Google Chrome before 53.0.2785.113 does not ensure that the recipient of a certain IPC message is a valid RenderFrame or RenderWidget, which allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) or possibly have unspecified other impact by leveraging access to a renderer process, related to render_frame_host_impl.cc and render_widget_host_impl.cc, as demonstrated by a Password Manager message.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3091-1 advisory.

    A use-after-free was discovered in the V8 bindings in Blink. If a user were tricked in to opening a     specially crafted website, an attacker could potentially exploit this to cause a denial of service via     application crash, or execute arbitrary code. (CVE-2016-5170)

    A use-after-free was discovered in the V8 bindings in Blink. If a user were tricked in to opening a     specially crafted website, an attacker could potentially exploit this to cause a denial of service via     application crash, or execute arbitrary code. (CVE-2016-5171)

    An issue was discovered in V8. If a user were tricked in to opening a specially crafted website, an     attacker could potentially exploit this to ontain sensitive information from arbitrary memory locations.
    (CVE-2016-5172)

    Multiple security issues were discovered in Chromium. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial     of service via application crash, or execute arbitrary code. (CVE-2016-5175, CVE-2016-5178)

    A use-after-free was discovered in V8. If a user were tricked in to opening a specially crafted website,     an attacker could potentially exploit this to cause a denial of service via application crash, or execute     arbitrary code. (CVE-2016-5177)

    It was discovered that Chromium does not ensure the recipient of a certain IPC message is a valid     RenderFrame or RenderWidget. An attacker could potentially exploit this to cause a denial of service via     application crash, or execute arbitary code. (CVE-2016-7549)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Chromium is an open source web browser, powered by WebKit (Blink).

This update upgrades Chromium to version 53.0.2785.113.

Security Fix(es) :

* Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when visited by the victim. (CVE-2016-5170, CVE-2016-5171, CVE-2016-5175, CVE-2016-5172, CVE-2016-5173, CVE-2016-5174)

ID	Name	Product	Family	Type	Severity
93938	Ubuntu 14.04 LTS / 16.04 LTS : Oxide vulnerabilities (USN-3091-1)	Nessus	Ubuntu Local Security Checks	Local	critical
93586	RHEL 6 : chromium-browser (RHSA-2016:1905)	Nessus	Red Hat Local Security Checks	Local	high

Detections

Analytics

CVE-2016-7549

high

Tenable Plugins

critical

high