The CPDF_Document::GetPage function in fpdfapi/fpdf_parser/fpdf_parser_document.cpp in PDFium, as used in Google Chrome before 46.0.2490.71, does not properly perform a cast of a dictionary object, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document.

The version of Google Chrome installed on the remote Windows host is prior to 46.0.2490.71. It is, therefore, affected by multiple vulnerabilities as referenced in the 2015_10_stable-channel-update advisory.

  - Multiple unspecified vulnerabilities in Google Chrome before 46.0.2490.71 allow attackers to cause a     denial of service or possibly have other impact via unknown vectors. (CVE-2015-6763)

  - Use-after-free vulnerability in content/browser/service_worker/embedded_worker_instance.cc in the     ServiceWorker implementation in Google Chrome before 46.0.2490.71 allows remote attackers to cause a     denial of service or possibly have unspecified other impact by leveraging object destruction in a     callback. (CVE-2015-6757)

  - The ContainerNode::parserInsertBefore function in core/dom/ContainerNode.cpp in Blink, as used in Google     Chrome before 46.0.2490.71, proceeds with a DOM tree insertion in certain cases where a parent node no     longer contains a child node, which allows remote attackers to bypass the Same Origin Policy via crafted     JavaScript code. (CVE-2015-6755)

  - Use-after-free vulnerability in the CPDFSDK_PageView implementation in fpdfsdk/src/fsdk_mgr.cpp in PDFium,     as used in Google Chrome before 46.0.2490.71, allows remote attackers to cause a denial of service (heap     memory corruption) or possibly have unspecified other impact by leveraging mishandling of a focused     annotation in a PDF document. (CVE-2015-6756)

  - The CPDF_Document::GetPage function in fpdfapi/fpdf_parser/fpdf_parser_document.cpp in PDFium, as used in     Google Chrome before 46.0.2490.71, does not properly perform a cast of a dictionary object, which allows     remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF     document. (CVE-2015-6758)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote macOS host is prior to 4.6.85.23. It is, therefore, affected by multiple vulnerabilities as referenced in the 2015_10_stable-channel-update advisory.

  - Multiple unspecified vulnerabilities in Google Chrome before 46.0.2490.71 allow attackers to cause a     denial of service or possibly have other impact via unknown vectors. (CVE-2015-6763)

  - Use-after-free vulnerability in content/browser/service_worker/embedded_worker_instance.cc in the     ServiceWorker implementation in Google Chrome before 46.0.2490.71 allows remote attackers to cause a     denial of service or possibly have unspecified other impact by leveraging object destruction in a     callback. (CVE-2015-6757)

  - The ContainerNode::parserInsertBefore function in core/dom/ContainerNode.cpp in Blink, as used in Google     Chrome before 46.0.2490.71, proceeds with a DOM tree insertion in certain cases where a parent node no     longer contains a child node, which allows remote attackers to bypass the Same Origin Policy via crafted     JavaScript code. (CVE-2015-6755)

  - Use-after-free vulnerability in the CPDFSDK_PageView implementation in fpdfsdk/src/fsdk_mgr.cpp in PDFium,     as used in Google Chrome before 46.0.2490.71, allows remote attackers to cause a denial of service (heap     memory corruption) or possibly have unspecified other impact by leveraging mishandling of a focused     annotation in a PDF document. (CVE-2015-6756)

  - The CPDF_Document::GetPage function in fpdfapi/fpdf_parser/fpdf_parser_document.cpp in PDFium, as used in     Google Chrome before 46.0.2490.71, does not properly perform a cast of a dictionary object, which allows     remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF     document. (CVE-2015-6758)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 4.6.85.23. It is, therefore, affected by multiple vulnerabilities as referenced in the 2015_10_stable-channel-update advisory.

  - Multiple unspecified vulnerabilities in Google Chrome before 46.0.2490.71 allow attackers to cause a     denial of service or possibly have other impact via unknown vectors. (CVE-2015-6763)

  - Use-after-free vulnerability in content/browser/service_worker/embedded_worker_instance.cc in the     ServiceWorker implementation in Google Chrome before 46.0.2490.71 allows remote attackers to cause a     denial of service or possibly have unspecified other impact by leveraging object destruction in a     callback. (CVE-2015-6757)

  - The ContainerNode::parserInsertBefore function in core/dom/ContainerNode.cpp in Blink, as used in Google     Chrome before 46.0.2490.71, proceeds with a DOM tree insertion in certain cases where a parent node no     longer contains a child node, which allows remote attackers to bypass the Same Origin Policy via crafted     JavaScript code. (CVE-2015-6755)

  - Use-after-free vulnerability in the CPDFSDK_PageView implementation in fpdfsdk/src/fsdk_mgr.cpp in PDFium,     as used in Google Chrome before 46.0.2490.71, allows remote attackers to cause a denial of service (heap     memory corruption) or possibly have unspecified other impact by leveraging mishandling of a focused     annotation in a PDF document. (CVE-2015-6756)

  - The CPDF_Document::GetPage function in fpdfapi/fpdf_parser/fpdf_parser_document.cpp in PDFium, as used in     Google Chrome before 46.0.2490.71, does not properly perform a cast of a dictionary object, which allows     remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF     document. (CVE-2015-6758)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote macOS host is prior to 46.0.2490.71. It is, therefore, affected by multiple vulnerabilities as referenced in the 2015_10_stable-channel-update advisory.

  - Multiple unspecified vulnerabilities in Google Chrome before 46.0.2490.71 allow attackers to cause a     denial of service or possibly have other impact via unknown vectors. (CVE-2015-6763)

  - Use-after-free vulnerability in content/browser/service_worker/embedded_worker_instance.cc in the     ServiceWorker implementation in Google Chrome before 46.0.2490.71 allows remote attackers to cause a     denial of service or possibly have unspecified other impact by leveraging object destruction in a     callback. (CVE-2015-6757)

  - The ContainerNode::parserInsertBefore function in core/dom/ContainerNode.cpp in Blink, as used in Google     Chrome before 46.0.2490.71, proceeds with a DOM tree insertion in certain cases where a parent node no     longer contains a child node, which allows remote attackers to bypass the Same Origin Policy via crafted     JavaScript code. (CVE-2015-6755)

  - Use-after-free vulnerability in the CPDFSDK_PageView implementation in fpdfsdk/src/fsdk_mgr.cpp in PDFium,     as used in Google Chrome before 46.0.2490.71, allows remote attackers to cause a denial of service (heap     memory corruption) or possibly have unspecified other impact by leveraging mishandling of a focused     annotation in a PDF document. (CVE-2015-6756)

  - The CPDF_Document::GetPage function in fpdfapi/fpdf_parser/fpdf_parser_document.cpp in PDFium, as used in     Google Chrome before 46.0.2490.71, does not properly perform a cast of a dictionary object, which allows     remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF     document. (CVE-2015-6758)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201603-09 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in the Chromium web       browser. Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information, or bypass security restrictions.
  Workaround :

    There is no known workaround at this time.

Chromium was update do the stable release 46.0.2490.71 to fix security issues.

The following vulnerabilities were fixed :

  - CVE-2015-6755: Cross-origin bypass in Blink

  - CVE-2015-6756: Use-after-free in PDFium

  - CVE-2015-6757: Use-after-free in ServiceWorker

  - CVE-2015-6758: Bad-cast in PDFium

  - CVE-2015-6759: Information leakage in LocalStorage

  - CVE-2015-6760: Improper error handling in libANGLE

  - CVE-2015-6761: Memory corruption in FFMpeg

  - CVE-2015-6762: CORS bypass via CSS fonts

  - CVE-2015-6763: Various fixes from internal audits,     fuzzing and other initiatives.

  - CVE-2015-7834: Multiple vulnerabilities in V8 fixed at     the tip of the 4.6 branch

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2015-1303     Mariusz Mlynski discovered a way to bypass the Same     Origin Policy in the DOM implementation.

  - CVE-2015-1304     Mariusz Mlynski discovered a way to bypass the Same     Origin Policy in the v8 JavaScript library.

  - CVE-2015-6755     Mariusz Mlynski discovered a way to bypass the Same     Origin Policy in blink/webkit.

  - CVE-2015-6756     A use-after-free issue was found in the pdfium library.

  - CVE-2015-6757     Collin Payne found a use-after-free issue in the     ServiceWorker implementation.

  - CVE-2015-6758     Atte Kettunen found an issue in the pdfium library.

  - CVE-2015-6759     Muneaki Nishimura discovered an information leak.

  - CVE-2015-6760     Ronald Crane discovered a logic error in the ANGLE     library involving lost device events.

  - CVE-2015-6761     Aki Helin and Khalil Zhani discovered a memory     corruption issue in the ffmpeg library.

  - CVE-2015-6762     Muneaki Nishimura discovered a way to bypass the Same     Origin Policy in the CSS implementation.

  - CVE-2015-6763     The chrome 46 development team found and fixed various     issues during internal auditing. Also multiple issues     were fixed in the v8 JavaScript library, version     4.6.85.23.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2015:1912 advisory.

    Chromium is an open-source web browser, powered by WebKit (Blink).

    Several flaws were found in the processing of malformed web content. A web     page containing malicious content could cause Chromium to crash, execute     arbitrary code, or disclose sensitive information when visited by the     victim. (CVE-2015-6755, CVE-2015-6756, CVE-2015-6757, CVE-2015-6758,     CVE-2015-6759, CVE-2015-6760, CVE-2015-6761, CVE-2015-6762, CVE-2015-6763)

    All Chromium users should upgrade to these updated packages, which contain     Chromium version 46.0.2490.71, which corrects these issues. After     installing the update, Chromium must be restarted for the changes to take     effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Mac OS X host is prior to 46.0.2490.71. It is, therefore, affected by multiple vulnerabilities :

  - A same-origin bypass vulnerability exists in Blink that     allows an attacker to bypass the same-origin policy.
    (CVE-2015-6755)

  - A use-after-free error exists in PDFium. A remote     attacker can exploit this to dereference already freed     memory, potentially resulting in the execution of     arbitrary code or a denial of service condition.
    (CVE-2015-6756)

  - A use-after-free error exists in ServiceWorker. A remote     attacker can exploit this to dereference already freed     memory, potentially resulting in the execution of     arbitrary code. (CVE-2015-6757)

  - An unspecified bad cast issue exists in PDFium that a     remote attacker can exploit to have an unspecified     impact. (CVE-2015-6758)

  - An unspecified flaw exists in LocalStorage that allows     an attacker to disclose sensitive information.
    (CVE-2015-6759)

  - An unspecified flaw exists when handling errors that     allows an attacker to have an unspecified impact.
    (CVE-2015-6760)

  - A memory corruption issues exists in FFMpeg due to     improper validation of user-supplied input. A remote     attacker can exploit this to execute arbitrary code.
    (CVE-2015-6761)

  - An unspecified flaw exists when handling CSS fonts. An     attacker can exploit this to bypass cross-origin     resource sharing (CORS) restrictions. (CVE-2015-6762)

  - Multiple unspecified high severity issues exist that     allow an attacker to have an unspecified impact.
    (CVE-2015-6763)

The version of Google Chrome installed on the remote Windows host is prior to 46.0.2490.71. It is, therefore, affected by multiple vulnerabilities :

  - A same-origin bypass vulnerability exists in Blink that     allows an attacker to bypass the same-origin policy.
    (CVE-2015-6755)

  - A use-after-free error exists in PDFium. A remote     attacker can exploit this to dereference already freed     memory, potentially resulting in the execution of     arbitrary code or a denial of service condition.
    (CVE-2015-6756)

  - A use-after-free error exists in ServiceWorker. A remote     attacker can exploit this to dereference already freed     memory, potentially resulting in the execution of     arbitrary code. (CVE-2015-6757)

  - An unspecified bad cast issue exists in PDFium that a     remote attacker can exploit to have an unspecified     impact. (CVE-2015-6758)

  - An unspecified flaw exists in LocalStorage that allows     an attacker to disclose sensitive information.
    (CVE-2015-6759)

  - An unspecified flaw exists when handling errors that     allows an attacker to have an unspecified impact.
    (CVE-2015-6760)

  - A memory corruption issues exists in FFMpeg due to     improper validation of user-supplied input. A remote     attacker can exploit this to execute arbitrary code.
    (CVE-2015-6761)

  - An unspecified flaw exists when handling CSS fonts. An     attacker can exploit this to bypass cross-origin     resource sharing (CORS) restrictions. (CVE-2015-6762)

  - Multiple unspecified high severity issues exist that     allow an attacker to have an unspecified impact.
    (CVE-2015-6763)

Google Chrome Releases reports :

24 security fixes in this release, including :

- [519558] High CVE-2015-6755: Cross-origin bypass in Blink. Credit to Mariusz Mlynski.

- [507316] High CVE-2015-6756: Use-after-free in PDFium. Credit to anonymous.

- [529520] High CVE-2015-6757: Use-after-free in ServiceWorker. Credit to Collin Payne.

- [522131] High CVE-2015-6758: Bad-cast in PDFium. Credit to Atte Kettunen of OUSPG.

- [514076] Medium CVE-2015-6759: Information leakage in LocalStorage.
Credit to Muneaki Nishimura (nishimunea).

- [519642] Medium CVE-2015-6760: Improper error handling in libANGLE.
Credit to lastland.net.

- [447860,532967] Medium CVE-2015-6761: Memory corruption in FFMpeg.
Credit to Aki Helin of OUSPG and anonymous.

- [512678] Low CVE-2015-6762: CORS bypass via CSS fonts. Credit to Muneaki Nishimura (nishimunea).

- [542517] CVE-2015-6763: Various fixes from internal audits, fuzzing and other initiatives.

- Multiple vulnerabilities in V8 fixed at the tip of the 4.6 branch (currently 4.6.85.23).

ID	Name	Product	Family	Severity
276624	Google Chrome < 46.0.2490.71 Multiple Vulnerabilities	Nessus	Windows	critical
276621	Google Chrome < 4.6.85.23 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
276615	Google Chrome < 4.6.85.23 Multiple Vulnerabilities	Nessus	Windows	critical
276612	Google Chrome < 46.0.2490.71 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
89902	GLSA-201603-09 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
86596	openSUSE Security Update : Chromium (openSUSE-2015-679)	Nessus	SuSE Local Security Checks	high
86486	Debian DSA-3376-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	high
86414	RHEL 6 : chromium-browser (RHSA-2015:1912)	Nessus	Red Hat Local Security Checks	high
86381	Google Chrome < 46.0.2490.71 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
86380	Google Chrome < 46.0.2490.71 Multiple Vulnerabilities	Nessus	Windows	high
86377	FreeBSD : chromium -- multiple vulnerabilities (8301c04d-71df-11e5-9fcb-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2015-6758

high

Tenable Plugins

critical

critical

critical

critical

critical

high

high

high

high

high

high