Vulnerabilities > CVE-2016-1681 - Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products

047910
CVSS 8.8 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
low complexity
debian
redhat
suse
opensuse
google
CWE-119
nessus
NVD
Published: 2016-06-05
Updated: 2023-11-07

Summary

Heap-based buffer overflow in the opj_j2k_read_SPCod_SPCoc function in j2k.c in OpenJPEG, as used in PDFium in Google Chrome before 51.0.2704.63, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document.

Vulnerable Configurations

Part Description Count
OS
Debian
1
OS
Redhat
3
OS
Suse
1
OS
Opensuse
2
Application
Google
3761

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
  • Client-side Injection-induced Buffer Overflow
    This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
  • Filter Failure through Buffer Overflow
    In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
  • MIME Conversion
    An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.

Nessus

  • NASL familyWindows
    NASL idGOOGLE_CHROME_51_0_2704_63.NASL
    descriptionThe version of Google Chrome installed on the remote Windows host is prior to 51.0.2704.63. It is, therefore, affected by multiple vulnerabilities : - Multiple unspecified flaws exist in extension bindings that allow a remote attacker to bypass the same-origin policy. No other details are available. (CVE-2016-1672, CVE-2016-1676) - Multiple unspecified flaws exist in Blink that allow a remote attacker to bypass the same-origin policy. No other details are available. (CVE-2016-1673, CVE-2016-1675) - An unspecified flaw exists in Extensions that allows a remote attacker to bypass the same-origin policy. No other details are available. (CVE-2016-1674) - An unspecified type confusion error exists in V8 decodeURI that allows a remote attacker to disclose potentially sensitive information. (CVE-2016-1677) - A heap buffer overflow condition exists in V8 due to improper validation of user-supplied input. A remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-1678) - A heap use-after-free error exists in V8 bindings that allows a remote attacker to deference already freed memory and execute arbitrary code. (CVE-2016-1679) - A heap use-after-free error exists in Google Skia that allows a remote attacker to deference already freed memory and execute arbitrary code. (CVE-2016-1680) - A buffer overflow condition exists in OpenJPEG in the opj_j2k_read_SPCod_SPCoc() function within file j2k.c due to improper validation of user-supplied input. A remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-1681) - An unspecified flaw exists in ServiceWorker that allows a remote attacker to bypass the Content Security Policy (CSP). No other details are available. (CVE-2016-1682) - An unspecified out-of-bounds access error exists in libxslt that allows a remote attacker to have an unspecified impact. (CVE-2016-1683) - An integer overflow condition exists in libxslt that allows a remote attacker to have an unspecified impact. (CVE-2016-1684) - Multiple out-of-bounds read errors exist in PDFium that allow a remote attacker to cause a denial of service condition or disclose potentially sensitive information. (CVE-2016-1685, CVE-2016-1686) - An unspecified flaw exists in Extensions that allows a remote attacker to disclose potentially sensitive information. No other details are available. (CVE-2016-1687) - An out-of-bounds read error exists in V8 that allows a remote attacker to cause a denial of service condition or disclose potentially sensitive information. (CVE-2016-1688) - A heap buffer overflow condition exists in Media due to improper validation of user-supplied input. A remote attacker can exploit this to execute arbitrary code. (CVE-2016-1689) - A heap use-after-free error exists in Autofill that allows a remote attacker to execute arbitrary code. (CVE-2016-1690) - A heap buffer overflow condition exists in Google Skia due to improper validation of user-supplied input. A remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-1691) - An unspecified flaw exists in ServiceWorker that allows a remote attacker to carry out a limited bypass of the same-origin policy. No other details are available. (CVE-2016-1692) - A flaw exists due to the Software Removal Tool being downloaded over an HTTP connection. A man-in-the-middle attacker can exploit this to manipulate its contents. (CVE-2016-1693) - A unspecified flaw exists that is triggered when HTTP Public Key Pinning (HPKP) pins are removed when clearing the cache. No other details are available. (CVE-2016-1694) - Multiple unspecified issues exist that allow a remote attacker to execute arbitrary code. (CVE-2016-1695) - A use-after-free error exists in
    last seen2020-06-01
    modified2020-06-02
    plugin id91350
    published2016-05-27
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/91350
    titleGoogle Chrome < 51.0.2704.63 Multiple Vulnerabilities
    code
    #
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(91350);
  script_version("1.14");
  script_cvs_date("Date: 2019/11/19");

  script_cve_id(
    "CVE-2016-1672",
    "CVE-2016-1673",
    "CVE-2016-1674",
    "CVE-2016-1675",
    "CVE-2016-1676",
    "CVE-2016-1677",
    "CVE-2016-1678",
    "CVE-2016-1679",
    "CVE-2016-1680",
    "CVE-2016-1681",
    "CVE-2016-1682",
    "CVE-2016-1683",
    "CVE-2016-1684",
    "CVE-2016-1685",
    "CVE-2016-1686",
    "CVE-2016-1687",
    "CVE-2016-1688",
    "CVE-2016-1689",
    "CVE-2016-1690",
    "CVE-2016-1691",
    "CVE-2016-1692",
    "CVE-2016-1693",
    "CVE-2016-1694",
    "CVE-2016-1695"
  );
  script_xref(name:"EDB-ID", value:"39961");

  script_name(english:"Google Chrome < 51.0.2704.63 Multiple Vulnerabilities");
  script_summary(english:"Checks the version of Google Chrome.");

  script_set_attribute(attribute:"synopsis", value:
"A web browser installed on the remote Windows host is affected by
multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Google Chrome installed on the remote Windows host is
prior to 51.0.2704.63. It is, therefore, affected by multiple
vulnerabilities :

  - Multiple unspecified flaws exist in extension bindings
    that allow a remote attacker to bypass the same-origin
    policy. No other details are available. (CVE-2016-1672,
    CVE-2016-1676)

  - Multiple unspecified flaws exist in Blink that allow a
    remote attacker to bypass the same-origin policy. No
    other details are available. (CVE-2016-1673,
    CVE-2016-1675)

  - An unspecified flaw exists in Extensions that allows a
    remote attacker to bypass the same-origin policy.
    No other details are available. (CVE-2016-1674)

  - An unspecified type confusion error exists in V8
    decodeURI that allows a remote attacker to disclose
    potentially sensitive information. (CVE-2016-1677)

  - A heap buffer overflow condition exists in V8 due to
    improper validation of user-supplied input. A remote
    attacker can exploit this to cause a denial of service
    condition or the execution of arbitrary code.
    (CVE-2016-1678)

  - A heap use-after-free error exists in V8 bindings that
    allows a remote attacker to deference already freed
    memory and execute arbitrary code. (CVE-2016-1679)

  - A heap use-after-free error exists in Google Skia that
    allows a remote attacker to deference already freed
    memory and execute arbitrary code. (CVE-2016-1680)

  - A buffer overflow condition exists in OpenJPEG in the
    opj_j2k_read_SPCod_SPCoc() function within file j2k.c
    due to improper validation of user-supplied input. A
    remote attacker can exploit this to cause a denial of
    service condition or the execution of arbitrary code.
    (CVE-2016-1681)

  - An unspecified flaw exists in ServiceWorker that allows
    a remote attacker to bypass the Content Security Policy
    (CSP). No other details are available. (CVE-2016-1682)

  - An unspecified out-of-bounds access error exists in
    libxslt that allows a remote attacker to have an
    unspecified impact. (CVE-2016-1683)

  - An integer overflow condition exists in libxslt that
    allows a remote attacker to have an unspecified impact.
    (CVE-2016-1684)

  - Multiple out-of-bounds read errors exist in PDFium that
    allow a remote attacker to cause a denial of service
    condition or disclose potentially sensitive information.
    (CVE-2016-1685, CVE-2016-1686)

  - An unspecified flaw exists in Extensions that allows a
    remote attacker to disclose potentially sensitive
    information. No other details are available.
    (CVE-2016-1687)

  - An out-of-bounds read error exists in V8 that allows a
    remote attacker to cause a denial of service condition
    or disclose potentially sensitive information.
    (CVE-2016-1688)

  - A heap buffer overflow condition exists in Media due to
    improper validation of user-supplied input. A remote
    attacker can exploit this to execute arbitrary code.
    (CVE-2016-1689)

  - A heap use-after-free error exists in Autofill that
    allows a remote attacker to execute arbitrary code.
    (CVE-2016-1690)

  - A heap buffer overflow condition exists in Google Skia
    due to improper validation of user-supplied input. A
    remote attacker can exploit this to cause a denial of
    service condition or the execution of arbitrary code.
    (CVE-2016-1691)

  - An unspecified flaw exists in ServiceWorker that allows
    a remote attacker to carry out a limited bypass of the
    same-origin policy. No other details are available.
    (CVE-2016-1692)

  - A flaw exists due to the Software Removal Tool being
    downloaded over an HTTP connection. A man-in-the-middle
    attacker can exploit this to manipulate its contents.
    (CVE-2016-1693)

  - A unspecified flaw exists that is triggered when HTTP
    Public Key Pinning (HPKP) pins are removed when clearing
    the cache. No other details are available.
    (CVE-2016-1694)

  - Multiple unspecified issues exist that allow a remote
    attacker to execute arbitrary code. (CVE-2016-1695)

  - A use-after-free error exists in 'MailboxManagerImpl'
    that is triggered when handling GPU commands. A remote
    attacker can exploit this to dereference already freed
    memory, resulting in the execution of arbitrary code.");
  # http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e4d6f0fa");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Google Chrome version 51.0.2704.63 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-1695");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2016/04/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2016/05/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2016/05/27");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:google:chrome");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("google_chrome_installed.nasl");
  script_require_keys("SMB/Google_Chrome/Installed");

  exit(0);
}

include("google_chrome_version.inc");

get_kb_item_or_exit("SMB/Google_Chrome/Installed");
installs = get_kb_list("SMB/Google_Chrome/*");

google_chrome_check_version(installs:installs, fix:'51.0.2704.63', severity:SECURITY_WARNING);
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2016-652.NASL
    descriptionChromium was updated to 51.0.2704.63 to fix the following vulnerabilities (boo#981886) : - CVE-2016-1672: Cross-origin bypass in extension bindings - CVE-2016-1673: Cross-origin bypass in Blink - CVE-2016-1674: Cross-origin bypass in extensions - CVE-2016-1675: Cross-origin bypass in Blink - CVE-2016-1676: Cross-origin bypass in extension bindings - CVE-2016-1677: Type confusion in V8 - CVE-2016-1678: Heap overflow in V8 - CVE-2016-1679: Heap use-after-free in V8 bindings - CVE-2016-1680: Heap use-after-free in Skia - CVE-2016-1681: Heap overflow in PDFium - CVE-2016-1682: CSP bypass for ServiceWorker - CVE-2016-1683: Out-of-bounds access in libxslt - CVE-2016-1684: Integer overflow in libxslt - CVE-2016-1685: Out-of-bounds read in PDFium - CVE-2016-1686: Out-of-bounds read in PDFium - CVE-2016-1687: Information leak in extensions - CVE-2016-1688: Out-of-bounds read in V8 - CVE-2016-1689: Heap buffer overflow in media - CVE-2016-1690: Heap use-after-free in Autofill - CVE-2016-1691: Heap buffer-overflow in Skia - CVE-2016-1692: Limited cross-origin bypass in ServiceWorker - CVE-2016-1693: HTTP Download of Software Removal Tool - CVE-2016-1694: HPKP pins removed on cache clearance - CVE-2016-1695: Various fixes from internal audits, fuzzing and other initiatives
    last seen2020-06-05
    modified2016-06-01
    plugin id91404
    published2016-06-01
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/91404
    titleopenSUSE Security Update : Chromium (openSUSE-2016-652)
    code
    #%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from openSUSE Security Update openSUSE-2016-652.
#
# The text description of this plugin is (C) SUSE LLC.
#

include("compat.inc");

if (description)
{
  script_id(91404);
  script_version("2.6");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");

  script_cve_id("CVE-2016-1672", "CVE-2016-1673", "CVE-2016-1674", "CVE-2016-1675", "CVE-2016-1676", "CVE-2016-1677", "CVE-2016-1678", "CVE-2016-1679", "CVE-2016-1680", "CVE-2016-1681", "CVE-2016-1682", "CVE-2016-1683", "CVE-2016-1684", "CVE-2016-1685", "CVE-2016-1686", "CVE-2016-1687", "CVE-2016-1688", "CVE-2016-1689", "CVE-2016-1690", "CVE-2016-1691", "CVE-2016-1692", "CVE-2016-1693", "CVE-2016-1694", "CVE-2016-1695");

  script_name(english:"openSUSE Security Update : Chromium (openSUSE-2016-652)");
  script_summary(english:"Check for the openSUSE-2016-652 patch");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote openSUSE host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Chromium was updated to 51.0.2704.63 to fix the following
vulnerabilities (boo#981886) :

  - CVE-2016-1672: Cross-origin bypass in extension bindings

  - CVE-2016-1673: Cross-origin bypass in Blink

  - CVE-2016-1674: Cross-origin bypass in extensions

  - CVE-2016-1675: Cross-origin bypass in Blink

  - CVE-2016-1676: Cross-origin bypass in extension bindings

  - CVE-2016-1677: Type confusion in V8

  - CVE-2016-1678: Heap overflow in V8

  - CVE-2016-1679: Heap use-after-free in V8 bindings

  - CVE-2016-1680: Heap use-after-free in Skia

  - CVE-2016-1681: Heap overflow in PDFium

  - CVE-2016-1682: CSP bypass for ServiceWorker

  - CVE-2016-1683: Out-of-bounds access in libxslt

  - CVE-2016-1684: Integer overflow in libxslt

  - CVE-2016-1685: Out-of-bounds read in PDFium

  - CVE-2016-1686: Out-of-bounds read in PDFium

  - CVE-2016-1687: Information leak in extensions

  - CVE-2016-1688: Out-of-bounds read in V8

  - CVE-2016-1689: Heap buffer overflow in media

  - CVE-2016-1690: Heap use-after-free in Autofill

  - CVE-2016-1691: Heap buffer-overflow in Skia

  - CVE-2016-1692: Limited cross-origin bypass in
    ServiceWorker

  - CVE-2016-1693: HTTP Download of Software Removal Tool

  - CVE-2016-1694: HPKP pins removed on cache clearance

  - CVE-2016-1695: Various fixes from internal audits,
    fuzzing and other initiatives"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.opensuse.org/show_bug.cgi?id=981886"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected Chromium packages."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:chromedriver");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:chromedriver-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:chromium");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:chromium-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:chromium-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:chromium-desktop-gnome");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:chromium-desktop-kde");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:chromium-ffmpegsumo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:chromium-ffmpegsumo-debuginfo");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:42.1");

  script_set_attribute(attribute:"patch_publication_date", value:"2016/05/27");
  script_set_attribute(attribute:"plugin_publication_date", value:"2016/06/01");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2016-2020 Tenable Network Security, Inc.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
if (release !~ "^(SUSE42\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "42.1", release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

ourarch = get_kb_item("Host/cpu");
if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
if (ourarch !~ "^(x86_64)$") audit(AUDIT_ARCH_NOT, "x86_64", ourarch);

flag = 0;

if ( rpm_check(release:"SUSE42.1", reference:"chromedriver-51.0.2704.63-51.1") ) flag++;
if ( rpm_check(release:"SUSE42.1", reference:"chromedriver-debuginfo-51.0.2704.63-51.1") ) flag++;
if ( rpm_check(release:"SUSE42.1", reference:"chromium-51.0.2704.63-51.1") ) flag++;
if ( rpm_check(release:"SUSE42.1", reference:"chromium-debuginfo-51.0.2704.63-51.1") ) flag++;
if ( rpm_check(release:"SUSE42.1", reference:"chromium-debugsource-51.0.2704.63-51.1") ) flag++;
if ( rpm_check(release:"SUSE42.1", reference:"chromium-desktop-gnome-51.0.2704.63-51.1") ) flag++;
if ( rpm_check(release:"SUSE42.1", reference:"chromium-desktop-kde-51.0.2704.63-51.1") ) flag++;
if ( rpm_check(release:"SUSE42.1", reference:"chromium-ffmpegsumo-51.0.2704.63-51.1") ) flag++;
if ( rpm_check(release:"SUSE42.1", reference:"chromium-ffmpegsumo-debuginfo-51.0.2704.63-51.1") ) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "chromedriver / chromedriver-debuginfo / chromium / etc");
}
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201607-07.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201607-07 (Chromium: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in the Chromium web browser. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, obtain sensitive information, or bypass security restrictions. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id92351
    published2016-07-18
    reporterThis script is Copyright (C) 2016 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/92351
    titleGLSA-201607-07 : Chromium: Multiple vulnerabilities
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-3590.NASL
    descriptionSeveral vulnerabilities have been discovered in the chromium web browser. - CVE-2016-1667 Mariusz Mylinski discovered a cross-origin bypass. - CVE-2016-1668 Mariusz Mylinski discovered a cross-origin bypass in bindings to v8. - CVE-2016-1669 Choongwoo Han discovered a buffer overflow in the v8 JavaScript library. - CVE-2016-1670 A race condition was found that could cause the renderer process to reuse ids that should have been unique. - CVE-2016-1672 Mariusz Mylinski discovered a cross-origin bypass in extension bindings. - CVE-2016-1673 Mariusz Mylinski discovered a cross-origin bypass in Blink/Webkit. - CVE-2016-1674 Mariusz Mylinski discovered another cross-origin bypass in extension bindings. - CVE-2016-1675 Mariusz Mylinski discovered another cross-origin bypass in Blink/Webkit. - CVE-2016-1676 Rob Wu discovered a cross-origin bypass in extension bindings. - CVE-2016-1677 Guang Gong discovered a type confusion issue in the v8 JavaScript library. - CVE-2016-1678 Christian Holler discovered an overflow issue in the v8 JavaScript library. - CVE-2016-1679 Rob Wu discovered a use-after-free issue in the bindings to v8. - CVE-2016-1680 Atte Kettunen discovered a use-after-free issue in the skia library. - CVE-2016-1681 Aleksandar Nikolic discovered an overflow issue in the pdfium library. - CVE-2016-1682 KingstonTime discovered a way to bypass the Content Security Policy. - CVE-2016-1683 Nicolas Gregoire discovered an out-of-bounds write issue in the libxslt library. - CVE-2016-1684 Nicolas Gregoire discovered an integer overflow issue in the libxslt library. - CVE-2016-1685 Ke Liu discovered an out-of-bounds read issue in the pdfium library. - CVE-2016-1686 Ke Liu discovered another out-of-bounds read issue in the pdfium library. - CVE-2016-1687 Rob Wu discovered an information leak in the handling of extensions. - CVE-2016-1688 Max Korenko discovered an out-of-bounds read issue in the v8 JavaScript library. - CVE-2016-1689 Rob Wu discovered a buffer overflow issue. - CVE-2016-1690 Rob Wu discovered a use-after-free issue. - CVE-2016-1691 Atte Kettunen discovered a buffer overflow issue in the skia library. - CVE-2016-1692 Til Jasper Ullrich discovered a cross-origin bypass issue. - CVE-2016-1693 Khalil Zhani discovered that the Software Removal Tool download was done over an HTTP connection. - CVE-2016-1694 Ryan Lester and Bryant Zadegan discovered that pinned public keys would be removed when clearing the browser cache. - CVE-2016-1695 The chrome development team found and fixed various issues during internal auditing.
    last seen2020-06-01
    modified2020-06-02
    plugin id91429
    published2016-06-02
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/91429
    titleDebian DSA-3590-1 : chromium-browser - security update
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2016-682.NASL
    descriptionChromium was updated to 51.0.2704.79 to fix the following vulnerabilities : - CVE-2016-1696: Cross-origin bypass in Extension bindings - CVE-2016-1697: Cross-origin bypass in Blink - CVE-2016-1698: Information leak in Extension bindings - CVE-2016-1699: Parameter sanitization failure in DevTools - CVE-2016-1700: Use-after-free in Extensions - CVE-2016-1701: Use-after-free in Autofill - CVE-2016-1702: Out-of-bounds read in Skia - CVE-2016-1703: Various fixes from internal audits, fuzzing and other initiatives Also includes vulnerabilities fixed in 51.0.2704.63 (boo#981886) : - CVE-2016-1672: Cross-origin bypass in extension bindings - CVE-2016-1673: Cross-origin bypass in Blink - CVE-2016-1674: Cross-origin bypass in extensions - CVE-2016-1675: Cross-origin bypass in Blink - CVE-2016-1676: Cross-origin bypass in extension bindings - CVE-2016-1677: Type confusion in V8 - CVE-2016-1678: Heap overflow in V8 - CVE-2016-1679: Heap use-after-free in V8 bindings - CVE-2016-1680: Heap use-after-free in Skia - CVE-2016-1681: Heap overflow in PDFium - CVE-2016-1682: CSP bypass for ServiceWorker - CVE-2016-1683: Out-of-bounds access in libxslt - CVE-2016-1684: Integer overflow in libxslt - CVE-2016-1685: Out-of-bounds read in PDFium - CVE-2016-1686: Out-of-bounds read in PDFium - CVE-2016-1687: Information leak in extensions - CVE-2016-1688: Out-of-bounds read in V8 - CVE-2016-1689: Heap buffer overflow in media - CVE-2016-1690: Heap use-after-free in Autofill - CVE-2016-1691: Heap buffer-overflow in Skia - CVE-2016-1692: Limited cross-origin bypass in ServiceWorker - CVE-2016-1693: HTTP Download of Software Removal Tool - CVE-2016-1694: HPKP pins removed on cache clearance - CVE-2016-1695: Various fixes from internal audits, fuzzing and other initiatives
    last seen2020-06-05
    modified2016-06-06
    plugin id91485
    published2016-06-06
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/91485
    titleopenSUSE Security Update : Chromium (openSUSE-2016-682)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_1A6BBB9524B811E6BD313065EC8FD3EC.NASL
    descriptionGoogle Chrome Releases reports : 42 security fixes in this release Please reference CVE/URL list for details
    last seen2020-06-01
    modified2020-06-02
    plugin id91370
    published2016-05-31
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/91370
    titleFreeBSD : chromium -- multiple vulnerabilities (1a6bbb95-24b8-11e6-bd31-3065ec8fd3ec)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2016-1190.NASL
    descriptionAn update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Chromium is an open source web browser, powered by WebKit (Blink). This update upgrades Chromium to version 51.0.2704.63. Security Fix(es) : * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when visited by the victim. (CVE-2016-1672, CVE-2016-1673, CVE-2016-1674, CVE-2016-1675, CVE-2016-1676, CVE-2016-1678, CVE-2016-1679, CVE-2016-1680, CVE-2016-1681, CVE-2016-1695, CVE-2016-1677, CVE-2016-1682, CVE-2016-1683, CVE-2016-1684, CVE-2016-1685, CVE-2016-1686, CVE-2016-1687, CVE-2016-1688, CVE-2016-1689, CVE-2016-1690, CVE-2016-1691, CVE-2016-1692, CVE-2016-1693, CVE-2016-1694)
    last seen2020-05-31
    modified2016-06-02
    plugin id91440
    published2016-06-02
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/91440
    titleRHEL 6 : chromium-browser (RHSA-2016:1190)
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_GOOGLE_CHROME_51_0_2704_63.NASL
    descriptionThe version of Google Chrome installed on the remote Mac OS X host is prior to 51.0.2704.63. It is, therefore, affected by multiple vulnerabilities : - Multiple unspecified flaws exist in extension bindings that allow a remote attacker to bypass the same-origin policy. No other details are available. (CVE-2016-1672, CVE-2016-1676) - Multiple unspecified flaws exist in Blink that allow a remote attacker to bypass the same-origin policy. No other details are available. (CVE-2016-1673, CVE-2016-1675) - An unspecified flaw exists in Extensions that allows a remote attacker to bypass the same-origin policy. No other details are available. (CVE-2016-1674) - An unspecified type confusion error exists in V8 decodeURI that allows a remote attacker to disclose potentially sensitive information. (CVE-2016-1677) - A heap buffer overflow condition exists in V8 due to improper validation of user-supplied input. A remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-1678) - A heap use-after-free error exists in V8 bindings that allows a remote attacker to deference already freed memory and execute arbitrary code. (CVE-2016-1679) - A heap use-after-free error exists in Google Skia that allows a remote attacker to deference already freed memory and execute arbitrary code. (CVE-2016-1680) - A buffer overflow condition exists in OpenJPEG in the opj_j2k_read_SPCod_SPCoc() function within file j2k.c due to improper validation of user-supplied input. A remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-1681) - An unspecified flaw exists in ServiceWorker that allows a remote attacker to bypass the Content Security Policy (CSP). No other details are available. (CVE-2016-1682) - An unspecified out-of-bounds access error exists in libxslt that allows a remote attacker to have an unspecified impact. (CVE-2016-1683) - An integer overflow condition exists in libxslt that allows a remote attacker to have an unspecified impact. (CVE-2016-1684) - Multiple out-of-bounds read errors exist in PDFium that allow a remote attacker to cause a denial of service condition or disclose potentially sensitive information. (CVE-2016-1685, CVE-2016-1686) - An unspecified flaw exists in Extensions that allows a remote attacker to disclose potentially sensitive information. No other details are available. (CVE-2016-1687) - An out-of-bounds read error exists in V8 that allows a remote attacker to cause a denial of service condition or disclose potentially sensitive information. (CVE-2016-1688) - A heap buffer overflow condition exists in Media due to improper validation of user-supplied input. A remote attacker can exploit this to execute arbitrary code. (CVE-2016-1689) - A heap use-after-free error exists in Autofill that allows a remote attacker to execute arbitrary code. (CVE-2016-1690) - A heap buffer overflow condition exists in Google Skia due to improper validation of user-supplied input. A remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-1691) - An unspecified flaw exists in ServiceWorker that allows a remote attacker to carry out a limited bypass of the same-origin policy. No other details are available. (CVE-2016-1692) - A flaw exists due to the Software Removal Tool being downloaded over an HTTP connection. A man-in-the-middle attacker can exploit this to manipulate its contents. (CVE-2016-1693) - A unspecified flaw exists that is triggered when HTTP Public Key Pinning (HPKP) pins are removed when clearing the cache. No other details are available. (CVE-2016-1694) - Multiple unspecified issues exist that allow a remote attacker to execute arbitrary code. (CVE-2016-1695) - A use-after-free error exists in
    last seen2020-06-01
    modified2020-06-02
    plugin id91351
    published2016-05-27
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/91351
    titleGoogle Chrome < 51.0.2704.63 Multiple Vulnerabilities (Mac OS X)

Redhat

advisories
rhsa
idRHSA-2016:1190
rpms
  • chromium-browser-0:51.0.2704.63-1.el6
  • chromium-browser-debuginfo-0:51.0.2704.63-1.el6

Seebug

bulletinFamilyexploit
description### SUMMARY An exploitable heap buffer overflow vulnerability exists in the Pdfium PDF reader included in the Google Chrome web browser. A specially crafted PDF document with embedded jpeg2000 image can cause a heap buffer overflow potentially resulting in an arbitrary code execution. An attacker can serve the malicious PDF file on a website and wait for a victim to visit to trigger this vulnerability. ### TESTED VERSIONS Google Chrome 50.0.2661.94 Pdfium Git 2016-05-08 ### PRODUCT URLs https://www.google.com/chrome/browser/desktop/ ### CVSSv3 SCORE 6.3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L ### DETAILS A heap buffer overflow vulnerability is present in the jpeg2000 image parser library as used by the Chrome's PDF renderer, PDFium. The vulnerability is located in the underlying jpeg2000 parsing library, openjpeg, but is made exploitable in case of Chrome due to special build process. Namely, an existing assert call in the openjpeg library usually prevents the heap overflow from being reached, but in the release versions of Chrome the assertations are omited. The source of the vulnerability is located in the following code in function `opj_j2k_read_siz` in `j2k.c` file: ``` for (i = 0; i < l_nb_tiles; ++i) { l_current_tile_param->tccps = (opj_tccp_t*) opj_calloc(l_image->numcomps, sizeof(opj_tccp_t)); if (l_current_tile_param->tccps == 00) { opj_event_msg(p_manager, EVT_ERROR, "Not enough memory to take in charge SIZ marker \n"); return OPJ_FALSE; } ++l_current_tile_param; } ``` If in the above call to `opj_calloc`, which is a `calloc` wrapper, `numcomps` value happens to be zero, `calloc` will return a unique pointer which can be later passed to `free` (this is implementation dependent, but is so on modern Linux OSes). The unique pointer returned by `calloc` will usually be a small allocation (0x20 bytes in case of x64 code). This can lead to a heap buffer overflow later in the code when this buffer is being used. The overflow happens inside `opj_j2k_read_SQcd_SQcc` function where previously allocated buffer is being dereferenced. The first out of bounds memory write happens in the following code: ``` l_tccp->qntsty = l_tmp & 0x1f; l_tccp->numgbits = l_tmp >> 5; ``` In the above code, `l_tccp` pointer will be pointing to the previously erroneously allocated area. The same structure is dereferenced during further out of bounds writes in the following code. First requirement for this overflow to happen, number of components to be 0, is actually checked against in an assert at the beginning of the function: ``` assert(p_comp_no < p_j2k->m_private_image->numcomps); ``` If the required condition for the erroneous allocation is satisfied, the above assert would fail which indeed does happen in the default build of openjpeg library. But, since the release builds of Chrome and PDFium omit these asserts the point of buffer overflow can be reached. The attached jpeg2000 testcase (embedded inside a PDF) has it's SIZ marker truncated (SIZ marker begins with 0xFF51). Number of components specified in the SIZ marker is 0 and isn't followed by individual component information. This short circuits the code that is parsing the file in `opj_j2k_read_siz` and leads to the required erroneous call to `calloc`. The only difference between a valid jpeg2000 file and the one that triggers this vulnerability is the fact that SIZ marker specifies 0 components. ### CRASH INFORMATION For debugging purposes, both a standard and ASAN build of latest PDFium code were tested, resulting in following crashes. Regular build crashes due to heap corruption. A heap buffer overflow has resulted in adjacent heap chunk metadata overwrite: ``` Rendering PDF file min_chrome.pdf. *** Error in `/home/test/pdfium_repo/pdfium_test_nonasan': free(): invalid next size (fast): 0x0000000000b947d0 *** ======= Backtrace: ========= /lib64/libc.so.6(+0x77da5)[0x7fdb6b408da5] /lib64/libc.so.6(+0x804fa)[0x7fdb6b4114fa] /lib64/libc.so.6(cfree+0x4c)[0x7fdb6b414cac] /home/test/pdfium_repo/pdfium_test_nonasan[0x4381a7] /home/test/pdfium_repo/pdfium_test_nonasan[0x437bc0] /home/test/pdfium_repo/pdfium_test_nonasan[0x4408d5] /home/test/pdfium_repo/pdfium_test_nonasan[0x442de9] /home/test/pdfium_repo/pdfium_test_nonasan[0x4fa2ba] /home/test/pdfium_repo/pdfium_test_nonasan[0x4b4640] /home/test/pdfium_repo/pdfium_test_nonasan[0x4b2b4c] /home/test/pdfium_repo/pdfium_test_nonasan[0x4b3a06] /home/test/pdfium_repo/pdfium_test_nonasan[0x4aea63] /home/test/pdfium_repo/pdfium_test_nonasan[0x4ae90f] /home/test/pdfium_repo/pdfium_test_nonasan[0x4b6308] /home/test/pdfium_repo/pdfium_test_nonasan[0x4afbc0] /home/test/pdfium_repo/pdfium_test_nonasan[0x4aee70] /home/test/pdfium_repo/pdfium_test_nonasan[0x4aba73] /home/test/pdfium_repo/pdfium_test_nonasan[0x4adddb] /home/test/pdfium_repo/pdfium_test_nonasan[0x464071] /home/test/pdfium_repo/pdfium_test_nonasan[0x463de3] /home/test/pdfium_repo/pdfium_test_nonasan[0x40500a] /home/test/pdfium_repo/pdfium_test_nonasan[0x40577e] /home/test/pdfium_repo/pdfium_test_nonasan[0x405d32] /lib64/libc.so.6(__libc_start_main+0xf0)[0x7fdb6b3b1580] /home/test/pdfium_repo/pdfium_test_nonasan[0x4033d9] ======= Memory map: ======== 00400000-0079d000 r-xp 00000000 fd:03 7867700 /home/test/pdfium_repo/pdfium_test_nonasan 0079d000-007ad000 r--p 0039c000 fd:03 7867700 /home/test/pdfium_repo/pdfium_test_nonasan 007ad000-007b1000 rw-p 003ac000 fd:03 7867700 /home/test/pdfium_repo/pdfium_test_nonasan 00b7a000-00bac000 rw-p 00000000 00:00 0 [heap] 7fdb64000000-7fdb64021000 rw-p 00000000 00:00 0 7fdb64021000-7fdb68000000 ---p 00000000 00:00 0 7fdb6b17a000-7fdb6b190000 r-xp 00000000 fd:01 272875 /usr/lib64/libgcc_s-5.3.1-20160406.so.1 7fdb6b190000-7fdb6b38f000 ---p 00016000 fd:01 272875 /usr/lib64/libgcc_s-5.3.1-20160406.so.1 7fdb6b38f000-7fdb6b390000 r--p 00015000 fd:01 272875 /usr/lib64/libgcc_s-5.3.1-20160406.so.1 7fdb6b390000-7fdb6b391000 rw-p 00016000 fd:01 272875 /usr/lib64/libgcc_s-5.3.1-20160406.so.1 7fdb6b391000-7fdb6b548000 r-xp 00000000 fd:01 264380 /usr/lib64/libc-2.22.so 7fdb6b548000-7fdb6b748000 ---p 001b7000 fd:01 264380 /usr/lib64/libc-2.22.so 7fdb6b748000-7fdb6b74c000 r--p 001b7000 fd:01 264380 /usr/lib64/libc-2.22.so 7fdb6b74c000-7fdb6b74e000 rw-p 001bb000 fd:01 264380 /usr/lib64/libc-2.22.so 7fdb6b74e000-7fdb6b752000 rw-p 00000000 00:00 0 7fdb6b752000-7fdb6b76a000 r-xp 00000000 fd:01 264408 /usr/lib64/libpthread-2.22.so 7fdb6b76a000-7fdb6b969000 ---p 00018000 fd:01 264408 /usr/lib64/libpthread-2.22.so 7fdb6b969000-7fdb6b96a000 r--p 00017000 fd:01 264408 /usr/lib64/libpthread-2.22.so 7fdb6b96a000-7fdb6b96b000 rw-p 00018000 fd:01 264408 /usr/lib64/libpthread-2.22.so 7fdb6b96b000-7fdb6b96f000 rw-p 00000000 00:00 0 7fdb6b96f000-7fdb6ba70000 r-xp 00000000 fd:01 293829 /usr/lib64/libm-2.22.so 7fdb6ba70000-7fdb6bc6f000 ---p 00101000 fd:01 293829 /usr/lib64/libm-2.22.so 7fdb6bc6f000-7fdb6bc70000 r--p 00100000 fd:01 293829 /usr/lib64/libm-2.22.so 7fdb6bc70000-7fdb6bc71000 rw-p 00101000 fd:01 293829 /usr/lib64/libm-2.22.so 7fdb6bc71000-7fdb6bde3000 r-xp 00000000 fd:01 264431 /usr/lib64/libstdc++.so.6.0.21 7fdb6bde3000-7fdb6bfe3000 ---p 00172000 fd:01 264431 /usr/lib64/libstdc++.so.6.0.21 7fdb6bfe3000-7fdb6bfed000 r--p 00172000 fd:01 264431 /usr/lib64/libstdc++.so.6.0.21 7fdb6bfed000-7fdb6bfef000 rw-p 0017c000 fd:01 264431 /usr/lib64/libstdc++.so.6.0.21 7fdb6bfef000-7fdb6bff3000 rw-p 00000000 00:00 0 7fdb6bff3000-7fdb6c014000 r-xp 00000000 fd:01 264371 /usr/lib64/ld-2.22.so 7fdb6c071000-7fdb6c1ee000 rw-p 00000000 00:00 0 7fdb6c211000-7fdb6c213000 rw-p 00000000 00:00 0 7fdb6c213000-7fdb6c214000 r--p 00020000 fd:01 264371 /usr/lib64/ld-2.22.so 7fdb6c214000-7fdb6c215000 rw-p 00021000 fd:01 264371 /usr/lib64/ld-2.22.so 7fdb6c215000-7fdb6c216000 rw-p 00000000 00:00 0 7ffd1e691000-7ffd1e6b2000 rw-p 00000000 00:00 0 [stack] 7ffd1e6fc000-7ffd1e6fe000 r--p 00000000 00:00 0 [vvar] 7ffd1e6fe000-7ffd1e700000 r-xp 00000000 00:00 0 [vdso] ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall] Aborted ``` PDFium build with address sanitizer : ``` Rendering PDF file min_chrome.pdf. ================================================================= ==1105==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000e9e8 at pc 0x00000059ceca bp 0x7fffffffcdd0 sp 0x7fffffffcdc8 WRITE of size 4 at 0x60200000e9e8 thread T0 #0 0x59cec9 (/home/test/pdfium_repo/pdfium_test+0x59cec9) #1 0x595d87 (/home/test/pdfium_repo/pdfium_test+0x595d87) #2 0x5912fc (/home/test/pdfium_repo/pdfium_test+0x5912fc) #3 0x5863c4 (/home/test/pdfium_repo/pdfium_test+0x5863c4) #4 0x83e6a0 (/home/test/pdfium_repo/pdfium_test+0x83e6a0) #5 0x8403e4 (/home/test/pdfium_repo/pdfium_test+0x8403e4) #6 0x7509c3 (/home/test/pdfium_repo/pdfium_test+0x7509c3) #7 0x74a3d6 (/home/test/pdfium_repo/pdfium_test+0x74a3d6) #8 0x74dc27 (/home/test/pdfium_repo/pdfium_test+0x74dc27) #9 0x73bd3c (/home/test/pdfium_repo/pdfium_test+0x73bd3c) #10 0x73b93a (/home/test/pdfium_repo/pdfium_test+0x73b93a) #11 0x757c7b (/home/test/pdfium_repo/pdfium_test+0x757c7b) #12 0x758624 (/home/test/pdfium_repo/pdfium_test+0x758624) #13 0x7409fc (/home/test/pdfium_repo/pdfium_test+0x7409fc) #14 0x73d3b1 (/home/test/pdfium_repo/pdfium_test+0x73d3b1) #15 0x7306c2 (/home/test/pdfium_repo/pdfium_test+0x7306c2) #16 0x7386bb (/home/test/pdfium_repo/pdfium_test+0x7386bb) #17 0x6403d2 (/home/test/pdfium_repo/pdfium_test+0x6403d2) #18 0x63fcfa (/home/test/pdfium_repo/pdfium_test+0x63fcfa) #19 0x4e2899 (/home/test/pdfium_repo/pdfium_test+0x4e2899) #20 0x4e3c96 (/home/test/pdfium_repo/pdfium_test+0x4e3c96) #21 0x4e50c3 (/home/test/pdfium_repo/pdfium_test+0x4e50c3) #22 0x7ffff666757f (/lib64/libc.so.6+0x2057f) 0x60200000e9e8 is located 8 bytes to the left of 1-byte region [0x60200000e9f0,0x60200000e9f1) allocated by thread T0 here: #0 0x4b0fe1 (/home/test/pdfium_repo/pdfium_test+0x4b0fe1) #1 0x596f4b (/home/test/pdfium_repo/pdfium_test+0x596f4b) #2 0x5912fc (/home/test/pdfium_repo/pdfium_test+0x5912fc) #3 0x5863c4 (/home/test/pdfium_repo/pdfium_test+0x5863c4) #4 0x83e6a0 (/home/test/pdfium_repo/pdfium_test+0x83e6a0) #5 0x8403e4 (/home/test/pdfium_repo/pdfium_test+0x8403e4) #6 0x7509c3 (/home/test/pdfium_repo/pdfium_test+0x7509c3) #7 0x74a3d6 (/home/test/pdfium_repo/pdfium_test+0x74a3d6) #8 0x74dc27 (/home/test/pdfium_repo/pdfium_test+0x74dc27) #9 0x73bd3c (/home/test/pdfium_repo/pdfium_test+0x73bd3c) #10 0x73b93a (/home/test/pdfium_repo/pdfium_test+0x73b93a) #11 0x757c7b (/home/test/pdfium_repo/pdfium_test+0x757c7b) #12 0x758624 (/home/test/pdfium_repo/pdfium_test+0x758624) #13 0x7409fc (/home/test/pdfium_repo/pdfium_test+0x7409fc) #14 0x73d3b1 (/home/test/pdfium_repo/pdfium_test+0x73d3b1) #15 0x7306c2 (/home/test/pdfium_repo/pdfium_test+0x7306c2) #16 0x7386bb (/home/test/pdfium_repo/pdfium_test+0x7386bb) #17 0x6403d2 (/home/test/pdfium_repo/pdfium_test+0x6403d2) #18 0x63fcfa (/home/test/pdfium_repo/pdfium_test+0x63fcfa) #19 0x4e2899 (/home/test/pdfium_repo/pdfium_test+0x4e2899) #20 0x4e3c96 (/home/test/pdfium_repo/pdfium_test+0x4e3c96) #21 0x4e50c3 (/home/test/pdfium_repo/pdfium_test+0x4e50c3) #22 0x7ffff666757f (/lib64/libc.so.6+0x2057f) SUMMARY: AddressSanitizer: heap-buffer-overflow (/home/test/pdfium_repo/pdfium_test+0x59cec9) Shadow bytes around the buggy address: 0x0c047fff9ce0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c047fff9cf0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c047fff9d00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c047fff9d10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c047fff9d20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa =>0x0c047fff9d30: fa fa fa fa fa fa 01 fa fa fa 01 fa fa[fa]01 fa 0x0c047fff9d40: fa fa 00 00 fa fa 00 04 fa fa 00 00 fa fa 00 00 0x0c047fff9d50: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa fd fd 0x0c047fff9d60: fa fa 00 00 fa fa 04 fa fa fa 04 fa fa fa fd fa 0x0c047fff9d70: fa fa 01 fa fa fa 00 fa fa fa 00 fa fa fa 00 00 0x0c047fff9d80: fa fa 00 fa fa fa fd fa fa fa fd fd fa fa 04 fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==1105==ABORTING ``` Debugging output of Chromium nightly build revision 392151 (latest at the time of writting): ``` ./chrome-wrapper [12918:12918:0507/003258:ERROR:navigation_entry_screenshot_manager.cc(141)] Invalid entry with unique id: 14 [1:7:0507/003301:ERROR:WaitUntilObserver.cpp(144)] Not implemented reached in void blink::WaitUntilObserver::reportError(const blink::ScriptValue &) ../../third_party/tcmalloc/chromium/src/tcmalloc.cc:289] Attempt to free invalid pointer 0x1df4f0ce0 Received signal 11 SEGV_MAPERR 000000000039 #0 0x55d6de8f0857 base::debug::(anonymous namespace)::StackDumpSignalHandler() #1 0x7fc1981089f0 <unknown> #2 0x55d6daced180 <unknown> #3 0x55d6dacf7954 tcmalloc::Log() #4 0x55d6dad03070 (anonymous namespace)::do_free_with_callback() #5 0x55d6de8b2630 opj_jp2_destroy #6 0x55d6de8b4b29 opj_destroy_codec #7 0x55d6df08da0a CCodec_JpxModule::CreateDecoder() #8 0x55d6df045250 CPDF_DIBSource::LoadJpxBitmap() #9 0x55d6df0436cc CPDF_DIBSource::CreateDecoder() #10 0x55d6df044616 CPDF_DIBSource::StartLoadDIBSource() #11 0x55d6df03f5bd CPDF_ImageCacheEntry::StartGetCachedBitmap() #12 0x55d6df03f46f CPDF_PageRenderCache::StartGetCachedBitmap() #13 0x55d6df046f04 CPDF_ImageLoaderHandle::Start() #14 0x55d6df0470e4 CPDF_ImageLoader::Start() #15 0x55d6df040906 CPDF_ImageRenderer::StartLoadDIBSource() #16 0x55d6df03fc30 CPDF_ImageRenderer::Start() #17 0x55d6df03c693 CPDF_RenderStatus::ContinueSingleObject() #18 0x55d6df03e99b CPDF_ProgressiveRenderer::Continue() #19 0x55d6defeae44 FPDF_RenderPage_Retail() #20 0x55d6defe5494 FPDF_RenderPageBitmap_Start #21 0x55d6de8cfe12 chrome_pdf::PDFiumEngine::ContinuePaint() #22 0x55d6de8cfaf2 chrome_pdf::PDFiumEngine::Paint() #23 0x55d6de8e409c chrome_pdf::OutOfProcessInstance::OnPaint() #24 0x55d6de8e8d7b PaintManager::DoPaint() #25 0x55d6de81fba4 pp::CompletionCallbackFactory<>::CallbackData<>::Thunk() #26 0x55d6dc2ac733 ppapi::TrackedCallback::Run() #27 0x55d6dcb3e0cf ppapi::proxy::PluginResource::OnReplyReceived() #28 0x55d6dcb3dd9f ppapi::proxy::PluginMessageFilter::DispatchResourceReply() #29 0x55d6de8f1936 base::debug::TaskAnnotator::RunTask() #30 0x55d6de907cd5 base::MessageLoop::RunTask() #31 0x55d6de907fc8 base::MessageLoop::DeferOrRunPendingTask() #32 0x55d6de9082eb base::MessageLoop::DoWork() #33 0x55d6de9096ca base::MessagePumpDefault::Run() #34 0x55d6de92291e base::RunLoop::Run() #35 0x55d6de9075aa base::MessageLoop::Run() #36 0x55d6de658fcb content::PpapiPluginMain() #37 0x55d6de8cb65d content::RunZygote() #38 0x55d6de8cc6e7 content::ContentMainRunnerImpl::Run() #39 0x55d6de8cb230 content::ContentMain() #40 0x55d6da8ceb5b ChromeMain #41 0x7fc195102580 __libc_start_main #42 0x55d6da8cea39 <unknown> r8: 0000000000000009 r9: cccccccccccccccd r10: 0000000000000004 r11: 0000000000000000 r12: 000055d6e0b999d0 r13: 00007ffea3ceb8c0 r14: 00007ffea3ceb798 r15: 0000000000000001 di: 0000000000000000 si: 00007ffea3ceb798 bp: 000055d6df4fee01 bx: 0000000000000066 dx: 0000000000000066 ax: 0000000000000000 cx: 00007fc198107aed sp: 00007ffea3ceb768 ip: 000055d6daced180 efl: 0000000000010297 cgf: 0000000000000033 erf: 0000000000000006 trp: 000000000000000e msk: 0000000000000000 cr2: 0000000000000039 [end of stack trace] ``` Latest Chrome release crashes upon opening the attached PDF file in a similar manner. ### TIMELINE * 2016-05-19 - Vendor Disclosure * 2016-05-31 - Public Release
idSSV:96765
last seen2017-11-19
modified2017-10-20
published2017-10-20
reporterRoot
titleGoogle Chrome PDFium jpeg2000 SIZ Code Execution Vulnerability(CVE-2016-1681)

Talos

idTALOS-2016-0174
last seen2019-05-29
published2016-06-08
reporterTalos Intelligence
sourcehttp://www.talosintelligence.com/vulnerability_reports/TALOS-2016-0174
titleGoogle Chrome PDFium jpeg2000 SIZ Code Execution Vulnerability

Related news

References