The version of Google Chrome installed on the remote macOS host is prior to 44.0.2403.89. It is, therefore, affected by multiple vulnerabilities as referenced in the 2015_07_stable-channel-update_21 advisory.

  - The Google V8 engine, as used in Google Chrome before 44.0.2403.89 and QtWebEngineCore in Qt before 5.5.1,     allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a     crafted web site. (CVE-2015-1290)

  - Use-after-free vulnerability in content/browser/indexed_db/indexed_db_backing_store.cc in the IndexedDB     implementation in Google Chrome before 44.0.2403.89 allows remote attackers to cause a denial of service     or possibly have unspecified other impact by leveraging an abort action before a certain write operation.
    (CVE-2015-1276)

  - PDFium, as used in Google Chrome before 44.0.2403.89, does not properly handle certain out-of-memory     conditions, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or     possibly have unspecified other impact via a crafted PDF document that triggers a large memory allocation.
    (CVE-2015-1271)

  - Heap-based buffer overflow in j2k.c in OpenJPEG before r3002, as used in PDFium in Google Chrome before     44.0.2403.89, allows remote attackers to cause a denial of service or possibly have unspecified other     impact via invalid JPEG2000 data in a PDF document. (CVE-2015-1273)

  - Google Chrome before 44.0.2403.89 does not ensure that the auto-open list omits all dangerous file types,     which makes it easier for remote attackers to execute arbitrary code by providing a crafted file and     leveraging a user's previous Always open files of this type choice, related to download_commands.cc and     download_prefs.cc. (CVE-2015-1274)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Google Chrome < 44.0.2403.89 Multiple Vulnerabilities

critical Nessus Plugin ID 84922

Version 1.10