openSUSE Security Update : Chromium (openSUSE-2016-756)

Critical Nessus Plugin ID 91848

New! Vulnerability Priority Rating (VPR)

Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it's different from CVSS.

VPR Score: 5.9

Synopsis

The remote openSUSE host is missing a security update.

Description

Chromium was updated to 51.0.2704.103 to fix three vulnerabilities :

- CVE-2016-1704: Various fixes from internal audits, fuzzing and other initiatives (shared identifier) (boo#985397)

Includes vulnerability fixes from 50.0.2661.102 (boo#979859) :

- CVE-2016-1667: Same origin bypass in DOM

- CVE-2016-1668: Same origin bypass in Blink V8 bindings

- CVE-2016-1669: Buffer overflow in V8

- CVE-2016-1670: Race condition in loader

Includes vulnerability fixes from 50.0.2661.94 (boo#977830) :

- CVE-2016-1660: Out-of-bounds write in Blink

- CVE-2016-1661: Memory corruption in cross-process frames

- CVE-2016-1662: Use-after-free in extensions

- CVE-2016-1663: Use-after-free in Blink’s V8 bindings

- CVE-2016-1664: Address bar spoofing

- CVE-2016-1665: Information leak in V8

- CVE-2016-1666: Various fixes from internal audits, fuzzing and other initiatives

Solution

Update the affected Chromium packages.

See Also

https://bugzilla.opensuse.org/show_bug.cgi?id=977830

https://bugzilla.opensuse.org/show_bug.cgi?id=979859

https://bugzilla.opensuse.org/show_bug.cgi?id=985397

Plugin Details

Severity: Critical

ID: 91848

File Name: openSUSE-2016-756.nasl

Version: 2.5

Type: local

Agent: unix

Published: 2016/06/27

Updated: 2020/06/04

Dependencies: 12634

Risk Information

Risk Factor: Critical

VPR Score: 5.9

CVSS v2.0

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS v3.0

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: p-cpe:/a:novell:opensuse:chromedriver, p-cpe:/a:novell:opensuse:chromedriver-debuginfo, p-cpe:/a:novell:opensuse:chromium, p-cpe:/a:novell:opensuse:chromium-debuginfo, p-cpe:/a:novell:opensuse:chromium-debugsource, p-cpe:/a:novell:opensuse:chromium-desktop-gnome, p-cpe:/a:novell:opensuse:chromium-desktop-kde, p-cpe:/a:novell:opensuse:chromium-ffmpegsumo, p-cpe:/a:novell:opensuse:chromium-ffmpegsumo-debuginfo, cpe:/o:novell:opensuse:13.1

Required KB Items: Host/local_checks_enabled, Host/SuSE/release, Host/SuSE/rpm-list, Host/cpu

Patch Publication Date: 2016/06/22

Reference Information

CVE: CVE-2016-1660, CVE-2016-1661, CVE-2016-1662, CVE-2016-1663, CVE-2016-1664, CVE-2016-1665, CVE-2016-1666, CVE-2016-1667, CVE-2016-1668, CVE-2016-1669, CVE-2016-1670, CVE-2016-1704