition,       gain privileges via a filesystem: URI, or have other unspecified impact.
  Workaround :

    There is no known workaround at this time.

Updated chromium-browser packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Chromium is an open source web browser, powered by WebKit (Blink).

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash or, potentially, execute arbitrary code with the privileges of the user running Chromium. (CVE-2014-7923, CVE-2014-7924, CVE-2014-7925, CVE-2014-7926, CVE-2014-7927, CVE-2014-7928, CVE-2014-7929, CVE-2014-7930, CVE-2014-7931, CVE-2014-7932, CVE-2014-7933, CVE-2014-7934, CVE-2014-7935, CVE-2014-7936, CVE-2014-7937, CVE-2014-7938, CVE-2014-7939, CVE-2014-7940, CVE-2014-7941, CVE-2014-7942, CVE-2014-7943, CVE-2014-7944, CVE-2014-7945, CVE-2014-7946, CVE-2014-7947, CVE-2014-7948)

All Chromium users should upgrade to these updated packages, which contain Chromium version 40.0.2214.91, which corrects these issues.
After installing the update, Chromium must be restarted for the changes to take effect.

Several memory corruption bugs were discovered in ICU. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via renderer crash or execute arbitrary code with the privileges of the sandboxed render process. (CVE-2014-7923, CVE-2014-7926)

A use-after-free was discovered in the IndexedDB implementation. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking the program. (CVE-2014-7924)

A use-after free was discovered in the WebAudio implementation in Blink. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via renderer crash or execute arbitrary code with the privileges of the sandboxed render process. (CVE-2014-7925)

Several memory corruption bugs were discovered in V8. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via renderer crash or execute arbitrary code with the privileges of the sandboxed render process. (CVE-2014-7927, CVE-2014-7928, CVE-2014-7931)

Several use-after free bugs were discovered in the DOM implementation in Blink. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via renderer crash or execute arbitrary code with the privileges of the sandboxed render process. (CVE-2014-7929, CVE-2014-7930, CVE-2014-7932, CVE-2014-7934)

A use-after free was discovered in FFmpeg. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via renderer crash or execute arbitrary code with the privileges of the sandboxed render process. (CVE-2014-7933)

Multiple off-by-one errors were discovered in FFmpeg. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via renderer crash or execute arbitrary code with the privileges of the sandboxed render process. (CVE-2014-7937)

A memory corruption bug was discovered in the fonts implementation. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via renderer crash or execute arbitrary code with the privileges of the sandboxed render process. (CVE-2014-7938)

It was discovered that ICU did not initialize memory for a data structure correctly. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via renderer crash or execute arbitrary code with the privileges of the sandboxed render process. (CVE-2014-7940)

It was discovered that the fonts implementation did not initialize memory for a data structure correctly. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via renderer crash or execute arbitrary code with the privileges of the sandboxed render process. (CVE-2014-7942)

An out-of-bounds read was discovered in Skia. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via renderer crash. (CVE-2014-7943)

An out-of-bounds read was discovered in Blink. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via renderer crash. (CVE-2014-7946)

It was discovered that the AppCache proceeded with caching for SSL sessions even if there is a certificate error. A remote attacker could potentially exploit this by conducting a MITM attack to modify HTML application content. (CVE-2014-7948)

Multiple security issues were discovered in Chromium. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking the program. (CVE-2015-1205)

Multiple security issues were discovered in V8. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial of service via renderer crash or execute arbitrary code with the privileges of the sandboxed render process. (CVE-2015-1346).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Google Chrome installed on the remote Windows host is a version prior to 40.0.2214.91. It is, therefore, affected by vulnerabilities in the following components :

  - AppCache
  - DOM
  - FFmpeg
  - Fonts
  - ICU
  - IndexedDB
  - PDFium
  - Skia
  - Speech
  - UI
  - V8
  - Views
  - WebAudio

The version of Google Chrome installed on the remote Mac OS X host is a version prior to 40.0.2214.91. It is, therefore, affected by vulnerabilities in the following components :

  - AppCache
  - DOM
  - FFmpeg
  - Fonts
  - ICU
  - IndexedDB
  - PDFium
  - Skia
  - Speech
  - UI
  - V8
  - Views
  - WebAudio

Google Chrome Releases reports :

62 security fixes in this release, including :

- [430353] High CVE-2014-7923: Memory corruption in ICU. Credit to yangdingning.

- [435880] High CVE-2014-7924: Use-after-free in IndexedDB. Credit to Collin Payne.

- [434136] High CVE-2014-7925: Use-after-free in WebAudio. Credit to mark.buer.

- [422824] High CVE-2014-7926: Memory corruption in ICU. Credit to yangdingning.

- [444695] High CVE-2014-7927: Memory corruption in V8. Credit to Christian Holler.

- [435073] High CVE-2014-7928: Memory corruption in V8. Credit to Christian Holler.

- [442806] High CVE-2014-7930: Use-after-free in DOM. Credit to cloudfuzzer.

- [442710] High CVE-2014-7931: Memory corruption in V8. Credit to cloudfuzzer.

- [443115] High CVE-2014-7929: Use-after-free in DOM. Credit to cloudfuzzer.

- [429666] High CVE-2014-7932: Use-after-free in DOM. Credit to Atte Kettunen of OUSPG.

- [427266] High CVE-2014-7933: Use-after-free in FFmpeg. Credit to aohelin.

- [427249] High CVE-2014-7934: Use-after-free in DOM. Credit to cloudfuzzer.

- [402957] High CVE-2014-7935: Use-after-free in Speech. Credit to Khalil Zhani.

- [428561] High CVE-2014-7936: Use-after-free in Views. Credit to Christoph Diehl.

- [419060] High CVE-2014-7937: Use-after-free in FFmpeg. Credit to Atte Kettunen of OUSPG.

- [416323] High CVE-2014-7938: Memory corruption in Fonts. Credit to Atte Kettunen of OUSPG.

- [399951] High CVE-2014-7939: Same-origin-bypass in V8. Credit to Takeshi Terada.

- [433866] Medium CVE-2014-7940: Uninitialized-value in ICU. Credit to miaubiz.

- [428557] Medium CVE-2014-7941: Out-of-bounds read in UI. Credit to Atte Kettunen of OUSPG and Christoph Diehl.

- [426762] Medium CVE-2014-7942: Uninitialized-value in Fonts. Credit to miaubiz.

- [422492] Medium CVE-2014-7943: Out-of-bounds read in Skia. Credit to Atte Kettunen of OUSPG.

- [418881] Medium CVE-2014-7944: Out-of-bounds read in PDFium. Credit to cloudfuzzer.

- [414310] Medium CVE-2014-7945: Out-of-bounds read in PDFium. Credit to cloudfuzzer.

- [414109] Medium CVE-2014-7946: Out-of-bounds read in Fonts. Credit to miaubiz.

- [430566] Medium CVE-2014-7947: Out-of-bounds read in PDFium. Credit to fuzztercluck.

- [414026] Medium CVE-2014-7948: Caching error in AppCache. Credit to jiayaoqijia.

- [449894] CVE-2015-1205: Various fixes from internal audits, fuzzing and other initiatives.

- Multiple vulnerabilities in V8 fixed at the tip of the 3.30 branch (currently 3.30.33.15).

ID	Name	Product	Family	Severity
135616	EulerOS Virtualization 3.0.2.2 : icu (EulerOS-SA-2020-1454)	Nessus	Huawei Local Security Checks	critical
134550	EulerOS Virtualization for ARM 64 3.0.2.0 : icu (EulerOS-SA-2020-1261)	Nessus	Huawei Local Security Checks	critical
132129	EulerOS 2.0 SP3 : icu (EulerOS-SA-2019-2594)	Nessus	Huawei Local Security Checks	critical
131882	EulerOS 2.0 SP2 : icu (EulerOS-SA-2019-2390)	Nessus	Huawei Local Security Checks	critical
130868	EulerOS 2.0 SP5 : icu (EulerOS-SA-2019-2159)	Nessus	Huawei Local Security Checks	high
86376	Fedora 22 : icu-54.1-4.fc22 (2015-16314)	Nessus	Fedora Local Security Checks	critical
86111	Fedora 23 : icu-54.1-5.fc23 (2015-16315)	Nessus	Fedora Local Security Checks	critical
83476	Debian DLA-219-1 : icu security update	Nessus	Debian Local Security Checks	critical
83123	Fedora 21 : icu-52.1-6.fc21 (2015-6087)	Nessus	Fedora Local Security Checks	critical
83122	Fedora 20 : icu-50.1.2-12.fc20 (2015-6084)	Nessus	Fedora Local Security Checks	critical
82414	Mandriva Linux Security Advisory : icu (MDVSA-2015:161-1)	Nessus	Mandriva Local Security Checks	high
82005	GLSA-201503-06 : ICU: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
81831	Debian DSA-3187-1 : icu - security update	Nessus	Debian Local Security Checks	critical
81754	Ubuntu 12.04 LTS : icu vulnerabilities (USN-2522-3)	Nessus	Ubuntu Local Security Checks	critical
81698	Ubuntu 12.04 LTS : icu regression (USN-2522-2)	Nessus	Ubuntu Local Security Checks	critical
81692	openSUSE Security Update : chromium (openSUSE-2015-204)	Nessus	SuSE Local Security Checks	high
81668	Ubuntu 14.04 LTS : ICU vulnerabilities (USN-2522-1)	Nessus	Ubuntu Local Security Checks	critical
81396	GLSA-201502-13 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
81035	RHEL 6 : chromium-browser (RHSA-2015:0093)	Nessus	Red Hat Local Security Checks	high
81016	Ubuntu 14.04 LTS : Oxide vulnerabilities (USN-2476-1)	Nessus	Ubuntu Local Security Checks	critical
80951	Google Chrome < 40.0.2214.91 Multiple Vulnerabilities	Nessus	Windows	high
80950	Google Chrome < 40.0.2214.91 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
80898	FreeBSD : chromium -- multiple vulnerabilities (e30e0c99-a1b7-11e4-b85c-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2014-7926

critical

Tenable Plugins

critical

critical

critical

critical

high

critical

critical

critical

critical

critical

high

critical

critical

critical

critical

high

critical

high

high

critical

high

high

high