The update_dimensions function in libavcodec/vp8.c in FFmpeg through 2.8.1, as used in Google Chrome before 46.0.2490.71 and other products, relies on a coefficient-partition count during multi-threaded operation, which allows remote attackers to cause a denial of service (race condition and memory corruption) or possibly have unspecified other impact via a crafted WebM file.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The update_dimensions function in libavcodec/vp8.c in FFmpeg through 2.8.1, as used in Google Chrome     before 46.0.2490.71 and other products, relies on a coefficient-partition count during multi-threaded     operation, which allows remote attackers to cause a denial of service (race condition and memory     corruption) or possibly have unspecified other impact via a crafted WebM file. (CVE-2015-6761)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host is affected by the vulnerability described in GLSA-201603-09 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in the Chromium web       browser. Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information, or bypass security restrictions.
  Workaround :

    There is no known workaround at this time.

NVD reports :

The update_dimensions function in libavcodec/vp8.c in FFmpeg through 2.8.1, as used in Google Chrome before 46.0.2490.71 and other products, relies on a coefficient-partition count during multi-threaded operation, which allows remote attackers to cause a denial of service (race condition and memory corruption) or possibly have unspecified other impact via a crafted WebM file.

The ljpeg_decode_yuv_scan function in libavcodec/mjpegdec.c in FFmpeg before 2.8.2 omits certain width and height checks, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted MJPEG data.

The ff_hevc_parse_sps function in libavcodec/hevc_ps.c in FFmpeg before 2.8.2 does not validate the Chroma Format Indicator, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted High Efficiency Video Coding (HEVC) data.

The decode_uncompressed function in libavcodec/faxcompr.c in FFmpeg before 2.8.2 does not validate uncompressed runs, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted CCITT FAX data.

The init_tile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.8.2 does not enforce minimum-value and maximum-value constraints on tile coordinates, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG 2000 data.

The jpeg2000_read_main_headers function in libavcodec/jpeg2000dec.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through 2.8.2 does not enforce uniqueness of the SIZ marker in a JPEG 2000 image, which allows remote attackers to cause a denial of service (out-of-bounds heap-memory access) or possibly have unspecified other impact via a crafted image with two or more of these markers.

Integer overflow in the ff_ivi_init_planes function in libavcodec/ivi.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through 2.8.2 allows remote attackers to cause a denial of service (out-of-bounds heap-memory access) or possibly have unspecified other impact via crafted image dimensions in Indeo Video Interactive data.

The smka_decode_frame function in libavcodec/smacker.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through 2.8.2 does not verify that the data size is consistent with the number of channels, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Smacker data.

Chromium was update do the stable release 46.0.2490.71 to fix security issues.

The following vulnerabilities were fixed :

  - CVE-2015-6755: Cross-origin bypass in Blink

  - CVE-2015-6756: Use-after-free in PDFium

  - CVE-2015-6757: Use-after-free in ServiceWorker

  - CVE-2015-6758: Bad-cast in PDFium

  - CVE-2015-6759: Information leakage in LocalStorage

  - CVE-2015-6760: Improper error handling in libANGLE

  - CVE-2015-6761: Memory corruption in FFMpeg

  - CVE-2015-6762: CORS bypass via CSS fonts

  - CVE-2015-6763: Various fixes from internal audits,     fuzzing and other initiatives.

  - CVE-2015-7834: Multiple vulnerabilities in V8 fixed at     the tip of the 4.6 branch

USN-2770-1 fixed vulnerabilities in Oxide in Ubuntu 14.04 LTS and Ubuntu 15.04. This update provides the corresponding updates for Ubuntu 15.10.

It was discovered that ContainerNode::parserInsertBefore in Blink would incorrectly proceed with a DOM tree insertion in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass same origin restrictions. (CVE-2015-6755)

A use-after-free was discovered in the service worker implementation in Chromium. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking the program. (CVE-2015-6757)

It was discovered that Blink did not ensure that the origin of LocalStorage resources are considered unique. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to obtain sensitive information. (CVE-2015-6759)

A race condition and memory corruption was discovered in FFmpeg. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via renderer crash, or execute arbitrary code with the privileges of the sandboxed render process. (CVE-2015-6761)

It was discovered that CSSFontFaceSrcValue::fetch in Blink did not use CORS in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass same origin restrictions. (CVE-2015-6762)

Multiple security issues were discovered in Chromium. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking the program. (CVE-2015-6763)

Multiple security issues were discovered in V8. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial of service via renderer crash or execute arbitrary code with the privileges of the sandboxed render process. (CVE-2015-7834).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2770-1 advisory.

    It was discovered that ContainerNode::parserInsertBefore in Blink would incorrectly proceed with a DOM     tree insertion in some circumstances. If a user were tricked in to opening a specially crafted website, an     attacker could potentially exploit this to bypass same origin restrictions. (CVE-2015-6755)

    A use-after-free was discovered in the service worker implementation in Chromium. If a user were tricked     in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of     service via application crash, or execute arbitrary code with the privileges of the user invoking the     program. (CVE-2015-6757)

    It was discovered that Blink did not ensure that the origin of LocalStorage resources are considered     unique. If a user were tricked in to opening a specially crafted website, an attacker could potentially     exploit this to obtain sensitive information. (CVE-2015-6759)

    A race condition and memory corruption was discovered in FFmpeg. If a user were tricked in to opening a     specially crafted website, an attacker could potentially exploit this to cause a denial of service via     renderer crash, or execute arbitrary code with the privileges of the sandboxed render process.
    (CVE-2015-6761)

    It was discovered that CSSFontFaceSrcValue::fetch in Blink did not use CORS in some circumstances. If a     user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to     bypass same origin restrictions. (CVE-2015-6762)

    Multiple security issues were discovered in Chromium. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial     of service via application crash or execute arbitrary code with the privileges of the user invoking the     program. (CVE-2015-6763)

    Multiple security issues were discovered in V8. If a user were tricked in to opening a specially crafted     website, an attacker could potentially exploit these to read uninitialized memory, cause a denial of     service via renderer crash or execute arbitrary code with the privileges of the sandboxed render process.
    (CVE-2015-7834)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2015-1303     Mariusz Mlynski discovered a way to bypass the Same     Origin Policy in the DOM implementation.

  - CVE-2015-1304     Mariusz Mlynski discovered a way to bypass the Same     Origin Policy in the v8 JavaScript library.

  - CVE-2015-6755     Mariusz Mlynski discovered a way to bypass the Same     Origin Policy in blink/webkit.

  - CVE-2015-6756     A use-after-free issue was found in the pdfium library.

  - CVE-2015-6757     Collin Payne found a use-after-free issue in the     ServiceWorker implementation.

  - CVE-2015-6758     Atte Kettunen found an issue in the pdfium library.

  - CVE-2015-6759     Muneaki Nishimura discovered an information leak.

  - CVE-2015-6760     Ronald Crane discovered a logic error in the ANGLE     library involving lost device events.

  - CVE-2015-6761     Aki Helin and Khalil Zhani discovered a memory     corruption issue in the ffmpeg library.

  - CVE-2015-6762     Muneaki Nishimura discovered a way to bypass the Same     Origin Policy in the CSS implementation.

  - CVE-2015-6763     The chrome 46 development team found and fixed various     issues during internal auditing. Also multiple issues     were fixed in the v8 JavaScript library, version     4.6.85.23.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2015:1912 advisory.

    Chromium is an open-source web browser, powered by WebKit (Blink).

    Several flaws were found in the processing of malformed web content. A web     page containing malicious content could cause Chromium to crash, execute     arbitrary code, or disclose sensitive information when visited by the     victim. (CVE-2015-6755, CVE-2015-6756, CVE-2015-6757, CVE-2015-6758,     CVE-2015-6759, CVE-2015-6760, CVE-2015-6761, CVE-2015-6762, CVE-2015-6763)

    All Chromium users should upgrade to these updated packages, which contain     Chromium version 46.0.2490.71, which corrects these issues. After     installing the update, Chromium must be restarted for the changes to take     effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Mac OS X host is prior to 46.0.2490.71. It is, therefore, affected by multiple vulnerabilities :

  - A same-origin bypass vulnerability exists in Blink that     allows an attacker to bypass the same-origin policy.
    (CVE-2015-6755)

  - A use-after-free error exists in PDFium. A remote     attacker can exploit this to dereference already freed     memory, potentially resulting in the execution of     arbitrary code or a denial of service condition.
    (CVE-2015-6756)

  - A use-after-free error exists in ServiceWorker. A remote     attacker can exploit this to dereference already freed     memory, potentially resulting in the execution of     arbitrary code. (CVE-2015-6757)

  - An unspecified bad cast issue exists in PDFium that a     remote attacker can exploit to have an unspecified     impact. (CVE-2015-6758)

  - An unspecified flaw exists in LocalStorage that allows     an attacker to disclose sensitive information.
    (CVE-2015-6759)

  - An unspecified flaw exists when handling errors that     allows an attacker to have an unspecified impact.
    (CVE-2015-6760)

  - A memory corruption issues exists in FFMpeg due to     improper validation of user-supplied input. A remote     attacker can exploit this to execute arbitrary code.
    (CVE-2015-6761)

  - An unspecified flaw exists when handling CSS fonts. An     attacker can exploit this to bypass cross-origin     resource sharing (CORS) restrictions. (CVE-2015-6762)

  - Multiple unspecified high severity issues exist that     allow an attacker to have an unspecified impact.
    (CVE-2015-6763)

The version of Google Chrome installed on the remote Windows host is prior to 46.0.2490.71. It is, therefore, affected by multiple vulnerabilities :

  - A same-origin bypass vulnerability exists in Blink that     allows an attacker to bypass the same-origin policy.
    (CVE-2015-6755)

  - A use-after-free error exists in PDFium. A remote     attacker can exploit this to dereference already freed     memory, potentially resulting in the execution of     arbitrary code or a denial of service condition.
    (CVE-2015-6756)

  - A use-after-free error exists in ServiceWorker. A remote     attacker can exploit this to dereference already freed     memory, potentially resulting in the execution of     arbitrary code. (CVE-2015-6757)

  - An unspecified bad cast issue exists in PDFium that a     remote attacker can exploit to have an unspecified     impact. (CVE-2015-6758)

  - An unspecified flaw exists in LocalStorage that allows     an attacker to disclose sensitive information.
    (CVE-2015-6759)

  - An unspecified flaw exists when handling errors that     allows an attacker to have an unspecified impact.
    (CVE-2015-6760)

  - A memory corruption issues exists in FFMpeg due to     improper validation of user-supplied input. A remote     attacker can exploit this to execute arbitrary code.
    (CVE-2015-6761)

  - An unspecified flaw exists when handling CSS fonts. An     attacker can exploit this to bypass cross-origin     resource sharing (CORS) restrictions. (CVE-2015-6762)

  - Multiple unspecified high severity issues exist that     allow an attacker to have an unspecified impact.
    (CVE-2015-6763)

Google Chrome Releases reports :

24 security fixes in this release, including :

- [519558] High CVE-2015-6755: Cross-origin bypass in Blink. Credit to Mariusz Mlynski.

- [507316] High CVE-2015-6756: Use-after-free in PDFium. Credit to anonymous.

- [529520] High CVE-2015-6757: Use-after-free in ServiceWorker. Credit to Collin Payne.

- [522131] High CVE-2015-6758: Bad-cast in PDFium. Credit to Atte Kettunen of OUSPG.

- [514076] Medium CVE-2015-6759: Information leakage in LocalStorage.
Credit to Muneaki Nishimura (nishimunea).

- [519642] Medium CVE-2015-6760: Improper error handling in libANGLE.
Credit to lastland.net.

- [447860,532967] Medium CVE-2015-6761: Memory corruption in FFMpeg.
Credit to Aki Helin of OUSPG and anonymous.

- [512678] Low CVE-2015-6762: CORS bypass via CSS fonts. Credit to Muneaki Nishimura (nishimunea).

- [542517] CVE-2015-6763: Various fixes from internal audits, fuzzing and other initiatives.

- Multiple vulnerabilities in V8 fixed at the tip of the 4.6 branch (currently 4.6.85.23).

ID	Name	Product	Family	Type	Severity
251557	Linux Distros Unpatched Vulnerability : CVE-2015-6761	Nessus	Misc.	Local	high
89902	GLSA-201603-09 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	critical
87178	FreeBSD : ffmpeg -- multiple vulnerabilities (b0da85af-21a3-4c15-a137-fe9e4bc86002)	Nessus	FreeBSD Local Security Checks	Local	high
86596	openSUSE Security Update : Chromium (openSUSE-2015-679)	Nessus	SuSE Local Security Checks	Local	high
86565	Ubuntu 15.10 : oxide-qt vulnerabilities (USN-2770-2)	Nessus	Ubuntu Local Security Checks	Local	high
86491	Ubuntu 14.04 LTS : Oxide vulnerabilities (USN-2770-1)	Nessus	Ubuntu Local Security Checks	Local	high
86486	Debian DSA-3376-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	Local	high
86414	RHEL 6 : chromium-browser (RHSA-2015:1912)	Nessus	Red Hat Local Security Checks	Local	high
86381	Google Chrome < 46.0.2490.71 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	Local	high
86380	Google Chrome < 46.0.2490.71 Multiple Vulnerabilities	Nessus	Windows	Local	medium
86377	FreeBSD : chromium -- multiple vulnerabilities (8301c04d-71df-11e5-9fcb-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	Local	high

Detections

Analytics

CVE-2015-6761

high

Tenable Plugins

high

critical

high

high

high

high

high

high

high

medium

high