Array index error in the MidiManagerUsb::DispatchSendMidiData function in media/midi/midi_manager_usb.cc in Google Chrome before 41.0.2272.76 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging renderer access to provide an invalid port index that triggers an out-of-bounds write operation, a different vulnerability than CVE-2015-1212.

The remote host is affected by the vulnerability described in GLSA-201503-12 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to cause a Denial of Service condition,       bypass security restrictions, or have other unspecified impact.
  Workaround :

    There is no known workaround at this time.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2015:0627 advisory.

    Chromium is an open-source web browser, powered by WebKit (Blink).

    Several flaws were found in the processing of malformed web content. A web     page containing malicious content could cause Chromium to crash or,     potentially, execute arbitrary code with the privileges of the user running     Chromium. (CVE-2015-1213, CVE-2015-1214, CVE-2015-1215, CVE-2015-1216,     CVE-2015-1217, CVE-2015-1218, CVE-2015-1219, CVE-2015-1220, CVE-2015-1221,     CVE-2015-1222, CVE-2015-1223, CVE-2015-1224, CVE-2015-1225, CVE-2015-1226,     CVE-2015-1227, CVE-2015-1228, CVE-2015-1229, CVE-2015-1230, CVE-2015-1231)

    All Chromium users should upgrade to these updated packages, which contain     Chromium version 41.0.2272.76, which corrects these issues. After     installing the update, Chromium must be restarted for the changes to take     effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Mac OS X host is prior to 41.0.2272.76. It is, therefore, affected by the following vulnerabilities :

  - A security feature bypass vulnerability, known as FREAK     (Factoring attack on RSA-EXPORT Keys), exists due to     the support of weak EXPORT_RSA cipher suites with keys     less than or equal to 512 bits. A man-in-the-middle     attacker may be able to downgrade the SSL/TLS connection     to use EXPORT_RSA cipher suites which can be factored in     a short amount of time, allowing the attacker to     intercept and decrypt the traffic. (CVE-2015-0204)

  - Multiple out-of-bounds write errors exist in skia     filters and media. (CVE-2015-1212, CVE-2015-1213,     CVE-2015-1214, CVE-2015-1215)

  - Multiple use-after-free errors exist in v8 bindings,     DOM, GIF decoder, web databases, and service workers,     which allow arbitrary code execution. (CVE-2015-1216,     CVE-2015-1218, CVE-2015-1220, CVE-2015-1221,     CVE-2015-1222, CVE-2015-1223)

  - Multiple type confusion errors exist in v8 bindings that     allow arbitrary code execution. (CVE-2015-1217,     CVE-2015-1230)

  - An integer overflow error exists in the WebGL that     allows arbitrary code execution. (CVE-2015-1219)

  - Multiple out-of-bounds read errors exist in vpxdecoder     and pdfium that allow unauthorized access to     information. (CVE-2015-1224, CVE-2015-1225)

  - A validation error exists in the debugger.
    (CVE-2015-1226)

  - Multiple uninitialized value errors exist in blink and     rendering. (CVE-2015-1227, CVE-2015-1228)

  - A cookie-injection vulnerability exists due to a failure     to properly handle a 407 HTTP status code accompanied by     a Set-Cookie header. (CVE-2015-1229)

  - Multiple, unspecified errors exist that allow remote     attackers to cause a denial of service condition.
    (CVE-2015-1231)

  - An out-of-bounds write flaw exists due to an array index     error in the DispatchSendMidiData() function that occurs     when handling a port index supplied by a renderer. A     remote attacker can exploit this to cause a denial of     service condition. (CVE-2015-1232)

  - A spoofing vulnerability exists due to improper     interaction between the '1993 search' features and     restore-from-disk RELOAD transitions when Instant     Extended mode is used. A remote attacker can exploit     this to spoof the address bar for a search-results page.
    (CVE-2015-2239)

The version of Google Chrome installed on the remote Windows host is prior to 41.0.2272.76. It is, therefore, affected by the following vulnerabilities :

  - Multiple out-of-bounds write errors exist in skia     filters and media. (CVE-2015-1212, CVE-2015-1213,     CVE-2015-1214, CVE-2015-1215)

  - Multiple use-after-free errors exist in v8 bindings,     DOM, GIF decoder, web databases, and service workers,     which allow arbitrary code execution. (CVE-2015-1216,     CVE-2015-1218, CVE-2015-1220, CVE-2015-1221,     CVE-2015-1222, CVE-2015-1223)

  - Multiple type confusion errors exist in v8 bindings that     allow arbitrary code execution. (CVE-2015-1217,     CVE-2015-1230)

  - An integer overflow error exists in the WebGL that     allows arbitrary code execution. (CVE-2015-1219)

  - Multiple out-of-bounds read errors exist in vpxdecoder     and pdfium that allow unauthorized access to     information. (CVE-2015-1224, CVE-2015-1225)

  - A validation error exists in the debugger.
    (CVE-2015-1226)

  - Multiple uninitialized value errors exist in blink and     rendering. (CVE-2015-1227, CVE-2015-1228)

  - A cookie-injection vulnerability exists due to a failure     to properly handle a 407 HTTP status code accompanied by     a Set-Cookie header. (CVE-2015-1229)

  - Multiple, unspecified errors exist that allow remote     attackers to cause a denial of service condition.
    (CVE-2015-1231)

  - An out-of-bounds write flaw exists due to an array index     error in the DispatchSendMidiData() function that occurs     when handling a port index supplied by a renderer. A     remote attacker can exploit this to cause a denial of     service condition. (CVE-2015-1232)

  - A spoofing vulnerability exists due to improper     interaction between the '1993 search' features and     restore-from-disk RELOAD transitions when Instant     Extended mode is used. A remote attacker can exploit     this to spoof the address bar for a search-results page.
    (CVE-2015-2239

ID	Name	Product	Family	Severity
82011	GLSA-201503-12 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
81662	RHEL 6 : chromium-browser (RHSA-2015:0627)	Nessus	Red Hat Local Security Checks	critical
81648	Google Chrome < 41.0.2272.76 Multiple Vulnerabilities (Mac OS X) (FREAK)	Nessus	MacOS X Local Security Checks	high
81647	Google Chrome < 41.0.2272.76 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2015-1232

critical

Tenable Plugins

high

critical

high

high