The Google V8 engine, as used in Google Chrome before 44.0.2403.89 and QtWebEngineCore in Qt before 5.5.1, allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a crafted web site.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The Google V8 engine, as used in Google Chrome before 44.0.2403.89 and QtWebEngineCore in Qt before 5.5.1,     allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a     crafted web site. (CVE-2015-1290)

Note that Nessus relies on the presence of the package as reported by the vendor.

Qt 5 was updated to the 5.5.1 release to deliver upstream improvements and fixes to Qt functionality.

The following Security fixes are contained in QtWebEngineCore :

  - ICU: CVE-2014-8146, CVE-2014-8147

  - Blink: CVE-2015-1284, CVE-2015-1291, CVE-2015-1292

  - Skia: CVE-2015-1294

  - V8: CVE-2015-1290

The following packages were rebuilt because they use private headers :

  - calibre

  - fcitx-qt5

  - frameworkintegration

  - kwayland

  - kwin5,

  - lxqt-powermanagement

  - lxqt-qtplugin

Google Chrome Releases reports :

43 security fixes in this release, including :

- [446032] High CVE-2015-1271: Heap-buffer-overflow in pdfium. Credit to cloudfuzzer.

- [459215] High CVE-2015-1273: Heap-buffer-overflow in pdfium. Credit to makosoft.

- [461858] High CVE-2015-1274: Settings allowed executable files to run immediately after download. Credit to andrewm.bpi.

- [462843] High CVE-2015-1275: UXSS in Chrome for Android. Credit to WangTao(neobyte) of Baidu X-Team.

- [472614] High CVE-2015-1276: Use-after-free in IndexedDB. Credit to Collin Payne.

- [483981] High CVE-2015-1279: Heap-buffer-overflow in pdfium. Credit to mlafon.

- [486947] High CVE-2015-1280: Memory corruption in skia. Credit to cloudfuzzer.

- [487155] High CVE-2015-1281: CSP bypass. Credit to Masato Kinugawa.

- [487928] High CVE-2015-1282: Use-after-free in pdfium. Credit to Chamal de Silva.

- [492052] High CVE-2015-1283: Heap-buffer-overflow in expat. Credit to sidhpurwala.huzaifa.

- [493243] High CVE-2015-1284: Use-after-free in blink. Credit to Atte Kettunen of OUSPG.

- [504011] High CVE-2015-1286: UXSS in blink. Credit to anonymous.

- [505374] High CVE-2015-1290: Memory corruption in V8. Credit to Yongjun Liu of NSFOCUS Security Team.

- [419383] Medium CVE-2015-1287: SOP bypass with CSS. Credit to filedescriptor.

- [444573] Medium CVE-2015-1270: Uninitialized memory read in ICU.
Credit to Atte Kettunen of OUSPG.

- [451456] Medium CVE-2015-1272: Use-after-free related to unexpected GPU process termination. Credit to Chamal de Silva.

- [479743] Medium CVE-2015-1277: Use-after-free in accessibility.
Credit to SkyLined.

- [482380] Medium CVE-2015-1278: URL spoofing using pdf files. Credit to Chamal de Silva.

- [498982] Medium CVE-2015-1285: Information leak in XSS auditor.
Credit to gazheyes.

- [479162] Low CVE-2015-1288: Spell checking dictionaries fetched over HTTP. Credit to mike@michaelruddy.com.

- [512110] CVE-2015-1289: Various fixes from internal audits, fuzzing and other initiatives.

The version of Google Chrome installed on the remote macOS host is prior to 44.0.2403.89. It is, therefore, affected by multiple vulnerabilities as referenced in the 2015_07_stable-channel-update_21 advisory.

  - The Google V8 engine, as used in Google Chrome before 44.0.2403.89 and QtWebEngineCore in Qt before 5.5.1,     allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a     crafted web site. (CVE-2015-1290)

  - Use-after-free vulnerability in content/browser/indexed_db/indexed_db_backing_store.cc in the IndexedDB     implementation in Google Chrome before 44.0.2403.89 allows remote attackers to cause a denial of service     or possibly have unspecified other impact by leveraging an abort action before a certain write operation.
    (CVE-2015-1276)

  - PDFium, as used in Google Chrome before 44.0.2403.89, does not properly handle certain out-of-memory     conditions, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or     possibly have unspecified other impact via a crafted PDF document that triggers a large memory allocation.
    (CVE-2015-1271)

  - Heap-based buffer overflow in j2k.c in OpenJPEG before r3002, as used in PDFium in Google Chrome before     44.0.2403.89, allows remote attackers to cause a denial of service or possibly have unspecified other     impact via invalid JPEG2000 data in a PDF document. (CVE-2015-1273)

  - Google Chrome before 44.0.2403.89 does not ensure that the auto-open list omits all dangerous file types,     which makes it easier for remote attackers to execute arbitrary code by providing a crafted file and     leveraging a user's previous Always open files of this type choice, related to download_commands.cc and     download_prefs.cc. (CVE-2015-1274)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 44.0.2403.89. It is, therefore, affected by multiple vulnerabilities as referenced in the 2015_07_stable-channel-update_21 advisory.

  - The Google V8 engine, as used in Google Chrome before 44.0.2403.89 and QtWebEngineCore in Qt before 5.5.1,     allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a     crafted web site. (CVE-2015-1290)

  - Use-after-free vulnerability in content/browser/indexed_db/indexed_db_backing_store.cc in the IndexedDB     implementation in Google Chrome before 44.0.2403.89 allows remote attackers to cause a denial of service     or possibly have unspecified other impact by leveraging an abort action before a certain write operation.
    (CVE-2015-1276)

  - PDFium, as used in Google Chrome before 44.0.2403.89, does not properly handle certain out-of-memory     conditions, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or     possibly have unspecified other impact via a crafted PDF document that triggers a large memory allocation.
    (CVE-2015-1271)

  - Heap-based buffer overflow in j2k.c in OpenJPEG before r3002, as used in PDFium in Google Chrome before     44.0.2403.89, allows remote attackers to cause a denial of service or possibly have unspecified other     impact via invalid JPEG2000 data in a PDF document. (CVE-2015-1273)

  - Google Chrome before 44.0.2403.89 does not ensure that the auto-open list omits all dangerous file types,     which makes it easier for remote attackers to execute arbitrary code by providing a crafted file and     leveraging a user's previous Always open files of this type choice, related to download_commands.cc and     download_prefs.cc. (CVE-2015-1274)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
264312	Linux Distros Unpatched Vulnerability : CVE-2015-1290	Nessus	Misc.	high
87627	openSUSE Security Update : Qt 5 (openSUSE-2015-953)	Nessus	SuSE Local Security Checks	high
84994	FreeBSD : chromium -- multiple vulnerabilities (9d732078-32c7-11e5-b263-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	critical
84922	Google Chrome < 44.0.2403.89 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
84921	Google Chrome < 44.0.2403.89 Multiple Vulnerabilities	Nessus	Windows	critical

Detections

Analytics

CVE-2015-1290

high

Tenable Plugins

high

high

critical

critical

critical