Use-after-free vulnerability in the CPDFSDK_PageView implementation in fpdfsdk/src/fsdk_mgr.cpp in PDFium, as used in Google Chrome before 46.0.2490.71, allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by leveraging mishandling of a focused annotation in a PDF document.

The remote host is affected by the vulnerability described in GLSA-201603-09 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in the Chromium web       browser. Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information, or bypass security restrictions.
  Workaround :

    There is no known workaround at this time.

Chromium was update do the stable release 46.0.2490.71 to fix security issues.

The following vulnerabilities were fixed :

  - CVE-2015-6755: Cross-origin bypass in Blink

  - CVE-2015-6756: Use-after-free in PDFium

  - CVE-2015-6757: Use-after-free in ServiceWorker

  - CVE-2015-6758: Bad-cast in PDFium

  - CVE-2015-6759: Information leakage in LocalStorage

  - CVE-2015-6760: Improper error handling in libANGLE

  - CVE-2015-6761: Memory corruption in FFMpeg

  - CVE-2015-6762: CORS bypass via CSS fonts

  - CVE-2015-6763: Various fixes from internal audits,     fuzzing and other initiatives.

  - CVE-2015-7834: Multiple vulnerabilities in V8 fixed at     the tip of the 4.6 branch

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2015-1303     Mariusz Mlynski discovered a way to bypass the Same     Origin Policy in the DOM implementation.

  - CVE-2015-1304     Mariusz Mlynski discovered a way to bypass the Same     Origin Policy in the v8 JavaScript library.

  - CVE-2015-6755     Mariusz Mlynski discovered a way to bypass the Same     Origin Policy in blink/webkit.

  - CVE-2015-6756     A use-after-free issue was found in the pdfium library.

  - CVE-2015-6757     Collin Payne found a use-after-free issue in the     ServiceWorker implementation.

  - CVE-2015-6758     Atte Kettunen found an issue in the pdfium library.

  - CVE-2015-6759     Muneaki Nishimura discovered an information leak.

  - CVE-2015-6760     Ronald Crane discovered a logic error in the ANGLE     library involving lost device events.

  - CVE-2015-6761     Aki Helin and Khalil Zhani discovered a memory     corruption issue in the ffmpeg library.

  - CVE-2015-6762     Muneaki Nishimura discovered a way to bypass the Same     Origin Policy in the CSS implementation.

  - CVE-2015-6763     The chrome 46 development team found and fixed various     issues during internal auditing. Also multiple issues     were fixed in the v8 JavaScript library, version     4.6.85.23.

Updated chromium-browser packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Chromium is an open source web browser, powered by WebKit (Blink).

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when visited by the victim. (CVE-2015-6755, CVE-2015-6756, CVE-2015-6757, CVE-2015-6758, CVE-2015-6759, CVE-2015-6760, CVE-2015-6761, CVE-2015-6762, CVE-2015-6763)

All Chromium users should upgrade to these updated packages, which contain Chromium version 46.0.2490.71, which corrects these issues.
After installing the update, Chromium must be restarted for the changes to take effect.

The version of Google Chrome installed on the remote Mac OS X host is prior to 46.0.2490.71. It is, therefore, affected by multiple vulnerabilities :

  - A same-origin bypass vulnerability exists in Blink that     allows an attacker to bypass the same-origin policy.
    (CVE-2015-6755)

  - A use-after-free error exists in PDFium. A remote     attacker can exploit this to dereference already freed     memory, potentially resulting in the execution of     arbitrary code or a denial of service condition.
    (CVE-2015-6756)

  - A use-after-free error exists in ServiceWorker. A remote     attacker can exploit this to dereference already freed     memory, potentially resulting in the execution of     arbitrary code. (CVE-2015-6757)

  - An unspecified bad cast issue exists in PDFium that a     remote attacker can exploit to have an unspecified     impact. (CVE-2015-6758)

  - An unspecified flaw exists in LocalStorage that allows     an attacker to disclose sensitive information.
    (CVE-2015-6759)

  - An unspecified flaw exists when handling errors that     allows an attacker to have an unspecified impact.
    (CVE-2015-6760)

  - A memory corruption issues exists in FFMpeg due to     improper validation of user-supplied input. A remote     attacker can exploit this to execute arbitrary code.
    (CVE-2015-6761)

  - An unspecified flaw exists when handling CSS fonts. An     attacker can exploit this to bypass cross-origin     resource sharing (CORS) restrictions. (CVE-2015-6762)

  - Multiple unspecified high severity issues exist that     allow an attacker to have an unspecified impact.
    (CVE-2015-6763)

The version of Google Chrome installed on the remote Windows host is prior to 46.0.2490.71. It is, therefore, affected by multiple vulnerabilities :

  - A same-origin bypass vulnerability exists in Blink that     allows an attacker to bypass the same-origin policy.
    (CVE-2015-6755)

  - A use-after-free error exists in PDFium. A remote     attacker can exploit this to dereference already freed     memory, potentially resulting in the execution of     arbitrary code or a denial of service condition.
    (CVE-2015-6756)

  - A use-after-free error exists in ServiceWorker. A remote     attacker can exploit this to dereference already freed     memory, potentially resulting in the execution of     arbitrary code. (CVE-2015-6757)

  - An unspecified bad cast issue exists in PDFium that a     remote attacker can exploit to have an unspecified     impact. (CVE-2015-6758)

  - An unspecified flaw exists in LocalStorage that allows     an attacker to disclose sensitive information.
    (CVE-2015-6759)

  - An unspecified flaw exists when handling errors that     allows an attacker to have an unspecified impact.
    (CVE-2015-6760)

  - A memory corruption issues exists in FFMpeg due to     improper validation of user-supplied input. A remote     attacker can exploit this to execute arbitrary code.
    (CVE-2015-6761)

  - An unspecified flaw exists when handling CSS fonts. An     attacker can exploit this to bypass cross-origin     resource sharing (CORS) restrictions. (CVE-2015-6762)

  - Multiple unspecified high severity issues exist that     allow an attacker to have an unspecified impact.
    (CVE-2015-6763)

Google Chrome Releases reports :

24 security fixes in this release, including :

- [519558] High CVE-2015-6755: Cross-origin bypass in Blink. Credit to Mariusz Mlynski.

- [507316] High CVE-2015-6756: Use-after-free in PDFium. Credit to anonymous.

- [529520] High CVE-2015-6757: Use-after-free in ServiceWorker. Credit to Collin Payne.

- [522131] High CVE-2015-6758: Bad-cast in PDFium. Credit to Atte Kettunen of OUSPG.

- [514076] Medium CVE-2015-6759: Information leakage in LocalStorage.
Credit to Muneaki Nishimura (nishimunea).

- [519642] Medium CVE-2015-6760: Improper error handling in libANGLE.
Credit to lastland.net.

- [447860,532967] Medium CVE-2015-6761: Memory corruption in FFMpeg.
Credit to Aki Helin of OUSPG and anonymous.

- [512678] Low CVE-2015-6762: CORS bypass via CSS fonts. Credit to Muneaki Nishimura (nishimunea).

- [542517] CVE-2015-6763: Various fixes from internal audits, fuzzing and other initiatives.

- Multiple vulnerabilities in V8 fixed at the tip of the 4.6 branch (currently 4.6.85.23).

ID	Name	Product	Family	Severity
89902	GLSA-201603-09 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
86596	openSUSE Security Update : Chromium (openSUSE-2015-679)	Nessus	SuSE Local Security Checks	high
86486	Debian DSA-3376-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	high
86414	RHEL 6 : chromium-browser (RHSA-2015:1912)	Nessus	Red Hat Local Security Checks	high
86381	Google Chrome < 46.0.2490.71 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
86380	Google Chrome < 46.0.2490.71 Multiple Vulnerabilities	Nessus	Windows	high
86377	FreeBSD : chromium -- multiple vulnerabilities (8301c04d-71df-11e5-9fcb-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2015-6756

high

Tenable Plugins

critical

high

high

high

high

high

high