ios/web/web_state/ui/crw_web_controller.mm in Google Chrome before 52.0.2743.82 on iOS does not ensure that an invalid URL is replaced with the about:blank URL, which allows remote attackers to spoof the URL display via a crafted web site.

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2016-1704     The chrome development team found and fixed various     issues during internal auditing.

  - CVE-2016-1705     The chrome development team found and fixed various     issues during internal auditing.

  - CVE-2016-1706     Pinkie Pie discovered a way to escape the Pepper Plugin     API sandbox.

  - CVE-2016-1707     xisigr discovered a URL spoofing issue.

  - CVE-2016-1708     Adam Varsan discovered a use-after-free issue.

  - CVE-2016-1709     ChenQin discovered a buffer overflow issue in the sfntly     library.

  - CVE-2016-1710     Mariusz Mlynski discovered a same-origin bypass.

  - CVE-2016-1711     Mariusz Mlynski discovered another same-origin bypass.

  - CVE-2016-5127     cloudfuzzer discovered a use-after-free issue.

  - CVE-2016-5128     A same-origin bypass issue was discovered in the v8     JavaScript library.

  - CVE-2016-5129     Jeonghoon Shin discovered a memory corruption issue in     the v8 JavaScript library.

  - CVE-2016-5130     Widih Matar discovered a URL spoofing issue.

  - CVE-2016-5131     Nick Wellnhofer discovered a use-after-free issue in the     libxml2 library.

  - CVE-2016-5132     Ben Kelly discovered a same-origin bypass.

  - CVE-2016-5133     Patch Eudor discovered an issue in proxy authentication.

  - CVE-2016-5134     Paul Stone discovered an information leak in the Proxy     Auto-Config feature.

  - CVE-2016-5135     ShenYeYinJiu discovered a way to bypass the Content     Security Policy.

  - CVE-2016-5136     Rob Wu discovered a use-after-free issue.

  - CVE-2016-5137     Xiaoyin Liu discovered a way to discover whether an HSTS     website had been visited.

Chromium was updated to 52.0.2743.82 to fix the following security issues (boo#989901) :

  - CVE-2016-1706: Sandbox escape in PPAPI

  - CVE-2016-1707: URL spoofing on iOS

  - CVE-2016-1708: Use-after-free in Extensions

  - CVE-2016-1709: Heap-buffer-overflow in sfntly

  - CVE-2016-1710: Same-origin bypass in Blink

  - CVE-2016-1711: Same-origin bypass in Blink

  - CVE-2016-5127: Use-after-free in Blink

  - CVE-2016-5128: Same-origin bypass in V8

  - CVE-2016-5129: Memory corruption in V8

  - CVE-2016-5130: URL spoofing

  - CVE-2016-5131: Use-after-free in libxml

  - CVE-2016-5132: Limited same-origin bypass in Service     Workers

  - CVE-2016-5133: Origin confusion in proxy authentication

  - CVE-2016-5134: URL leakage via PAC script

  - CVE-2016-5135: Content-Security-Policy bypass

  - CVE-2016-5136: Use after free in extensions

  - CVE-2016-5137: History sniffing with HSTS and CSP

  - CVE-2016-1705: Various fixes from internal audits,     fuzzing and other initiatives

The version of Google Chrome installed on the remote macOS host is prior to 52.0.2743.82. It is, therefore, affected by multiple vulnerabilities as referenced in the 2016_07_stable-channel-update advisory.

  - The PPAPI implementation in Google Chrome before 52.0.2743.82 does not validate the origin of IPC messages     to the plugin broker process that should have come from the browser process, which allows remote attackers     to bypass a sandbox protection mechanism via an unexpected message type, related to     broker_process_dispatcher.cc, ppapi_plugin_process_host.cc, ppapi_thread.cc, and     render_frame_message_filter.cc. (CVE-2016-1706)

  - ios/web/web_state/ui/crw_web_controller.mm in Google Chrome before 52.0.2743.82 on iOS does not ensure     that an invalid URL is replaced with the about:blank URL, which allows remote attackers to spoof the URL     display via a crafted web site. (CVE-2016-1707)

  - The Chrome Web Store inline-installation implementation in the Extensions subsystem in Google Chrome     before 52.0.2743.82 does not properly consider object lifetimes during progress observation, which allows     remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact     via a crafted web site. (CVE-2016-1708)

  - Heap-based buffer overflow in the ByteArray::Get method in data/byte_array.cc in Google sfntly before     2016-06-10, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of     service or possibly have unspecified other impact via a crafted SFNT font. (CVE-2016-1709)

  - The ChromeClientImpl::createWindow method in WebKit/Source/web/ChromeClientImpl.cpp in Blink, as used in     Google Chrome before 52.0.2743.82, does not prevent window creation by a deferred frame, which allows     remote attackers to bypass the Same Origin Policy via a crafted web site. (CVE-2016-1710)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 52.0.2743.82. It is, therefore, affected by multiple vulnerabilities as referenced in the 2016_07_stable-channel-update advisory.

  - The PPAPI implementation in Google Chrome before 52.0.2743.82 does not validate the origin of IPC messages     to the plugin broker process that should have come from the browser process, which allows remote attackers     to bypass a sandbox protection mechanism via an unexpected message type, related to     broker_process_dispatcher.cc, ppapi_plugin_process_host.cc, ppapi_thread.cc, and     render_frame_message_filter.cc. (CVE-2016-1706)

  - ios/web/web_state/ui/crw_web_controller.mm in Google Chrome before 52.0.2743.82 on iOS does not ensure     that an invalid URL is replaced with the about:blank URL, which allows remote attackers to spoof the URL     display via a crafted web site. (CVE-2016-1707)

  - The Chrome Web Store inline-installation implementation in the Extensions subsystem in Google Chrome     before 52.0.2743.82 does not properly consider object lifetimes during progress observation, which allows     remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact     via a crafted web site. (CVE-2016-1708)

  - Heap-based buffer overflow in the ByteArray::Get method in data/byte_array.cc in Google sfntly before     2016-06-10, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of     service or possibly have unspecified other impact via a crafted SFNT font. (CVE-2016-1709)

  - The ChromeClientImpl::createWindow method in WebKit/Source/web/ChromeClientImpl.cpp in Blink, as used in     Google Chrome before 52.0.2743.82, does not prevent window creation by a deferred frame, which allows     remote attackers to bypass the Same Origin Policy via a crafted web site. (CVE-2016-1710)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
92666	Debian DSA-3637-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	critical
92655	openSUSE Security Update : Chromium (openSUSE-2016-919)	Nessus	SuSE Local Security Checks	critical
92629	Google Chrome < 52.0.2743.82 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
92628	Google Chrome < 52.0.2743.82 Multiple Vulnerabilities	Nessus	Windows	critical
92551	openSUSE Security Update : Chromium (openSUSE-2016-901)	Nessus	SuSE Local Security Checks	critical
92550	openSUSE Security Update : Chromium (openSUSE-2016-900)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2016-1707

medium

Tenable Plugins

critical

critical

critical

critical

critical

critical