extensions/renderer/resources/binding.js in the extension bindings in Google Chrome before 51.0.2704.63 does not properly use prototypes, which allows remote attackers to bypass the Same Origin Policy via unspecified vectors.

The remote host is affected by the vulnerability described in GLSA-201607-07 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in the Chromium web       browser. Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information, or bypass security restrictions.
  Workaround :

    There is no known workaround at this time.

Chromium was updated to 51.0.2704.79 to fix the following vulnerabilities :

  - CVE-2016-1696: Cross-origin bypass in Extension bindings

  - CVE-2016-1697: Cross-origin bypass in Blink

  - CVE-2016-1698: Information leak in Extension bindings

  - CVE-2016-1699: Parameter sanitization failure in     DevTools

  - CVE-2016-1700: Use-after-free in Extensions

  - CVE-2016-1701: Use-after-free in Autofill

  - CVE-2016-1702: Out-of-bounds read in Skia

  - CVE-2016-1703: Various fixes from internal audits,     fuzzing and other initiatives Also includes     vulnerabilities fixed in 51.0.2704.63 (boo#981886) :

  - CVE-2016-1672: Cross-origin bypass in extension bindings

  - CVE-2016-1673: Cross-origin bypass in Blink

  - CVE-2016-1674: Cross-origin bypass in extensions

  - CVE-2016-1675: Cross-origin bypass in Blink

  - CVE-2016-1676: Cross-origin bypass in extension bindings

  - CVE-2016-1677: Type confusion in V8

  - CVE-2016-1678: Heap overflow in V8

  - CVE-2016-1679: Heap use-after-free in V8 bindings

  - CVE-2016-1680: Heap use-after-free in Skia

  - CVE-2016-1681: Heap overflow in PDFium

  - CVE-2016-1682: CSP bypass for ServiceWorker

  - CVE-2016-1683: Out-of-bounds access in libxslt

  - CVE-2016-1684: Integer overflow in libxslt

  - CVE-2016-1685: Out-of-bounds read in PDFium

  - CVE-2016-1686: Out-of-bounds read in PDFium

  - CVE-2016-1687: Information leak in extensions

  - CVE-2016-1688: Out-of-bounds read in V8

  - CVE-2016-1689: Heap buffer overflow in media

  - CVE-2016-1690: Heap use-after-free in Autofill

  - CVE-2016-1691: Heap buffer-overflow in Skia

  - CVE-2016-1692: Limited cross-origin bypass in     ServiceWorker

  - CVE-2016-1693: HTTP Download of Software Removal Tool

  - CVE-2016-1694: HPKP pins removed on cache clearance

  - CVE-2016-1695: Various fixes from internal audits,     fuzzing and other initiatives

An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Chromium is an open source web browser, powered by WebKit (Blink).

This update upgrades Chromium to version 51.0.2704.63.

Security Fix(es) :

* Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when visited by the victim. (CVE-2016-1672, CVE-2016-1673, CVE-2016-1674, CVE-2016-1675, CVE-2016-1676, CVE-2016-1678, CVE-2016-1679, CVE-2016-1680, CVE-2016-1681, CVE-2016-1695, CVE-2016-1677, CVE-2016-1682, CVE-2016-1683, CVE-2016-1684, CVE-2016-1685, CVE-2016-1686, CVE-2016-1687, CVE-2016-1688, CVE-2016-1689, CVE-2016-1690, CVE-2016-1691, CVE-2016-1692, CVE-2016-1693, CVE-2016-1694)

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2016-1667     Mariusz Mylinski discovered a cross-origin bypass.

  - CVE-2016-1668     Mariusz Mylinski discovered a cross-origin bypass in     bindings to v8.

  - CVE-2016-1669     Choongwoo Han discovered a buffer overflow in the v8     JavaScript library.

  - CVE-2016-1670     A race condition was found that could cause the renderer     process to reuse ids that should have been unique.

  - CVE-2016-1672     Mariusz Mylinski discovered a cross-origin bypass in     extension bindings.

  - CVE-2016-1673     Mariusz Mylinski discovered a cross-origin bypass in     Blink/Webkit.

  - CVE-2016-1674     Mariusz Mylinski discovered another cross-origin bypass     in extension bindings.

  - CVE-2016-1675     Mariusz Mylinski discovered another cross-origin bypass     in Blink/Webkit.

  - CVE-2016-1676     Rob Wu discovered a cross-origin bypass in extension     bindings.

  - CVE-2016-1677     Guang Gong discovered a type confusion issue in the v8     JavaScript library.

  - CVE-2016-1678     Christian Holler discovered an overflow issue in the v8     JavaScript library.

  - CVE-2016-1679     Rob Wu discovered a use-after-free issue in the bindings     to v8.

  - CVE-2016-1680     Atte Kettunen discovered a use-after-free issue in the     skia library.

  - CVE-2016-1681     Aleksandar Nikolic discovered an overflow issue in the     pdfium library.

  - CVE-2016-1682     KingstonTime discovered a way to bypass the Content     Security Policy.

  - CVE-2016-1683     Nicolas Gregoire discovered an out-of-bounds write issue     in the libxslt library.

  - CVE-2016-1684     Nicolas Gregoire discovered an integer overflow issue in     the libxslt library.

  - CVE-2016-1685     Ke Liu discovered an out-of-bounds read issue in the     pdfium library.

  - CVE-2016-1686     Ke Liu discovered another out-of-bounds read issue in     the pdfium library.

  - CVE-2016-1687     Rob Wu discovered an information leak in the handling of     extensions.

  - CVE-2016-1688     Max Korenko discovered an out-of-bounds read issue in     the v8 JavaScript library.

  - CVE-2016-1689     Rob Wu discovered a buffer overflow issue.

  - CVE-2016-1690     Rob Wu discovered a use-after-free issue.

  - CVE-2016-1691     Atte Kettunen discovered a buffer overflow issue in the     skia library.

  - CVE-2016-1692     Til Jasper Ullrich discovered a cross-origin bypass     issue.

  - CVE-2016-1693     Khalil Zhani discovered that the Software Removal Tool     download was done over an HTTP connection.

  - CVE-2016-1694     Ryan Lester and Bryant Zadegan discovered that pinned     public keys would be removed when clearing the browser     cache.

  - CVE-2016-1695     The chrome development team found and fixed various     issues during internal auditing.

Chromium was updated to 51.0.2704.63 to fix the following vulnerabilities (boo#981886) :

  - CVE-2016-1672: Cross-origin bypass in extension bindings

  - CVE-2016-1673: Cross-origin bypass in Blink

  - CVE-2016-1674: Cross-origin bypass in extensions

  - CVE-2016-1675: Cross-origin bypass in Blink

  - CVE-2016-1676: Cross-origin bypass in extension bindings

  - CVE-2016-1677: Type confusion in V8

  - CVE-2016-1678: Heap overflow in V8

  - CVE-2016-1679: Heap use-after-free in V8 bindings

  - CVE-2016-1680: Heap use-after-free in Skia

  - CVE-2016-1681: Heap overflow in PDFium

  - CVE-2016-1682: CSP bypass for ServiceWorker

  - CVE-2016-1683: Out-of-bounds access in libxslt

  - CVE-2016-1684: Integer overflow in libxslt

  - CVE-2016-1685: Out-of-bounds read in PDFium

  - CVE-2016-1686: Out-of-bounds read in PDFium

  - CVE-2016-1687: Information leak in extensions

  - CVE-2016-1688: Out-of-bounds read in V8

  - CVE-2016-1689: Heap buffer overflow in media

  - CVE-2016-1690: Heap use-after-free in Autofill

  - CVE-2016-1691: Heap buffer-overflow in Skia

  - CVE-2016-1692: Limited cross-origin bypass in     ServiceWorker

  - CVE-2016-1693: HTTP Download of Software Removal Tool

  - CVE-2016-1694: HPKP pins removed on cache clearance

  - CVE-2016-1695: Various fixes from internal audits,     fuzzing and other initiatives

The version of Google Chrome installed on the remote macOS host is prior to 51.0.2704.63. It is, therefore, affected by multiple vulnerabilities as referenced in the 2016_05_stable-channel-update_25 advisory.

  - Multiple unspecified vulnerabilities in Google Chrome before 51.0.2704.63 allow attackers to cause a     denial of service or possibly have other impact via unknown vectors. (CVE-2016-1695)

  - The ModuleSystem::RequireForJsInner function in extensions/renderer/module_system.cc in the extension     bindings in Google Chrome before 51.0.2704.63 mishandles properties, which allows remote attackers to     conduct bindings-interception attacks and bypass the Same Origin Policy via unspecified vectors.
    (CVE-2016-1672)

  - Blink, as used in Google Chrome before 51.0.2704.63, allows remote attackers to bypass the Same Origin     Policy via unspecified vectors. (CVE-2016-1673)

  - The extensions subsystem in Google Chrome before 51.0.2704.63 allows remote attackers to bypass the Same     Origin Policy via unspecified vectors. (CVE-2016-1674)

  - Blink, as used in Google Chrome before 51.0.2704.63, allows remote attackers to bypass the Same Origin     Policy by leveraging the mishandling of Document reattachment during destruction, related to     FrameLoader.cpp and LocalFrame.cpp. (CVE-2016-1675)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 51.0.2704.63. It is, therefore, affected by multiple vulnerabilities as referenced in the 2016_05_stable-channel-update_25 advisory.

  - Multiple unspecified vulnerabilities in Google Chrome before 51.0.2704.63 allow attackers to cause a     denial of service or possibly have other impact via unknown vectors. (CVE-2016-1695)

  - The ModuleSystem::RequireForJsInner function in extensions/renderer/module_system.cc in the extension     bindings in Google Chrome before 51.0.2704.63 mishandles properties, which allows remote attackers to     conduct bindings-interception attacks and bypass the Same Origin Policy via unspecified vectors.
    (CVE-2016-1672)

  - Blink, as used in Google Chrome before 51.0.2704.63, allows remote attackers to bypass the Same Origin     Policy via unspecified vectors. (CVE-2016-1673)

  - The extensions subsystem in Google Chrome before 51.0.2704.63 allows remote attackers to bypass the Same     Origin Policy via unspecified vectors. (CVE-2016-1674)

  - Blink, as used in Google Chrome before 51.0.2704.63, allows remote attackers to bypass the Same Origin     Policy by leveraging the mishandling of Document reattachment during destruction, related to     FrameLoader.cpp and LocalFrame.cpp. (CVE-2016-1675)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
92351	GLSA-201607-07 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	high
91485	openSUSE Security Update : Chromium (openSUSE-2016-682)	Nessus	SuSE Local Security Checks	Local	high
91440	RHEL 6 : chromium-browser (RHSA-2016:1190)	Nessus	Red Hat Local Security Checks	Local	high
91429	Debian DSA-3590-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	Local	high
91404	openSUSE Security Update : Chromium (openSUSE-2016-652)	Nessus	SuSE Local Security Checks	Local	high
91351	Google Chrome < 51.0.2704.63 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	Local	high
91350	Google Chrome < 51.0.2704.63 Multiple Vulnerabilities	Nessus	Windows	Local	high

Detections

Analytics

CVE-2016-1676

high

Tenable Plugins

high

high

high

high

high

high

high