PDFium, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.

The version of Google Chrome installed on the remote macOS host is prior to 4.1.0.21. It is, therefore, affected by multiple vulnerabilities as referenced in the 2015_03_stable-channel-update advisory.

  - Multiple use-after-free vulnerabilities in core/html/HTMLInputElement.cpp in the DOM implementation in     Blink, as used in Google Chrome before 41.0.2272.76, allow remote attackers to cause a denial of service     or possibly have unspecified other impact via vectors that trigger extraneous change events, as     demonstrated by events for invalid input or input to read-only fields, related to the     initializeTypeInParsing and updateType functions. (CVE-2015-1223)

  - Array index error in the MidiManagerUsb::DispatchSendMidiData function in media/midi/midi_manager_usb.cc     in Google Chrome before 41.0.2272.76 allows remote attackers to cause a denial of service or possibly have     unspecified other impact by leveraging renderer access to provide an invalid port index that triggers an     out-of-bounds write operation, a different vulnerability than CVE-2015-1212. (CVE-2015-1232)

  - The SkBitmap::ReadRawPixels function in core/SkBitmap.cpp in the filters implementation in Skia, as used     in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly     have unspecified other impact via vectors that trigger an out-of-bounds write operation. (CVE-2015-1213)

  - Integer overflow in the SkAutoSTArray implementation in include/core/SkTemplates.h in the filters     implementation in Skia, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a     denial of service or possibly have unspecified other impact via vectors that trigger a reset action with a     large count value, leading to an out-of-bounds write operation. (CVE-2015-1214)

  - The filters implementation in Skia, as used in Google Chrome before 41.0.2272.76, allows remote attackers     to cause a denial of service or possibly have unspecified other impact via vectors that trigger an out-of-     bounds write operation. (CVE-2015-1215)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 4.1.0.21. It is, therefore, affected by multiple vulnerabilities as referenced in the 2015_03_stable-channel-update advisory.

  - Multiple use-after-free vulnerabilities in core/html/HTMLInputElement.cpp in the DOM implementation in     Blink, as used in Google Chrome before 41.0.2272.76, allow remote attackers to cause a denial of service     or possibly have unspecified other impact via vectors that trigger extraneous change events, as     demonstrated by events for invalid input or input to read-only fields, related to the     initializeTypeInParsing and updateType functions. (CVE-2015-1223)

  - Array index error in the MidiManagerUsb::DispatchSendMidiData function in media/midi/midi_manager_usb.cc     in Google Chrome before 41.0.2272.76 allows remote attackers to cause a denial of service or possibly have     unspecified other impact by leveraging renderer access to provide an invalid port index that triggers an     out-of-bounds write operation, a different vulnerability than CVE-2015-1212. (CVE-2015-1232)

  - The SkBitmap::ReadRawPixels function in core/SkBitmap.cpp in the filters implementation in Skia, as used     in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly     have unspecified other impact via vectors that trigger an out-of-bounds write operation. (CVE-2015-1213)

  - Integer overflow in the SkAutoSTArray implementation in include/core/SkTemplates.h in the filters     implementation in Skia, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a     denial of service or possibly have unspecified other impact via vectors that trigger a reset action with a     large count value, leading to an out-of-bounds write operation. (CVE-2015-1214)

  - The filters implementation in Skia, as used in Google Chrome before 41.0.2272.76, allows remote attackers     to cause a denial of service or possibly have unspecified other impact via vectors that trigger an out-of-     bounds write operation. (CVE-2015-1215)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201503-12 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to cause a Denial of Service condition,       bypass security restrictions, or have other unspecified impact.
  Workaround :

    There is no known workaround at this time.

Chromium was updated to 41.0.2272.76 (bnc#920825)

Security fixes :

  - CVE-2015-1212: Out-of-bounds write in media

  - CVE-2015-1213: Out-of-bounds write in skia filters

  - CVE-2015-1214: Out-of-bounds write in skia filters

  - CVE-2015-1215: Out-of-bounds write in skia filters

  - CVE-2015-1216: Use-after-free in v8 bindings

  - CVE-2015-1217: Type confusion in v8 bindings

  - CVE-2015-1218: Use-after-free in dom

  - CVE-2015-1219: Integer overflow in webgl

  - CVE-2015-1220: Use-after-free in gif decoder

  - CVE-2015-1221: Use-after-free in web databases

  - CVE-2015-1222: Use-after-free in service workers

  - CVE-2015-1223: Use-after-free in dom

  - CVE-2015-1230: Type confusion in v8

  - CVE-2015-1224: Out-of-bounds read in vpxdecoder

  - CVE-2015-1225: Out-of-bounds read in pdfium

  - CVE-2015-1226: Validation issue in debugger

  - CVE-2015-1227: Uninitialized value in blink

  - CVE-2015-1228: Uninitialized value in rendering

  - CVE-2015-1229: Cookie injection via proxies

  - CVE-2015-1231: Various fixes from internal audits

  - Multiple vulnerabilities in V8 fixed at the tip of the     4.1 branch

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2015:0627 advisory.

    Chromium is an open-source web browser, powered by WebKit (Blink).

    Several flaws were found in the processing of malformed web content. A web     page containing malicious content could cause Chromium to crash or,     potentially, execute arbitrary code with the privileges of the user running     Chromium. (CVE-2015-1213, CVE-2015-1214, CVE-2015-1215, CVE-2015-1216,     CVE-2015-1217, CVE-2015-1218, CVE-2015-1219, CVE-2015-1220, CVE-2015-1221,     CVE-2015-1222, CVE-2015-1223, CVE-2015-1224, CVE-2015-1225, CVE-2015-1226,     CVE-2015-1227, CVE-2015-1228, CVE-2015-1229, CVE-2015-1230, CVE-2015-1231)

    All Chromium users should upgrade to these updated packages, which contain     Chromium version 41.0.2272.76, which corrects these issues. After     installing the update, Chromium must be restarted for the changes to take     effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote macOS host is prior to 41.0.2272.76. It is, therefore, affected by multiple vulnerabilities as referenced in the 2015_03_stable-channel-update advisory.

  - Multiple use-after-free vulnerabilities in core/html/HTMLInputElement.cpp in the DOM implementation in     Blink, as used in Google Chrome before 41.0.2272.76, allow remote attackers to cause a denial of service     or possibly have unspecified other impact via vectors that trigger extraneous change events, as     demonstrated by events for invalid input or input to read-only fields, related to the     initializeTypeInParsing and updateType functions. (CVE-2015-1223)

  - Array index error in the MidiManagerUsb::DispatchSendMidiData function in media/midi/midi_manager_usb.cc     in Google Chrome before 41.0.2272.76 allows remote attackers to cause a denial of service or possibly have     unspecified other impact by leveraging renderer access to provide an invalid port index that triggers an     out-of-bounds write operation, a different vulnerability than CVE-2015-1212. (CVE-2015-1232)

  - The SkBitmap::ReadRawPixels function in core/SkBitmap.cpp in the filters implementation in Skia, as used     in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly     have unspecified other impact via vectors that trigger an out-of-bounds write operation. (CVE-2015-1213)

  - Integer overflow in the SkAutoSTArray implementation in include/core/SkTemplates.h in the filters     implementation in Skia, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a     denial of service or possibly have unspecified other impact via vectors that trigger a reset action with a     large count value, leading to an out-of-bounds write operation. (CVE-2015-1214)

  - The filters implementation in Skia, as used in Google Chrome before 41.0.2272.76, allows remote attackers     to cause a denial of service or possibly have unspecified other impact via vectors that trigger an out-of-     bounds write operation. (CVE-2015-1215)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 41.0.2272.76. It is, therefore, affected by multiple vulnerabilities as referenced in the 2015_03_stable-channel-update advisory.

  - Multiple use-after-free vulnerabilities in core/html/HTMLInputElement.cpp in the DOM implementation in     Blink, as used in Google Chrome before 41.0.2272.76, allow remote attackers to cause a denial of service     or possibly have unspecified other impact via vectors that trigger extraneous change events, as     demonstrated by events for invalid input or input to read-only fields, related to the     initializeTypeInParsing and updateType functions. (CVE-2015-1223)

  - Array index error in the MidiManagerUsb::DispatchSendMidiData function in media/midi/midi_manager_usb.cc     in Google Chrome before 41.0.2272.76 allows remote attackers to cause a denial of service or possibly have     unspecified other impact by leveraging renderer access to provide an invalid port index that triggers an     out-of-bounds write operation, a different vulnerability than CVE-2015-1212. (CVE-2015-1232)

  - The SkBitmap::ReadRawPixels function in core/SkBitmap.cpp in the filters implementation in Skia, as used     in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly     have unspecified other impact via vectors that trigger an out-of-bounds write operation. (CVE-2015-1213)

  - Integer overflow in the SkAutoSTArray implementation in include/core/SkTemplates.h in the filters     implementation in Skia, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a     denial of service or possibly have unspecified other impact via vectors that trigger a reset action with a     large count value, leading to an out-of-bounds write operation. (CVE-2015-1214)

  - The filters implementation in Skia, as used in Google Chrome before 41.0.2272.76, allows remote attackers     to cause a denial of service or possibly have unspecified other impact via vectors that trigger an out-of-     bounds write operation. (CVE-2015-1215)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Chrome Releases reports :

51 security fixes in this release, including :

- [456516] High CVE-2015-1212: Out-of-bounds write in media. Credit to anonymous.

- [448423] High CVE-2015-1213: Out-of-bounds write in skia filters.
Credit to cloudfuzzer.

- [445810] High CVE-2015-1214: Out-of-bounds write in skia filters.
Credit to cloudfuzzer.

- [445809] High CVE-2015-1215: Out-of-bounds write in skia filters.
Credit to cloudfuzzer.

- [454954] High CVE-2015-1216: Use-after-free in v8 bindings. Credit to anonymous.

- [456192] High CVE-2015-1217: Type confusion in v8 bindings. Credit to anonymous.

- [456059] High CVE-2015-1218: Use-after-free in dom. Credit to cloudfuzzer.

- [446164] High CVE-2015-1219: Integer overflow in webgl. Credit to Chen Zhang (demi6od) of NSFOCUS Security Team.

- [437651] High CVE-2015-1220: Use-after-free in gif decoder. Credit to Aki Helin of OUSPG.

- [455368] High CVE-2015-1221: Use-after-free in web databases. Credit to Collin Payne.

- [448082] High CVE-2015-1222: Use-after-free in service workers.
Credit to Collin Payne.

- [454231] High CVE-2015-1223: Use-after-free in dom. Credit to Maksymillian Motyl.

- High CVE-2015-1230: Type confusion in v8. Credit to Skylined working with HP's Zero Day Initiative.

- [449958] Medium CVE-2015-1224: Out-of-bounds read in vpxdecoder.
Credit to Aki Helin of OUSPG.

- [446033] Medium CVE-2015-1225: Out-of-bounds read in pdfium. Credit to cloudfuzzer.

- [456841] Medium CVE-2015-1226: Validation issue in debugger. Credit to Rob Wu.

- [450389] Medium CVE-2015-1227: Uninitialized value in blink. Credit to Christoph Diehl.

- [444707] Medium CVE-2015-1228: Uninitialized value in rendering.
Credit to miaubiz.

- [431504] Medium CVE-2015-1229: Cookie injection via proxies. Credit to iliwoy.

- [463349] CVE-2015-1231: Various fixes from internal audits, fuzzing, and other initiatives.

ID	Name	Product	Family	Severity
275869	Google Chrome < 4.1.0.21 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
275863	Google Chrome < 4.1.0.21 Multiple Vulnerabilities	Nessus	Windows	critical
82011	GLSA-201503-12 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
81870	openSUSE Security Update : chromium (openSUSE-2015-228)	Nessus	SuSE Local Security Checks	high
81662	RHEL 6 : chromium-browser (RHSA-2015:0627)	Nessus	Red Hat Local Security Checks	critical
81648	Google Chrome < 41.0.2272.76 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
81647	Google Chrome < 41.0.2272.76 Multiple Vulnerabilities	Nessus	Windows	critical
81618	FreeBSD : chromium -- multiple vulnerabilities (8505e013-c2b3-11e4-875d-000c6e25e3e9)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2015-1225

high

Tenable Plugins

critical

critical

high

high

critical

critical

critical

high