The BasicJsonStringifier::SerializeJSArray function in json-stringifier.h in the JSON stringifier in Google V8, as used in Google Chrome before 47.0.2526.73, improperly loads array elements, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via crafted JavaScript code.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The BasicJsonStringifier::SerializeJSArray function in json-stringifier.h in the JSON stringifier in     Google V8, as used in Google Chrome before 47.0.2526.73, improperly loads array elements, which allows     remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified     other impact via crafted JavaScript code. (CVE-2015-6764)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - The BasicJsonStringifier::SerializeJSArray function in json-stringifier.h in the JSON stringifier in
    Google V8, as used in Google Chrome before 47.0.2526.73, improperly loads array elements, which allows
    remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified
    other impact via crafted JavaScript code. (CVE-2015-6764)

  - Node.js 0.12.x before 0.12.9, 4.x before 4.2.3, and 5.x before 5.1.1 does not ensure the availability of a
    parser for each HTTP socket, which allows remote attackers to cause a denial of service (uncaughtException
    and service outage) via a pipelined HTTP request. (CVE-2015-8027)

The version of Apple Xcode installed on the remote macOS or Mac OS X host is prior to 8.1. It is, therefore, affected by multiple remote code execution vulnerabilities in the Node.js component of the Xcode Server. An unauthenticated, remote attacker can exploit these vulnerabilities to cause a denial of service condition or the execution of arbitrary code.

The remote host is affected by the vulnerability described in GLSA-201603-09 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in the Chromium web       browser. Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information, or bypass security restrictions.
  Workaround :

    There is no known workaround at this time.

This update contains nodejs 4.2.4 and fixes the following issues :

  - CVE-2015-6764: unspecified out-of-bounds access     vulnerability (boo#956902)

  - CVE-2015-8027: unspecified denial of service     vulnerability (boo#956901)

The following non-security bugs were fixed :

  - boo#948045: Nodejs 4.0 rpm does not install     addon-rpm.gypi

  - boo#961254: common.gypi should install at     /usr/share/node and npm requires nodejs-devel

Also contains all upstream bug fixes and improvements in the 4.2.2, 4.2.3 and 4.2.4 releases.

Chromium was updated to 47.0.2526.80 to fix security issues and bugs.

The following vulnerabilities were fixed :

  - CVE-2015-6788: Type confusion in extensions

  - CVE-2015-6789: Use-after-free in Blink

  - CVE-2015-6790: Escaping issue in saved pages

  - CVE-2015-6791: Various fixes from internal audits,     fuzzing and other initiatives

The following vulnerabilities were fixed in 47.0.2526.73 :

  - CVE-2015-6765: Use-after-free in AppCache

  - CVE-2015-6766: Use-after-free in AppCache

  - CVE-2015-6767: Use-after-free in AppCache

  - CVE-2015-6768: Cross-origin bypass in DOM

  - CVE-2015-6769: Cross-origin bypass in core

  - CVE-2015-6770: Cross-origin bypass in DOM

  - CVE-2015-6771: Out of bounds access in v8

  - CVE-2015-6772: Cross-origin bypass in DOM

  - CVE-2015-6764: Out of bounds access in v8

  - CVE-2015-6773: Out of bounds access in Skia

  - CVE-2015-6774: Use-after-free in Extensions

  - CVE-2015-6775: Type confusion in PDFium

  - CVE-2015-6776: Out of bounds access in PDFium

  - CVE-2015-6777: Use-after-free in DOM

  - CVE-2015-6778: Out of bounds access in PDFium

  - CVE-2015-6779: Scheme bypass in PDFium

  - CVE-2015-6780: Use-after-free in Infobars

  - CVE-2015-6781: Integer overflow in Sfntly

  - CVE-2015-6782: Content spoofing in Omnibox

  - CVE-2015-6783: Signature validation issue in Android     Crazy Linker.

  - CVE-2015-6784: Escaping issue in saved pages

  - CVE-2015-6785: Wildcard matching issue in CSP

  - CVE-2015-6786: Scheme bypass in CSP

  - CVE-2015-6787: Various fixes from internal audits,     fuzzing and other initiatives.

  - Multiple vulnerabilities in V8 fixed at the tip of the     4.7 branch (currently 4.7.80.23)

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2015-1302     Rub Wu discovered an information leak in the pdfium     library.

  - CVE-2015-6764     Guang Gong discovered an out-of-bounds read issue in the     v8 JavaScript library.

  - CVE-2015-6765     A use-after-free issue was discovered in AppCache.

  - CVE-2015-6766     A use-after-free issue was discovered in AppCache.

  - CVE-2015-6767     A use-after-free issue was discovered in AppCache.

  - CVE-2015-6768     Mariusz Mlynski discovered a way to bypass the Same     Origin Policy.

  - CVE-2015-6769     Mariusz Mlynski discovered a way to bypass the Same     Origin Policy.

  - CVE-2015-6770     Mariusz Mlynski discovered a way to bypass the Same     Origin Policy.

  - CVE-2015-6771     An out-of-bounds read issue was discovered in the v8     JavaScript library.

  - CVE-2015-6772     Mariusz Mlynski discovered a way to bypass the Same     Origin Policy.

  - CVE-2015-6773     cloudfuzzer discovered an out-of-bounds read issue in     the skia library.

  - CVE-2015-6774     A use-after-free issue was found in extensions binding.

  - CVE-2015-6775     Atte Kettunen discovered a type confusion issue in the     pdfium library.

  - CVE-2015-6776     Hanno Bock dicovered an out-of-bounds access issue in     the openjpeg library, which is used by pdfium.

  - CVE-2015-6777     Long Liu found a use-after-free issue.

  - CVE-2015-6778     Karl Skomski found an out-of-bounds read issue in the     pdfium library.

  - CVE-2015-6779     Til Jasper Ullrich discovered that the pdfium library     does not sanitize 'chrome:' URLs.

  - CVE-2015-6780     Khalil Zhani discovered a use-after-free issue.

  - CVE-2015-6781     miaubiz discovered an integer overflow issue in the     sfntly library.

  - CVE-2015-6782     Luan Herrera discovered a URL spoofing issue.

  - CVE-2015-6784     Inti De Ceukelaire discovered a way to inject HTML into     serialized web pages.

  - CVE-2015-6785     Michael Ficarra discovered a way to bypass the Content     Security Policy.

  - CVE-2015-6786     Michael Ficarra discovered another way to bypass the     Content Security Policy.

The version of Google Chrome installed on the remote host is prior to 47.0.2526.73 and is affected by multiple vulnerabilities :

 - An out-of-bounds access error exists in Google V8 that is triggered when loading array elements. An attacker can exploit this to have an unspecified impact. (CVE-2015-6764) 
 - A use-after-free error exists that is triggered when handling updates. An unauthenticated, remote attacker can exploit this to dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2015-6765) 
 - A use-after-free error exists in AppCache that is triggered when handling updates. An unauthenticated, remote attacker can exploit this to dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2015-6766) 
 - A use-after-free error exists in the 'OnChannelConnected()' function. An unauthenticated, remote attacker can exploit this to dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2015-6767) 
 - A same-origin bypass vulnerability exists due to a flaw that is triggered when handling 'javascript:' URI document navigations during page dismissal events. An attacker can exploit this to bypass the same-origin policy. (CVE-2015-6768) 
 - A same-origin bypass vulnerability exists due to a flaw that is triggered when committing a provisional load and handling the window proxy. An attacker can exploit this to bypass the same-origin policy. (CVE-2015-6769) 
 - A same-origin bypass vulnerability exists due to a flaw in DOM. An attacker can exploit this to bypass the same-origin policy. (CVE-2015-6770) 
 - An out-of-bounds access error exists in Google V8 related Map and Filter array construction. An attacker can exploit this to have an unspecified impact. (CVE-2015-6771) 
 - A same-origin bypass vulnerability exists due to a flaw that is triggered when navigating to a 'javascript:' URI and detaching the document. An attacker can exploit this to bypass the same-origin policy. (CVE-2015-6772) 
 - An out-of-bounds access error exists in Google Skia related to the handling of rows. An attacker can exploit this to have an unspecified impact. (CVE-2015-6773) 
 - A use-after-free error exists in the 'GetLoadTimes()' function. An unauthenticated, remote attacker can exploit this to dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2015-6774) 
 - A type confusion error exists in Google PDFium. An unauthenticated, remote attacker can exploit this to execute arbitrary code. (CVE-2015-6775) 
 - A heap-based overflow condition exists in OpenJPEG in the 'opj_dwt_decode()' function due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2015-6776) 
 - A use-after-free error exists in the 'notifyNodeInsertedInternal()' function.

The version of Google Chrome installed on the remote Mac OS X host is prior to 47.0.2526.73. It is, therefore, affected by multiple vulnerabilities :

  - An out-of-bounds access error exists in Google V8 that     is triggered when loading array elements. An attacker     can exploit this to have an unspecified impact.
    (CVE-2015-6764)

  - A use-after-free error exists that is triggered when     handling updates. An unauthenticated, remote attacker     can exploit this to dereference already freed memory,     resulting in the execution of arbitrary code.
    (CVE-2015-6765)

  - A use-after-free error exists in AppCache that is     triggered when handling updates. An unauthenticated,     remote attacker can exploit this to dereference already     freed memory, resulting in the execution of arbitrary     code. (CVE-2015-6766)

  - A use-after-free error exists in the     OnChannelConnected() function. An unauthenticated,     remote attacker can exploit this to dereference already     freed memory, resulting in the execution of arbitrary     code. (CVE-2015-6767)

  - A same-origin bypass vulnerability exists due to a flaw     that is triggered when handling 'javascript:' URI     document navigations during page dismissal events. An     attacker can exploit this to bypass the same-origin     policy. (CVE-2015-6768)

  - A same-origin bypass vulnerability exists due to a flaw     that is triggered when committing a provisional load and     handling the window proxy. An attacker can exploit this     to bypass the same-origin policy. (CVE-2015-6769)

  - A same-origin bypass vulnerability exists due to a flaw     in DOM. An attacker can exploit this to bypass the     same-origin policy. (CVE-2015-6770)

  - An out-of-bounds access error exists in Google V8     related Map and Filter array construction. An attacker     can exploit this to have an unspecified impact.
    (CVE-2015-6771)

  - A same-origin bypass vulnerability exists due to a flaw     that is triggered when navigating to a 'javascript:' URI     and detaching the document. An attacker can exploit this     to bypass the same-origin policy. (CVE-2015-6772)

  - An out-of-bounds access error exists in Google Skia     related to the handling of rows. An attacker can exploit     this to have an unspecified impact. (CVE-2015-6773)

  - A use-after-free error exists in the GetLoadTimes()     function. An unauthenticated, remote attacker can     exploit this to dereference already freed memory,     resulting in the execution of arbitrary code.
    (CVE-2015-6774)

  - A type confusion error exists in Google PDFium. An     unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2015-6775)

  - An heap-based overflow condition exists in OpenJPEG in     the opj_dwt_decode() function due to improper validation     of user-supplied input. An unauthenticated, remote     attacker can exploit this to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2015-6776)

  - A use-after-free error exists in the     notifyNodeInsertedInternal() function. An     unauthenticated, remote attacker can exploit this to     dereference already freed memory, resulting in the     execution of arbitrary code. (CVE-2015-6777)

  - An out-of-bounds access error exists in Google PDFium.
    An attacker can exploit this to have an unspecified     impact. (CVE-2015-6778)

  - A security bypass vulnerability exists in Google PDFium     due to improper restriction of certain URLs (e.g. allows     working links to 'chrome://'). An attacker can exploit     this to bypass intended access restrictions.
    (CVE-2015-6779)

  - A use-after-free error exists that is triggered when     handling the origin info bubble. An unauthenticated,     remote attacker can exploit this to dereference already     freed memory, resulting in the execution of arbitrary     code. (CVE-2015-6780)

  - An integer overflow condition exists in Google sfntly     due to improper validation of user-supplied input. An     attacker can exploit this to have an unspecified impact.
    (CVE-2015-6781)

  - A content spoofing vulnerability exists due to a flaw in     the Document::open() function that is triggered when     handling page dismissal events. An attacker can exploit     this to spoof omnibox content. (CVE-2015-6782)

  - A security bypass vulnerability exists in Google Android     Crazy Linker that is triggered when searching for the     zip EOCD record signature. An attacker can exploit this     to bypass signature validation. (CVE-2015-6783)

  - A flaw exists that is triggered as '--' in the page URL     is not escaped by the page serializer when saving pages.
    An attacker can exploit this to inject text that is     treated as HTML content. (CVE-2015-6784)

  - A security bypass vulnerability exists that is triggered     when matching Content Security Policy (CSP) source lists     containing wildcards. An attacker can exploit this to     bypass CSP restrictions. (CVE-2015-6785)

  - A security bypass vulnerability exists due to a flaw     that is triggered when matching 'data:', 'blob:', and     'filesystem:' URIs against wildcards. An attacker can     exploit this to bypass CSP restrictions. (CVE-2015-6786)

  - Multiple unspecified flaws exist that allow an     unauthenticated, remote attacker to execute arbitrary     code. (CVE-2015-6787)

The version of Google Chrome installed on the remote Windows host is prior to 47.0.2526.73. It is, therefore, affected by multiple vulnerabilities :

  - An out-of-bounds access error exists in Google V8 that     is triggered when loading array elements. An attacker     can exploit this to have an unspecified impact.
    (CVE-2015-6764)

  - A use-after-free error exists that is triggered when     handling updates. An unauthenticated, remote attacker     can exploit this to dereference already freed memory,     resulting in the execution of arbitrary code.
    (CVE-2015-6765)

  - A use-after-free error exists in AppCache that is     triggered when handling updates. An unauthenticated,     remote attacker can exploit this to dereference already     freed memory, resulting in the execution of arbitrary     code. (CVE-2015-6766)

  - A use-after-free error exists in the     OnChannelConnected() function. An unauthenticated,     remote attacker can exploit this to dereference already     freed memory, resulting in the execution of arbitrary     code. (CVE-2015-6767)

  - A same-origin bypass vulnerability exists due to a flaw     that is triggered when handling 'javascript:' URI     document navigations during page dismissal events. An     attacker can exploit this to bypass the same-origin     policy. (CVE-2015-6768)

  - A same-origin bypass vulnerability exists due to a flaw     that is triggered when committing a provisional load and     handling the window proxy. An attacker can exploit this     to bypass the same-origin policy. (CVE-2015-6769)

  - A same-origin bypass vulnerability exists due to a flaw     in DOM. An attacker can exploit this to bypass the     same-origin policy. (CVE-2015-6770)

  - An out-of-bounds access error exists in Google V8     related Map and Filter array construction. An attacker     can exploit this to have an unspecified impact.
    (CVE-2015-6771)

  - A same-origin bypass vulnerability exists due to a flaw     that is triggered when navigating to a 'javascript:' URI     and detaching the document. An attacker can exploit this     to bypass the same-origin policy. (CVE-2015-6772)

  - An out-of-bounds access error exists in Google Skia     related to the handling of rows. An attacker can exploit     this to have an unspecified impact. (CVE-2015-6773)

  - A use-after-free error exists in the GetLoadTimes()     function. An unauthenticated, remote attacker can     exploit this to dereference already freed memory,     resulting in the execution of arbitrary code.
    (CVE-2015-6774)

  - A type confusion error exists in Google PDFium. An     unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2015-6775)

  - An heap-based overflow condition exists in OpenJPEG in     the opj_dwt_decode() function due to improper validation     of user-supplied input. An unauthenticated, remote     attacker can exploit this to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2015-6776)

  - A use-after-free error exists in the     notifyNodeInsertedInternal() function. An     unauthenticated, remote attacker can exploit this to     dereference already freed memory, resulting in the     execution of arbitrary code. (CVE-2015-6777)

  - An out-of-bounds access error exists in Google PDFium.
    An attacker can exploit this to have an unspecified     impact. (CVE-2015-6778)

  - A security bypass vulnerability exists in Google PDFium     due to improper restriction of certain URLs (e.g.,     working links to 'chrome://' are allowed). An attacker     can exploit this to bypass intended access restrictions.
    (CVE-2015-6779)

  - A use-after-free error exists that is triggered when     handling the origin info bubble. An unauthenticated,     remote attacker can exploit this to dereference already     freed memory, resulting in the execution of arbitrary     code. (CVE-2015-6780)

  - An integer overflow condition exists in Google sfntly     due to improper validation of user-supplied input. An     attacker can exploit this to have an unspecified impact.
    (CVE-2015-6781)

  - A content spoofing vulnerability exists due to a flaw in     the Document::open() function that is triggered when     handling page dismissal events. An attacker can exploit     this to spoof omnibox content. (CVE-2015-6782)

  - A security bypass vulnerability exists in Google Android     Crazy Linker that is triggered when searching for the     zip EOCD record signature. An attacker can exploit this     to bypass signature validation. (CVE-2015-6783)

  - A flaw exists that is triggered as '--' in the page URL     is not escaped by the page serializer when saving pages.
    An attacker can exploit this to inject text that is     treated as HTML content. (CVE-2015-6784)

  - A security bypass vulnerability exists that is triggered     when matching Content Security Policy (CSP) source lists     containing wildcards. An attacker can exploit this to     bypass CSP restrictions. (CVE-2015-6785)

  - A security bypass vulnerability exists due to a flaw     that is triggered when matching 'data:', 'blob:', and     'filesystem:' URIs against wildcards. An attacker can     exploit this to bypass CSP restrictions. (CVE-2015-6786)

  - Multiple unspecified flaws exist that allow an     unauthenticated, remote attacker to execute arbitrary     code. (CVE-2015-6787)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2015:2545 advisory.

    Chromium is an open-source web browser, powered by WebKit (Blink).

    Several flaws were found in the processing of malformed web content. A web     page containing malicious content could cause Chromium to crash, execute     arbitrary code, or disclose sensitive information when visited by the     victim. (CVE-2015-6764, CVE-2015-6765, CVE-2015-6766, CVE-2015-6767,     CVE-2015-6768, CVE-2015-6769, CVE-2015-6770, CVE-2015-6771, CVE-2015-6772,     CVE-2015-6773, CVE-2015-6774, CVE-2015-6775, CVE-2015-6776, CVE-2015-6777,     CVE-2015-6778, CVE-2015-6779, CVE-2015-6780, CVE-2015-6781, CVE-2015-6782,     CVE-2015-6784, CVE-2015-6785, CVE-2015-6786, CVE-2015-6787)

    All Chromium users should upgrade to these updated packages, which contain     Chromium version 47.0.2526.73, which corrects these issues. After     installing the update, Chromium must be restarted for the changes to take     effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Chromium was update do the stable release 46.0.2490.71 to fix security issues.

The following vulnerabilities were fixed :

  - CVE-2015-6755: Cross-origin bypass in Blink

  - CVE-2015-6756: Use-after-free in PDFium

  - CVE-2015-6757: Use-after-free in ServiceWorker

  - CVE-2015-6758: Bad-cast in PDFium

  - CVE-2015-6759: Information leakage in LocalStorage

  - CVE-2015-6760: Improper error handling in libANGLE

  - CVE-2015-6761: Memory corruption in FFMpeg

  - CVE-2015-6762: CORS bypass via CSS fonts

  - CVE-2015-6763: Various fixes from internal audits,     fuzzing and other initiatives.

  - CVE-2015-7834: Multiple vulnerabilities in V8 fixed at     the tip of the 4.6 branch

ID	Name	Product	Family	Severity
253305	Linux Distros Unpatched Vulnerability : CVE-2015-6764	Nessus	Misc.	critical
401107	Alpine: multiple nodejs packages: security update to 4.2.1-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
401107	Alpine: multiple nodejs packages: security update to 4.2.1-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
94935	Apple Xcode < 8.1 Node.js Multiple RCE (macOS)	Nessus	MacOS X Local Security Checks	critical
89902	GLSA-201603-09 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
88130	openSUSE Security Update : nodejs (openSUSE-2016-46)	Nessus	SuSE Local Security Checks	high
87488	openSUSE Security Update : Chromium (openSUSE-2015-912)	Nessus	SuSE Local Security Checks	critical
87289	Debian DSA-3415-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	critical
9020	Google Chrome < 47.0.2526.73 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
87207	Google Chrome < 47.0.2526.73 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
87206	Google Chrome < 47.0.2526.73 Multiple Vulnerabilities	Nessus	Windows	medium
87195	RHEL 6 : chromium-browser (RHSA-2015:2545)	Nessus	Red Hat Local Security Checks	critical
86596	openSUSE Security Update : Chromium (openSUSE-2015-679)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2015-6764

critical

Tenable Plugins

critical

critical

critical

critical

critical

high

critical

critical

high

critical

medium

critical

high