Vulnerabilities > CVE-2016-1709 - Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Google Chrome and Sfntly

047910
CVSS 8.8 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
low complexity
google
CWE-119
nessus

Summary

Heap-based buffer overflow in the ByteArray::Get method in data/byte_array.cc in Google sfntly before 2016-06-10, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted SFNT font.

Vulnerable Configurations

Part Description Count
Application
Google
3765

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
  • Client-side Injection-induced Buffer Overflow
    This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
  • Filter Failure through Buffer Overflow
    In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
  • MIME Conversion
    An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.

Nessus

  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2016-1485.NASL
    descriptionAn update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Chromium is an open source web browser, powered by WebKit (Blink). This update upgrades Chromium to version 52.0.2743.82. Security Fix(es) : * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when visited by the victim. (CVE-2016-1706, CVE-2016-1708, CVE-2016-1709, CVE-2016-1710, CVE-2016-1711, CVE-2016-5127, CVE-2016-5128, CVE-2016-5129, CVE-2016-5130, CVE-2016-5131, CVE-2016-5132, CVE-2016-5133, CVE-2016-5134, CVE-2016-5135, CVE-2016-5136, CVE-2016-5137, CVE-2016-1705)
    last seen2020-05-31
    modified2016-07-26
    plugin id92552
    published2016-07-26
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/92552
    titleRHEL 6 : chromium-browser (RHSA-2016:1485)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2016:1485. The text 
    # itself is copyright (C) Red Hat, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(92552);
      script_version("2.16");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/29");
    
      script_cve_id("CVE-2016-1705", "CVE-2016-1706", "CVE-2016-1708", "CVE-2016-1709", "CVE-2016-1710", "CVE-2016-1711", "CVE-2016-5127", "CVE-2016-5128", "CVE-2016-5129", "CVE-2016-5130", "CVE-2016-5131", "CVE-2016-5132", "CVE-2016-5133", "CVE-2016-5134", "CVE-2016-5135", "CVE-2016-5136", "CVE-2016-5137");
      script_xref(name:"RHSA", value:"2016:1485");
    
      script_name(english:"RHEL 6 : chromium-browser (RHSA-2016:1485)");
      script_summary(english:"Checks the rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis",
        value:"The remote Red Hat host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description",
        value:
    "An update for chromium-browser is now available for Red Hat Enterprise
    Linux 6 Supplementary.
    
    Red Hat Product Security has rated this update as having a security
    impact of Important. A Common Vulnerability Scoring System (CVSS) base
    score, which gives a detailed severity rating, is available for each
    vulnerability from the CVE link(s) in the References section.
    
    Chromium is an open source web browser, powered by WebKit (Blink).
    
    This update upgrades Chromium to version 52.0.2743.82.
    
    Security Fix(es) :
    
    * Multiple flaws were found in the processing of malformed web
    content. A web page containing malicious content could cause Chromium
    to crash, execute arbitrary code, or disclose sensitive information
    when visited by the victim. (CVE-2016-1706, CVE-2016-1708,
    CVE-2016-1709, CVE-2016-1710, CVE-2016-1711, CVE-2016-5127,
    CVE-2016-5128, CVE-2016-5129, CVE-2016-5130, CVE-2016-5131,
    CVE-2016-5132, CVE-2016-5133, CVE-2016-5134, CVE-2016-5135,
    CVE-2016-5136, CVE-2016-5137, CVE-2016-1705)"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/errata/RHSA-2016:1485"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2016-1705"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2016-1706"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2016-1708"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2016-1709"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2016-1710"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2016-1711"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2016-5127"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2016-5128"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2016-5129"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2016-5130"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2016-5131"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2016-5132"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2016-5133"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2016-5134"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2016-5135"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2016-5136"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2016-5137"
      );
      script_set_attribute(
        attribute:"solution",
        value:
    "Update the affected chromium-browser and / or
    chromium-browser-debuginfo packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:chromium-browser");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:chromium-browser-debuginfo");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:6");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2016/07/23");
      script_set_attribute(attribute:"patch_publication_date", value:"2016/07/26");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/07/26");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Red Hat Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
    os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
    os_ver = os_ver[1];
    if (! preg(pattern:"^6([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 6.x", "Red Hat " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);
    
    yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
    if (!empty_or_null(yum_updateinfo)) 
    {
      rhsa = "RHSA-2016:1485";
      yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
      if (!empty_or_null(yum_report))
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : yum_report 
        );
        exit(0);
      }
      else
      {
        audit_message = "affected by Red Hat security advisory " + rhsa;
        audit(AUDIT_OS_NOT, audit_message);
      }
    }
    else
    {
      flag = 0;
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"chromium-browser-52.0.2743.82-1.el6", allowmaj:TRUE)) flag++;
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"chromium-browser-52.0.2743.82-1.el6", allowmaj:TRUE)) flag++;
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"chromium-browser-debuginfo-52.0.2743.82-1.el6", allowmaj:TRUE)) flag++;
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"chromium-browser-debuginfo-52.0.2743.82-1.el6", allowmaj:TRUE)) flag++;
    
      if (flag)
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : rpm_report_get() + redhat_report_package_caveat()
        );
        exit(0);
      }
      else
      {
        tested = pkg_tests_get();
        if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
        else audit(AUDIT_PACKAGE_NOT_INSTALLED, "chromium-browser / chromium-browser-debuginfo");
      }
    }
    
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_GOOGLE_CHROME_52_0_2743_82.NASL
    descriptionThe version of Google Chrome installed on the remote Mac OS X host is prior to 52.0.2743.82. It is, therefore, affected by multiple vulnerabilities : - Multiple unspecified vulnerabilities exist that allow a remote attacker to cause a denial of service condition or possibly have other impact via unknown vectors. (CVE-2016-1705) - A sandbox protection bypass vulnerability exists in PPAPI due to a failure to validate the origin of IPC messages to the plugin broker process. An unauthenticated, remote attacker can exploit this to bypass the sandbox. (CVE-2016-1706) - A use-after-free error exists in Extensions due to a failure to consider object lifetimes during progress observation. An unauthenticated, remote attacker can exploit this to dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2016-1708) - An array indexing error exists in the ByteArray::Get() function in data/byte_array.cc due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to cause a heap-based buffer overflow, resulting in a denial of service condition or the execution of arbitrary code. (CVE-2016-1709) - A same-origin bypass vulnerability exists in Blink due to a failure to prevent window creation by a deferred frame. A remote attacker can exploit this to bypass the same-origin policy. (CVE-2016-1710) - A same-origin bypass vulnerability exists in Blink due to a failure to disable frame navigation during a detach operation on a DocumentLoader object. A remote attacker can exploit this to bypass the same-origin policy. (CVE-2016-1711) - A use-after-free error exists in Blink in the previousLinePosition() function. An unauthenticated, remote attacker can exploit this, via crafted JavaScript code involving an @import at-rule in a Cascading Style Sheets (CSS) token sequence in conjunction with a rel=import attribute of a LINK element, to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-5127) - A same-origin bypass vulnerability exists in Google V8 due to a failure to prevent API interceptors from modifying a store target without setting a property. A remote attacker can exploit this to bypass the same-origin policy. (CVE-2016-5128) - A flaw exists in V8 due to improper processing of left-trimmed objects. An unauthenticated, remote attacker can exploit this, via crafted JavaScript code, to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-5129) - A flaw exists that is triggered when handling two forward navigations that compete in different frames. A remote attacker can exploit this to conduct a URL spoofing attack. (CVE-2016-5130) - A use-after-free error exists in libxml2 in the xmlXPtrRangeToFunction() function. An unauthenticated, remote attacker can exploit this to dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2016-5131) - A same-origin bypass vulnerability exists in the Service Workers subsystem due to a failure to properly implement the Secure Contexts specification during decisions about whether to control a subframe. A remote attacker can exploit this to bypass the same-origin policy. (CVE-2016-5132) - A flaw exists in the handling of origin information during proxy authentication that allows a man-in-the-middle attacker to spoof a proxy-authentication login prompt or trigger incorrect credential storage by modifying the client-server data stream. (CVE-2016-5133) - A validation flaw exists in the Proxy Auto-Config (PAC) feature due to a failure to ensure that URL information is restricted to a scheme, host, and port. A remote attacker can exploit this to disclose credentials by operating a server with a PAC script. (CVE-2016-5134) - A cross-origin bypass vulnerability exists in Blink due to a failure to consider referrer-policy information inside an HTML document during a preload request. A remote attacker can exploit this to bypass the Content Security Policy (CSP) protection mechanism. (CVE-2016-5135) - A use-after-free error exists in Extensions that allows a remote attacker to dereference already freed memory, resulting in the execution of arbitrary code with elevated privileges. (CVE-2016-5136) - An information disclosure vulnerability exists in Blink when handling HTTP vs HTTPs ports in source expressions. An unauthenticated, remote attacker can exploit this to determine whether a specific HTTP Strict Transport Security (HSTS) web site has been visited by reading a CSP report. (CVE-2016-5137) Note that Nessus has not tested for these issues but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id92629
    published2016-07-29
    reporterThis script is Copyright (C) 2016-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/92629
    titleGoogle Chrome < 52.0.2743.82 Multiple Vulnerabilities (Mac OS X)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(92629);
      script_version("1.9");
      script_cvs_date("Date: 2018/07/14  1:59:36");
    
      script_cve_id(
        "CVE-2016-1705",
        "CVE-2016-1706",
        "CVE-2016-1708",
        "CVE-2016-1709",
        "CVE-2016-1710",
        "CVE-2016-1711",
        "CVE-2016-5127",
        "CVE-2016-5128",
        "CVE-2016-5129",
        "CVE-2016-5130",
        "CVE-2016-5131",
        "CVE-2016-5132",
        "CVE-2016-5133",
        "CVE-2016-5134",
        "CVE-2016-5135",
        "CVE-2016-5136",
        "CVE-2016-5137"
      );
      script_bugtraq_id(92053);
    
      script_name(english:"Google Chrome < 52.0.2743.82 Multiple Vulnerabilities (Mac OS X)");
      script_summary(english:"Checks the version of Google Chrome.");
    
      script_set_attribute(attribute:"synopsis", value:
    "A web browser installed on the remote Mac OS X host is affected by
    multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The version of Google Chrome installed on the remote Mac OS X host is
    prior to 52.0.2743.82. It is, therefore, affected by multiple
    vulnerabilities :
    
      - Multiple unspecified vulnerabilities exist that allow a
        remote attacker to cause a denial of service condition
        or possibly have other impact via unknown vectors.
        (CVE-2016-1705)
    
      - A sandbox protection bypass vulnerability exists in
        PPAPI due to a failure to validate the origin of IPC
        messages to the plugin broker process. An
        unauthenticated, remote attacker can exploit this to
        bypass the sandbox. (CVE-2016-1706)
    
      - A use-after-free error exists in Extensions due to a
        failure to consider object lifetimes during progress
        observation. An unauthenticated, remote attacker can
        exploit this to dereference already freed memory,
        resulting in the execution of arbitrary code.
        (CVE-2016-1708)
    
      - An array indexing error exists in the ByteArray::Get()
        function in data/byte_array.cc due to improper 
        validation of user-supplied input. An unauthenticated,
        remote attacker can exploit this to cause a heap-based
        buffer overflow, resulting in a denial of service
        condition or the execution of arbitrary code.
        (CVE-2016-1709)
    
      - A same-origin bypass vulnerability exists in Blink due
        to a failure to prevent window creation by a deferred
        frame. A remote attacker can exploit this to bypass the
        same-origin policy. (CVE-2016-1710)
    
      - A same-origin bypass vulnerability exists in Blink due
        to a failure to disable frame navigation during a detach
        operation on a DocumentLoader object. A remote attacker
        can exploit this to bypass the same-origin policy.
        (CVE-2016-1711)
    
      - A use-after-free error exists in Blink in the
        previousLinePosition() function. An unauthenticated,
        remote attacker can exploit this, via crafted JavaScript
        code involving an @import at-rule in a Cascading Style
        Sheets (CSS) token sequence in conjunction with a
        rel=import attribute of a LINK element, to cause a
        denial of service condition or the execution of
        arbitrary code. (CVE-2016-5127)
    
      - A same-origin bypass vulnerability exists in Google V8
        due to a failure to prevent API interceptors from
        modifying a store target without setting a property. A
        remote attacker can exploit this to bypass the
        same-origin policy. (CVE-2016-5128)
    
      - A flaw exists in V8 due to improper processing of
        left-trimmed objects. An unauthenticated, remote
        attacker can exploit this, via crafted JavaScript code,
        to cause a denial of service condition or the execution
        of arbitrary code. (CVE-2016-5129)
    
      - A flaw exists that is triggered when handling two
        forward navigations that compete in different frames. A
        remote attacker can exploit this to conduct a URL
        spoofing attack. (CVE-2016-5130)
    
      - A use-after-free error exists in libxml2 in the
        xmlXPtrRangeToFunction() function. An unauthenticated,
        remote attacker can exploit this to dereference already
        freed memory, resulting in the execution of arbitrary
        code. (CVE-2016-5131)
    
      - A same-origin bypass vulnerability exists in the Service
        Workers subsystem due to a failure to properly implement
        the Secure Contexts specification during decisions about
        whether to control a subframe. A remote attacker can
        exploit this to bypass the same-origin policy.
        (CVE-2016-5132)
    
      - A flaw exists in the handling of origin information
        during proxy authentication that allows a
        man-in-the-middle attacker to spoof a
        proxy-authentication login prompt or trigger incorrect
        credential storage by modifying the client-server data
        stream. (CVE-2016-5133)
    
      - A validation flaw exists in the Proxy Auto-Config (PAC)
        feature due to a failure to ensure that URL information
        is restricted to a scheme, host, and port. A remote
        attacker can exploit this to disclose credentials by
        operating a server with a PAC script. (CVE-2016-5134)
    
      - A cross-origin bypass vulnerability exists in Blink due
        to a failure to consider referrer-policy information
        inside an HTML document during a preload request. A
        remote attacker can exploit this to bypass the Content
        Security Policy (CSP) protection mechanism.
        (CVE-2016-5135)
    
      - A use-after-free error exists in Extensions that allows
        a remote attacker to dereference already freed memory,
        resulting in the execution of arbitrary code with
        elevated privileges. (CVE-2016-5136)
    
      - An information disclosure vulnerability exists in Blink
        when handling HTTP vs HTTPs ports in source expressions.
        An unauthenticated, remote attacker can exploit this to
        determine whether a specific HTTP Strict Transport
        Security (HSTS) web site has been visited by reading a
        CSP report. (CVE-2016-5137)
    
    Note that Nessus has not tested for these issues but has instead
    relied only on the application's self-reported version number.");
      # http://googlechromereleases.blogspot.com/2016/07/stable-channel-update.html
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?7c7c32d0");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to Google Chrome version 52.0.2743.82 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2016/07/20");
      script_set_attribute(attribute:"patch_publication_date", value:"2016/07/20");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/07/29");
    
      script_set_attribute(attribute:"plugin_type",value:"local");
      script_set_attribute(attribute:"cpe",value:"cpe:/a:google:chrome");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"MacOS X Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2016-2018 Tenable Network Security, Inc.");
    
      script_dependencies("macosx_google_chrome_installed.nbin");
      script_require_keys("MacOSX/Google Chrome/Installed");
    
      exit(0);
    }
    
    include("google_chrome_version.inc");
    
    get_kb_item_or_exit("MacOSX/Google Chrome/Installed");
    
    google_chrome_check_version(fix:'52.0.2743.82', severity:SECURITY_HOLE);
    
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-3637.NASL
    descriptionSeveral vulnerabilities have been discovered in the chromium web browser. - CVE-2016-1704 The chrome development team found and fixed various issues during internal auditing. - CVE-2016-1705 The chrome development team found and fixed various issues during internal auditing. - CVE-2016-1706 Pinkie Pie discovered a way to escape the Pepper Plugin API sandbox. - CVE-2016-1707 xisigr discovered a URL spoofing issue. - CVE-2016-1708 Adam Varsan discovered a use-after-free issue. - CVE-2016-1709 ChenQin discovered a buffer overflow issue in the sfntly library. - CVE-2016-1710 Mariusz Mlynski discovered a same-origin bypass. - CVE-2016-1711 Mariusz Mlynski discovered another same-origin bypass. - CVE-2016-5127 cloudfuzzer discovered a use-after-free issue. - CVE-2016-5128 A same-origin bypass issue was discovered in the v8 JavaScript library. - CVE-2016-5129 Jeonghoon Shin discovered a memory corruption issue in the v8 JavaScript library. - CVE-2016-5130 Widih Matar discovered a URL spoofing issue. - CVE-2016-5131 Nick Wellnhofer discovered a use-after-free issue in the libxml2 library. - CVE-2016-5132 Ben Kelly discovered a same-origin bypass. - CVE-2016-5133 Patch Eudor discovered an issue in proxy authentication. - CVE-2016-5134 Paul Stone discovered an information leak in the Proxy Auto-Config feature. - CVE-2016-5135 ShenYeYinJiu discovered a way to bypass the Content Security Policy. - CVE-2016-5136 Rob Wu discovered a use-after-free issue. - CVE-2016-5137 Xiaoyin Liu discovered a way to discover whether an HSTS website had been visited.
    last seen2020-06-01
    modified2020-06-02
    plugin id92666
    published2016-08-02
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/92666
    titleDebian DSA-3637-1 : chromium-browser - security update
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Debian Security Advisory DSA-3637. The text 
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(92666);
      script_version("2.11");
      script_cvs_date("Date: 2019/07/15 14:20:30");
    
      script_cve_id("CVE-2016-1704", "CVE-2016-1705", "CVE-2016-1706", "CVE-2016-1707", "CVE-2016-1708", "CVE-2016-1709", "CVE-2016-1710", "CVE-2016-1711", "CVE-2016-5127", "CVE-2016-5128", "CVE-2016-5129", "CVE-2016-5130", "CVE-2016-5131", "CVE-2016-5132", "CVE-2016-5133", "CVE-2016-5134", "CVE-2016-5135", "CVE-2016-5136", "CVE-2016-5137");
      script_xref(name:"DSA", value:"3637");
    
      script_name(english:"Debian DSA-3637-1 : chromium-browser - security update");
      script_summary(english:"Checks dpkg output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Debian host is missing a security-related update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Several vulnerabilities have been discovered in the chromium web
    browser.
    
      - CVE-2016-1704
        The chrome development team found and fixed various
        issues during internal auditing.
    
      - CVE-2016-1705
        The chrome development team found and fixed various
        issues during internal auditing.
    
      - CVE-2016-1706
        Pinkie Pie discovered a way to escape the Pepper Plugin
        API sandbox.
    
      - CVE-2016-1707
        xisigr discovered a URL spoofing issue.
    
      - CVE-2016-1708
        Adam Varsan discovered a use-after-free issue.
    
      - CVE-2016-1709
        ChenQin discovered a buffer overflow issue in the sfntly
        library.
    
      - CVE-2016-1710
        Mariusz Mlynski discovered a same-origin bypass.
    
      - CVE-2016-1711
        Mariusz Mlynski discovered another same-origin bypass.
    
      - CVE-2016-5127
        cloudfuzzer discovered a use-after-free issue.
    
      - CVE-2016-5128
        A same-origin bypass issue was discovered in the v8
        JavaScript library.
    
      - CVE-2016-5129
        Jeonghoon Shin discovered a memory corruption issue in
        the v8 JavaScript library.
    
      - CVE-2016-5130
        Widih Matar discovered a URL spoofing issue.
    
      - CVE-2016-5131
        Nick Wellnhofer discovered a use-after-free issue in the
        libxml2 library.
    
      - CVE-2016-5132
        Ben Kelly discovered a same-origin bypass.
    
      - CVE-2016-5133
        Patch Eudor discovered an issue in proxy authentication.
    
      - CVE-2016-5134
        Paul Stone discovered an information leak in the Proxy
        Auto-Config feature.
    
      - CVE-2016-5135
        ShenYeYinJiu discovered a way to bypass the Content
        Security Policy.
    
      - CVE-2016-5136
        Rob Wu discovered a use-after-free issue.
    
      - CVE-2016-5137
        Xiaoyin Liu discovered a way to discover whether an HSTS
        website had been visited."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-1704"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-1705"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-1706"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-1707"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-1708"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-1709"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-1710"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-1711"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5127"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5128"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5129"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5130"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5131"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5132"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5133"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5134"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5135"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5136"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5137"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://packages.debian.org/source/jessie/chromium-browser"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.debian.org/security/2016/dsa-3637"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "Upgrade the chromium-browser packages.
    
    For the stable distribution (jessie), these problems have been fixed
    in version 52.0.2743.82-1~deb8u1."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:chromium-browser");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:8.0");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2016/07/03");
      script_set_attribute(attribute:"patch_publication_date", value:"2016/07/31");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/08/02");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"8.0", prefix:"chromedriver", reference:"52.0.2743.82-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"chromium", reference:"52.0.2743.82-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"chromium-dbg", reference:"52.0.2743.82-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"chromium-inspector", reference:"52.0.2743.82-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"chromium-l10n", reference:"52.0.2743.82-1~deb8u1")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2016-919.NASL
    descriptionChromium was updated to 52.0.2743.82 to fix the following security issues (boo#989901) : - CVE-2016-1706: Sandbox escape in PPAPI - CVE-2016-1707: URL spoofing on iOS - CVE-2016-1708: Use-after-free in Extensions - CVE-2016-1709: Heap-buffer-overflow in sfntly - CVE-2016-1710: Same-origin bypass in Blink - CVE-2016-1711: Same-origin bypass in Blink - CVE-2016-5127: Use-after-free in Blink - CVE-2016-5128: Same-origin bypass in V8 - CVE-2016-5129: Memory corruption in V8 - CVE-2016-5130: URL spoofing - CVE-2016-5131: Use-after-free in libxml - CVE-2016-5132: Limited same-origin bypass in Service Workers - CVE-2016-5133: Origin confusion in proxy authentication - CVE-2016-5134: URL leakage via PAC script - CVE-2016-5135: Content-Security-Policy bypass - CVE-2016-5136: Use after free in extensions - CVE-2016-5137: History sniffing with HSTS and CSP - CVE-2016-1705: Various fixes from internal audits, fuzzing and other initiatives
    last seen2020-06-05
    modified2016-08-01
    plugin id92655
    published2016-08-01
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/92655
    titleopenSUSE Security Update : Chromium (openSUSE-2016-919)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2016-901.NASL
    descriptionChromium was updated to 52.0.2743.82 to fix the following security issues (boo#989901) : - CVE-2016-1706: Sandbox escape in PPAPI - CVE-2016-1707: URL spoofing on iOS - CVE-2016-1708: Use-after-free in Extensions - CVE-2016-1709: Heap-buffer-overflow in sfntly - CVE-2016-1710: Same-origin bypass in Blink - CVE-2016-1711: Same-origin bypass in Blink - CVE-2016-5127: Use-after-free in Blink - CVE-2016-5128: Same-origin bypass in V8 - CVE-2016-5129: Memory corruption in V8 - CVE-2016-5130: URL spoofing - CVE-2016-5131: Use-after-free in libxml - CVE-2016-5132: Limited same-origin bypass in Service Workers - CVE-2016-5133: Origin confusion in proxy authentication - CVE-2016-5134: URL leakage via PAC script - CVE-2016-5135: Content-Security-Policy bypass - CVE-2016-5136: Use after free in extensions - CVE-2016-5137: History sniffing with HSTS and CSP - CVE-2016-1705: Various fixes from internal audits, fuzzing and other initiatives
    last seen2020-06-05
    modified2016-07-26
    plugin id92551
    published2016-07-26
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/92551
    titleopenSUSE Security Update : Chromium (openSUSE-2016-901)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_6FAE9FE1504811E68AA73065EC8FD3EC.NASL
    descriptionGoogle Chrome Releases reports : 48 security fixes in this release, including : - [610600] High CVE-2016-1706: Sandbox escape in PPAPI. Credit to Pinkie Pie xisigr of Tencent
    last seen2020-06-01
    modified2020-06-02
    plugin id92537
    published2016-07-25
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/92537
    titleFreeBSD : chromium -- multiple vulnerabilities (6fae9fe1-5048-11e6-8aa7-3065ec8fd3ec)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2016-900.NASL
    descriptionChromium was updated to 52.0.2743.82 to fix the following security issues (boo#989901) : - CVE-2016-1706: Sandbox escape in PPAPI - CVE-2016-1707: URL spoofing on iOS - CVE-2016-1708: Use-after-free in Extensions - CVE-2016-1709: Heap-buffer-overflow in sfntly - CVE-2016-1710: Same-origin bypass in Blink - CVE-2016-1711: Same-origin bypass in Blink - CVE-2016-5127: Use-after-free in Blink - CVE-2016-5128: Same-origin bypass in V8 - CVE-2016-5129: Memory corruption in V8 - CVE-2016-5130: URL spoofing - CVE-2016-5131: Use-after-free in libxml - CVE-2016-5132: Limited same-origin bypass in Service Workers - CVE-2016-5133: Origin confusion in proxy authentication - CVE-2016-5134: URL leakage via PAC script - CVE-2016-5135: Content-Security-Policy bypass - CVE-2016-5136: Use after free in extensions - CVE-2016-5137: History sniffing with HSTS and CSP - CVE-2016-1705: Various fixes from internal audits, fuzzing and other initiatives
    last seen2020-06-05
    modified2016-07-26
    plugin id92550
    published2016-07-26
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/92550
    titleopenSUSE Security Update : Chromium (openSUSE-2016-900)
  • NASL familyWindows
    NASL idGOOGLE_CHROME_52_0_2743_82.NASL
    descriptionThe version of Google Chrome installed on the remote Windows host is prior to 52.0.2743.82. It is, therefore, affected by multiple vulnerabilities : - Multiple unspecified vulnerabilities exist that allow a remote attacker to cause a denial of service condition or possibly have other impact via unknown vectors. (CVE-2016-1705) - A sandbox protection bypass vulnerability exists in PPAPI due to a failure to validate the origin of IPC messages to the plugin broker process. An unauthenticated, remote attacker can exploit this to bypass the sandbox. (CVE-2016-1706) - A use-after-free error exists in Extensions due to a failure to consider object lifetimes during progress observation. An unauthenticated, remote attacker can exploit this to dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2016-1708) - An array indexing error exists in the ByteArray::Get() function in data/byte_array.cc due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to cause a heap-based buffer overflow, resulting in a denial of service condition or the execution of arbitrary code. (CVE-2016-1709) - A same-origin bypass vulnerability exists in Blink due to a failure to prevent window creation by a deferred frame. A remote attacker can exploit this to bypass the same-origin policy. (CVE-2016-1710) - A same-origin bypass vulnerability exists in Blink due to a failure to disable frame navigation during a detach operation on a DocumentLoader object. A remote attacker can exploit this to bypass the same-origin policy. (CVE-2016-1711) - A use-after-free error exists in Blink in the previousLinePosition() function. An unauthenticated, remote attacker can exploit this, via crafted JavaScript code involving an @import at-rule in a Cascading Style Sheets (CSS) token sequence in conjunction with a rel=import attribute of a LINK element, to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-5127) - A same-origin bypass vulnerability exists in Google V8 due to a failure to prevent API interceptors from modifying a store target without setting a property. A remote attacker can exploit this to bypass the same-origin policy. (CVE-2016-5128) - A flaw exists in V8 due to improper processing of left-trimmed objects. An unauthenticated, remote attacker can exploit this, via crafted JavaScript code, to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-5129) - A flaw exists that is triggered when handling two forward navigations that compete in different frames. A remote attacker can exploit this to conduct a URL spoofing attack. (CVE-2016-5130) - A use-after-free error exists in libxml2 in the xmlXPtrRangeToFunction() function. An unauthenticated, remote attacker can exploit this to dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2016-5131) - A same-origin bypass vulnerability exists in the Service Workers subsystem due to a failure to properly implement the Secure Contexts specification during decisions about whether to control a subframe. A remote attacker can exploit this to bypass the same-origin policy. (CVE-2016-5132) - A flaw exists in the handling of origin information during proxy authentication that allows a man-in-the-middle attacker to spoof a proxy-authentication login prompt or trigger incorrect credential storage by modifying the client-server data stream. (CVE-2016-5133) - A validation flaw exists in the Proxy Auto-Config (PAC) feature due to a failure to ensure that URL information is restricted to a scheme, host, and port. A remote attacker can exploit this to disclose credentials by operating a server with a PAC script. (CVE-2016-5134) - A cross-origin bypass vulnerability exists in Blink due to a failure to consider referrer-policy information inside an HTML document during a preload request. A remote attacker can exploit this to bypass the Content Security Policy (CSP) protection mechanism. (CVE-2016-5135) - A use-after-free error exists in Extensions that allows a remote attacker to dereference already freed memory, resulting in the execution of arbitrary code with elevated privileges. (CVE-2016-5136) - An information disclosure vulnerability exists in Blink when handling HTTP vs HTTPs ports in source expressions. An unauthenticated, remote attacker can exploit this to determine whether a specific HTTP Strict Transport Security (HSTS) web site has been visited by reading a CSP report. (CVE-2016-5137) Note that Nessus has not tested for these issues but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id92628
    published2016-07-29
    reporterThis script is Copyright (C) 2016-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/92628
    titleGoogle Chrome < 52.0.2743.82 Multiple Vulnerabilities

Redhat

advisories
rhsa
idRHSA-2016:1485
rpms
  • chromium-browser-0:52.0.2743.82-1.el6
  • chromium-browser-debuginfo-0:52.0.2743.82-1.el6