Detections
Analytics
Google Chrome < 49.0.2623.87 Multiple Vulnerabilities
high Nessus Plugin ID 89787
Language:
Synopsis
A web browser installed on the remote macOS host is affected by multiple vulnerabilities.Description
The version of Google Chrome installed on the remote macOS host is prior to 49.0.2623.87. It is, therefore, affected by multiple vulnerabilities as referenced in the 2016_03_stable-channel-update_8 advisory.- Multiple integer signedness errors in the opj_j2k_update_image_data function in j2k.c in OpenJPEG, as used in PDFium in Google Chrome before 49.0.2623.87, allow remote attackers to cause a denial of service (incorrect cast and out-of-bounds write) or possibly have unspecified other impact via crafted JPEG 2000 data. (CVE-2016-1645)
- The ImageInputType::ensurePrimaryContent function in WebKit/Source/core/html/forms/ImageInputType.cpp in Blink, as used in Google Chrome before 49.0.2623.87, does not properly maintain the user agent shadow DOM, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage type confusion. (CVE-2016-1643)
- WebKit/Source/core/layout/LayoutObject.cpp in Blink, as used in Google Chrome before 49.0.2623.87, does not properly restrict relayout scheduling, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted HTML document. (CVE-2016-1644)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to Google Chrome version 49.0.2623.87 or later.See Also
Plugin Details
Severity: High
ID: 89787
File Name: macosx_google_chrome_49_0_2623_87.nasl
Version: 1.11
Type: local
Agent: macosx
Family: MacOS X Local Security Checks
Published: 3/9/2016
Updated: 11/24/2025
Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 9.3
Temporal Score: 6.9
Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2016-1645
CVSS v3
Risk Factor: High
Base Score: 8.8
Temporal Score: 7.7
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:google:chrome
Required KB Items: installed_sw/Google Chrome
Exploit Ease: No known exploits are available
Patch Publication Date: 3/8/2016
Vulnerability Publication Date: 2/23/2016