Insufficient data validation in Chromecast plugin in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Insufficient data validation in Chromecast plugin in Google Chrome prior to 63.0.3239.84 allowed a remote     attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (CVE-2017-15430)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update for Chromium to version 69.0.3497.81 fixes multiple issues.

Security issues fixed (boo#1107235) :

  - CVE-2018-16065: Out of bounds write in V8

  - CVE-2018-16066:Out of bounds read in Blink

  - CVE-2018-16067: Out of bounds read in WebAudio

  - CVE-2018-16068: Out of bounds write in Mojo

  - CVE-2018-16069:Out of bounds read in SwiftShader

  - CVE-2018-16070: Integer overflow in Skia

  - CVE-2018-16071: Use after free in WebRTC

  - CVE-2018-16073: Site Isolation bypass after tab restore

  - CVE-2018-16074: Site Isolation bypass using Blob URLS

  - Out of bounds read in Little-CMS

  - CVE-2018-16075: Local file access in Blink

  - CVE-2018-16076: Out of bounds read in PDFium

  - CVE-2018-16077: Content security policy bypass in Blink

  - CVE-2018-16078: Credit card information leak in Autofill

  - CVE-2018-16079: URL spoof in permission dialogs

  - CVE-2018-16080: URL spoof in full screen mode

  - CVE-2018-16081: Local file access in DevTools

  - CVE-2018-16082: Stack-based buffer overflow in     SwiftShader

  - CVE-2018-16083: Out of bounds read in WebRTC

  - CVE-2018-16084: User confirmation bypass in external     protocol handling

  - CVE-2018-16085: Use after free in Memory Instrumentation

  - CVE-2017-15430: Unsafe navigation in Chromecast     (boo#1106341)

  - CVE-2018-16086: Script injection in New Tab Page

  - CVE-2018-16087: Multiple download restriction bypass

  - CVE-2018-16088: User gesture requirement bypass The re2     regular expression library was updated to the current     version 2018-09-01.

Google Chrome Releases reports :

37 security fixes in this release, including :

- [778505] Critical CVE-2017-15407: Out of bounds write in QUIC.
Reported by Ned Williamson on 2017-10-26

- [762374] High CVE-2017-15408: Heap buffer overflow in PDFium.
Reported by Ke Liu of Tencent's Xuanwu LAB on 2017-09-06

- [763972] High CVE-2017-15409: Out of bounds write in Skia. Reported by Anonymous on 2017-09-11

- [765921] High CVE-2017-15410: Use after free in PDFium. Reported by Luat Nguyen of KeenLab, Tencent on 2017-09-16

- [770148] High CVE-2017-15411: Use after free in PDFium. Reported by Luat Nguyen of KeenLab, Tencent on 2017-09-29

- [727039] High CVE-2017-15412: Use after free in libXML. Reported by Nick Wellnhofer on 2017-05-27

- [766666] High CVE-2017-15413: Type confusion in WebAssembly.
Reported by Gaurav Dewan of Adobe Systems India Pvt. Ltd. on 2017-09-19

- [765512] Medium CVE-2017-15415: Pointer information disclosure in IPC call. Reported by Viktor Brange of Microsoft Offensive Security Research Team on 2017-09-15

- [779314] Medium CVE-2017-15416: Out of bounds read in Blink.
Reported by Ned Williamson on 2017-10-28

- [699028] Medium CVE-2017-15417: Cross origin information disclosure in Skia. Reported by Max May on 2017-03-07

- [765858] Medium CVE-2017-15418: Use of uninitialized value in Skia.
Reported by Kushal Arvind Shah of Fortinet's FortiGuard Labs on 2017-09-15

- [780312] Medium CVE-2017-15419: Cross origin leak of redirect URL in Blink. Reported by Jun Kokatsu on 2017-10-31

- [777419] Medium CVE-2017-15420: URL spoofing in Omnibox. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-10-23

- [774382] Medium CVE-2017-15422: Integer overflow in ICU. Reported by Yuan Deng of Ant-financial Light-Year Security Lab on 2017-10-13

- [780484] Medium CVE-2017-15430: Unsafe navigation in Chromecast Plugin. Reported by jinmo123 on 2017-01-11

- [778101] Low CVE-2017-15423: Issue with SPAKE implementation in BoringSSL. Reported by Greg Hudson on 2017-10-25

- [756226] Low CVE-2017-15424: URL Spoof in Omnibox. Reported by Khalil Zhani on 2017-08-16

- [756456] Low CVE-2017-15425: URL Spoof in Omnibox. Reported by xisigr of Tencent's Xuanwu Lab on 2017-08-17

- [757735] Low CVE-2017-15426: URL Spoof in Omnibox. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-08-18

- [768910] Low CVE-2017-15427: Insufficient blocking of JavaScript in Omnibox. Reported by Junaid Farhan on 2017-09-26

- [792099] Various fixes from internal audits, fuzzing and other initiatives

The version of Google Chrome installed on the remote macOS host is prior to 63.0.3239.84. It is, therefore, affected by multiple vulnerabilities as referenced in the 2017_12_stable-channel-update-for-desktop advisory.

  - Type confusion in WebAssembly in V8 in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2017-15413)

  - Out-of-bounds Write in the QUIC networking stack in Google Chrome prior to 63.0.3239.84 allowed a remote     attacker to gain code execution via a malicious server. (CVE-2017-15407)

  - Heap buffer overflow in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to     potentially exploit heap corruption via a crafted PDF file that is mishandled by PDFium. (CVE-2017-15408)

  - Heap buffer overflow in Skia in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2017-15409)

  - Use after free in PDFium in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially     exploit heap corruption via a crafted PDF file. (CVE-2017-15410, CVE-2017-15411)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 63.0.3239.84. It is, therefore, affected by multiple vulnerabilities as referenced in the 2017_12_stable-channel-update-for-desktop advisory.

  - Type confusion in WebAssembly in V8 in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2017-15413)

  - Out-of-bounds Write in the QUIC networking stack in Google Chrome prior to 63.0.3239.84 allowed a remote     attacker to gain code execution via a malicious server. (CVE-2017-15407)

  - Heap buffer overflow in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to     potentially exploit heap corruption via a crafted PDF file that is mishandled by PDFium. (CVE-2017-15408)

  - Heap buffer overflow in Skia in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2017-15409)

  - Use after free in PDFium in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially     exploit heap corruption via a crafted PDF file. (CVE-2017-15410, CVE-2017-15411)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
263186	Linux Distros Unpatched Vulnerability : CVE-2017-15430	Nessus	Misc.	medium
123291	openSUSE Security Update : chromium (openSUSE-2019-674)	Nessus	SuSE Local Security Checks	critical
117380	openSUSE Security Update : chromium (openSUSE-2018-979)	Nessus	SuSE Local Security Checks	critical
106236	FreeBSD : chromium -- multiple vulnerabilities (1d951e85-ffdb-11e7-8b91-e8e0b747a45a)	Nessus	FreeBSD Local Security Checks	high
105153	Google Chrome < 63.0.3239.84 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
105152	Google Chrome < 63.0.3239.84 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2017-15430

medium

Tenable Plugins

medium

critical

critical

high

high

high