Multiple unspecified vulnerabilities in Google Chrome before 40.0.2214.111 on Windows, OS X, and Linux and before 40.0.2214.109 on Android allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Multiple unspecified vulnerabilities in Google Chrome before 40.0.2214.111 on Windows, OS X, and Linux and     before 40.0.2214.109 on Android allow attackers to cause a denial of service or possibly have other impact     via unknown vectors. (CVE-2015-1212)

Note that Nessus relies on the presence of the package as reported by the vendor.

Chromium was updated to 41.0.2272.76 (bnc#920825)

Security fixes :

  - CVE-2015-1212: Out-of-bounds write in media

  - CVE-2015-1213: Out-of-bounds write in skia filters

  - CVE-2015-1214: Out-of-bounds write in skia filters

  - CVE-2015-1215: Out-of-bounds write in skia filters

  - CVE-2015-1216: Use-after-free in v8 bindings

  - CVE-2015-1217: Type confusion in v8 bindings

  - CVE-2015-1218: Use-after-free in dom

  - CVE-2015-1219: Integer overflow in webgl

  - CVE-2015-1220: Use-after-free in gif decoder

  - CVE-2015-1221: Use-after-free in web databases

  - CVE-2015-1222: Use-after-free in service workers

  - CVE-2015-1223: Use-after-free in dom

  - CVE-2015-1230: Type confusion in v8

  - CVE-2015-1224: Out-of-bounds read in vpxdecoder

  - CVE-2015-1225: Out-of-bounds read in pdfium

  - CVE-2015-1226: Validation issue in debugger

  - CVE-2015-1227: Uninitialized value in blink

  - CVE-2015-1228: Uninitialized value in rendering

  - CVE-2015-1229: Cookie injection via proxies

  - CVE-2015-1231: Various fixes from internal audits

  - Multiple vulnerabilities in V8 fixed at the tip of the     4.1 branch

chromium was updated to version 40.0.2214.111 to fix 31 vulnerabilities.

These security issues were fixed :

  - CVE-2015-1209: Use-after-free in DOM (bnc#916841).

  - CVE-2015-1210: Cross-origin-bypass in V8 bindings     (bnc#916843).

  - CVE-2015-1211: Privilege escalation using service     workers (bnc#916838).

  - CVE-2015-1212: Various fixes from internal audits,     fuzzing and other initiatives (bnc#916840).

  - CVE-2014-7923: Memory corruption in ICU (bnc#914468).

  - CVE-2014-7924: Use-after-free in IndexedDB (bnc#914468).

  - CVE-2014-7925: Use-after-free in WebAudio (bnc#914468).

  - CVE-2014-7926: Memory corruption in ICU (bnc#914468).

  - CVE-2014-7927: Memory corruption in V8 (bnc#914468).

  - CVE-2014-7928: Memory corruption in V8 (bnc#914468).

  - CVE-2014-7930: Use-after-free in DOM (bnc#914468).

  - CVE-2014-7931: Memory corruption in V8 (bnc#914468).

  - CVE-2014-7929: Use-after-free in DOM (bnc#914468).

  - CVE-2014-7932: Use-after-free in DOM (bnc#914468).

  - CVE-2014-7933: Use-after-free in FFmpeg (bnc#914468).

  - CVE-2014-7934: Use-after-free in DOM (bnc#914468).

  - CVE-2014-7935: Use-after-free in Speech (bnc#914468).

  - CVE-2014-7936: Use-after-free in Views (bnc#914468).

  - CVE-2014-7937: Use-after-free in FFmpeg (bnc#914468).

  - CVE-2014-7938: Memory corruption in Fonts (bnc#914468).

  - CVE-2014-7939: Same-origin-bypass in V8 (bnc#914468).

  - CVE-2014-7940: Uninitialized-value in ICU (bnc#914468).

  - CVE-2014-7941: Out-of-bounds read in UI (bnc#914468).

  - CVE-2014-7942: Uninitialized-value in Fonts     (bnc#914468).

  - CVE-2014-7943: Out-of-bounds read in Skia

  - CVE-2014-7944: Out-of-bounds read in PDFium

  - CVE-2014-7945: Out-of-bounds read in PDFium

  - CVE-2014-7946: Out-of-bounds read in Fonts

  - CVE-2014-7947: Out-of-bounds read in PDFium

  - CVE-2014-7948: Caching error in AppCache

  - CVE-2015-1205: Various fixes from internal audits,     fuzzing and other initiatives

These non-security issues were fixed :

  - Fix using 'echo' command in chromium-browser.sh script

The version of Google Chrome installed on the remote Mac OS X host is prior to 41.0.2272.76. It is, therefore, affected by the following vulnerabilities :

  - A security feature bypass vulnerability, known as FREAK     (Factoring attack on RSA-EXPORT Keys), exists due to     the support of weak EXPORT_RSA cipher suites with keys     less than or equal to 512 bits. A man-in-the-middle     attacker may be able to downgrade the SSL/TLS connection     to use EXPORT_RSA cipher suites which can be factored in     a short amount of time, allowing the attacker to     intercept and decrypt the traffic. (CVE-2015-0204)

  - Multiple out-of-bounds write errors exist in skia     filters and media. (CVE-2015-1212, CVE-2015-1213,     CVE-2015-1214, CVE-2015-1215)

  - Multiple use-after-free errors exist in v8 bindings,     DOM, GIF decoder, web databases, and service workers,     which allow arbitrary code execution. (CVE-2015-1216,     CVE-2015-1218, CVE-2015-1220, CVE-2015-1221,     CVE-2015-1222, CVE-2015-1223)

  - Multiple type confusion errors exist in v8 bindings that     allow arbitrary code execution. (CVE-2015-1217,     CVE-2015-1230)

  - An integer overflow error exists in the WebGL that     allows arbitrary code execution. (CVE-2015-1219)

  - Multiple out-of-bounds read errors exist in vpxdecoder     and pdfium that allow unauthorized access to     information. (CVE-2015-1224, CVE-2015-1225)

  - A validation error exists in the debugger.
    (CVE-2015-1226)

  - Multiple uninitialized value errors exist in blink and     rendering. (CVE-2015-1227, CVE-2015-1228)

  - A cookie-injection vulnerability exists due to a failure     to properly handle a 407 HTTP status code accompanied by     a Set-Cookie header. (CVE-2015-1229)

  - Multiple, unspecified errors exist that allow remote     attackers to cause a denial of service condition.
    (CVE-2015-1231)

  - An out-of-bounds write flaw exists due to an array index     error in the DispatchSendMidiData() function that occurs     when handling a port index supplied by a renderer. A     remote attacker can exploit this to cause a denial of     service condition. (CVE-2015-1232)

  - A spoofing vulnerability exists due to improper     interaction between the '1993 search' features and     restore-from-disk RELOAD transitions when Instant     Extended mode is used. A remote attacker can exploit     this to spoof the address bar for a search-results page.
    (CVE-2015-2239)

Chrome Releases reports :

51 security fixes in this release, including :

- [456516] High CVE-2015-1212: Out-of-bounds write in media. Credit to anonymous.

- [448423] High CVE-2015-1213: Out-of-bounds write in skia filters.
Credit to cloudfuzzer.

- [445810] High CVE-2015-1214: Out-of-bounds write in skia filters.
Credit to cloudfuzzer.

- [445809] High CVE-2015-1215: Out-of-bounds write in skia filters.
Credit to cloudfuzzer.

- [454954] High CVE-2015-1216: Use-after-free in v8 bindings. Credit to anonymous.

- [456192] High CVE-2015-1217: Type confusion in v8 bindings. Credit to anonymous.

- [456059] High CVE-2015-1218: Use-after-free in dom. Credit to cloudfuzzer.

- [446164] High CVE-2015-1219: Integer overflow in webgl. Credit to Chen Zhang (demi6od) of NSFOCUS Security Team.

- [437651] High CVE-2015-1220: Use-after-free in gif decoder. Credit to Aki Helin of OUSPG.

- [455368] High CVE-2015-1221: Use-after-free in web databases. Credit to Collin Payne.

- [448082] High CVE-2015-1222: Use-after-free in service workers.
Credit to Collin Payne.

- [454231] High CVE-2015-1223: Use-after-free in dom. Credit to Maksymillian Motyl.

- High CVE-2015-1230: Type confusion in v8. Credit to Skylined working with HP's Zero Day Initiative.

- [449958] Medium CVE-2015-1224: Out-of-bounds read in vpxdecoder.
Credit to Aki Helin of OUSPG.

- [446033] Medium CVE-2015-1225: Out-of-bounds read in pdfium. Credit to cloudfuzzer.

- [456841] Medium CVE-2015-1226: Validation issue in debugger. Credit to Rob Wu.

- [450389] Medium CVE-2015-1227: Uninitialized value in blink. Credit to Christoph Diehl.

- [444707] Medium CVE-2015-1228: Uninitialized value in rendering.
Credit to miaubiz.

- [431504] Medium CVE-2015-1229: Cookie injection via proxies. Credit to iliwoy.

- [463349] CVE-2015-1231: Various fixes from internal audits, fuzzing, and other initiatives.

The remote host is affected by the vulnerability described in GLSA-201502-13 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to cause a Denial of Service condition,       gain privileges via a filesystem: URI, or have other unspecified impact.
  Workaround :

    There is no known workaround at this time.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2495-1 advisory.

    A use-after-free bug was discovered in the DOM implementation in Blink. If a user were tricked in to     opening a specially crafted website, an attacker could potentially exploit this to cause a denial of     service via renderer crash or execute arbitrary code with the privileges of the sandboxed render process.
    (CVE-2015-1209)

    It was discovered that V8 did not properly consider frame access restrictions when throwing exceptions in     some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could     potentially exploit this to bypass same origin restrictions. (CVE-2015-1210)

    It was discovered that Chromium did not properly restrict the URI scheme during ServiceWorker     registration. If a user were tricked in to downloading and opening a specially crafted HTML file, an     attacker could potentially exploit this to bypass security restrictions. (CVE-2015-1211)

    Multiple security issues were discovered in Chromium. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial     of service via application crash or execute arbitrary code with the privileges of the user invoking the     program. (CVE-2015-1212)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2015:0163 advisory.

    Chromium is an open-source web browser, powered by WebKit (Blink).

    Several flaws were found in the processing of malformed web content. A web     page containing malicious content could cause Chromium to crash or,     potentially, execute arbitrary code with the privileges of the user running     Chromium. (CVE-2015-1209, CVE-2015-1210, CVE-2015-1211, CVE-2015-1212)

    All Chromium users should upgrade to these updated packages, which contain     Chromium version 40.0.2214.111, which corrects these issues. After     installing the update, Chromium must be restarted for the changes to take     effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Chrome Releases reports :

11 security fixes in this release, including :

- [447906] High CVE-2015-1209: Use-after-free in DOM. Credit to Maksymillian.

- [453979] High CVE-2015-1210: Cross-origin-bypass in V8 bindings.
Credit to anonymous.

- [453982] High CVE-2015-1211: Privilege escalation using service workers. Credit to anonymous.

- [455225] CVE-2015-1212: Various fixes from internal audits, fuzzing and other initiatives.

The version of Google Chrome installed on the remote Mac OS X host is prior to 40.0.2214.111. It is, therefore, affected by the following vulnerabilities :

  - Several use-after-free errors exist that allow arbitrary     code execution. (CVE-2015-0313, CVE-2015-0315,     CVE-2015-0320, CVE-2015-0322)

  - Several memory corruption errors exist that allow     arbitrary code execution. (CVE-2015-0314,     CVE-2015-0316, CVE-2015-0318, CVE-2015-0321,     CVE-2015-0329, CVE-2015-0330)

  - Several type confusion errors exist that allow     arbitrary code execution. (CVE-2015-0317, CVE-2015-0319)

  - Several heap-based buffer-overflow errors exist that     allow arbitrary code execution. (CVE-2015-0323,     CVE-2015-0327)

  - A buffer overflow error exists that allows arbitrary     code execution. (CVE-2015-0324)

  - Several null pointer dereference errors exist that have     unspecified impacts. (CVE-2015-0325, CVE-2015-0326,     CVE-2015-0328).

  - A user-after-free error exists within the processing of     invalid m3u8 playlists. A remote attacker, with a     specially crafted m3u8 playlist file, can force a     dangling pointer to be reused after it has been freed,     allowing the execution of arbitrary code.
    (CVE-2015-0331)

  - A use-after-free error exists related to the DOM     component. (CVE-2015-1209)

  - A cross-origin bypass error exists related to the V8     JavaScript engine bindings. (CVE-2015-1210)

  - A privilege escalation error exists related to service     workers. (CVE-2015-1211)

  - Various, unspecified errors exist. (CVE-2015-1212)

The version of Google Chrome installed on the remote Windows host is prior to 40.0.2214.111. It is, therefore, affected by the following vulnerabilities :

  - Several use-after-free errors exist that allow arbitrary     code execution. (CVE-2015-0313, CVE-2015-0315,     CVE-2015-0320, CVE-2015-0322)

  - Several memory corruption errors exist that allow     arbitrary code execution. (CVE-2015-0314,     CVE-2015-0316, CVE-2015-0318, CVE-2015-0321,     CVE-2015-0329, CVE-2015-0330)

  - Several type confusion errors exist that allow     arbitrary code execution. (CVE-2015-0317, CVE-2015-0319)

  - Several heap-based buffer-overflow errors exist that     allow arbitrary code execution. (CVE-2015-0323,     CVE-2015-0327)

  - A buffer overflow error exists that allows arbitrary     code execution. (CVE-2015-0324)

  - Several null pointer dereference errors exist that have     unspecified impacts. (CVE-2015-0325, CVE-2015-0326,     CVE-2015-0328).

  - A user-after-free error exists within the processing of     invalid m3u8 playlists. A remote attacker, with a     specially crafted m3u8 playlist file, can force a     dangling pointer to be reused after it has been freed,     allowing the execution of arbitrary code.
    (CVE-2015-0331)

  - A use-after-free error exists related to the DOM     component. (CVE-2015-1209)

  - A cross-origin bypass error exists related to the V8     JavaScript engine bindings. (CVE-2015-1210)

  - A privilege escalation error exists related to service     workers. (CVE-2015-1211)

  - Various, unspecified errors exist. (CVE-2015-1212)

ID	Name	Product	Family	Severity
218520	Linux Distros Unpatched Vulnerability : CVE-2015-1212	Nessus	Misc.	critical
81870	openSUSE Security Update : chromium (openSUSE-2015-228)	Nessus	SuSE Local Security Checks	high
81692	openSUSE Security Update : chromium (openSUSE-2015-204)	Nessus	SuSE Local Security Checks	high
81648	Google Chrome < 41.0.2272.76 Multiple Vulnerabilities (Mac OS X) (FREAK)	Nessus	MacOS X Local Security Checks	high
81618	FreeBSD : chromium -- multiple vulnerabilities (8505e013-c2b3-11e4-875d-000c6e25e3e9)	Nessus	FreeBSD Local Security Checks	high
81396	GLSA-201502-13 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
81296	Ubuntu 14.04 LTS : Oxide vulnerabilities (USN-2495-1)	Nessus	Ubuntu Local Security Checks	high
81290	RHEL 6 : chromium-browser (RHSA-2015:0163)	Nessus	Red Hat Local Security Checks	critical
81223	FreeBSD : chromium -- multiple vulnerabilities (a6eb239f-adbe-11e4-9fce-080027593b9a)	Nessus	FreeBSD Local Security Checks	high
81208	Google Chrome < 40.0.2214.111 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
81207	Google Chrome < 40.0.2214.111 Multiple Vulnerabilities	Nessus	Windows	critical

Detections

Analytics

CVE-2015-1212

critical

Tenable Plugins

critical

high

high

high

high

high

high

critical

high

critical

critical