The V8ThrowException::createDOMException function in bindings/core/v8/V8ThrowException.cpp in the V8 bindings in Blink, as used in Google Chrome before 40.0.2214.111 on Windows, OS X, and Linux and before 40.0.2214.109 on Android, does not properly consider frame access restrictions during the throwing of an exception, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.

chromium was updated to version 40.0.2214.111 to fix 31 vulnerabilities.

These security issues were fixed :

  - CVE-2015-1209: Use-after-free in DOM (bnc#916841).

  - CVE-2015-1210: Cross-origin-bypass in V8 bindings     (bnc#916843).

  - CVE-2015-1211: Privilege escalation using service     workers (bnc#916838).

  - CVE-2015-1212: Various fixes from internal audits,     fuzzing and other initiatives (bnc#916840).

  - CVE-2014-7923: Memory corruption in ICU (bnc#914468).

  - CVE-2014-7924: Use-after-free in IndexedDB (bnc#914468).

  - CVE-2014-7925: Use-after-free in WebAudio (bnc#914468).

  - CVE-2014-7926: Memory corruption in ICU (bnc#914468).

  - CVE-2014-7927: Memory corruption in V8 (bnc#914468).

  - CVE-2014-7928: Memory corruption in V8 (bnc#914468).

  - CVE-2014-7930: Use-after-free in DOM (bnc#914468).

  - CVE-2014-7931: Memory corruption in V8 (bnc#914468).

  - CVE-2014-7929: Use-after-free in DOM (bnc#914468).

  - CVE-2014-7932: Use-after-free in DOM (bnc#914468).

  - CVE-2014-7933: Use-after-free in FFmpeg (bnc#914468).

  - CVE-2014-7934: Use-after-free in DOM (bnc#914468).

  - CVE-2014-7935: Use-after-free in Speech (bnc#914468).

  - CVE-2014-7936: Use-after-free in Views (bnc#914468).

  - CVE-2014-7937: Use-after-free in FFmpeg (bnc#914468).

  - CVE-2014-7938: Memory corruption in Fonts (bnc#914468).

  - CVE-2014-7939: Same-origin-bypass in V8 (bnc#914468).

  - CVE-2014-7940: Uninitialized-value in ICU (bnc#914468).

  - CVE-2014-7941: Out-of-bounds read in UI (bnc#914468).

  - CVE-2014-7942: Uninitialized-value in Fonts     (bnc#914468).

  - CVE-2014-7943: Out-of-bounds read in Skia

  - CVE-2014-7944: Out-of-bounds read in PDFium

  - CVE-2014-7945: Out-of-bounds read in PDFium

  - CVE-2014-7946: Out-of-bounds read in Fonts

  - CVE-2014-7947: Out-of-bounds read in PDFium

  - CVE-2014-7948: Caching error in AppCache

  - CVE-2015-1205: Various fixes from internal audits,     fuzzing and other initiatives

These non-security issues were fixed :

  - Fix using 'echo' command in chromium-browser.sh script

The remote host is affected by the vulnerability described in GLSA-201502-13 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to cause a Denial of Service condition,       gain privileges via a filesystem: URI, or have other unspecified impact.
  Workaround :

    There is no known workaround at this time.

A use-after-free bug was discovered in the DOM implementation in Blink. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via renderer crash or execute arbitrary code with the privileges of the sandboxed render process. (CVE-2015-1209)

It was discovered that V8 did not properly consider frame access restrictions when throwing exceptions in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass same origin restrictions.
(CVE-2015-1210)

It was discovered that Chromium did not properly restrict the URI scheme during ServiceWorker registration. If a user were tricked in to downloading and opening a specially crafted HTML file, an attacker could potentially exploit this to bypass security restrictions.
(CVE-2015-1211)

Multiple security issues were discovered in Chromium. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking the program. (CVE-2015-1212).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated chromium-browser packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Chromium is an open source web browser, powered by WebKit (Blink).

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash or, potentially, execute arbitrary code with the privileges of the user running Chromium. (CVE-2015-1209, CVE-2015-1210, CVE-2015-1211, CVE-2015-1212)

All Chromium users should upgrade to these updated packages, which contain Chromium version 40.0.2214.111, which corrects these issues.
After installing the update, Chromium must be restarted for the changes to take effect.

Chrome Releases reports :

11 security fixes in this release, including :

- [447906] High CVE-2015-1209: Use-after-free in DOM. Credit to Maksymillian.

- [453979] High CVE-2015-1210: Cross-origin-bypass in V8 bindings.
Credit to anonymous.

- [453982] High CVE-2015-1211: Privilege escalation using service workers. Credit to anonymous.

- [455225] CVE-2015-1212: Various fixes from internal audits, fuzzing and other initiatives.

The version of Google Chrome installed on the remote Mac OS X host is prior to 40.0.2214.111. It is, therefore, affected by the following vulnerabilities :

  - Several use-after-free errors exist that allow arbitrary     code execution. (CVE-2015-0313, CVE-2015-0315,     CVE-2015-0320, CVE-2015-0322)

  - Several memory corruption errors exist that allow     arbitrary code execution. (CVE-2015-0314,     CVE-2015-0316, CVE-2015-0318, CVE-2015-0321,     CVE-2015-0329, CVE-2015-0330)

  - Several type confusion errors exist that allow     arbitrary code execution. (CVE-2015-0317, CVE-2015-0319)

  - Several heap-based buffer-overflow errors exist that     allow arbitrary code execution. (CVE-2015-0323,     CVE-2015-0327)

  - A buffer overflow error exists that allows arbitrary     code execution. (CVE-2015-0324)

  - Several null pointer dereference errors exist that have     unspecified impacts. (CVE-2015-0325, CVE-2015-0326,     CVE-2015-0328).

  - A user-after-free error exists within the processing of     invalid m3u8 playlists. A remote attacker, with a     specially crafted m3u8 playlist file, can force a     dangling pointer to be reused after it has been freed,     allowing the execution of arbitrary code.
    (CVE-2015-0331)

  - A use-after-free error exists related to the DOM     component. (CVE-2015-1209)

  - A cross-origin bypass error exists related to the V8     JavaScript engine bindings. (CVE-2015-1210)

  - A privilege escalation error exists related to service     workers. (CVE-2015-1211)

  - Various, unspecified errors exist. (CVE-2015-1212)

The version of Google Chrome installed on the remote Windows host is prior to 40.0.2214.111. It is, therefore, affected by the following vulnerabilities :

  - Several use-after-free errors exist that allow arbitrary     code execution. (CVE-2015-0313, CVE-2015-0315,     CVE-2015-0320, CVE-2015-0322)

  - Several memory corruption errors exist that allow     arbitrary code execution. (CVE-2015-0314,     CVE-2015-0316, CVE-2015-0318, CVE-2015-0321,     CVE-2015-0329, CVE-2015-0330)

  - Several type confusion errors exist that allow     arbitrary code execution. (CVE-2015-0317, CVE-2015-0319)

  - Several heap-based buffer-overflow errors exist that     allow arbitrary code execution. (CVE-2015-0323,     CVE-2015-0327)

  - A buffer overflow error exists that allows arbitrary     code execution. (CVE-2015-0324)

  - Several null pointer dereference errors exist that have     unspecified impacts. (CVE-2015-0325, CVE-2015-0326,     CVE-2015-0328).

  - A user-after-free error exists within the processing of     invalid m3u8 playlists. A remote attacker, with a     specially crafted m3u8 playlist file, can force a     dangling pointer to be reused after it has been freed,     allowing the execution of arbitrary code.
    (CVE-2015-0331)

  - A use-after-free error exists related to the DOM     component. (CVE-2015-1209)

  - A cross-origin bypass error exists related to the V8     JavaScript engine bindings. (CVE-2015-1210)

  - A privilege escalation error exists related to service     workers. (CVE-2015-1211)

  - Various, unspecified errors exist. (CVE-2015-1212)

ID	Name	Product	Family	Severity
81692	openSUSE Security Update : chromium (openSUSE-2015-204)	Nessus	SuSE Local Security Checks	high
81396	GLSA-201502-13 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
81296	Ubuntu 14.04 LTS : Oxide vulnerabilities (USN-2495-1)	Nessus	Ubuntu Local Security Checks	critical
81290	RHEL 6 : chromium-browser (RHSA-2015:0163)	Nessus	Red Hat Local Security Checks	high
81223	FreeBSD : chromium -- multiple vulnerabilities (a6eb239f-adbe-11e4-9fce-080027593b9a)	Nessus	FreeBSD Local Security Checks	high
81208	Google Chrome < 40.0.2214.111 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
81207	Google Chrome < 40.0.2214.111 Multiple Vulnerabilities	Nessus	Windows	critical

Detections

Analytics

CVE-2015-1210

high

Tenable Plugins

high

high

critical

high

high

critical

critical