Multiple use-after-free vulnerabilities in the DOM implementation in Blink, as used in Google Chrome before 41.0.2272.76, allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger movement of a SCRIPT element to different documents, related to (1) the HTMLScriptElement::didMoveToNewDocument function in core/html/HTMLScriptElement.cpp and (2) the SVGScriptElement::didMoveToNewDocument function in core/svg/SVGScriptElement.cpp.

The remote host is affected by the vulnerability described in GLSA-201503-12 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to cause a Denial of Service condition,       bypass security restrictions, or have other unspecified impact.
  Workaround :

    There is no known workaround at this time.

Chromium was updated to 41.0.2272.76 (bnc#920825)

Security fixes :

  - CVE-2015-1212: Out-of-bounds write in media

  - CVE-2015-1213: Out-of-bounds write in skia filters

  - CVE-2015-1214: Out-of-bounds write in skia filters

  - CVE-2015-1215: Out-of-bounds write in skia filters

  - CVE-2015-1216: Use-after-free in v8 bindings

  - CVE-2015-1217: Type confusion in v8 bindings

  - CVE-2015-1218: Use-after-free in dom

  - CVE-2015-1219: Integer overflow in webgl

  - CVE-2015-1220: Use-after-free in gif decoder

  - CVE-2015-1221: Use-after-free in web databases

  - CVE-2015-1222: Use-after-free in service workers

  - CVE-2015-1223: Use-after-free in dom

  - CVE-2015-1230: Type confusion in v8

  - CVE-2015-1224: Out-of-bounds read in vpxdecoder

  - CVE-2015-1225: Out-of-bounds read in pdfium

  - CVE-2015-1226: Validation issue in debugger

  - CVE-2015-1227: Uninitialized value in blink

  - CVE-2015-1228: Uninitialized value in rendering

  - CVE-2015-1229: Cookie injection via proxies

  - CVE-2015-1231: Various fixes from internal audits

  - Multiple vulnerabilities in V8 fixed at the tip of the     4.1 branch

Several out-of-bounds write bugs were discovered in Skia. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking the program. (CVE-2015-1213, CVE-2015-1214, CVE-2015-1215)

A use-after-free was discovered in the V8 bindings in Blink. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via renderer crash, or execute arbitrary code with the privileges of the sandboxed render process. (CVE-2015-1216)

Multiple type confusion bugs were discovered in the V8 bindings in Blink. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via renderer crash, or execute arbitrary code with the privileges of the sandboxed render process. (CVE-2015-1217, CVE-2015-1230)

Multiple use-after-free bugs were discovered in the DOM implementation in Blink. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via renderer crash, or execute arbitrary code with the privileges of the sandboxed render process. (CVE-2015-1218, CVE-2015-1223)

An integer overflow was discovered in Skia. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking the program. (CVE-2015-1219)

A use-after-free was discovered in the GIF image decoder in Blink. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via renderer crash, or execute arbitrary code with the privileges of the sandboxed render process. (CVE-2015-1220)

A use-after-free was discovered in Blink. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via renderer crash, or execute arbitrary code with the privileges of the sandboxed render process. (CVE-2015-1221)

Multiple use-after-free bugs were discovered in the service worker implementation in Chromium. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking the program.
(CVE-2015-1222)

An out-of-bounds read was discovered in the VPX decoder implementation in Chromium. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via renderer crash. (CVE-2015-1224)

It was discovered that Blink did not initialize memory for image drawing in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to read uninitialized memory. (CVE-2015-1227)

It was discovered that Blink did not initialize memory for a data structure in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via renderer crash, or execute arbitrary code with the privileges of the sandboxed render process.
(CVE-2015-1228)

It was discovered that a web proxy returning a 407 response could inject cookies in to the originally requested domain. If a user connected to a malicious web proxy, an attacker could potentially exploit this to conduct session-fixation attacks. (CVE-2015-1229)

Multiple security issues were discovered in Chromium. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking the program. (CVE-2015-1231)

Multiple security issues were discovered in V8. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial of service via renderer crash or execute arbitrary code with the privileges of the sandboxed render process. (CVE-2015-2238).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated chromium-browser packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Chromium is an open source web browser, powered by WebKit (Blink).

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash or, potentially, execute arbitrary code with the privileges of the user running Chromium. (CVE-2015-1213, CVE-2015-1214, CVE-2015-1215, CVE-2015-1216, CVE-2015-1217, CVE-2015-1218, CVE-2015-1219, CVE-2015-1220, CVE-2015-1221, CVE-2015-1222, CVE-2015-1223, CVE-2015-1224, CVE-2015-1225, CVE-2015-1226, CVE-2015-1227, CVE-2015-1228, CVE-2015-1229, CVE-2015-1230, CVE-2015-1231)

All Chromium users should upgrade to these updated packages, which contain Chromium version 41.0.2272.76, which corrects these issues.
After installing the update, Chromium must be restarted for the changes to take effect.

The version of Google Chrome installed on the remote Mac OS X host is prior to 41.0.2272.76. It is, therefore, affected by the following vulnerabilities :

  - A security feature bypass vulnerability, known as FREAK     (Factoring attack on RSA-EXPORT Keys), exists due to     the support of weak EXPORT_RSA cipher suites with keys     less than or equal to 512 bits. A man-in-the-middle     attacker may be able to downgrade the SSL/TLS connection     to use EXPORT_RSA cipher suites which can be factored in     a short amount of time, allowing the attacker to     intercept and decrypt the traffic. (CVE-2015-0204)

  - Multiple out-of-bounds write errors exist in skia     filters and media. (CVE-2015-1212, CVE-2015-1213,     CVE-2015-1214, CVE-2015-1215)

  - Multiple use-after-free errors exist in v8 bindings,     DOM, GIF decoder, web databases, and service workers,     which allow arbitrary code execution. (CVE-2015-1216,     CVE-2015-1218, CVE-2015-1220, CVE-2015-1221,     CVE-2015-1222, CVE-2015-1223)

  - Multiple type confusion errors exist in v8 bindings that     allow arbitrary code execution. (CVE-2015-1217,     CVE-2015-1230)

  - An integer overflow error exists in the WebGL that     allows arbitrary code execution. (CVE-2015-1219)

  - Multiple out-of-bounds read errors exist in vpxdecoder     and pdfium that allow unauthorized access to     information. (CVE-2015-1224, CVE-2015-1225)

  - A validation error exists in the debugger.
    (CVE-2015-1226)

  - Multiple uninitialized value errors exist in blink and     rendering. (CVE-2015-1227, CVE-2015-1228)

  - A cookie-injection vulnerability exists due to a failure     to properly handle a 407 HTTP status code accompanied by     a Set-Cookie header. (CVE-2015-1229)

  - Multiple, unspecified errors exist that allow remote     attackers to cause a denial of service condition.
    (CVE-2015-1231)

  - An out-of-bounds write flaw exists due to an array index     error in the DispatchSendMidiData() function that occurs     when handling a port index supplied by a renderer. A     remote attacker can exploit this to cause a denial of     service condition. (CVE-2015-1232)

  - A spoofing vulnerability exists due to improper     interaction between the '1993 search' features and     restore-from-disk RELOAD transitions when Instant     Extended mode is used. A remote attacker can exploit     this to spoof the address bar for a search-results page.
    (CVE-2015-2239)

The version of Google Chrome installed on the remote Windows host is prior to 41.0.2272.76. It is, therefore, affected by the following vulnerabilities :

  - Multiple out-of-bounds write errors exist in skia     filters and media. (CVE-2015-1212, CVE-2015-1213,     CVE-2015-1214, CVE-2015-1215)

  - Multiple use-after-free errors exist in v8 bindings,     DOM, GIF decoder, web databases, and service workers,     which allow arbitrary code execution. (CVE-2015-1216,     CVE-2015-1218, CVE-2015-1220, CVE-2015-1221,     CVE-2015-1222, CVE-2015-1223)

  - Multiple type confusion errors exist in v8 bindings that     allow arbitrary code execution. (CVE-2015-1217,     CVE-2015-1230)

  - An integer overflow error exists in the WebGL that     allows arbitrary code execution. (CVE-2015-1219)

  - Multiple out-of-bounds read errors exist in vpxdecoder     and pdfium that allow unauthorized access to     information. (CVE-2015-1224, CVE-2015-1225)

  - A validation error exists in the debugger.
    (CVE-2015-1226)

  - Multiple uninitialized value errors exist in blink and     rendering. (CVE-2015-1227, CVE-2015-1228)

  - A cookie-injection vulnerability exists due to a failure     to properly handle a 407 HTTP status code accompanied by     a Set-Cookie header. (CVE-2015-1229)

  - Multiple, unspecified errors exist that allow remote     attackers to cause a denial of service condition.
    (CVE-2015-1231)

  - An out-of-bounds write flaw exists due to an array index     error in the DispatchSendMidiData() function that occurs     when handling a port index supplied by a renderer. A     remote attacker can exploit this to cause a denial of     service condition. (CVE-2015-1232)

  - A spoofing vulnerability exists due to improper     interaction between the '1993 search' features and     restore-from-disk RELOAD transitions when Instant     Extended mode is used. A remote attacker can exploit     this to spoof the address bar for a search-results page.
    (CVE-2015-2239

Chrome Releases reports :

51 security fixes in this release, including :

- [456516] High CVE-2015-1212: Out-of-bounds write in media. Credit to anonymous.

- [448423] High CVE-2015-1213: Out-of-bounds write in skia filters.
Credit to cloudfuzzer.

- [445810] High CVE-2015-1214: Out-of-bounds write in skia filters.
Credit to cloudfuzzer.

- [445809] High CVE-2015-1215: Out-of-bounds write in skia filters.
Credit to cloudfuzzer.

- [454954] High CVE-2015-1216: Use-after-free in v8 bindings. Credit to anonymous.

- [456192] High CVE-2015-1217: Type confusion in v8 bindings. Credit to anonymous.

- [456059] High CVE-2015-1218: Use-after-free in dom. Credit to cloudfuzzer.

- [446164] High CVE-2015-1219: Integer overflow in webgl. Credit to Chen Zhang (demi6od) of NSFOCUS Security Team.

- [437651] High CVE-2015-1220: Use-after-free in gif decoder. Credit to Aki Helin of OUSPG.

- [455368] High CVE-2015-1221: Use-after-free in web databases. Credit to Collin Payne.

- [448082] High CVE-2015-1222: Use-after-free in service workers.
Credit to Collin Payne.

- [454231] High CVE-2015-1223: Use-after-free in dom. Credit to Maksymillian Motyl.

- High CVE-2015-1230: Type confusion in v8. Credit to Skylined working with HP's Zero Day Initiative.

- [449958] Medium CVE-2015-1224: Out-of-bounds read in vpxdecoder.
Credit to Aki Helin of OUSPG.

- [446033] Medium CVE-2015-1225: Out-of-bounds read in pdfium. Credit to cloudfuzzer.

- [456841] Medium CVE-2015-1226: Validation issue in debugger. Credit to Rob Wu.

- [450389] Medium CVE-2015-1227: Uninitialized value in blink. Credit to Christoph Diehl.

- [444707] Medium CVE-2015-1228: Uninitialized value in rendering.
Credit to miaubiz.

- [431504] Medium CVE-2015-1229: Cookie injection via proxies. Credit to iliwoy.

- [463349] CVE-2015-1231: Various fixes from internal audits, fuzzing, and other initiatives.

ID	Name	Product	Family	Severity
82011	GLSA-201503-12 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
81870	openSUSE Security Update : chromium (openSUSE-2015-228)	Nessus	SuSE Local Security Checks	high
81753	Ubuntu 14.04 LTS : Oxide vulnerabilities (USN-2521-1)	Nessus	Ubuntu Local Security Checks	high
81662	RHEL 6 : chromium-browser (RHSA-2015:0627)	Nessus	Red Hat Local Security Checks	high
81648	Google Chrome < 41.0.2272.76 Multiple Vulnerabilities (Mac OS X) (FREAK)	Nessus	MacOS X Local Security Checks	high
81647	Google Chrome < 41.0.2272.76 Multiple Vulnerabilities	Nessus	Windows	high
81618	FreeBSD : chromium -- multiple vulnerabilities (8505e013-c2b3-11e4-875d-000c6e25e3e9)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2015-1218

high

Tenable Plugins

high

high

high

high

high

high

high