Heap-based buffer overflow in j2k.c in OpenJPEG before r3002, as used in PDFium in Google Chrome before 44.0.2403.89, allows remote attackers to cause a denial of service or possibly have unspecified other impact via invalid JPEG2000 data in a PDF document.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Heap-based buffer overflow in j2k.c in OpenJPEG before r3002, as used in PDFium in Google Chrome before     44.0.2403.89, allows remote attackers to cause a denial of service or possibly have unspecified other     impact via invalid JPEG2000 data in a PDF document. (CVE-2015-1273)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host is affected by the vulnerability described in GLSA-201603-09 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in the Chromium web       browser. Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information, or bypass security restrictions.
  Workaround :

    There is no known workaround at this time.

The version of Google Chrome installed on the remote Windows host is prior to 45.0.2454.85 and is affected by multiple vulnerabilities :

 - A cross-origin bypass vulnerability exists due to a flaw in the 'ContainerNode::parserRemoveChild()' function in 'ContainerNode.cpp' wherein user scripts may unexpectedly run in 'onunload' handlers during Document Object Model (DOM) modification. A remote attacker can exploit this, via a specially crafted web page, to bypass cross-origin restrictions. (CVE-2015-1291)
 - A cross-origin bypass vulnerability exists due to a flaw in the 'LocalDOMWindow::navigator()' function in 'LocalDOMWindow.cpp' wherein an incorrect navigator associated with a frame may be returned. A remote attacker can exploit this, via a specially crafted web page, to bypass cross-origin restrictions. (CVE-2015-1292)
 - An unspecified cross-origin bypass vulnerability exists that allows a remote attacker, via a specially crafted web page, to bypass cross-origin restrictions. (CVE-2015-1293)
 - A use-after-free error exists in the 'SkMatrix::invertNonIdentity()' function in 'SkMatrix.cpp'. A remote attacker can exploit this to dereference already freed memory, potentially resulting in the execution of arbitrary code. (CVE-2015-1294)
 - A use-after-free error exists in 'print_web_view_helper.cc' that is triggered when handling nested IPC handlers. A remote attacker can exploit this to dereference already freed memory, potentially resulting in the execution of arbitrary code. (CVE-2015-1295)
 - A spoofing vulnerability exists due to a flaw that is triggered when displaying a URL containing certain characters in an omnibox. A remote attacker can exploit this to include characters that may look like a padlock, spoofing a secure connection. (CVE-2015-1296)
 - An unspecified flaw exists related to permission scoping as requests in an extension are not hidden from other extensions. (CVE-2015-1297)
 - An unspecified URL handling issue exists as the URL to be opened after an extension is uninstalled is not restricted to HTTP and HTTPS. (CVE-2015-1298)
 - A use-after-free error exists due to improper validation of user-supplied input. A remote attacker can exploit this to dereference already freed memory, potentially resulting in the execution of arbitrary code. (CVE-2015-1299)
 - An unspecified information disclosure vulnerability exists in Blink. (CVE-2015-1300)
 - Multiple unspecified flaws exist that allow an attacker to have unspecified medium severity impact. (CVE-2015-1301)
 - A flaw in Google V8 affects 'heap/heap.cc' when handling background tab heap growing. This may allow a context-dependent attacker to have an unspecified impact. (CVE-2015-6580)
 - The decompose function in 'platform/transforms/TransformationMatrix.cpp' in Blink does not verify that a matrix inversion succeeded, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted web site. (CVE-2015-6582)
 - A location bar is not displayed for a hosted app's window after navigation away from the installation site, which might make it easier for remote attackers to spoof content via a crafted app, related to 'browser.cc' and 'hosted_app_browser_controller.cc'. (CVE-2015-6583)
 - OpenJPEG contains a double-free flaw in the opj_j2k_copy_default_tcp_and_create_tcp() function in 'lib/openjp2/j2k.c'. This may allow a context-dependent attacker to crash an application linked against the library or potentially execute arbitrary code. This issue was originally reported as fixed in Google Chrome version 44.0.2403.89 as part of bug 459215. However, it was later reported as fixed in version 45.0.2454.85. (CVE-2015-1273, CVE-2015-1301, CVE-2015-6581)

Updated chromium-browser packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Chromium is an open source web browser, powered by WebKit (Blink).

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash or, potentially, execute arbitrary code with the privileges of the user running Chromium. (CVE-2015-1271, CVE-2015-1270, CVE-2015-1272, CVE-2015-1273, CVE-2015-1274, CVE-2015-1276, CVE-2015-1277, CVE-2015-1278, CVE-2015-1279, CVE-2015-1281, CVE-2015-1282, CVE-2015-1283, CVE-2015-1284, CVE-2015-1285, CVE-2015-1286, CVE-2015-1287, CVE-2015-1288, CVE-2015-1289, CVE-2015-5605)

All Chromium users should upgrade to these updated packages, which contain Chromium version 44.0.2403.89, which corrects these issues.
After installing the update, Chromium must be restarted for the changes to take effect.

Chromium was updated to 44.0.2403.89 to fix multiple security issues.

The following vulnerabilities were fixed :

  - CVE-2015-1271: Heap-buffer-overflow in pdfium

  - CVE-2015-1273: Heap-buffer-overflow in pdfium

  - CVE-2015-1274: Settings allowed executable files to run     immediately after download

  - CVE-2015-1275: UXSS in Chrome for Android

  - CVE-2015-1276: Use-after-free in IndexedDB

  - CVE-2015-1279: Heap-buffer-overflow in pdfium

  - CVE-2015-1280: Memory corruption in skia

  - CVE-2015-1281: CSP bypass

  - CVE-2015-1282: Use-after-free in pdfium

  - CVE-2015-1283: Heap-buffer-overflow in expat

  - CVE-2015-1284: Use-after-free in blink

  - CVE-2015-1286: UXSS in blink

  - CVE-2015-1287: SOP bypass with CSS

  - CVE-2015-1270: Uninitialized memory read in ICU

  - CVE-2015-1272: Use-after-free related to unexpected GPU     process termination

  - CVE-2015-1277: Use-after-free in accessibility

  - CVE-2015-1278: URL spoofing using pdf files

  - CVE-2015-1285: Information leak in XSS auditor

  - CVE-2015-1288: Spell checking dictionaries fetched over     HTTP

  - CVE-2015-1289: Various fixes from internal audits,     fuzzing and other initiatives

  - CVE-2015-5605: Rgular-expression implementation     mishandles interrupts, DoS via JS

The following non-security changes are included :

  - A number of new apps/extension APIs

  - Lots of under the hood changes for stability and     performance

  - Pepper Flash plugin updated to 18.0.0.209

Google Chrome Releases reports :

43 security fixes in this release, including :

- [446032] High CVE-2015-1271: Heap-buffer-overflow in pdfium. Credit to cloudfuzzer.

- [459215] High CVE-2015-1273: Heap-buffer-overflow in pdfium. Credit to makosoft.

- [461858] High CVE-2015-1274: Settings allowed executable files to run immediately after download. Credit to andrewm.bpi.

- [462843] High CVE-2015-1275: UXSS in Chrome for Android. Credit to WangTao(neobyte) of Baidu X-Team.

- [472614] High CVE-2015-1276: Use-after-free in IndexedDB. Credit to Collin Payne.

- [483981] High CVE-2015-1279: Heap-buffer-overflow in pdfium. Credit to mlafon.

- [486947] High CVE-2015-1280: Memory corruption in skia. Credit to cloudfuzzer.

- [487155] High CVE-2015-1281: CSP bypass. Credit to Masato Kinugawa.

- [487928] High CVE-2015-1282: Use-after-free in pdfium. Credit to Chamal de Silva.

- [492052] High CVE-2015-1283: Heap-buffer-overflow in expat. Credit to sidhpurwala.huzaifa.

- [493243] High CVE-2015-1284: Use-after-free in blink. Credit to Atte Kettunen of OUSPG.

- [504011] High CVE-2015-1286: UXSS in blink. Credit to anonymous.

- [505374] High CVE-2015-1290: Memory corruption in V8. Credit to Yongjun Liu of NSFOCUS Security Team.

- [419383] Medium CVE-2015-1287: SOP bypass with CSS. Credit to filedescriptor.

- [444573] Medium CVE-2015-1270: Uninitialized memory read in ICU.
Credit to Atte Kettunen of OUSPG.

- [451456] Medium CVE-2015-1272: Use-after-free related to unexpected GPU process termination. Credit to Chamal de Silva.

- [479743] Medium CVE-2015-1277: Use-after-free in accessibility.
Credit to SkyLined.

- [482380] Medium CVE-2015-1278: URL spoofing using pdf files. Credit to Chamal de Silva.

- [498982] Medium CVE-2015-1285: Information leak in XSS auditor.
Credit to gazheyes.

- [479162] Low CVE-2015-1288: Spell checking dictionaries fetched over HTTP. Credit to mike@michaelruddy.com.

- [512110] CVE-2015-1289: Various fixes from internal audits, fuzzing and other initiatives.

Several vulnerabilities were discovered in the chromium web browser.

  - CVE-2015-1266     Intended access restrictions could be bypassed for     certain URLs like chrome://gpu.

  - CVE-2015-1267     A way to bypass the Same Origin Policy was discovered.

  - CVE-2015-1268     Mariusz Mlynski also discovered a way to bypass the Same     Origin Policy.

  - CVE-2015-1269     Mike Rudy discovered that hostnames were not properly     compared in the HTTP Strict Transport Policy and HTTP     Public Key Pinning features, which could allow those     access restrictions to be bypassed.

  - CVE-2015-1270     Atte Kettunen discovered an uninitialized memory read in     the ICU library.

  - CVE-2015-1271     cloudfuzzer discovered a buffer overflow in the pdfium     library.

  - CVE-2015-1272     Chamal de Silva discovered race conditions in the GPU     process implementation.

  - CVE-2015-1273     makosoft discovered a buffer overflow in openjpeg, which     is used by the pdfium library embedded in chromium.

  - CVE-2015-1274     andrewm.bpi discovered that the auto-open list allowed     certain file types to be executed immediately after     download.

  - CVE-2015-1276     Colin Payne discovered a use-after-free issue in the     IndexedDB implementation.

  - CVE-2015-1277     SkyLined discovered a use-after-free issue in chromium's     accessibility implementation.

  - CVE-2015-1278     Chamal de Silva discovered a way to use PDF documents to     spoof a URL.

  - CVE-2015-1279     mlafon discovered a buffer overflow in the pdfium     library.

  - CVE-2015-1280     cloudfuzzer discovered a memory corruption issue in the     SKIA library.

  - CVE-2015-1281     Masato Knugawa discovered a way to bypass the Content     Security Policy.

  - CVE-2015-1282     Chamal de Silva discovered multiple use-after-free     issues in the pdfium library.

  - CVE-2015-1283     Huzaifa Sidhpurwala discovered a buffer overflow in the     expat library.

  - CVE-2015-1284     Atte Kettunen discovered that the maximum number of page     frames was not correctly checked.

  - CVE-2015-1285     gazheyes discovered an information leak in the XSS     auditor, which normally helps to prevent certain classes     of cross-site scripting problems.

  - CVE-2015-1286     A cross-site scripting issue was discovered in the     interface to the v8 JavaScript library.

  - CVE-2015-1287     filedescriptor discovered a way to bypass the Same     Origin Policy.

  - CVE-2015-1288     Mike Ruddy discovered that the spellchecking     dictionaries could still be downloaded over plain HTTP     (related to CVE-2015-1263 ).

  - CVE-2015-1289     The chrome 44 development team found and fixed various     issues during internal auditing.

In addition to the above issues, Google disabled the hotword extension by default in this version, which if enabled downloads files without the user's intervention.

The version of Google Chrome installed on the remote macOS host is prior to 44.0.2403.89. It is, therefore, affected by multiple vulnerabilities as referenced in the 2015_07_stable-channel-update_21 advisory.

  - The Google V8 engine, as used in Google Chrome before 44.0.2403.89 and QtWebEngineCore in Qt before 5.5.1,     allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a     crafted web site. (CVE-2015-1290)

  - Use-after-free vulnerability in content/browser/indexed_db/indexed_db_backing_store.cc in the IndexedDB     implementation in Google Chrome before 44.0.2403.89 allows remote attackers to cause a denial of service     or possibly have unspecified other impact by leveraging an abort action before a certain write operation.
    (CVE-2015-1276)

  - PDFium, as used in Google Chrome before 44.0.2403.89, does not properly handle certain out-of-memory     conditions, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or     possibly have unspecified other impact via a crafted PDF document that triggers a large memory allocation.
    (CVE-2015-1271)

  - Heap-based buffer overflow in j2k.c in OpenJPEG before r3002, as used in PDFium in Google Chrome before     44.0.2403.89, allows remote attackers to cause a denial of service or possibly have unspecified other     impact via invalid JPEG2000 data in a PDF document. (CVE-2015-1273)

  - Google Chrome before 44.0.2403.89 does not ensure that the auto-open list omits all dangerous file types,     which makes it easier for remote attackers to execute arbitrary code by providing a crafted file and     leveraging a user's previous Always open files of this type choice, related to download_commands.cc and     download_prefs.cc. (CVE-2015-1274)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 44.0.2403.89. It is, therefore, affected by multiple vulnerabilities as referenced in the 2015_07_stable-channel-update_21 advisory.

  - The Google V8 engine, as used in Google Chrome before 44.0.2403.89 and QtWebEngineCore in Qt before 5.5.1,     allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a     crafted web site. (CVE-2015-1290)

  - Use-after-free vulnerability in content/browser/indexed_db/indexed_db_backing_store.cc in the IndexedDB     implementation in Google Chrome before 44.0.2403.89 allows remote attackers to cause a denial of service     or possibly have unspecified other impact by leveraging an abort action before a certain write operation.
    (CVE-2015-1276)

  - PDFium, as used in Google Chrome before 44.0.2403.89, does not properly handle certain out-of-memory     conditions, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or     possibly have unspecified other impact via a crafted PDF document that triggers a large memory allocation.
    (CVE-2015-1271)

  - Heap-based buffer overflow in j2k.c in OpenJPEG before r3002, as used in PDFium in Google Chrome before     44.0.2403.89, allows remote attackers to cause a denial of service or possibly have unspecified other     impact via invalid JPEG2000 data in a PDF document. (CVE-2015-1273)

  - Google Chrome before 44.0.2403.89 does not ensure that the auto-open list omits all dangerous file types,     which makes it easier for remote attackers to execute arbitrary code by providing a crafted file and     leveraging a user's previous Always open files of this type choice, related to download_commands.cc and     download_prefs.cc. (CVE-2015-1274)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
251835	Linux Distros Unpatched Vulnerability : CVE-2015-1273	Nessus	Misc.	Local	high
89902	GLSA-201603-09 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	critical
8854	Google Chrome < 45.0.2454.85 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients		high
85039	RHEL 6 : chromium-browser (RHSA-2015:1499)	Nessus	Red Hat Local Security Checks	Local	critical
85003	openSUSE Security Update : Chromium (openSUSE-2015-513)	Nessus	SuSE Local Security Checks	Local	critical
84994	FreeBSD : chromium -- multiple vulnerabilities (9d732078-32c7-11e5-b263-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	Local	critical
84992	Debian DSA-3315-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	Local	critical
84922	Google Chrome < 44.0.2403.89 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	Local	critical
84921	Google Chrome < 44.0.2403.89 Multiple Vulnerabilities	Nessus	Windows	Local	critical

Detections

Analytics

CVE-2015-1273

high

Tenable Plugins

high

critical

high

critical

critical

critical

critical

critical

critical