Array index error in the MidiManagerUsb::DispatchSendMidiData function in media/midi/midi_manager_usb.cc in Google Chrome before 41.0.2272.76 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging renderer access to provide an invalid port index that triggers an out-of-bounds write operation, a different vulnerability than CVE-2015-1212.

The version of Google Chrome installed on the remote macOS host is prior to 4.1.0.21. It is, therefore, affected by multiple vulnerabilities as referenced in the 2015_03_stable-channel-update advisory.

  - Multiple use-after-free vulnerabilities in core/html/HTMLInputElement.cpp in the DOM implementation in     Blink, as used in Google Chrome before 41.0.2272.76, allow remote attackers to cause a denial of service     or possibly have unspecified other impact via vectors that trigger extraneous change events, as     demonstrated by events for invalid input or input to read-only fields, related to the     initializeTypeInParsing and updateType functions. (CVE-2015-1223)

  - Array index error in the MidiManagerUsb::DispatchSendMidiData function in media/midi/midi_manager_usb.cc     in Google Chrome before 41.0.2272.76 allows remote attackers to cause a denial of service or possibly have     unspecified other impact by leveraging renderer access to provide an invalid port index that triggers an     out-of-bounds write operation, a different vulnerability than CVE-2015-1212. (CVE-2015-1232)

  - The SkBitmap::ReadRawPixels function in core/SkBitmap.cpp in the filters implementation in Skia, as used     in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly     have unspecified other impact via vectors that trigger an out-of-bounds write operation. (CVE-2015-1213)

  - Integer overflow in the SkAutoSTArray implementation in include/core/SkTemplates.h in the filters     implementation in Skia, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a     denial of service or possibly have unspecified other impact via vectors that trigger a reset action with a     large count value, leading to an out-of-bounds write operation. (CVE-2015-1214)

  - The filters implementation in Skia, as used in Google Chrome before 41.0.2272.76, allows remote attackers     to cause a denial of service or possibly have unspecified other impact via vectors that trigger an out-of-     bounds write operation. (CVE-2015-1215)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 4.1.0.21. It is, therefore, affected by multiple vulnerabilities as referenced in the 2015_03_stable-channel-update advisory.

  - Multiple use-after-free vulnerabilities in core/html/HTMLInputElement.cpp in the DOM implementation in     Blink, as used in Google Chrome before 41.0.2272.76, allow remote attackers to cause a denial of service     or possibly have unspecified other impact via vectors that trigger extraneous change events, as     demonstrated by events for invalid input or input to read-only fields, related to the     initializeTypeInParsing and updateType functions. (CVE-2015-1223)

  - Array index error in the MidiManagerUsb::DispatchSendMidiData function in media/midi/midi_manager_usb.cc     in Google Chrome before 41.0.2272.76 allows remote attackers to cause a denial of service or possibly have     unspecified other impact by leveraging renderer access to provide an invalid port index that triggers an     out-of-bounds write operation, a different vulnerability than CVE-2015-1212. (CVE-2015-1232)

  - The SkBitmap::ReadRawPixels function in core/SkBitmap.cpp in the filters implementation in Skia, as used     in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly     have unspecified other impact via vectors that trigger an out-of-bounds write operation. (CVE-2015-1213)

  - Integer overflow in the SkAutoSTArray implementation in include/core/SkTemplates.h in the filters     implementation in Skia, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a     denial of service or possibly have unspecified other impact via vectors that trigger a reset action with a     large count value, leading to an out-of-bounds write operation. (CVE-2015-1214)

  - The filters implementation in Skia, as used in Google Chrome before 41.0.2272.76, allows remote attackers     to cause a denial of service or possibly have unspecified other impact via vectors that trigger an out-of-     bounds write operation. (CVE-2015-1215)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201503-12 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to cause a Denial of Service condition,       bypass security restrictions, or have other unspecified impact.
  Workaround :

    There is no known workaround at this time.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2015:0627 advisory.

    Chromium is an open-source web browser, powered by WebKit (Blink).

    Several flaws were found in the processing of malformed web content. A web     page containing malicious content could cause Chromium to crash or,     potentially, execute arbitrary code with the privileges of the user running     Chromium. (CVE-2015-1213, CVE-2015-1214, CVE-2015-1215, CVE-2015-1216,     CVE-2015-1217, CVE-2015-1218, CVE-2015-1219, CVE-2015-1220, CVE-2015-1221,     CVE-2015-1222, CVE-2015-1223, CVE-2015-1224, CVE-2015-1225, CVE-2015-1226,     CVE-2015-1227, CVE-2015-1228, CVE-2015-1229, CVE-2015-1230, CVE-2015-1231)

    All Chromium users should upgrade to these updated packages, which contain     Chromium version 41.0.2272.76, which corrects these issues. After     installing the update, Chromium must be restarted for the changes to take     effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote macOS host is prior to 41.0.2272.76. It is, therefore, affected by multiple vulnerabilities as referenced in the 2015_03_stable-channel-update advisory.

  - Multiple use-after-free vulnerabilities in core/html/HTMLInputElement.cpp in the DOM implementation in     Blink, as used in Google Chrome before 41.0.2272.76, allow remote attackers to cause a denial of service     or possibly have unspecified other impact via vectors that trigger extraneous change events, as     demonstrated by events for invalid input or input to read-only fields, related to the     initializeTypeInParsing and updateType functions. (CVE-2015-1223)

  - Array index error in the MidiManagerUsb::DispatchSendMidiData function in media/midi/midi_manager_usb.cc     in Google Chrome before 41.0.2272.76 allows remote attackers to cause a denial of service or possibly have     unspecified other impact by leveraging renderer access to provide an invalid port index that triggers an     out-of-bounds write operation, a different vulnerability than CVE-2015-1212. (CVE-2015-1232)

  - The SkBitmap::ReadRawPixels function in core/SkBitmap.cpp in the filters implementation in Skia, as used     in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly     have unspecified other impact via vectors that trigger an out-of-bounds write operation. (CVE-2015-1213)

  - Integer overflow in the SkAutoSTArray implementation in include/core/SkTemplates.h in the filters     implementation in Skia, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a     denial of service or possibly have unspecified other impact via vectors that trigger a reset action with a     large count value, leading to an out-of-bounds write operation. (CVE-2015-1214)

  - The filters implementation in Skia, as used in Google Chrome before 41.0.2272.76, allows remote attackers     to cause a denial of service or possibly have unspecified other impact via vectors that trigger an out-of-     bounds write operation. (CVE-2015-1215)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 41.0.2272.76. It is, therefore, affected by multiple vulnerabilities as referenced in the 2015_03_stable-channel-update advisory.

  - Multiple use-after-free vulnerabilities in core/html/HTMLInputElement.cpp in the DOM implementation in     Blink, as used in Google Chrome before 41.0.2272.76, allow remote attackers to cause a denial of service     or possibly have unspecified other impact via vectors that trigger extraneous change events, as     demonstrated by events for invalid input or input to read-only fields, related to the     initializeTypeInParsing and updateType functions. (CVE-2015-1223)

  - Array index error in the MidiManagerUsb::DispatchSendMidiData function in media/midi/midi_manager_usb.cc     in Google Chrome before 41.0.2272.76 allows remote attackers to cause a denial of service or possibly have     unspecified other impact by leveraging renderer access to provide an invalid port index that triggers an     out-of-bounds write operation, a different vulnerability than CVE-2015-1212. (CVE-2015-1232)

  - The SkBitmap::ReadRawPixels function in core/SkBitmap.cpp in the filters implementation in Skia, as used     in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly     have unspecified other impact via vectors that trigger an out-of-bounds write operation. (CVE-2015-1213)

  - Integer overflow in the SkAutoSTArray implementation in include/core/SkTemplates.h in the filters     implementation in Skia, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a     denial of service or possibly have unspecified other impact via vectors that trigger a reset action with a     large count value, leading to an out-of-bounds write operation. (CVE-2015-1214)

  - The filters implementation in Skia, as used in Google Chrome before 41.0.2272.76, allows remote attackers     to cause a denial of service or possibly have unspecified other impact via vectors that trigger an out-of-     bounds write operation. (CVE-2015-1215)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
275869	Google Chrome < 4.1.0.21 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
275863	Google Chrome < 4.1.0.21 Multiple Vulnerabilities	Nessus	Windows	critical
82011	GLSA-201503-12 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
81662	RHEL 6 : chromium-browser (RHSA-2015:0627)	Nessus	Red Hat Local Security Checks	critical
81648	Google Chrome < 41.0.2272.76 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
81647	Google Chrome < 41.0.2272.76 Multiple Vulnerabilities	Nessus	Windows	critical

Detections

Analytics

CVE-2015-1232

critical

Tenable Plugins

critical

critical

high

critical

critical

critical