numbers.c in libxslt before 1.1.29, as used in Google Chrome before 51.0.2704.63, mishandles the i format token for xsl:number data, which allows remote attackers to cause a denial of service (integer overflow or resource consumption) or possibly have unspecified other impact via a crafted document.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - numbers.c in libxslt before 1.1.29, as used in Google Chrome before 51.0.2704.63, mishandles the i format     token for xsl:number data, which allows remote attackers to cause a denial of service (integer overflow or     resource consumption) or possibly have unspecified other impact via a crafted document. (CVE-2016-1684)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.2.2. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-23 advisory. Several of the third-party components were found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Nessus Network Monitor 6.2.2 updates the following components:

  - c-ares from version 1.10.0 to version 1.19.1.
  - curl from version 7.79.1 to version 8.1.2.
  - libbzip2 from version 1.0.6 to version 1.0.8.
  - libpcre from version 8.42 to version 8.44.
  - libxml2 from version 2.7.7 to version 2.11.1.
  - libxslt from version 1.1.26 to version 1.1.37.
  - libxmlsec from version 1.2.18 to version 1.2.37.
  - sqlite from version 3.27.2 to version 3.40.1.
  - jQuery Cookie from version 1.3.1 to version 1.4.1.
  - jQuery UI from version 1.13.0 to version 1.13.2.
  - OpenSSL from version 3.0.8 to version 3.0.9.

According to the versions of the libxslt packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - In numbers.c in libxslt 1.1.33, a type holding grouping     characters of an xsl:number instruction was too narrow     and an invalid character/length combination could be     passed to xsltNumberFormatDecimal, leading to a read of     uninitialized stack data.(CVE-2019-13118)

  - In numbers.c in libxslt 1.1.33, an xsl:number with     certain format strings could lead to a uninitialized     read in xsltNumberFormatInsertNumbers. This could allow     an attacker to discern whether a byte on the stack     contains the characters A, a, I, i, or 0, or any other     character.(CVE-2019-13117)

  - numbers.c in libxslt before 1.1.29, as used in Google     Chrome before 51.0.2704.63, mishandles the i format     token for xsl:number data, which allows remote     attackers to cause a denial of service (integer     overflow or resource consumption) or possibly have     unspecified other impact via a crafted     document.(CVE-2016-1684)

  - numbers.c in libxslt before 1.1.29, as used in Google     Chrome before 51.0.2704.63, mishandles namespace nodes,     which allows remote attackers to cause a denial of     service (out-of-bounds heap memory access) or possibly     have unspecified other impact via a crafted     document.(CVE-2016-1683)

  - The xsltStylePreCompute function in preproc.c in     libxslt 1.1.28 does not check if the parent node is an     element, which allows attackers to cause a denial of     service via a crafted XML file, related to a 'type     confusion' issue.(CVE-2015-7995)

  - In xsltCopyText in transform.c in libxslt 1.1.33, a     pointer variable isn't reset under certain     circumstances. If the relevant memory area happened to     be freed and reused in a certain way, a bounds check     could fail and memory outside a buffer could be written     to, or uninitialized data could be     disclosed.(CVE-2019-18197)

  - Type confusion in xsltNumberFormatGetMultipleLevel     prior to libxslt 1.1.33 could allow attackers to     potentially exploit heap corruption via crafted XML     data.(CVE-2019-5815)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libxslt packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - numbers.c in libxslt before 1.1.29, as used in Google     Chrome before 51.0.2704.63, mishandles the i format     token for xsl:number data, which allows remote     attackers to cause a denial of service (integer     overflow or resource consumption) or possibly have     unspecified other impact via a crafted     document.(CVE-2016-1684)

  - numbers.c in libxslt before 1.1.29, as used in Google     Chrome before 51.0.2704.63, mishandles namespace nodes,     which allows remote attackers to cause a denial of     service (out-of-bounds heap memory access) or possibly     have unspecified other impact via a crafted     document.(CVE-2016-1683)

  - A type confusion vulnerability was discovered in the     xsltStylePreCompute() function of libxslt. A remote     attacker could possibly exploit this flaw to cause an     application using libxslt to crash by tricking the     application into processing a specially crafted XSLT     document.(CVE-2015-7995)

  - In xsltCopyText in transform.c in libxslt 1.1.33, a     pointer variable isn't reset under certain     circumstances. If the relevant memory area happened to     be freed and reused in a certain way, a bounds check     could fail and memory outside a buffer could be written     to, or uninitialized data could be     disclosed.(CVE-2019-18197)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libxslt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The xsltStylePreCompute function in preproc.c in     libxslt 1.1.28 does not check if the parent node is an     element, which allows attackers to cause a denial of     service via a crafted XML file, related to a 'type     confusion' issue.(CVE-2015-7995)

  - numbers.c in libxslt before 1.1.29, as used in Google     Chrome before 51.0.2704.63, mishandles namespace nodes,     which allows remote attackers to cause a denial of     service (out-of-bounds heap memory access) or possibly     have unspecified other impact via a crafted     document.(CVE-2016-1683)

  - numbers.c in libxslt before 1.1.29, as used in Google     Chrome before 51.0.2704.63, mishandles the i format     token for xsl:number data, which allows remote     attackers to cause a denial of service (integer     overflow or resource consumption) or possibly have     unspecified other impact via a crafted     document.(CVE-2016-1684)

  - libxslt in Apple iOS before 9.3.3, OS X before 10.11.6,     iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on     Windows, tvOS before 9.2.2, and watchOS before 2.2.2     allows remote attackers to cause a denial of service     (memory corruption) or possibly have unspecified other     impact via unknown vectors, a different vulnerability     than CVE-2016-4608, CVE-2016-4609, CVE-2016-4610, and     CVE-2016-4612.(CVE-2016-4607)

  - libxslt in Apple iOS before 9.3.3, OS X before 10.11.6,     iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on     Windows, tvOS before 9.2.2, and watchOS before 2.2.2     allows remote attackers to cause a denial of service     (memory corruption) or possibly have unspecified other     impact via unknown vectors, a different vulnerability     than CVE-2016-4607, CVE-2016-4609, CVE-2016-4610, and     CVE-2016-4612.(CVE-2016-4608)

  - libxslt in Apple iOS before 9.3.3, OS X before 10.11.6,     iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on     Windows, tvOS before 9.2.2, and watchOS before 2.2.2     allows remote attackers to cause a denial of service     (memory corruption) or possibly have unspecified other     impact via unknown vectors, a different vulnerability     than CVE-2016-4607, CVE-2016-4608, CVE-2016-4610, and     CVE-2016-4612.(CVE-2016-4609)

  - libxslt in Apple iOS before 9.3.3, OS X before 10.11.6,     iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on     Windows, tvOS before 9.2.2, and watchOS before 2.2.2     allows remote attackers to cause a denial of service     (memory corruption) or possibly have unspecified other     impact via unknown vectors, a different vulnerability     than CVE-2016-4607, CVE-2016-4608, CVE-2016-4609, and     CVE-2016-4612.(CVE-2016-4610)

  - In xsltCopyText in transform.c in libxslt 1.1.33, a     pointer variable isn't reset under certain     circumstances. If the relevant memory area happened to     be freed and reused in a certain way, a bounds check     could fail and memory outside a buffer could be written     to, or uninitialized data could be     disclosed.(CVE-2019-18197)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libxslt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - This C library allows to transform XML files into other     XML files (or HTML, text, ...) using the standard XSLT     stylesheet transformation mechanism. To use it you need     to have a version of libxml2 i1/4z= 2.6.27 installed. The     xsltproc command is a command line interface to the     XSLT engine.Security Fix(es):In xsltCopyText in     transform.c in libxslt 1.1.33, a pointer variable isn't     reset under certain circumstances. If the relevant     memory area happened to be freed and reused in a     certain way, a bounds check could fail and memory     outside a buffer could be written to, or uninitialized     data could be disclosed.(CVE-2019-18197)The     xsltStylePreCompute function in preproc.c in libxslt     1.1.28 does not check if the parent node is an element,     which allows attackers to cause a denial of service via     a crafted XML file, related to a 'type confusion'     issue.(CVE-2015-7995)numbers.c in libxslt before     1.1.29, as used in Google Chrome before 51.0.2704.63,     mishandles namespace nodes, which allows remote     attackers to cause a denial of service (out-of-bounds     heap memory access) or possibly have unspecified other     impact via a crafted document.(CVE-2016-1683)numbers.c     in libxslt before 1.1.29, as used in Google Chrome     before 51.0.2704.63, mishandles the i format token for     xsl:number data, which allows remote attackers to cause     a denial of service (integer overflow or resource     consumption) or possibly have unspecified other impact     via a crafted document.(CVE-2016-1684)libxslt in Apple     iOS before 9.3.3, OS X before 10.11.6, iTunes before     12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS     before 9.2.2, and watchOS before 2.2.2 allows remote     attackers to cause a denial of service (memory     corruption) or possibly have unspecified other impact     via unknown vectors, a different vulnerability than     CVE-2016-4608, CVE-2016-4609, CVE-2016-4610, and     CVE-2016-4612.(CVE-2016-4607)libxslt in Apple iOS     before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2     on Windows, iCloud before 5.2.1 on Windows, tvOS before     9.2.2, and watchOS before 2.2.2 allows remote attackers     to cause a denial of service (memory corruption) or     possibly have unspecified other impact via unknown     vectors, a different vulnerability than CVE-2016-4607,     CVE-2016-4609, CVE-2016-4610, and     CVE-2016-4612.(CVE-2016-4608)libxslt in Apple iOS     before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2     on Windows, iCloud before 5.2.1 on Windows, tvOS before     9.2.2, and watchOS before 2.2.2 allows remote attackers     to cause a denial of service (memory corruption) or     possibly have unspecified other impact via unknown     vectors, a different vulnerability than CVE-2016-4607,     CVE-2016-4608, CVE-2016-4610, and     CVE-2016-4612.(CVE-2016-4609)libxslt in Apple iOS     before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2     on Windows, iCloud before 5.2.1 on Windows, tvOS before     9.2.2, and watchOS before 2.2.2 allows remote attackers     to cause a denial of service (memory corruption) or     possibly have unspecified other impact via unknown     vectors, a different vulnerability than CVE-2016-4607,     CVE-2016-4608, CVE-2016-4609, and     CVE-2016-4612.(CVE-2016-4610)** REJECT ** DO NOT USE     THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-1683.
    Reason: This candidate is a reservation duplicate of     CVE-2016-1683. Notes: All CVE users should reference     CVE-2016-1683 instead of this candidate. All references     and descriptions in this candidate have been removed to     prevent accidental usage.(CVE-2016-4612)In numbers.c in     libxslt 1.1.33, an xsl:number with certain format     strings could lead to a uninitialized read in     xsltNumberFormatInsertNumbers. This could allow an     attacker to discern whether a byte on the stack     contains the characters A, a, I, i, or 0, or any other     character.(CVE-2019-13117)In numbers.c in libxslt     1.1.33, a type holding grouping characters of an     xsl:number instruction was too narrow and an invalid     character/length combination could be passed to     xsltNumberFormatDecimal, leading to a read of     uninitialized stack data.(CVE-2019-13118)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libxslt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The xsltStylePreCompute function in preproc.c in     libxslt 1.1.28 does not check if the parent node is an     element, which allows attackers to cause a denial of     service via a crafted XML file, related to a 'type     confusion' issue.(CVE-2015-7995)

  - numbers.c in libxslt before 1.1.29, as used in Google     Chrome before 51.0.2704.63, mishandles namespace nodes,     which allows remote attackers to cause a denial of     service (out-of-bounds heap memory access) or possibly     have unspecified other impact via a crafted     document.(CVE-2016-1683)

  - numbers.c in libxslt before 1.1.29, as used in Google     Chrome before 51.0.2704.63, mishandles the i format     token for xsl:number data, which allows remote     attackers to cause a denial of service (integer     overflow or resource consumption) or possibly have     unspecified other impact via a crafted     document.(CVE-2016-1684)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 1.1.33

Fix CVE-2016-1841, CVE-2016-4607, CVE-2016-4608, CVE-2016-4610, CVE-2016-4609, CVE-2019-11068, CVE-2016-1684, CVE-2016-1683, CVE-2016-4738.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3271-1 advisory.

    Holger Fuhrmannek discovered an integer overflow in the xsltAddTextString() function in Libxslt. An     attacker could use this to craft a malicious document that, when opened, could cause a denial of service     (application crash) or possible execute arbitrary code. (CVE-2017-5029)

    Nicolas Gregoire discovered that Libxslt mishandled namespace nodes. An attacker could use this to craft a     malicious document that, when opened, could cause a denial of service (application crash) or possibly     execute arbtrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 14.04 LTS, and Ubuntu 12.04 LTS.
    (CVE-2016-1683)

    Sebastian Apelt discovered that a use-after-error existed in the xsltDocumentFunctionLoadDocument()     function in Libxslt. An attacker could use this to craft a malicious document that, when opened, could     cause a denial of service (application crash) or possibly execute arbitrary code. This issue only affected     Ubuntu 16.04 LTS, Ubuntu 14.04 LTS, and Ubuntu 12.04 LTS. (CVE-2016-1841)

    It was discovered that a type confusion error existed in the xsltStylePreCompute() function in Libxslt. An     attacker could use this to craft a malicious XML file that, when opened, caused a denial of service     (application crash). This issue only affected Ubuntu 14.04 LTS and Ubuntu 12.04 LTS. (CVE-2015-7995)

    Nicolas Gregoire discovered the Libxslt mishandled the 'i' and 'a' format tokens for xsl:number data. An     attacker could use this to craft a malicious document that, when opened, could cause a denial of service     (application crash). This issue only affected Ubuntu 16.04 LTS, Ubuntu 14.04 LTS, and Ubuntu 12.04 LTS.
    (CVE-2016-1684)

    It was discovered that the xsltFormatNumberConversion() function in Libxslt did not properly handle empty     decimal separators. An attacker could use this to craft a malicious document that, when opened, could     cause a denial of service (application crash). This issue only affected Ubuntu 16.10, Ubuntu 16.04 LTS,     Ubuntu 14.04 LTS, and Ubuntu 12.04 LTS. (CVE-2016-4738)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is running a version of Mac OS X that is 10.9.5 or 10.10.5 and is missing Security Update 2016-004. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache_mod_php (affects 10.10.5 only)
  - CoreGraphics
  - ImageIO
  - libxml2
  - libxslt

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The remote host is running a version of Mac OS X that is 10.11.x prior to 10.11.6. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache_mod_php
  - Audio
  - bsdiff
  - CFNetwork
  - CoreGraphics
  - FaceTime
  - Graphics Drivers
  - ImageIO
  - Intel Graphics Driver
  - IOHIDFamily
  - IOKit
  - IOSurface
  - Kernel
  - libc++abi
  - libexpat
  - LibreSSL
  - libxml2
  - libxslt
  - Login Window
  - OpenSSL
  - QuickTime
  - Safari Login AutoFill
  - Sandbox Profiles

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

According to its banner, the version of the remote Apple TV device is prior to 9.2.2. It is, therefore, affected by multiple vulnerabilities in the following components :

  - CoreGraphics
  - ImageIO
  - IOAcceleratorFamily
  - IOHIDFamily
  - Kernel
  - libxml2
  - libxslt
  - Sandbox Profiles
  - WebKit
  - WebKit Page Loading

Note that only 4th generation models are affected by the vulnerabilities.

The version of Apple iTunes running on the remote Windows host is prior to 12.4.2. It is, therefore, affected by multiple vulnerabilities :

  - Multiple memory corruption issues exist in the libxslt     component due to improper validation of user-supplied     input. An unauthenticated, remote attacker can exploit     this to cause a denial of service condition or the     execution of arbitrary code. (CVE-2016-1684,     CVE-2016-4607, CVE-2016-4608, CVE-2016-4609,     CVE-2016-4610, CVE-2016-4612)

  - Multiple memory corruption issues exist in the libxml2     component that allow a remote attacker to cause a denial     of service condition or the execution of arbitrary code.
    (CVE-2016-1836, CVE-2016-4447, CVE-2016-4448,     CVE-2016-4483, CVE-2016-4614, CVE-2016-4615,     CVE-2016-4616, CVE-2016-4619)

  - An XXE (Xml eXternal Entity) injection vulnerability     exists in the libxml2 component due to an incorrectly     configured XML parser accepting XML external entities     from an untrusted source. A remote attacker can exploit     this, via a specially crafted XML file, to disclose     arbitrary files and user information. (CVE-2016-4449)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apple iTunes installed on the remote Windows host is prior to 12.4.2. It is, therefore, affected by multiple vulnerabilities :

  - Multiple memory corruption issues exist in the libxslt     component due to improper validation of user-supplied     input. An unauthenticated, remote attacker can exploit     this to cause a denial of service condition or the     execution of arbitrary code. (CVE-2016-1684,     CVE-2016-4607, CVE-2016-4608, CVE-2016-4609,     CVE-2016-4610, CVE-2016-4612)

  - Multiple memory corruption issues exist in the libxml2     component that allow a remote attacker to cause a denial     of service condition or the execution of arbitrary code.
    (CVE-2016-1836, CVE-2016-4447, CVE-2016-4448,     CVE-2016-4483, CVE-2016-4614, CVE-2016-4615,     CVE-2016-4616, CVE-2016-4619)

  - An XXE (Xml eXternal Entity) injection vulnerability     exists in the libxml2 component due to an incorrectly     configured XML parser accepting XML external entities     from an untrusted source. A remote attacker can exploit     this, via a specially crafted XML file, to disclose     arbitrary files and user information. (CVE-2016-4449)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of iOS running on the mobile device is prior to 9.3.3. It is, therefore, affected by multiple vulnerabilities, the most serious of which can result in remote code execution, in the following components :

  - Calendar
  - CoreGraphics
  - FaceTime
  - ImageIO
  - IOAcceleratorFamily
  - IOHIDFamily
  - Kernel
  - libxml2
  - libxslt
  - Safari
  - Sandbox Profiles
  - Siri Contacts
  - Web Media
  - WebKit
  - WebKit JavaScript Bindings
  - WebKit Page Loading

The remote host is affected by the vulnerability described in GLSA-201607-07 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in the Chromium web       browser. Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information, or bypass security restrictions.
  Workaround :

    There is no known workaround at this time.

Google reports :

- [583156] Medium CVE-2016-1683: Out-of-bounds access in libxslt.
Credit to Nicolas Gregoire.

- [583171] Medium CVE-2016-1684: Integer overflow in libxslt. Credit to Nicolas Gregoire.

Several vulnerabilities were discovered in libxslt, an XSLT processing runtime library, which could lead to information disclosure or denial-of-service (application crash) against an application using the libxslt library.

Several vulnerabilities were found in libxslt.

CVE-2015-7995

A missing type check could cause an application crash via a especially crafted file.

CVE-2016-1683

An out of bounds heap access bug was found in libxslt.

CVE-2016-1684

There was an integer overflow bug in libxslt that could lead to an application crash.

For Debian 7 'Wheezy', these problems have been fixed in version 1.1.26-14.1+deb7u1.

We recommend that you upgrade your libxslt packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2992-1 advisory.

    An unspecified security issue was discovered in Blink. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit this to bypass same-origin restrictions.
    (CVE-2016-1673)

    An issue was discovered with Document reattachment in Blink in some circumstances. If a user were tricked     in to opening a specially crafted website, an attacker could potentially exploit this to bypass same-     origin restrictions. (CVE-2016-1675)

    A type confusion bug was discovered in V8. If a user were tricked in to opening a specially crafted     website, an attacker could potentially exploit this to obtain sensitive information. (CVE-2016-1677)

    A heap overflow was discovered in V8. If a user were tricked in to opening a specially crafted website, an     attacker could potentially exploit this to cause a denial of service (application crash) or execute     arbitrary code. (CVE-2016-1678)

    A use-after-free was discovered in the V8ValueConverter implementation in Chromium in some circumstances.
    If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit     this to cause a denial of service (application crash) or execute arbitrary code. (CVE-2016-1679)

    A use-after-free was discovered in Skia. If a user were tricked in to opening a specially crafted website,     an attacker could potentially exploit this to cause a denial of service (application crash) or execute     arbitrary code. (CVE-2016-1680)

    A security issue was discovered in ServiceWorker registration in Blink in some circumstances. If a user     were tricked in to opening a specially crafted website, an attacker could potentially exploit this to     bypass Content Security Policy (CSP) protections. (CVE-2016-1682)

    An out-of-bounds memory access was discovered in libxslt. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit this to cause a denial of service (application     crash) or execute arbitrary code. (CVE-2016-1683)

    An integer overflow was discovered in libxslt. If a user were tricked in to opening a specially crafted     website, an attacker could potentially exploit this to cause a denial of service (application crash or     resource consumption). (CVE-2016-1684)

    An out-of-bounds read was discovered in the regular expression implementation in V8. If a user were     tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a     denial of service (application crash). (CVE-2016-1688)

    A heap overflow was discovered in Chromium. If a user were tricked in to opening a specially crafted     website, an attacker could potentially exploit this to cause a denial of service (application crash) or     execute arbitrary code. (CVE-2016-1689)

    A heap overflow was discovered in Skia. If a user were tricked in to opening a specially crafted website,     an attacker could potentially exploit this to cause a denial of service (application crash) or execute     arbitrary code. (CVE-2016-1691)

    It was discovered that Blink permits cross-origin loading of stylesheets by a service worker even when the     stylesheet download has an incorrect MIME type. If a user were tricked in to opening a specially crafted     website, an attacker could potentially exploit this to bypass same-origin restrictions. (CVE-2016-1692)

    Multiple security issues were discovered in Chromium. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial     of service (application crash) or execute arbitrary code. (CVE-2016-1695, CVE-2016-1703)

    It was discovered that Blink does not prevent frame navigation during DocumentLoader detach operations. If     a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this     to bypass same-origin restrictions. (CVE-2016-1697)

    A parameter sanitization bug was discovered in the devtools subsystem in Blink. An attacker could     potentially exploit this to bypass intended access restrictions. (CVE-2016-1699)

    An out-of-bounds read was discovered in Skia. If a user were tricked in to opening a specially crafted     website, an attacker could potentially exploit this to cause a denial of service (application crash).
    (CVE-2016-1702)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Chromium was updated to 51.0.2704.79 to fix the following vulnerabilities :

  - CVE-2016-1696: Cross-origin bypass in Extension bindings

  - CVE-2016-1697: Cross-origin bypass in Blink

  - CVE-2016-1698: Information leak in Extension bindings

  - CVE-2016-1699: Parameter sanitization failure in     DevTools

  - CVE-2016-1700: Use-after-free in Extensions

  - CVE-2016-1701: Use-after-free in Autofill

  - CVE-2016-1702: Out-of-bounds read in Skia

  - CVE-2016-1703: Various fixes from internal audits,     fuzzing and other initiatives Also includes     vulnerabilities fixed in 51.0.2704.63 (boo#981886) :

  - CVE-2016-1672: Cross-origin bypass in extension bindings

  - CVE-2016-1673: Cross-origin bypass in Blink

  - CVE-2016-1674: Cross-origin bypass in extensions

  - CVE-2016-1675: Cross-origin bypass in Blink

  - CVE-2016-1676: Cross-origin bypass in extension bindings

  - CVE-2016-1677: Type confusion in V8

  - CVE-2016-1678: Heap overflow in V8

  - CVE-2016-1679: Heap use-after-free in V8 bindings

  - CVE-2016-1680: Heap use-after-free in Skia

  - CVE-2016-1681: Heap overflow in PDFium

  - CVE-2016-1682: CSP bypass for ServiceWorker

  - CVE-2016-1683: Out-of-bounds access in libxslt

  - CVE-2016-1684: Integer overflow in libxslt

  - CVE-2016-1685: Out-of-bounds read in PDFium

  - CVE-2016-1686: Out-of-bounds read in PDFium

  - CVE-2016-1687: Information leak in extensions

  - CVE-2016-1688: Out-of-bounds read in V8

  - CVE-2016-1689: Heap buffer overflow in media

  - CVE-2016-1690: Heap use-after-free in Autofill

  - CVE-2016-1691: Heap buffer-overflow in Skia

  - CVE-2016-1692: Limited cross-origin bypass in     ServiceWorker

  - CVE-2016-1693: HTTP Download of Software Removal Tool

  - CVE-2016-1694: HPKP pins removed on cache clearance

  - CVE-2016-1695: Various fixes from internal audits,     fuzzing and other initiatives

An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Chromium is an open source web browser, powered by WebKit (Blink).

This update upgrades Chromium to version 51.0.2704.63.

Security Fix(es) :

* Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when visited by the victim. (CVE-2016-1672, CVE-2016-1673, CVE-2016-1674, CVE-2016-1675, CVE-2016-1676, CVE-2016-1678, CVE-2016-1679, CVE-2016-1680, CVE-2016-1681, CVE-2016-1695, CVE-2016-1677, CVE-2016-1682, CVE-2016-1683, CVE-2016-1684, CVE-2016-1685, CVE-2016-1686, CVE-2016-1687, CVE-2016-1688, CVE-2016-1689, CVE-2016-1690, CVE-2016-1691, CVE-2016-1692, CVE-2016-1693, CVE-2016-1694)

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2016-1667     Mariusz Mylinski discovered a cross-origin bypass.

  - CVE-2016-1668     Mariusz Mylinski discovered a cross-origin bypass in     bindings to v8.

  - CVE-2016-1669     Choongwoo Han discovered a buffer overflow in the v8     JavaScript library.

  - CVE-2016-1670     A race condition was found that could cause the renderer     process to reuse ids that should have been unique.

  - CVE-2016-1672     Mariusz Mylinski discovered a cross-origin bypass in     extension bindings.

  - CVE-2016-1673     Mariusz Mylinski discovered a cross-origin bypass in     Blink/Webkit.

  - CVE-2016-1674     Mariusz Mylinski discovered another cross-origin bypass     in extension bindings.

  - CVE-2016-1675     Mariusz Mylinski discovered another cross-origin bypass     in Blink/Webkit.

  - CVE-2016-1676     Rob Wu discovered a cross-origin bypass in extension     bindings.

  - CVE-2016-1677     Guang Gong discovered a type confusion issue in the v8     JavaScript library.

  - CVE-2016-1678     Christian Holler discovered an overflow issue in the v8     JavaScript library.

  - CVE-2016-1679     Rob Wu discovered a use-after-free issue in the bindings     to v8.

  - CVE-2016-1680     Atte Kettunen discovered a use-after-free issue in the     skia library.

  - CVE-2016-1681     Aleksandar Nikolic discovered an overflow issue in the     pdfium library.

  - CVE-2016-1682     KingstonTime discovered a way to bypass the Content     Security Policy.

  - CVE-2016-1683     Nicolas Gregoire discovered an out-of-bounds write issue     in the libxslt library.

  - CVE-2016-1684     Nicolas Gregoire discovered an integer overflow issue in     the libxslt library.

  - CVE-2016-1685     Ke Liu discovered an out-of-bounds read issue in the     pdfium library.

  - CVE-2016-1686     Ke Liu discovered another out-of-bounds read issue in     the pdfium library.

  - CVE-2016-1687     Rob Wu discovered an information leak in the handling of     extensions.

  - CVE-2016-1688     Max Korenko discovered an out-of-bounds read issue in     the v8 JavaScript library.

  - CVE-2016-1689     Rob Wu discovered a buffer overflow issue.

  - CVE-2016-1690     Rob Wu discovered a use-after-free issue.

  - CVE-2016-1691     Atte Kettunen discovered a buffer overflow issue in the     skia library.

  - CVE-2016-1692     Til Jasper Ullrich discovered a cross-origin bypass     issue.

  - CVE-2016-1693     Khalil Zhani discovered that the Software Removal Tool     download was done over an HTTP connection.

  - CVE-2016-1694     Ryan Lester and Bryant Zadegan discovered that pinned     public keys would be removed when clearing the browser     cache.

  - CVE-2016-1695     The chrome development team found and fixed various     issues during internal auditing.

Chromium was updated to 51.0.2704.63 to fix the following vulnerabilities (boo#981886) :

  - CVE-2016-1672: Cross-origin bypass in extension bindings

  - CVE-2016-1673: Cross-origin bypass in Blink

  - CVE-2016-1674: Cross-origin bypass in extensions

  - CVE-2016-1675: Cross-origin bypass in Blink

  - CVE-2016-1676: Cross-origin bypass in extension bindings

  - CVE-2016-1677: Type confusion in V8

  - CVE-2016-1678: Heap overflow in V8

  - CVE-2016-1679: Heap use-after-free in V8 bindings

  - CVE-2016-1680: Heap use-after-free in Skia

  - CVE-2016-1681: Heap overflow in PDFium

  - CVE-2016-1682: CSP bypass for ServiceWorker

  - CVE-2016-1683: Out-of-bounds access in libxslt

  - CVE-2016-1684: Integer overflow in libxslt

  - CVE-2016-1685: Out-of-bounds read in PDFium

  - CVE-2016-1686: Out-of-bounds read in PDFium

  - CVE-2016-1687: Information leak in extensions

  - CVE-2016-1688: Out-of-bounds read in V8

  - CVE-2016-1689: Heap buffer overflow in media

  - CVE-2016-1690: Heap use-after-free in Autofill

  - CVE-2016-1691: Heap buffer-overflow in Skia

  - CVE-2016-1692: Limited cross-origin bypass in     ServiceWorker

  - CVE-2016-1693: HTTP Download of Software Removal Tool

  - CVE-2016-1694: HPKP pins removed on cache clearance

  - CVE-2016-1695: Various fixes from internal audits,     fuzzing and other initiatives

The version of Google Chrome installed on the remote Mac OS X host is prior to 51.0.2704.63. It is, therefore, affected by multiple vulnerabilities :

  - Multiple unspecified flaws exist in extension bindings     that allow a remote attacker to bypass the same-origin     policy. No other details are available. (CVE-2016-1672,     CVE-2016-1676)

  - Multiple unspecified flaws exist in Blink that allow a     remote attacker to bypass the same-origin policy. No     other details are available. (CVE-2016-1673,     CVE-2016-1675)

  - An unspecified flaw exists in Extensions that allows a     remote attacker to bypass the same-origin policy.
    No other details are available. (CVE-2016-1674)

  - An unspecified type confusion error exists in V8     decodeURI that allows a remote attacker to disclose     potentially sensitive information. (CVE-2016-1677)

  - A heap buffer overflow condition exists in V8 due to     improper validation of user-supplied input. A remote     attacker can exploit this to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2016-1678)

  - A heap use-after-free error exists in V8 bindings that     allows a remote attacker to deference already freed     memory and execute arbitrary code. (CVE-2016-1679)

  - A heap use-after-free error exists in Google Skia that     allows a remote attacker to deference already freed     memory and execute arbitrary code. (CVE-2016-1680)

  - A buffer overflow condition exists in OpenJPEG in the     opj_j2k_read_SPCod_SPCoc() function within file j2k.c     due to improper validation of user-supplied input. A     remote attacker can exploit this to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2016-1681)

  - An unspecified flaw exists in ServiceWorker that allows     a remote attacker to bypass the Content Security Policy     (CSP). No other details are available. (CVE-2016-1682)

  - An unspecified out-of-bounds access error exists in     libxslt that allows a remote attacker to have an     unspecified impact. (CVE-2016-1683)

  - An integer overflow condition exists in libxslt that     allows a remote attacker to have an unspecified impact.
    (CVE-2016-1684)

  - Multiple out-of-bounds read errors exist in PDFium that     allow a remote attacker to cause a denial of service     condition or disclose potentially sensitive information.
    (CVE-2016-1685, CVE-2016-1686)

  - An unspecified flaw exists in Extensions that allows a     remote attacker to disclose potentially sensitive     information. No other details are available.
    (CVE-2016-1687)

  - An out-of-bounds read error exists in V8 that allows a     remote attacker to cause a denial of service condition     or disclose potentially sensitive information.
    (CVE-2016-1688)

  - A heap buffer overflow condition exists in Media due to     improper validation of user-supplied input. A remote     attacker can exploit this to execute arbitrary code.
    (CVE-2016-1689)

  - A heap use-after-free error exists in Autofill that     allows a remote attacker to execute arbitrary code.
    (CVE-2016-1690)

  - A heap buffer overflow condition exists in Google Skia     due to improper validation of user-supplied input. A     remote attacker can exploit this to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2016-1691)

  - An unspecified flaw exists in ServiceWorker that allows     a remote attacker to carry out a limited bypass of the     same-origin policy. No other details are available.
    (CVE-2016-1692)

  - A flaw exists due to the Software Removal Tool being     downloaded over an HTTP connection. A man-in-the-middle     attacker can exploit this to manipulate its contents.
    (CVE-2016-1693)

  - A unspecified flaw exists that is triggered when HTTP     Public Key Pinning (HPKP) pins are removed when clearing     the cache. No other details are available.
    (CVE-2016-1694)

  - Multiple unspecified issues exist that allow a remote     attacker to execute arbitrary code. (CVE-2016-1695)

  - A use-after-free error exists in 'MailboxManagerImpl'     that is triggered when handling GPU commands. A remote     attacker can exploit this to dereference already freed     memory, resulting in the execution of arbitrary code.

The version of Google Chrome installed on the remote Windows host is prior to 51.0.2704.63. It is, therefore, affected by multiple vulnerabilities :

  - Multiple unspecified flaws exist in extension bindings     that allow a remote attacker to bypass the same-origin     policy. No other details are available. (CVE-2016-1672,     CVE-2016-1676)

  - Multiple unspecified flaws exist in Blink that allow a     remote attacker to bypass the same-origin policy. No     other details are available. (CVE-2016-1673,     CVE-2016-1675)

  - An unspecified flaw exists in Extensions that allows a     remote attacker to bypass the same-origin policy.
    No other details are available. (CVE-2016-1674)

  - An unspecified type confusion error exists in V8     decodeURI that allows a remote attacker to disclose     potentially sensitive information. (CVE-2016-1677)

  - A heap buffer overflow condition exists in V8 due to     improper validation of user-supplied input. A remote     attacker can exploit this to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2016-1678)

  - A heap use-after-free error exists in V8 bindings that     allows a remote attacker to deference already freed     memory and execute arbitrary code. (CVE-2016-1679)

  - A heap use-after-free error exists in Google Skia that     allows a remote attacker to deference already freed     memory and execute arbitrary code. (CVE-2016-1680)

  - A buffer overflow condition exists in OpenJPEG in the     opj_j2k_read_SPCod_SPCoc() function within file j2k.c     due to improper validation of user-supplied input. A     remote attacker can exploit this to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2016-1681)

  - An unspecified flaw exists in ServiceWorker that allows     a remote attacker to bypass the Content Security Policy     (CSP). No other details are available. (CVE-2016-1682)

  - An unspecified out-of-bounds access error exists in     libxslt that allows a remote attacker to have an     unspecified impact. (CVE-2016-1683)

  - An integer overflow condition exists in libxslt that     allows a remote attacker to have an unspecified impact.
    (CVE-2016-1684)

  - Multiple out-of-bounds read errors exist in PDFium that     allow a remote attacker to cause a denial of service     condition or disclose potentially sensitive information.
    (CVE-2016-1685, CVE-2016-1686)

  - An unspecified flaw exists in Extensions that allows a     remote attacker to disclose potentially sensitive     information. No other details are available.
    (CVE-2016-1687)

  - An out-of-bounds read error exists in V8 that allows a     remote attacker to cause a denial of service condition     or disclose potentially sensitive information.
    (CVE-2016-1688)

  - A heap buffer overflow condition exists in Media due to     improper validation of user-supplied input. A remote     attacker can exploit this to execute arbitrary code.
    (CVE-2016-1689)

  - A heap use-after-free error exists in Autofill that     allows a remote attacker to execute arbitrary code.
    (CVE-2016-1690)

  - A heap buffer overflow condition exists in Google Skia     due to improper validation of user-supplied input. A     remote attacker can exploit this to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2016-1691)

  - An unspecified flaw exists in ServiceWorker that allows     a remote attacker to carry out a limited bypass of the     same-origin policy. No other details are available.
    (CVE-2016-1692)

  - A flaw exists due to the Software Removal Tool being     downloaded over an HTTP connection. A man-in-the-middle     attacker can exploit this to manipulate its contents.
    (CVE-2016-1693)

  - A unspecified flaw exists that is triggered when HTTP     Public Key Pinning (HPKP) pins are removed when clearing     the cache. No other details are available.
    (CVE-2016-1694)

  - Multiple unspecified issues exist that allow a remote     attacker to execute arbitrary code. (CVE-2016-1695)

  - A use-after-free error exists in 'MailboxManagerImpl'     that is triggered when handling GPU commands. A remote     attacker can exploit this to dereference already freed     memory, resulting in the execution of arbitrary code.

ID	Name	Product	Family	Severity
219276	Linux Distros Unpatched Vulnerability : CVE-2016-1684	Nessus	Misc.	high
177842	Nessus Network Monitor < 6.2.2 Multiple Vulnerabilities (TNS-2023-23)	Nessus	Misc.	critical
135571	EulerOS Virtualization 3.0.2.2 : libxslt (EulerOS-SA-2020-1442)	Nessus	Huawei Local Security Checks	high
134504	EulerOS Virtualization for ARM 64 3.0.2.0 : libxslt (EulerOS-SA-2020-1215)	Nessus	Huawei Local Security Checks	high
132162	EulerOS 2.0 SP3 : libxslt (EulerOS-SA-2019-2627)	Nessus	Huawei Local Security Checks	critical
131672	EulerOS 2.0 SP2 : libxslt (EulerOS-SA-2019-2519)	Nessus	Huawei Local Security Checks	critical
130674	EulerOS 2.0 SP5 : libxslt (EulerOS-SA-2019-2212)	Nessus	Huawei Local Security Checks	high
126015	Fedora 30 : mingw-libxslt (2019-320d5295fc)	Nessus	Fedora Local Security Checks	critical
99725	Ubuntu 14.04 LTS / 16.04 LTS : Libxslt vulnerabilities (USN-3271-1)	Nessus	Ubuntu Local Security Checks	high
92497	Mac OS X 10.9.5 and 10.10.5 Multiple Vulnerabilities (Security Update 2016-004)	Nessus	MacOS X Local Security Checks	critical
92496	Mac OS X 10.11.x < 10.11.6 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
92494	Apple TV < 9.2.2 Multiple Vulnerabilities	Nessus	Misc.	critical
92411	Apple iTunes < 12.4.2 Multiple Vulnerabilities (uncredentialed check)	Nessus	Peer-To-Peer File Sharing	critical
92410	Apple iTunes < 12.4.2 Multiple Vulnerabilities (credentialed check)	Nessus	Windows	critical
92359	Apple iOS < 9.3.3 Multiple Vulnerabilities	Nessus	Mobile Devices	critical
92351	GLSA-201607-07 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
91720	FreeBSD : libxslt -- Denial of Service (1a2aa04f-3718-11e6-b3c8-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	high
91693	Debian DSA-3605-1 : libxslt - security update	Nessus	Debian Local Security Checks	high
91578	Debian DLA-514-1 : libxslt security update	Nessus	Debian Local Security Checks	high
91498	Ubuntu 14.04 LTS / 16.04 LTS : Oxide vulnerabilities (USN-2992-1)	Nessus	Ubuntu Local Security Checks	high
91485	openSUSE Security Update : Chromium (openSUSE-2016-682)	Nessus	SuSE Local Security Checks	high
91440	RHEL 6 : chromium-browser (RHSA-2016:1190)	Nessus	Red Hat Local Security Checks	high
91429	Debian DSA-3590-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	high
91404	openSUSE Security Update : Chromium (openSUSE-2016-652)	Nessus	SuSE Local Security Checks	high
91351	Google Chrome < 51.0.2704.63 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
91350	Google Chrome < 51.0.2704.63 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2016-1684

high

Tenable Plugins

high

critical

high

high

critical

critical

high

critical

high

critical

critical

critical

critical

critical

critical

high

high

high

high

high

high

high

high

high

high

high