The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2570-1 advisory.

    An issue was discovered in the HTML parser in Blink. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit this to bypass same-origin restrictions.
    (CVE-2015-1235)

    An issue was discovered in the Web Audio API implementation in Blink. If a user were tricked in to opening     a specially crafted website, an attacker could potentially exploit this to bypass same-origin     restrictions. (CVE-2015-1236)

    A use-after-free was discovered in Chromium. If a user were tricked in to opening a specially crafted     website, an attacker could potentially exploit this to cause a denial of service via renderer crash, or     execute arbitrary code with the privileges of the sandboxed render process. (CVE-2015-1237)

    An out-of-bounds write was discovered in Skia. If a user were tricked in to opening a specially crafted     website, an attacker could potentially exploit this to cause a denial of service via application crash or     execute arbitrary code with the privileges of the user invoking the program. (CVE-2015-1238)

    An out-of-bounds read was discovered in the WebGL implementation. If a user were tricked in to opening a     specially crafted website, an attacker could potentially exploit this to cause a denial of service via     renderer crash. (CVE-2015-1240)

    An issue was discovered with the interaction of page navigation and touch event handling. If a user were     tricked in to opening a specially crafted website, an attacker could potentially exploit this to conduct     tap jacking attacks. (CVE-2015-1241)

    A type confusion bug was discovered in V8. If a user were tricked in to opening a specially crafted     website, an attacker could potentially exploit this to cause a denial of service via renderer crash, or     execute arbitrary code with the privileges of the sandboxed render process. (CVE-2015-1242)

    It was discovered that websocket connections were not upgraded whenever a HSTS policy is active. A remote     attacker could potentially exploit this to conduct a machine-in-the-middle (MITM) attack. (CVE-2015-1244)

    An out-of-bounds read was discovered in Blink. If a user were tricked in to opening a specially crafted     website, an attacker could potentially exploit this to cause a denial of service via renderer crash.
    (CVE-2015-1246)

    Multiple security issues were discovered in Chromium. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial     of service via application crash or execute arbitrary code with the privileges of the user invoking the     program. (CVE-2015-1249)

    A use-after-free was discovered in the file picker implementation. If a user were tricked in to opening a     specially crafted website, an attacker could potentially exploit this to cause a denial of service via     application crash or execute arbitrary code with the privileges of the user invoking the program.
    (CVE-2015-1321)

    Multiple security issues were discovered in V8. If a user were tricked in to opening a specially crafted     website, an attacker could potentially exploit these to read uninitialized memory, cause a denial of     service via renderer crash or execute arbitrary code with the privileges of the sandboxed render process.
    (CVE-2015-3333)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Multiple unspecified vulnerabilities in Google V8 before 4.2.77.14, as used in Google Chrome before     42.0.2311.90, allow attackers to cause a denial of service or possibly have other impact via unknown     vectors. (CVE-2015-3333)

Note that Nessus relies on the presence of the package as reported by the vendor.

Chromium was updated to latest stable release 42.0.2311.90 to fix security issues and bugs. The following vulnerabilities were fixed :

  - CVE-2015-1235: Cross-origin-bypass in HTML parser.

  - CVE-2015-1236: Cross-origin-bypass in Blink.

  - CVE-2015-1237: Use-after-free in IPC.

  - CVE-2015-1238: Out-of-bounds write in Skia.

  - CVE-2015-1240: Out-of-bounds read in WebGL.

  - CVE-2015-1241: Tap-Jacking.

  - CVE-2015-1242: Type confusion in V8.

  - CVE-2015-1244: HSTS bypass in WebSockets.

  - CVE-2015-1245: Use-after-free in PDFium.

  - CVE-2015-1246: Out-of-bounds read in Blink.

  - CVE-2015-1247: Scheme issues in OpenSearch.

  - CVE-2015-1248: SafeBrowsing bypass.

  - CVE-2015-1249: Various fixes from internal audits,     fuzzing and other initiatives.

  - CVE-2015-3333: Multiple vulnerabilities in V8 fixed at     the tip of the 4.2 branch (currently 4.2.77.14).

  - CVE-2015-3336: fullscreen and UI locking without user     confirmeation

  - CVE-2015-3335: unspecified impact of crafed programs     running in NaCl sandbox 

  - CVE-2015-3334: 'Media: Allowed by you' sometimes not     shown in a permissions table

New functionality added :

  - A number of new apps, extension and Web Platform APIs     (including the Push API!)

  - Lots of under the hood changes for stability and     performance

Several vulnerabilities were discovered in the chromium web browser.

  - CVE-2015-1235     A Same Origin Policy bypass issue was discovered in the     HTML parser.

  - CVE-2015-1236     Amitay Dobo discovered a Same Origin Policy bypass in     the Web Audio API.

  - CVE-2015-1237     Khalil Zhani discovered a use-after-free issue in IPC.

  - CVE-2015-1238     'cloudfuzzer' discovered an out-of-bounds write in the     skia library.

  - CVE-2015-1240     'w3bd3vil' discovered an out-of-bounds read in the WebGL     implementation.

  - CVE-2015-1241     Phillip Moon and Matt Weston discovered a way to trigger     local user interface actions remotely via a crafted     website.

  - CVE-2015-1242     A type confusion issue was discovered in the v8     JavaScript library.

  - CVE-2015-1244     Mike Ruddy discovered a way to bypass the HTTP Strict     Transport Security policy.

  - CVE-2015-1245     Khalil Zhani discovered a use-after-free issue in the     pdfium library.

  - CVE-2015-1246     Atte Kettunen discovered an out-of-bounds read issue in     webkit/blink.

  - CVE-2015-1247     Jann Horn discovered that 'file:' URLs in OpenSearch     documents were not sanitized, which could allow local     files to be read remotely when using the OpenSearch     feature from a crafted website.

  - CVE-2015-1248     Vittorio Gambaletta discovered a way to bypass the     SafeBrowsing feature, which could allow the remote     execution of a downloaded executable file.

  - CVE-2015-1249     The chrome 41 development team found various issues from     internal fuzzing, audits, and other studies.

  - CVE-2015-3333     Multiple issues were discovered and fixed in v8     4.2.7.14.

  - CVE-2015-3334     It was discovered that remote websites could capture     video data from attached web cameras without permission.

  - CVE-2015-3336     It was discovered that remote websites could cause user     interface disruptions like window fullscreening and     mouse pointer locking.

ID	Name	Product	Family	Published	Updated	Severity
83109	Ubuntu 14.04 LTS : Oxide vulnerabilities (USN-2570-1)	Nessus	Ubuntu Local Security Checks	4/28/2015	8/27/2024	high
264193	Linux Distros Unpatched Vulnerability : CVE-2015-3333	Nessus	Misc.	9/10/2025	9/10/2025	critical
83025	openSUSE Security Update : Chromium (openSUSE-2015-320)	Nessus	SuSE Local Security Checks	4/23/2015	1/19/2021	high
83120	Debian DSA-3238-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	4/29/2015	1/11/2021	high

Detections

Analytics

Plugins Search

high

critical

high

high