The CSSFontFaceSrcValue::fetch function in core/css/CSSFontFaceSrcValue.cpp in the Cascading Style Sheets (CSS) implementation in Blink, as used in Google Chrome before 46.0.2490.71, does not use the CORS cross-origin request algorithm when a font's URL appears to be a same-origin URL, which allows remote web servers to bypass the Same Origin Policy via a redirect.

The remote host is affected by the vulnerability described in GLSA-201603-09 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in the Chromium web       browser. Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information, or bypass security restrictions.
  Workaround :

    There is no known workaround at this time.

Chromium was update do the stable release 46.0.2490.71 to fix security issues.

The following vulnerabilities were fixed :

  - CVE-2015-6755: Cross-origin bypass in Blink

  - CVE-2015-6756: Use-after-free in PDFium

  - CVE-2015-6757: Use-after-free in ServiceWorker

  - CVE-2015-6758: Bad-cast in PDFium

  - CVE-2015-6759: Information leakage in LocalStorage

  - CVE-2015-6760: Improper error handling in libANGLE

  - CVE-2015-6761: Memory corruption in FFMpeg

  - CVE-2015-6762: CORS bypass via CSS fonts

  - CVE-2015-6763: Various fixes from internal audits,     fuzzing and other initiatives.

  - CVE-2015-7834: Multiple vulnerabilities in V8 fixed at     the tip of the 4.6 branch

USN-2770-1 fixed vulnerabilities in Oxide in Ubuntu 14.04 LTS and Ubuntu 15.04. This update provides the corresponding updates for Ubuntu 15.10.

It was discovered that ContainerNode::parserInsertBefore in Blink would incorrectly proceed with a DOM tree insertion in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass same origin restrictions. (CVE-2015-6755)

A use-after-free was discovered in the service worker implementation in Chromium. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking the program. (CVE-2015-6757)

It was discovered that Blink did not ensure that the origin of LocalStorage resources are considered unique. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to obtain sensitive information. (CVE-2015-6759)

A race condition and memory corruption was discovered in FFmpeg. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via renderer crash, or execute arbitrary code with the privileges of the sandboxed render process. (CVE-2015-6761)

It was discovered that CSSFontFaceSrcValue::fetch in Blink did not use CORS in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass same origin restrictions. (CVE-2015-6762)

Multiple security issues were discovered in Chromium. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking the program. (CVE-2015-6763)

Multiple security issues were discovered in V8. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial of service via renderer crash or execute arbitrary code with the privileges of the sandboxed render process. (CVE-2015-7834).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that ContainerNode::parserInsertBefore in Blink would incorrectly proceed with a DOM tree insertion in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass same origin restrictions. (CVE-2015-6755)

A use-after-free was discovered in the service worker implementation in Chromium. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking the program. (CVE-2015-6757)

It was discovered that Blink did not ensure that the origin of LocalStorage resources are considered unique. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to obtain sensitive information.
(CVE-2015-6759)

A race condition and memory corruption was discovered in FFmpeg. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via renderer crash, or execute arbitrary code with the privileges of the sandboxed render process. (CVE-2015-6761)

It was discovered that CSSFontFaceSrcValue::fetch in Blink did not use CORS in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass same origin restrictions. (CVE-2015-6762)

Multiple security issues were discovered in Chromium. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking the program. (CVE-2015-6763)

Multiple security issues were discovered in V8. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial of service via renderer crash or execute arbitrary code with the privileges of the sandboxed render process. (CVE-2015-7834).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2015-1303     Mariusz Mlynski discovered a way to bypass the Same     Origin Policy in the DOM implementation.

  - CVE-2015-1304     Mariusz Mlynski discovered a way to bypass the Same     Origin Policy in the v8 JavaScript library.

  - CVE-2015-6755     Mariusz Mlynski discovered a way to bypass the Same     Origin Policy in blink/webkit.

  - CVE-2015-6756     A use-after-free issue was found in the pdfium library.

  - CVE-2015-6757     Collin Payne found a use-after-free issue in the     ServiceWorker implementation.

  - CVE-2015-6758     Atte Kettunen found an issue in the pdfium library.

  - CVE-2015-6759     Muneaki Nishimura discovered an information leak.

  - CVE-2015-6760     Ronald Crane discovered a logic error in the ANGLE     library involving lost device events.

  - CVE-2015-6761     Aki Helin and Khalil Zhani discovered a memory     corruption issue in the ffmpeg library.

  - CVE-2015-6762     Muneaki Nishimura discovered a way to bypass the Same     Origin Policy in the CSS implementation.

  - CVE-2015-6763     The chrome 46 development team found and fixed various     issues during internal auditing. Also multiple issues     were fixed in the v8 JavaScript library, version     4.6.85.23.

Updated chromium-browser packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Chromium is an open source web browser, powered by WebKit (Blink).

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when visited by the victim. (CVE-2015-6755, CVE-2015-6756, CVE-2015-6757, CVE-2015-6758, CVE-2015-6759, CVE-2015-6760, CVE-2015-6761, CVE-2015-6762, CVE-2015-6763)

All Chromium users should upgrade to these updated packages, which contain Chromium version 46.0.2490.71, which corrects these issues.
After installing the update, Chromium must be restarted for the changes to take effect.

The version of Google Chrome installed on the remote Mac OS X host is prior to 46.0.2490.71. It is, therefore, affected by multiple vulnerabilities :

  - A same-origin bypass vulnerability exists in Blink that     allows an attacker to bypass the same-origin policy.
    (CVE-2015-6755)

  - A use-after-free error exists in PDFium. A remote     attacker can exploit this to dereference already freed     memory, potentially resulting in the execution of     arbitrary code or a denial of service condition.
    (CVE-2015-6756)

  - A use-after-free error exists in ServiceWorker. A remote     attacker can exploit this to dereference already freed     memory, potentially resulting in the execution of     arbitrary code. (CVE-2015-6757)

  - An unspecified bad cast issue exists in PDFium that a     remote attacker can exploit to have an unspecified     impact. (CVE-2015-6758)

  - An unspecified flaw exists in LocalStorage that allows     an attacker to disclose sensitive information.
    (CVE-2015-6759)

  - An unspecified flaw exists when handling errors that     allows an attacker to have an unspecified impact.
    (CVE-2015-6760)

  - A memory corruption issues exists in FFMpeg due to     improper validation of user-supplied input. A remote     attacker can exploit this to execute arbitrary code.
    (CVE-2015-6761)

  - An unspecified flaw exists when handling CSS fonts. An     attacker can exploit this to bypass cross-origin     resource sharing (CORS) restrictions. (CVE-2015-6762)

  - Multiple unspecified high severity issues exist that     allow an attacker to have an unspecified impact.
    (CVE-2015-6763)

The version of Google Chrome installed on the remote Windows host is prior to 46.0.2490.71. It is, therefore, affected by multiple vulnerabilities :

  - A same-origin bypass vulnerability exists in Blink that     allows an attacker to bypass the same-origin policy.
    (CVE-2015-6755)

  - A use-after-free error exists in PDFium. A remote     attacker can exploit this to dereference already freed     memory, potentially resulting in the execution of     arbitrary code or a denial of service condition.
    (CVE-2015-6756)

  - A use-after-free error exists in ServiceWorker. A remote     attacker can exploit this to dereference already freed     memory, potentially resulting in the execution of     arbitrary code. (CVE-2015-6757)

  - An unspecified bad cast issue exists in PDFium that a     remote attacker can exploit to have an unspecified     impact. (CVE-2015-6758)

  - An unspecified flaw exists in LocalStorage that allows     an attacker to disclose sensitive information.
    (CVE-2015-6759)

  - An unspecified flaw exists when handling errors that     allows an attacker to have an unspecified impact.
    (CVE-2015-6760)

  - A memory corruption issues exists in FFMpeg due to     improper validation of user-supplied input. A remote     attacker can exploit this to execute arbitrary code.
    (CVE-2015-6761)

  - An unspecified flaw exists when handling CSS fonts. An     attacker can exploit this to bypass cross-origin     resource sharing (CORS) restrictions. (CVE-2015-6762)

  - Multiple unspecified high severity issues exist that     allow an attacker to have an unspecified impact.
    (CVE-2015-6763)

Google Chrome Releases reports :

24 security fixes in this release, including :

- [519558] High CVE-2015-6755: Cross-origin bypass in Blink. Credit to Mariusz Mlynski.

- [507316] High CVE-2015-6756: Use-after-free in PDFium. Credit to anonymous.

- [529520] High CVE-2015-6757: Use-after-free in ServiceWorker. Credit to Collin Payne.

- [522131] High CVE-2015-6758: Bad-cast in PDFium. Credit to Atte Kettunen of OUSPG.

- [514076] Medium CVE-2015-6759: Information leakage in LocalStorage.
Credit to Muneaki Nishimura (nishimunea).

- [519642] Medium CVE-2015-6760: Improper error handling in libANGLE.
Credit to lastland.net.

- [447860,532967] Medium CVE-2015-6761: Memory corruption in FFMpeg.
Credit to Aki Helin of OUSPG and anonymous.

- [512678] Low CVE-2015-6762: CORS bypass via CSS fonts. Credit to Muneaki Nishimura (nishimunea).

- [542517] CVE-2015-6763: Various fixes from internal audits, fuzzing and other initiatives.

- Multiple vulnerabilities in V8 fixed at the tip of the 4.6 branch (currently 4.6.85.23).

ID	Name	Product	Family	Severity
89902	GLSA-201603-09 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
86596	openSUSE Security Update : Chromium (openSUSE-2015-679)	Nessus	SuSE Local Security Checks	high
86565	Ubuntu 15.10 : oxide-qt vulnerabilities (USN-2770-2)	Nessus	Ubuntu Local Security Checks	high
86491	Ubuntu 14.04 LTS : Oxide vulnerabilities (USN-2770-1)	Nessus	Ubuntu Local Security Checks	high
86486	Debian DSA-3376-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	high
86414	RHEL 6 : chromium-browser (RHSA-2015:1912)	Nessus	Red Hat Local Security Checks	high
86381	Google Chrome < 46.0.2490.71 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
86380	Google Chrome < 46.0.2490.71 Multiple Vulnerabilities	Nessus	Windows	high
86377	FreeBSD : chromium -- multiple vulnerabilities (8301c04d-71df-11e5-9fcb-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2015-6762

high

Tenable Plugins

critical

high

high

high

high

high

high

high

high