A use after free in ANGLE in Google Chrome prior to 57.0.2987.98 for Windows allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 53.0.2. It is, therefore, affected by a vulnerability as referenced in the mfsa2017-14 advisory.

  - A use-after-free can occur during Buffer11 API calls within the ANGLE graphics library, used for WebGL     content. This can lead to a potentially exploitable crash.  Note: This issue is in <code>libGLES</code>,     which is only in use on Windows. Other operating systems are not affected. (CVE-2017-5031)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 52.1.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2017-14 advisory.

  - A use-after-free can occur during Buffer11 API calls within the ANGLE graphics library, used for WebGL     content. This can lead to a potentially exploitable crash.  Note: This issue is in <code>libGLES</code>,     which is only in use on Windows. Other operating systems are not affected. (CVE-2017-5031)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 53.0.2. It is, therefore, affected by a vulnerability as referenced in the mfsa2017-14 advisory.

  - A use-after-free can occur during Buffer11 API calls within the ANGLE graphics library, used for WebGL     content. This can lead to a potentially exploitable crash.  Note: This issue is in <code>libGLES</code>,     which is only in use on Windows. Other operating systems are not affected. (CVE-2017-5031)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote Windows host is prior to 52.1.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2017-14 advisory.

  - A use-after-free can occur during Buffer11 API calls within the ANGLE graphics library, used for WebGL     content. This can lead to a potentially exploitable crash.  Note: This issue is in <code>libGLES</code>,     which is only in use on Windows. Other operating systems are not affected. (CVE-2017-5031)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201704-02 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in the Chromium web       browser. Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information, or bypass security restrictions.
  Workaround :

    There is no known workaround at this time.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3236-1 advisory.

    Multiple vulnerabilities were discovered in Chromium. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit these to obtain sensitive information, spoof     application UI by causing the security status API or webview URL to indicate the wrong values, bypass     security restrictions, cause a denial of service via application crash, or execute arbitrary code.
    (CVE-2017-5029, CVE-2017-5030, CVE-2017-5031, CVE-2017-5033, CVE-2017-5035, CVE-2017-5037, CVE-2017-5040,     CVE-2017-5041, CVE-2017-5044, CVE-2017-5045, CVE-2017-5046)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Chromium was updated to 57.0.2987.98 to fix security issues and bugs.

The following vulnerabilities were fixed (bsc#1028848) :

  - CVE-2017-5030: Memory corruption in V8

  - CVE-2017-5031: Use after free in ANGLE

  - CVE-2017-5032: Out of bounds write in PDFium

  - CVE-2017-5029: Integer overflow in libxslt

  - CVE-2017-5034: Use after free in PDFium

  - CVE-2017-5035: Incorrect security UI in Omnibox

  - CVE-2017-5036: Use after free in PDFium

  - CVE-2017-5037: Multiple out of bounds writes in     ChunkDemuxer

  - CVE-2017-5039: Use after free in PDFium

  - CVE-2017-5040: Information disclosure in V8

  - CVE-2017-5041: Address spoofing in Omnibox

  - CVE-2017-5033: Bypass of Content Security Policy in     Blink

  - CVE-2017-5042: Incorrect handling of cookies in Cast

  - CVE-2017-5038: Use after free in GuestView

  - CVE-2017-5043: Use after free in GuestView

  - CVE-2017-5044: Heap overflow in Skia

  - CVE-2017-5045: Information disclosure in XSS Auditor

  - CVE-2017-5046: Information disclosure in Blink

The following non-security changes are included :

  - Address broken rendering on non-intel cards

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2017-5029     Holger Fuhrmannek discovered an integer overflow issue     in the libxslt library.

  - CVE-2017-5030     Brendon Tiszka discovered a memory corruption issue in     the v8 JavaScript library.

  - CVE-2017-5031     Looben Yang discovered a use-after-free issue in the     ANGLE library.

  - CVE-2017-5032     Ashfaq Ansari discovered an out-of-bounds write in the     pdfium library.

  - CVE-2017-5033     Nicolai Grodum discovered a way to bypass the Content     Security Policy.

  - CVE-2017-5034     Ke Liu discovered an integer overflow issue in the     pdfium library.

  - CVE-2017-5035     Enzo Aguado discovered an issue with the omnibox.

  - CVE-2017-5036     A use-after-free issue was discovered in the pdfium     library.

  - CVE-2017-5037     Yongke Wang discovered multiple out-of-bounds write     issues.

  - CVE-2017-5038     A use-after-free issue was discovered in the guest view.

  - CVE-2017-5039     jinmo123 discovered a use-after-free issue in the pdfium     library.

  - CVE-2017-5040     Choongwoo Han discovered an information disclosure issue     in the v8 JavaScript library.

  - CVE-2017-5041     Jordi Chancel discovered an address spoofing issue.

  - CVE-2017-5042     Mike Ruddy discovered incorrect handling of cookies.

  - CVE-2017-5043     Another use-after-free issue was discovered in the guest     view.

  - CVE-2017-5044     Kushal Arvind Shah discovered a heap overflow issue in     the skia library.

  - CVE-2017-5045     Dhaval Kapil discovered an information disclosure issue.

  - CVE-2017-5046     Masato Kinugawa discovered an information disclosure     issue.

The version of Google Chrome installed on the remote macOS host is prior to 57.0.2987.98. It is, therefore, affected by multiple vulnerabilities as referenced in the 2017_03_stable-channel-update-for-desktop advisory.

  - An integer overflow in FFmpeg in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and     57.0.2987.108 for Android allowed a remote attacker to perform an out of bounds memory write via a crafted     video file, related to ChunkDemuxer. (CVE-2017-5037, CVE-2017-5047, CVE-2017-5048, CVE-2017-5049,     CVE-2017-5050, CVE-2017-5051)

  - Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and     Mac and 57.0.2987.108 for Android allowed a remote attacker to execute arbitrary code via a crafted HTML     page. (CVE-2017-5030)

  - A use after free in ANGLE in Google Chrome prior to 57.0.2987.98 for Windows allowed a remote attacker to     perform an out of bounds memory read via a crafted HTML page. (CVE-2017-5031)

  - PDFium in Google Chrome prior to 57.0.2987.98 for Windows could be made to increment off the end of a     buffer, which allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
    (CVE-2017-5032)

  - The xsltAddTextString function in transform.c in libxslt 1.1.29, as used in Blink in Google Chrome prior     to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android, lacked a check for integer     overflow during a size calculation, which allowed a remote attacker to perform an out of bounds memory     write via a crafted HTML page. (CVE-2017-5029)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 57.0.2987.98. It is, therefore, affected by multiple vulnerabilities as referenced in the 2017_03_stable-channel-update-for-desktop advisory.

  - An integer overflow in FFmpeg in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and     57.0.2987.108 for Android allowed a remote attacker to perform an out of bounds memory write via a crafted     video file, related to ChunkDemuxer. (CVE-2017-5037, CVE-2017-5047, CVE-2017-5048, CVE-2017-5049,     CVE-2017-5050, CVE-2017-5051)

  - Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and     Mac and 57.0.2987.108 for Android allowed a remote attacker to execute arbitrary code via a crafted HTML     page. (CVE-2017-5030)

  - A use after free in ANGLE in Google Chrome prior to 57.0.2987.98 for Windows allowed a remote attacker to     perform an out of bounds memory read via a crafted HTML page. (CVE-2017-5031)

  - PDFium in Google Chrome prior to 57.0.2987.98 for Windows could be made to increment off the end of a     buffer, which allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
    (CVE-2017-5032)

  - The xsltAddTextString function in transform.c in libxslt 1.1.29, as used in Blink in Google Chrome prior     to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android, lacked a check for integer     overflow during a size calculation, which allowed a remote attacker to perform an out of bounds memory     write via a crafted HTML page. (CVE-2017-5029)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Chromium is an open source web browser, powered by WebKit (Blink).

This update upgrades Chromium to version 57.0.2987.98.

Security Fix(es) :

* Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when visited by the victim. (CVE-2017-5029, CVE-2017-5030, CVE-2017-5031, CVE-2017-5032, CVE-2017-5034, CVE-2017-5035, CVE-2017-5036, CVE-2017-5037, CVE-2017-5039, CVE-2017-5033, CVE-2017-5038, CVE-2017-5040, CVE-2017-5041, CVE-2017-5042, CVE-2017-5043, CVE-2017-5044, CVE-2017-5045, CVE-2017-5046)

Google Chrome Releases reports :

36 security fixes in this release

Please reference CVE/URL list for details

ID	Name	Product	Family	Type	Severity
275672	Mozilla Firefox < 53.0.2	Nessus	MacOS X Local Security Checks	Local	high
275662	Mozilla Firefox ESR < 52.1.1	Nessus	MacOS X Local Security Checks	Local	high
100127	Mozilla Firefox < 53.0.2	Nessus	Windows	Local	high
100126	Mozilla Firefox ESR < 52.1.1	Nessus	Windows	Local	high
99275	GLSA-201704-02 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	critical
99093	Ubuntu 14.04 LTS / 16.04 LTS : Oxide vulnerabilities (USN-3236-1)	Nessus	Ubuntu Local Security Checks	Local	high
97817	openSUSE Security Update : Chromium (openSUSE-2017-353)	Nessus	SuSE Local Security Checks	Local	high
97783	Debian DSA-3810-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	Local	high
97725	Google Chrome < 57.0.2987.98 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	Local	high
97724	Google Chrome < 57.0.2987.98 Multiple Vulnerabilities	Nessus	Windows	Local	high
97718	RHEL 6 : chromium-browser (RHSA-2017:0499)	Nessus	Red Hat Local Security Checks	Local	high
97689	FreeBSD : chromium -- multiple vulnerabilities (a505d397-0758-11e7-8d8b-e8e0b747a45a)	Nessus	FreeBSD Local Security Checks	Local	high

Detections

Analytics

CVE-2017-5031

high

Tenable Plugins

high

high

high

high

critical

high

high

high

high

high

high

high