core/html/parser/HTMLConstructionSite.cpp in the DOM implementation in Blink, as used in Google Chrome before 43.0.2357.65, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code that appends a child to a SCRIPT element, related to the insert and executeReparentTask functions.

The version of Google Chrome installed on the remote macOS host is prior to 4.3.61.21. It is, therefore, affected by multiple vulnerabilities as referenced in the 2015_05_stable-channel-update_19 advisory.

  - Multiple unspecified vulnerabilities in Google Chrome before 43.0.2357.65 allow attackers to cause a     denial of service or possibly have other impact via unknown vectors. (CVE-2015-1265)

  - Multiple use-after-free vulnerabilities in content/renderer/media/user_media_client_impl.cc in the WebRTC     implementation in Google Chrome before 43.0.2357.65 allow remote attackers to cause a denial of service or     possibly have unspecified other impact via crafted JavaScript code that executes upon completion of a     getUserMedia request. (CVE-2015-1260)

  - common/partial_circular_buffer.cc in Google Chrome before 43.0.2357.65 does not properly handle wraps,     which allows remote attackers to bypass a sandbox protection mechanism or cause a denial of service (out-     of-bounds write) via vectors that trigger a write operation with a large amount of data, related to the     PartialCircularBuffer::Write and PartialCircularBuffer::DoWrite functions. (CVE-2015-1252)

  - core/html/parser/HTMLConstructionSite.cpp in the DOM implementation in Blink, as used in Google Chrome     before 43.0.2357.65, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code     that appends a child to a SCRIPT element, related to the insert and executeReparentTask functions.
    (CVE-2015-1253)

  - core/dom/Document.cpp in Blink, as used in Google Chrome before 43.0.2357.65, enables the inheritance of     the designMode attribute, which allows remote attackers to bypass the Same Origin Policy by leveraging the     availability of editing. (CVE-2015-1254)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 4.3.61.21. It is, therefore, affected by multiple vulnerabilities as referenced in the 2015_05_stable-channel-update_19 advisory.

  - Multiple unspecified vulnerabilities in Google Chrome before 43.0.2357.65 allow attackers to cause a     denial of service or possibly have other impact via unknown vectors. (CVE-2015-1265)

  - Multiple use-after-free vulnerabilities in content/renderer/media/user_media_client_impl.cc in the WebRTC     implementation in Google Chrome before 43.0.2357.65 allow remote attackers to cause a denial of service or     possibly have unspecified other impact via crafted JavaScript code that executes upon completion of a     getUserMedia request. (CVE-2015-1260)

  - common/partial_circular_buffer.cc in Google Chrome before 43.0.2357.65 does not properly handle wraps,     which allows remote attackers to bypass a sandbox protection mechanism or cause a denial of service (out-     of-bounds write) via vectors that trigger a write operation with a large amount of data, related to the     PartialCircularBuffer::Write and PartialCircularBuffer::DoWrite functions. (CVE-2015-1252)

  - core/html/parser/HTMLConstructionSite.cpp in the DOM implementation in Blink, as used in Google Chrome     before 43.0.2357.65, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code     that appends a child to a SCRIPT element, related to the insert and executeReparentTask functions.
    (CVE-2015-1253)

  - core/dom/Document.cpp in Blink, as used in Google Chrome before 43.0.2357.65, enables the inheritance of     the designMode attribute, which allows remote attackers to bypass the Same Origin Policy by leveraging the     availability of editing. (CVE-2015-1254)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201506-04 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker can cause arbitrary remote code execution, Denial of       Service or bypass of security mechanisms.
  Workaround :

    There is no known workaround at this time.

Chromium was updated to 43.0.2357.65 to fix security issues and bugs.

The following vulnerabilities were fixed :

  - CVE-2015-1251: Use-after-free in Speech (boo#931659)

  - CVE-2015-1252: Sandbox escape in Chrome (boo#931671)

  - CVE-2015-1253: Cross-origin bypass in DOM (boo#931670)

  - CVE-2015-1254: Cross-origin bypass in Editing     (boo#931669)

  - CVE-2015-1255: Use-after-free in WebAudio (boo#931674)

  - CVE-2015-1256: Use-after-free in SVG (boo#931664)

  - CVE-2015-1257: Container-overflow in SVG (boo#931665)

  - CVE-2015-1258: Negative-size parameter in Libvpx     (boo#931666)

  - CVE-2015-1259: Uninitialized value in PDFium     (boo#931667)

  - CVE-2015-1260: Use-after-free in WebRTC (boo#931668)

  - CVE-2015-1261: URL bar spoofing (boo#931673)

  - CVE-2015-1262: Uninitialized value in Blink (boo#931672)

  - CVE-2015-1263: Insecure download of spellcheck     dictionary (boo#931663)

  - CVE-2015-1264: Cross-site scripting in bookmarks     (boo#931661)

  - CVE-2015-1265: Various fixes from internal audits,     fuzzing and other initiatives (boo#931660)

  - Multiple vulnerabilities in V8 fixed at the tip of the     4.3 branch (currently 4.3.61.21)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2015:1023 advisory.

    Chromium is an open-source web browser, powered by WebKit (Blink).

    Several flaws were found in the processing of malformed web content. A web     page containing malicious content could cause Chromium to crash or,     potentially, execute arbitrary code with the privileges of the user running     Chromium. (CVE-2015-1251, CVE-2015-1252, CVE-2015-1253, CVE-2015-1254,     CVE-2015-1255, CVE-2015-1256, CVE-2015-1257, CVE-2015-1258, CVE-2015-1259,     CVE-2015-1260, CVE-2015-1261, CVE-2015-1262, CVE-2015-1263, CVE-2015-1264,     CVE-2015-1265)

    All Chromium users should upgrade to these updated packages, which contain     Chromium version 43.0.2357.65, which corrects these issues. After     installing the update, Chromium must be restarted for the changes to take     effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities were discovered in the chromium web browser.

  - CVE-2015-1251     SkyLined discovered a use-after-free issue in speech     recognition.

  - CVE-2015-1252     An out-of-bounds write issue was discovered that could     be used to escape from the sandbox.

  - CVE-2015-1253     A cross-origin bypass issue was discovered in the DOM     parser.

  - CVE-2015-1254     A cross-origin bypass issue was discovered in the DOM     editing feature.

  - CVE-2015-1255     Khalil Zhani discovered a use-after-free issue in     WebAudio.

  - CVE-2015-1256     Atte Kettunen discovered a use-after-free issue in the     SVG implementation.

  - CVE-2015-1257     miaubiz discovered an overflow issue in the SVG     implementation.

  - CVE-2015-1258     cloudfuzzer discovered an invalid size parameter used in     the libvpx library.

  - CVE-2015-1259     Atte Kettunen discovered an uninitialized memory issue     in the pdfium library.

  - CVE-2015-1260     Khalil Zhani discovered multiple use-after-free issues     in chromium's interface to the WebRTC library.

  - CVE-2015-1261     Juho Nurminen discovered a URL bar spoofing issue.

  - CVE-2015-1262     miaubiz discovered the use of an uninitialized class     member in font handling.

  - CVE-2015-1263     Mike Ruddy discovered that downloading the spellcheck     dictionary was not done over HTTPS.

  - CVE-2015-1264     K0r3Ph1L discovered a cross-site scripting issue that     could be triggered by bookmarking a site.

  - CVE-2015-1265     The chrome 43 development team found and fixed various     issues during internal auditing. Also multiple issues     were fixed in the libv8 library, version 4.3.61.21.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2610-1 advisory.

    Several security issues were discovered in the DOM implementation in Blink. If a user were tricked in to     opening a specially crafted website, an attacker could potentially exploit these to bypass Same Origin     Policy restrictions. (CVE-2015-1253, CVE-2015-1254)

    A use-after-free was discovered in the WebAudio implementation in Chromium. If a user were tricked in to     opening a specially crafted website, an attacker could potentially exploit this to cause a denial of     service via renderer crash, or execute arbitrary code with the privileges of the sandboxed render process.
    (CVE-2015-1255)

    A use-after-free was discovered in the SVG implementation in Blink. If a user were tricked in to opening a     specially crafted website, an attacker could potentially exploit this to cause a denial of service via     renderer crash, or execute arbitrary code with the privileges of the sandboxed render process.
    (CVE-2015-1256)

    A security issue was discovered in the SVG implementation in Blink. If a user were tricked in to opening a     specially crafted website, an attacker could potentially exploit this to cause a denial of service via     renderer crash. (CVE-2015-1257)

    An issue was discovered with the build of libvpx. If a user were tricked in to opening a specially crafted     website, an attacker could potentially exploit this to cause a denial of service via renderer crash, or     execute arbitrary code with the privileges of the sandboxed render process. (CVE-2015-1258)

    Multiple use-after-free issues were discovered in the WebRTC implementation in Chromium. If a user were     tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a     denial of service via renderer crash, or execute arbitrary code with the privileges of the sandboxed     render process. (CVE-2015-1260)

    An uninitialized value bug was discovered in the font shaping code in Blink. If a user were tricked in to     opening a specially crafted website, an attacker could potentially exploit this to cause a denial of     service via renderer crash. (CVE-2015-1262)

    Multiple security issues were discovered in Chromium. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial     of service via application crash or execute arbitrary code with the privileges of the user invoking the     program. (CVE-2015-1265)

    Multiple security issues were discovered in V8. If a user were tricked in to opening a specially crafted     website, an attacker could potentially exploit these to read uninitialized memory, cause a denial of     service via renderer crash or execute arbitrary code with the privileges of the sandboxed render process.
    (CVE-2015-3910)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote macOS host is prior to 43.0.2357.65. It is, therefore, affected by multiple vulnerabilities as referenced in the 2015_05_stable-channel-update_19 advisory.

  - Multiple unspecified vulnerabilities in Google Chrome before 43.0.2357.65 allow attackers to cause a     denial of service or possibly have other impact via unknown vectors. (CVE-2015-1265)

  - Multiple use-after-free vulnerabilities in content/renderer/media/user_media_client_impl.cc in the WebRTC     implementation in Google Chrome before 43.0.2357.65 allow remote attackers to cause a denial of service or     possibly have unspecified other impact via crafted JavaScript code that executes upon completion of a     getUserMedia request. (CVE-2015-1260)

  - common/partial_circular_buffer.cc in Google Chrome before 43.0.2357.65 does not properly handle wraps,     which allows remote attackers to bypass a sandbox protection mechanism or cause a denial of service (out-     of-bounds write) via vectors that trigger a write operation with a large amount of data, related to the     PartialCircularBuffer::Write and PartialCircularBuffer::DoWrite functions. (CVE-2015-1252)

  - core/html/parser/HTMLConstructionSite.cpp in the DOM implementation in Blink, as used in Google Chrome     before 43.0.2357.65, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code     that appends a child to a SCRIPT element, related to the insert and executeReparentTask functions.
    (CVE-2015-1253)

  - core/dom/Document.cpp in Blink, as used in Google Chrome before 43.0.2357.65, enables the inheritance of     the designMode attribute, which allows remote attackers to bypass the Same Origin Policy by leveraging the     availability of editing. (CVE-2015-1254)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 43.0.2357.65. It is, therefore, affected by multiple vulnerabilities as referenced in the 2015_05_stable-channel-update_19 advisory.

  - Multiple unspecified vulnerabilities in Google Chrome before 43.0.2357.65 allow attackers to cause a     denial of service or possibly have other impact via unknown vectors. (CVE-2015-1265)

  - Multiple use-after-free vulnerabilities in content/renderer/media/user_media_client_impl.cc in the WebRTC     implementation in Google Chrome before 43.0.2357.65 allow remote attackers to cause a denial of service or     possibly have unspecified other impact via crafted JavaScript code that executes upon completion of a     getUserMedia request. (CVE-2015-1260)

  - common/partial_circular_buffer.cc in Google Chrome before 43.0.2357.65 does not properly handle wraps,     which allows remote attackers to bypass a sandbox protection mechanism or cause a denial of service (out-     of-bounds write) via vectors that trigger a write operation with a large amount of data, related to the     PartialCircularBuffer::Write and PartialCircularBuffer::DoWrite functions. (CVE-2015-1252)

  - core/html/parser/HTMLConstructionSite.cpp in the DOM implementation in Blink, as used in Google Chrome     before 43.0.2357.65, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code     that appends a child to a SCRIPT element, related to the insert and executeReparentTask functions.
    (CVE-2015-1253)

  - core/dom/Document.cpp in Blink, as used in Google Chrome before 43.0.2357.65, enables the inheritance of     the designMode attribute, which allows remote attackers to bypass the Same Origin Policy by leveraging the     availability of editing. (CVE-2015-1254)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Google Chrome Releases reports :

37 security fixes in this release, including :

- [474029] High CVE-2015-1252: Sandbox escape in Chrome. Credit to anonymous.

- [464552] High CVE-2015-1253: Cross-origin bypass in DOM. Credit to anonymous.

- [444927] High CVE-2015-1254: Cross-origin bypass in Editing. Credit to armin@rawsec.net.

- [473253] High CVE-2015-1255: Use-after-free in WebAudio. Credit to Khalil Zhani.

- [478549] High CVE-2015-1256: Use-after-free in SVG. Credit to Atte Kettunen of OUSPG.

- [481015] High CVE-2015-1251: Use-after-free in Speech. Credit to SkyLined working with HP's Zero Day Initiative.

- [468519] Medium CVE-2015-1257: Container-overflow in SVG. Credit to miaubiz.

- [450939] Medium CVE-2015-1258: Negative-size parameter in libvpx.
Credit to cloudfuzzer

- [468167] Medium CVE-2015-1259: Uninitialized value in PDFium. Credit to Atte Kettunen of OUSPG

- [474370] Medium CVE-2015-1260: Use-after-free in WebRTC. Credit to Khalil Zhani.

- [466351] Medium CVE-2015-1261: URL bar spoofing. Credit to Juho Nurminen.

- [476647] Medium CVE-2015-1262: Uninitialized value in Blink. Credit to miaubiz.

- [479162] Low CVE-2015-1263: Insecure download of spellcheck dictionary. Credit to Mike Ruddy.

- [481015] Low CVE-2015-1264: Cross-site scripting in bookmarks.
Credit to K0r3Ph1L.

- [489518] CVE-2015-1265: Various fixes from internal audits, fuzzing and other initiatives.

- Multiple vulnerabilities in V8 fixed at the tip of the 4.3 branch (currently 4.3.61.21).

ID	Name	Product	Family	Severity
276618	Google Chrome < 4.3.61.21 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
276611	Google Chrome < 4.3.61.21 Multiple Vulnerabilities	Nessus	Windows	critical
84332	GLSA-201506-04 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
83915	openSUSE Security Update : Chromium (openSUSE-2015-390)	Nessus	SuSE Local Security Checks	high
83808	RHEL 6 : chromium-browser (RHSA-2015:1023)	Nessus	Red Hat Local Security Checks	medium
83784	Debian DSA-3267-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	high
83778	Ubuntu 14.04 LTS : Oxide vulnerabilities (USN-2610-1)	Nessus	Ubuntu Local Security Checks	high
83746	Google Chrome < 43.0.2357.65 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
83745	Google Chrome < 43.0.2357.65 Multiple Vulnerabilities	Nessus	Windows	critical
83556	FreeBSD : chromium -- multiple vulnerabilities (a9d456b4-fe4c-11e4-ad15-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2015-1253

high

Tenable Plugins

critical

critical

high

high

medium

high

high

critical

critical

high