Vulnerabilities > CVE-2016-5201 - Information Exposure vulnerability in Google Chrome

047910
CVSS 6.5 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
NONE
Availability impact
NONE
network
low complexity
google
CWE-200
nessus

Summary

A leak of privateClass in the extensions API in Google Chrome prior to 54.0.2840.100 for Linux, and 54.0.2840.99 for Windows, and 54.0.2840.98 for Mac allowed a remote attacker to access privileged JavaScript code via a crafted HTML page.

Vulnerable Configurations

Part Description Count
Application
Google
3776

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Subverting Environment Variable Values
    The attacker directly or indirectly modifies environment variables used by or controlling the target software. The attacker's goal is to cause the target software to deviate from its expected operation in a manner that benefits the attacker.
  • Footprinting
    An attacker engages in probing and exploration activity to identify constituents and properties of the target. Footprinting is a general term to describe a variety of information gathering techniques, often used by attackers in preparation for some attack. It consists of using tools to learn as much as possible about the composition, configuration, and security mechanisms of the targeted application, system or network. Information that might be collected during a footprinting effort could include open ports, applications and their versions, network topology, and similar information. While footprinting is not intended to be damaging (although certain activities, such as network scans, can sometimes cause disruptions to vulnerable applications inadvertently) it may often pave the way for more damaging attacks.
  • Exploiting Trust in Client (aka Make the Client Invisible)
    An attack of this type exploits a programs' vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by placing themselves in the communication channel between client and server such that communication directly to the server is possible where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
  • Browser Fingerprinting
    An attacker carefully crafts small snippets of Java Script to efficiently detect the type of browser the potential victim is using. Many web-based attacks need prior knowledge of the web browser including the version of browser to ensure successful exploitation of a vulnerability. Having this knowledge allows an attacker to target the victim with attacks that specifically exploit known or zero day weaknesses in the type and version of the browser used by the victim. Automating this process via Java Script as a part of the same delivery system used to exploit the browser is considered more efficient as the attacker can supply a browser fingerprinting method and integrate it with exploit code, all contained in Java Script and in response to the same web page request by the browser.
  • Session Credential Falsification through Prediction
    This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.

Nessus

  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2016-A815B7BF5D.NASL
    descriptionUpdate to Chromium 55. Security fix for CVE-2016-5199, CVE-2016-5200, CVE-2016-5201, CVE-2016-5202, CVE-2016-9651, CVE-2016-5208, CVE-2016-5207, CVE-2016-5206, CVE-2016-5205, CVE-2016-5204, CVE-2016-5209, CVE-2016-5203, CVE-2016-5210, CVE-2016-5212, CVE-2016-5211, CVE-2016-5213, CVE-2016-5214, CVE-2016-5216, CVE-2016-5215, CVE-2016-5217, CVE-2016-5218, CVE-2016-5219, CVE-2016-5221, CVE-2016-5220, CVE-2016-5222, CVE-2016-9650, CVE-2016-5223, CVE-2016-5226, CVE-2016-5225, CVE-2016-5224, CVE-2016-9652 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2016-12-16
    plugin id95903
    published2016-12-16
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/95903
    titleFedora 25 : chromium (2016-a815b7bf5d)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Fedora Security Advisory FEDORA-2016-a815b7bf5d.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(95903);
      script_version("3.14");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2016-5199", "CVE-2016-5200", "CVE-2016-5201", "CVE-2016-5202", "CVE-2016-5203", "CVE-2016-5204", "CVE-2016-5205", "CVE-2016-5206", "CVE-2016-5207", "CVE-2016-5208", "CVE-2016-5209", "CVE-2016-5210", "CVE-2016-5211", "CVE-2016-5212", "CVE-2016-5213", "CVE-2016-5214", "CVE-2016-5215", "CVE-2016-5216", "CVE-2016-5217", "CVE-2016-5218", "CVE-2016-5219", "CVE-2016-5220", "CVE-2016-5221", "CVE-2016-5222", "CVE-2016-5223", "CVE-2016-5224", "CVE-2016-5225", "CVE-2016-5226", "CVE-2016-9650", "CVE-2016-9651", "CVE-2016-9652");
      script_xref(name:"FEDORA", value:"2016-a815b7bf5d");
    
      script_name(english:"Fedora 25 : chromium (2016-a815b7bf5d)");
      script_summary(english:"Checks rpm output for the updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Fedora host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Update to Chromium 55. 
    
    Security fix for CVE-2016-5199, CVE-2016-5200, CVE-2016-5201,
    CVE-2016-5202, CVE-2016-9651, CVE-2016-5208, CVE-2016-5207,
    CVE-2016-5206, CVE-2016-5205, CVE-2016-5204, CVE-2016-5209,
    CVE-2016-5203, CVE-2016-5210, CVE-2016-5212, CVE-2016-5211,
    CVE-2016-5213, CVE-2016-5214, CVE-2016-5216, CVE-2016-5215,
    CVE-2016-5217, CVE-2016-5218, CVE-2016-5219, CVE-2016-5221,
    CVE-2016-5220, CVE-2016-5222, CVE-2016-9650, CVE-2016-5223,
    CVE-2016-5226, CVE-2016-5225, CVE-2016-5224, CVE-2016-9652
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Fedora update system website.
    Tenable has attempted to automatically clean and format it as much as
    possible without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bodhi.fedoraproject.org/updates/FEDORA-2016-a815b7bf5d"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected chromium package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:chromium");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:25");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2017/01/19");
      script_set_attribute(attribute:"patch_publication_date", value:"2016/12/15");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/12/16");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Fedora Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
    os_ver = pregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
    os_ver = os_ver[1];
    if (! preg(pattern:"^25([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 25", "Fedora " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"FC25", reference:"chromium-55.0.2883.87-1.fc25")) flag++;
    
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "chromium");
    }
    
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201611-16.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201611-16 (Chromium: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in the Chromium web browser. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, obtain sensitive information, or bypass security restrictions. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id95267
    published2016-11-23
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/95267
    titleGLSA-201611-16 : Chromium: Multiple vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Gentoo Linux Security Advisory GLSA 201611-16.
    #
    # The advisory text is Copyright (C) 2001-2019 Gentoo Foundation, Inc.
    # and licensed under the Creative Commons - Attribution / Share Alike 
    # license. See http://creativecommons.org/licenses/by-sa/3.0/
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(95267);
      script_version("3.5");
      script_cvs_date("Date: 2019/11/12");
    
      script_cve_id("CVE-2016-5199", "CVE-2016-5200", "CVE-2016-5201", "CVE-2016-5202");
      script_xref(name:"GLSA", value:"201611-16");
    
      script_name(english:"GLSA-201611-16 : Chromium: Multiple vulnerabilities");
      script_summary(english:"Checks for updated package(s) in /var/db/pkg");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Gentoo host is missing one or more security-related
    patches."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The remote host is affected by the vulnerability described in GLSA-201611-16
    (Chromium: Multiple vulnerabilities)
    
        Multiple vulnerabilities have been discovered in the Chromium web
          browser. Please review the CVE identifiers referenced below for details.
      
    Impact :
    
        A remote attacker could possibly execute arbitrary code with the
          privileges of the process, cause a Denial of Service condition, obtain
          sensitive information, or bypass security restrictions.
      
    Workaround :
    
        There is no known workaround at this time."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security.gentoo.org/glsa/201611-16"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "All Chromium users should upgrade to the latest version:
          # emerge --sync
          # emerge --ask --oneshot --verbose
          '>=www-client/chromium-54.0.2840.100'"
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:chromium");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2017/01/19");
      script_set_attribute(attribute:"patch_publication_date", value:"2016/11/22");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/11/23");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Gentoo Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("qpkg.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
    if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (qpkg_check(package:"www-client/chromium", unaffected:make_list("ge 54.0.2840.100"), vulnerable:make_list("lt 54.0.2840.100"))) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = qpkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "Chromium");
    }
    
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-3731.NASL
    descriptionSeveral vulnerabilities have been discovered in the chromium web browser. - CVE-2016-5181 A cross-site scripting issue was discovered. - CVE-2016-5182 Giwan Go discovered a heap overflow issue. - CVE-2016-5183 A use-after-free issue was discovered in the pdfium library. - CVE-2016-5184 Another use-after-free issue was discovered in the pdfium library. - CVE-2016-5185 cloudfuzzer discovered a use-after-free issue in Blink/Webkit. - CVE-2016-5186 Abdulrahman Alqabandi discovered an out-of-bounds read issue in the developer tools. - CVE-2016-5187 Luan Herrera discovered a URL spoofing issue. - CVE-2016-5188 Luan Herrera discovered that some drop down menus can be used to hide parts of the user interface. - CVE-2016-5189 xisigr discovered a URL spoofing issue. - CVE-2016-5190 Atte Kettunen discovered a use-after-free issue. - CVE-2016-5191 Gareth Hughes discovered a cross-site scripting issue. - CVE-2016-5192 [email protected] discovered a same-origin bypass. - CVE-2016-5193 Yuyang Zhou discovered a way to pop open a new window. - CVE-2016-5194 The chrome development team found and fixed various issues during internal auditing. - CVE-2016-5198 Tencent Keen Security Lab discovered an out-of-bounds memory access issue in the v8 JavaScript library. - CVE-2016-5199 A heap corruption issue was discovered in the ffmpeg library. - CVE-2016-5200 Choongwoo Han discovered an out-of-bounds memory access issue in the v8 JavaScript library. - CVE-2016-5201 Rob Wu discovered an information leak. - CVE-2016-5202 The chrome development team found and fixed various issues during internal auditing. - CVE-2016-5203 A use-after-free issue was discovered in the pdfium library. - CVE-2016-5204 Mariusz Mlynski discovered a cross-site scripting issue in SVG image handling. - CVE-2016-5205 A cross-site scripting issue was discovered. - CVE-2016-5206 Rob Wu discovered a same-origin bypass in the pdfium library. - CVE-2016-5207 Mariusz Mlynski discovered a cross-site scripting issue. - CVE-2016-5208 Mariusz Mlynski discovered another cross-site scripting issue. - CVE-2016-5209 Giwan Go discovered an out-of-bounds write issue in Blink/Webkit. - CVE-2016-5210 Ke Liu discovered an out-of-bounds write in the pdfium library. - CVE-2016-5211 A use-after-free issue was discovered in the pdfium library. - CVE-2016-5212 Khalil Zhani discovered an information disclosure issue in the developer tools. - CVE-2016-5213 Khalil Zhani discovered a use-after-free issue in the v8 JavaScript library. - CVE-2016-5214 Jonathan Birch discovered a file download protection bypass. - CVE-2016-5215 Looben Yang discovered a use-after-free issue. - CVE-2016-5216 A use-after-free issue was discovered in the pdfium library. - CVE-2016-5217 Rob Wu discovered a condition where data was not validated by the pdfium library. - CVE-2016-5218 Abdulrahman Alqabandi discovered a URL spoofing issue. - CVE-2016-5219 Rob Wu discovered a use-after-free issue in the v8 JavaScript library. - CVE-2016-5220 Rob Wu discovered a way to access files on the local system. - CVE-2016-5221 Tim Becker discovered an integer overflow issue in the angle library. - CVE-2016-5222 xisigr discovered a URL spoofing issue. - CVE-2016-5223 Hwiwon Lee discovered an integer overflow issue in the pdfium library. - CVE-2016-5224 Roeland Krak discovered a same-origin bypass in SVG image handling. - CVE-2016-5225 Scott Helme discovered a Content Security Protection bypass. - CVE-2016-5226 Jun Kokatsu discovered a cross-scripting issue. - CVE-2016-9650 Jakub Zoczek discovered a Content Security Protection information disclosure. - CVE-2016-9651 Guang Gong discovered a way to access private data in the v8 JavaScript library. - CVE-2016-9652 The chrome development team found and fixed various issues during internal auditing.
    last seen2020-06-01
    modified2020-06-02
    plugin id95667
    published2016-12-12
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/95667
    titleDebian DSA-3731-1 : chromium-browser - security update
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Debian Security Advisory DSA-3731. The text 
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(95667);
      script_version("3.17");
      script_cvs_date("Date: 2019/11/22");
    
      script_cve_id("CVE-2016-5181", "CVE-2016-5182", "CVE-2016-5183", "CVE-2016-5184", "CVE-2016-5185", "CVE-2016-5186", "CVE-2016-5187", "CVE-2016-5188", "CVE-2016-5189", "CVE-2016-5190", "CVE-2016-5191", "CVE-2016-5192", "CVE-2016-5193", "CVE-2016-5194", "CVE-2016-5198", "CVE-2016-5199", "CVE-2016-5200", "CVE-2016-5201", "CVE-2016-5202", "CVE-2016-5203", "CVE-2016-5204", "CVE-2016-5205", "CVE-2016-5206", "CVE-2016-5207", "CVE-2016-5208", "CVE-2016-5209", "CVE-2016-5210", "CVE-2016-5211", "CVE-2016-5212", "CVE-2016-5213", "CVE-2016-5214", "CVE-2016-5215", "CVE-2016-5216", "CVE-2016-5217", "CVE-2016-5218", "CVE-2016-5219", "CVE-2016-5220", "CVE-2016-5221", "CVE-2016-5222", "CVE-2016-5223", "CVE-2016-5224", "CVE-2016-5225", "CVE-2016-5226", "CVE-2016-9650", "CVE-2016-9651", "CVE-2016-9652");
      script_xref(name:"DSA", value:"3731");
    
      script_name(english:"Debian DSA-3731-1 : chromium-browser - security update");
      script_summary(english:"Checks dpkg output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Debian host is missing a security-related update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Several vulnerabilities have been discovered in the chromium web
    browser.
    
      - CVE-2016-5181
        A cross-site scripting issue was discovered.
    
      - CVE-2016-5182
        Giwan Go discovered a heap overflow issue.
    
      - CVE-2016-5183
        A use-after-free issue was discovered in the pdfium
        library.
    
      - CVE-2016-5184
        Another use-after-free issue was discovered in the
        pdfium library.
    
      - CVE-2016-5185
        cloudfuzzer discovered a use-after-free issue in
        Blink/Webkit.
    
      - CVE-2016-5186
        Abdulrahman Alqabandi discovered an out-of-bounds read
        issue in the developer tools.
    
      - CVE-2016-5187
        Luan Herrera discovered a URL spoofing issue.
    
      - CVE-2016-5188
        Luan Herrera discovered that some drop down menus can be
        used to hide parts of the user interface.
    
      - CVE-2016-5189
        xisigr discovered a URL spoofing issue.
    
      - CVE-2016-5190
        Atte Kettunen discovered a use-after-free issue.
    
      - CVE-2016-5191
        Gareth Hughes discovered a cross-site scripting issue.
    
      - CVE-2016-5192
        [email protected] discovered a same-origin bypass.
    
      - CVE-2016-5193
        Yuyang Zhou discovered a way to pop open a new window.
    
      - CVE-2016-5194
        The chrome development team found and fixed various
        issues during internal auditing.
    
      - CVE-2016-5198
        Tencent Keen Security Lab discovered an out-of-bounds
        memory access issue in the v8 JavaScript library.
    
      - CVE-2016-5199
        A heap corruption issue was discovered in the ffmpeg
        library.
    
      - CVE-2016-5200
        Choongwoo Han discovered an out-of-bounds memory access
        issue in the v8 JavaScript library.
    
      - CVE-2016-5201
        Rob Wu discovered an information leak.
    
      - CVE-2016-5202
        The chrome development team found and fixed various
        issues during internal auditing.
    
      - CVE-2016-5203
        A use-after-free issue was discovered in the pdfium
        library.
    
      - CVE-2016-5204
        Mariusz Mlynski discovered a cross-site scripting issue
        in SVG image handling.
    
      - CVE-2016-5205
        A cross-site scripting issue was discovered.
    
      - CVE-2016-5206
        Rob Wu discovered a same-origin bypass in the pdfium
        library.
    
      - CVE-2016-5207
        Mariusz Mlynski discovered a cross-site scripting issue.
    
      - CVE-2016-5208
        Mariusz Mlynski discovered another cross-site scripting
        issue.
    
      - CVE-2016-5209
        Giwan Go discovered an out-of-bounds write issue in
        Blink/Webkit.
    
      - CVE-2016-5210
        Ke Liu discovered an out-of-bounds write in the pdfium
        library.
    
      - CVE-2016-5211
        A use-after-free issue was discovered in the pdfium
        library.
    
      - CVE-2016-5212
        Khalil Zhani discovered an information disclosure issue
        in the developer tools.
    
      - CVE-2016-5213
        Khalil Zhani discovered a use-after-free issue in the v8
        JavaScript library.
    
      - CVE-2016-5214
        Jonathan Birch discovered a file download protection
        bypass.
    
      - CVE-2016-5215
        Looben Yang discovered a use-after-free issue.
    
      - CVE-2016-5216
        A use-after-free issue was discovered in the pdfium
        library.
    
      - CVE-2016-5217
        Rob Wu discovered a condition where data was not
        validated by the pdfium library.
    
      - CVE-2016-5218
        Abdulrahman Alqabandi discovered a URL spoofing issue.
    
      - CVE-2016-5219
        Rob Wu discovered a use-after-free issue in the v8
        JavaScript library.
    
      - CVE-2016-5220
        Rob Wu discovered a way to access files on the local
        system.
    
      - CVE-2016-5221
        Tim Becker discovered an integer overflow issue in the
        angle library.
    
      - CVE-2016-5222
        xisigr discovered a URL spoofing issue.
    
      - CVE-2016-5223
        Hwiwon Lee discovered an integer overflow issue in the
        pdfium library.
    
      - CVE-2016-5224
        Roeland Krak discovered a same-origin bypass in SVG
        image handling.
    
      - CVE-2016-5225
        Scott Helme discovered a Content Security Protection
        bypass.
    
      - CVE-2016-5226
        Jun Kokatsu discovered a cross-scripting issue.
    
      - CVE-2016-9650
        Jakub Zoczek discovered a Content Security Protection
        information disclosure.
    
      - CVE-2016-9651
        Guang Gong discovered a way to access private data in
        the v8 JavaScript library.
    
      - CVE-2016-9652
        The chrome development team found and fixed various
        issues during internal auditing."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5181"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5182"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5183"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5184"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5185"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5186"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5187"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5188"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5189"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5190"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5191"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5192"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5193"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5194"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5198"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5199"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5200"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5201"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5202"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5203"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5204"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5205"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5206"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5207"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5208"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5209"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5210"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5211"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5212"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5213"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5214"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5215"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5216"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5217"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5218"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5219"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5220"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5221"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5222"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5223"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5224"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5225"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-5226"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-9650"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-9651"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-9652"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://packages.debian.org/source/jessie/chromium-browser"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.debian.org/security/2016/dsa-3731"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "Upgrade the chromium-browser packages.
    
    For the stable distribution (jessie), these problems have been fixed
    in version 55.0.2883.75-1~deb8u1."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:chromium-browser");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:8.0");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2016/12/18");
      script_set_attribute(attribute:"patch_publication_date", value:"2016/12/11");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/12/12");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"8.0", prefix:"chromedriver", reference:"55.0.2883.75-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"chromium", reference:"55.0.2883.75-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"chromium-dbg", reference:"55.0.2883.75-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"chromium-inspector", reference:"55.0.2883.75-1~deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"chromium-l10n", reference:"55.0.2883.75-1~deb8u1")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2016-2718.NASL
    descriptionAn update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Chromium is an open source web browser, powered by WebKit (Blink). This update upgrades Chromium to version 54.0.2840.100. Security Fix(es) : * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when visited by the victim. (CVE-2016-5199, CVE-2016-5200, CVE-2016-5202, CVE-2016-5201)
    last seen2020-05-31
    modified2016-11-15
    plugin id94897
    published2016-11-15
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/94897
    titleRHEL 6 : chromium-browser (RHSA-2016:2718)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2016:2718. The text 
    # itself is copyright (C) Red Hat, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(94897);
      script_version("2.15");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/29");
    
      script_cve_id("CVE-2016-5199", "CVE-2016-5200", "CVE-2016-5201", "CVE-2016-5202");
      script_xref(name:"RHSA", value:"2016:2718");
    
      script_name(english:"RHEL 6 : chromium-browser (RHSA-2016:2718)");
      script_summary(english:"Checks the rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis",
        value:"The remote Red Hat host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description",
        value:
    "An update for chromium-browser is now available for Red Hat Enterprise
    Linux 6 Supplementary.
    
    Red Hat Product Security has rated this update as having a security
    impact of Important. A Common Vulnerability Scoring System (CVSS) base
    score, which gives a detailed severity rating, is available for each
    vulnerability from the CVE link(s) in the References section.
    
    Chromium is an open source web browser, powered by WebKit (Blink).
    
    This update upgrades Chromium to version 54.0.2840.100.
    
    Security Fix(es) :
    
    * Multiple flaws were found in the processing of malformed web
    content. A web page containing malicious content could cause Chromium
    to crash, execute arbitrary code, or disclose sensitive information
    when visited by the victim. (CVE-2016-5199, CVE-2016-5200,
    CVE-2016-5202, CVE-2016-5201)"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/errata/RHSA-2016:2718"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2016-5199"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2016-5200"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2016-5201"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2016-5202"
      );
      script_set_attribute(
        attribute:"solution",
        value:
    "Update the affected chromium-browser and / or
    chromium-browser-debuginfo packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:chromium-browser");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:chromium-browser-debuginfo");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:6");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2017/01/19");
      script_set_attribute(attribute:"patch_publication_date", value:"2016/11/14");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/11/15");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Red Hat Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
    os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
    os_ver = os_ver[1];
    if (! preg(pattern:"^6([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 6.x", "Red Hat " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);
    
    yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
    if (!empty_or_null(yum_updateinfo)) 
    {
      rhsa = "RHSA-2016:2718";
      yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
      if (!empty_or_null(yum_report))
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : yum_report 
        );
        exit(0);
      }
      else
      {
        audit_message = "affected by Red Hat security advisory " + rhsa;
        audit(AUDIT_OS_NOT, audit_message);
      }
    }
    else
    {
      flag = 0;
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"chromium-browser-54.0.2840.100-1.el6", allowmaj:TRUE)) flag++;
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"chromium-browser-54.0.2840.100-1.el6", allowmaj:TRUE)) flag++;
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"chromium-browser-debuginfo-54.0.2840.100-1.el6", allowmaj:TRUE)) flag++;
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"chromium-browser-debuginfo-54.0.2840.100-1.el6", allowmaj:TRUE)) flag++;
    
      if (flag)
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : rpm_report_get() + redhat_report_package_caveat()
        );
        exit(0);
      }
      else
      {
        tested = pkg_tests_get();
        if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
        else audit(AUDIT_PACKAGE_NOT_INSTALLED, "chromium-browser / chromium-browser-debuginfo");
      }
    }
    
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2017-C5B2C9A435.NASL
    descriptionThis update updates QtWebEngine to the 5.8.0 release. QtWebEngine 5.8.0 is part of the Qt 5.8.0 release, but only the QtWebEngine component is included in this update. The update fixes the following security issues in QtWebEngine 5.7.1: CVE-2016-5182, CVE-2016-5183, CVE-2016-5189, CVE-2016-5199, CVE-2016-5201, CVE-2016-5203, CVE-2016-5204, CVE-2016-5205, CVE-2016-5206, CVE-2016-5208, CVE-2016-5207, CVE-2016-5210, CVE-2016-5211, CVE-2016-5212, CVE-2016-5213, CVE-2016-5214, CVE-2016-5215. CVE-2016-5216, CVE-2016-5217, CVE-2016-5218, CVE-2016-5219, CVE-2016-5221, CVE-2016-5222, CVE-2016-5223, CVE-2016-5224, CVE-2016-5225, CVE-2016-9650 and CVE-2016-9651. Other immediately usable changes in QtWebEngine 5.8 include : - Based on Chromium 53.0.2785.148 with security fixes from Chromium up to version 55.0.2883.75. (5.7.1 was based on Chromium 49.0.2623.111 with security fixes from Chromium up to version 54.0.2840.87.) - The `view-source:` scheme is now supported. - User scripts now support metadata (`@include`, `@exclude`, `@match`) as in Greasemonkey. - Some `chrome:` schemes now supported, for instance `chrome://gpu`. - Several bugs were fixed, see https://code.qt.io/cgit/qt/qtwebengine.git/tree/dist/cha nges-5.8.0 for details. The following changes in QtWebEngine 5.8 require compile-time application support and will only be available after applications are rebuilt (and patched to remove the checks for Qt 5.8, because Qt is still version 5.7.1, only QtWebEngine is being updated) : - Spellchecking with a forked version of Hunspell. This Fedora package automatically converts system Hunspell dictionaries (installed by system RPMs into the systemwide location) to the Chromium `bdic` format used by QtWebEngine (using an RPM file trigger). If you wish to use dictionaries installed manually, use the included `qwebengine_convert_dict` tool. Alternatively, you can also download dictionaries directly in the Chromium `bdic` format. - Support for printing directly to a printer. (Note that QupZilla already supports printing to a printer, because it can use the printToPdf API that has existed since QtWebEngine 5.7 to print to a printer with the help of the `lpr` command-line tool. But other applications such as KMail require the new direct printing API.) - Added a setting to enable printing of CSS backgrounds. The following new QML APIs are available to developers : - Tooltips (HTML5 global title attribute) are now also supported in the QML API. - Qt WebEngine (QML) allows defining custom dialogs / context menus. - Qt WebEngine (QML) on `eglfs` uses builtin dialogs based on Qt Quick Controls 2. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2017-07-17
    plugin id101716
    published2017-07-17
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/101716
    titleFedora 26 : qt5-qtwebengine (2017-c5b2c9a435)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Fedora Security Advisory FEDORA-2017-c5b2c9a435.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(101716);
      script_version("3.6");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2016-5182", "CVE-2016-5183", "CVE-2016-5189", "CVE-2016-5199", "CVE-2016-5201", "CVE-2016-5203", "CVE-2016-5204", "CVE-2016-5205", "CVE-2016-5206", "CVE-2016-5207", "CVE-2016-5208", "CVE-2016-5210", "CVE-2016-5211", "CVE-2016-5212", "CVE-2016-5213", "CVE-2016-5214", "CVE-2016-5215", "CVE-2016-5216", "CVE-2016-5217", "CVE-2016-5218", "CVE-2016-5219", "CVE-2016-5221", "CVE-2016-5222", "CVE-2016-5223", "CVE-2016-5224", "CVE-2016-5225", "CVE-2016-9650", "CVE-2016-9651");
      script_xref(name:"FEDORA", value:"2017-c5b2c9a435");
    
      script_name(english:"Fedora 26 : qt5-qtwebengine (2017-c5b2c9a435)");
      script_summary(english:"Checks rpm output for the updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Fedora host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "This update updates QtWebEngine to the 5.8.0 release. QtWebEngine
    5.8.0 is part of the Qt 5.8.0 release, but only the QtWebEngine
    component is included in this update.
    
    The update fixes the following security issues in QtWebEngine 5.7.1:
    CVE-2016-5182, CVE-2016-5183, CVE-2016-5189, CVE-2016-5199,
    CVE-2016-5201, CVE-2016-5203, CVE-2016-5204, CVE-2016-5205,
    CVE-2016-5206, CVE-2016-5208, CVE-2016-5207, CVE-2016-5210,
    CVE-2016-5211, CVE-2016-5212, CVE-2016-5213, CVE-2016-5214,
    CVE-2016-5215. CVE-2016-5216, CVE-2016-5217, CVE-2016-5218,
    CVE-2016-5219, CVE-2016-5221, CVE-2016-5222, CVE-2016-5223,
    CVE-2016-5224, CVE-2016-5225, CVE-2016-9650 and CVE-2016-9651.
    
    Other immediately usable changes in QtWebEngine 5.8 include :
    
      - Based on Chromium 53.0.2785.148 with security fixes from
        Chromium up to version 55.0.2883.75. (5.7.1 was based on
        Chromium 49.0.2623.111 with security fixes from Chromium
        up to version 54.0.2840.87.)
    
      - The `view-source:` scheme is now supported.
    
      - User scripts now support metadata (`@include`,
        `@exclude`, `@match`) as in Greasemonkey.
    
      - Some `chrome:` schemes now supported, for instance
        `chrome://gpu`.
    
      - Several bugs were fixed, see
        https://code.qt.io/cgit/qt/qtwebengine.git/tree/dist/cha
        nges-5.8.0 for details.
    
    The following changes in QtWebEngine 5.8 require compile-time
    application support and will only be available after applications are
    rebuilt (and patched to remove the checks for Qt 5.8, because Qt is
    still version 5.7.1, only QtWebEngine is being updated) :
    
      - Spellchecking with a forked version of Hunspell. This
        Fedora package automatically converts system Hunspell
        dictionaries (installed by system RPMs into the
        systemwide location) to the Chromium `bdic` format used
        by QtWebEngine (using an RPM file trigger). If you wish
        to use dictionaries installed manually, use the included
        `qwebengine_convert_dict` tool. Alternatively, you can
        also download dictionaries directly in the Chromium
        `bdic` format.
    
      - Support for printing directly to a printer. (Note that
        QupZilla already supports printing to a printer, because
        it can use the printToPdf API that has existed since
        QtWebEngine 5.7 to print to a printer with the help of
        the `lpr` command-line tool. But other applications such
        as KMail require the new direct printing API.)
    
      - Added a setting to enable printing of CSS backgrounds.
    
    The following new QML APIs are available to developers :
    
      - Tooltips (HTML5 global title attribute) are now also
        supported in the QML API.
    
      - Qt WebEngine (QML) allows defining custom dialogs /
        context menus.
    
      - Qt WebEngine (QML) on `eglfs` uses builtin dialogs based
        on Qt Quick Controls 2.
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Fedora update system website.
    Tenable has attempted to automatically clean and format it as much as
    possible without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bodhi.fedoraproject.org/updates/FEDORA-2017-c5b2c9a435"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://code.qt.io/cgit/qt/qtwebengine.git/tree/dist/changes-5.8.0"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected qt5-qtwebengine package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:qt5-qtwebengine");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:26");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2016/12/18");
      script_set_attribute(attribute:"patch_publication_date", value:"2017/04/16");
      script_set_attribute(attribute:"plugin_publication_date", value:"2017/07/17");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Fedora Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
    os_ver = pregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
    os_ver = os_ver[1];
    if (! preg(pattern:"^26([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 26", "Fedora " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"FC26", reference:"qt5-qtwebengine-5.8.0-8.fc26")) flag++;
    
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_WARNING,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "qt5-qtwebengine");
    }
    
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_GOOGLE_CHROME_54_0_2840_98.NASL
    descriptionThe version of Google Chrome installed on the remote macOS or Mac OS X host is prior to 54.0.2840.98. It is, therefore, affected by the following vulnerabilities : - A remote code execution vulnerability exists in the FFmpeg component due to an integer overflow condition in the mov_read_keys() function in mov.c caused by improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, by convincing a user to visit a website containing specially crafted content, to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-5199) - A denial of service vulnerability exists in the V8 component due to an out-of-bounds read error that is triggered when handling
    last seen2020-06-01
    modified2020-06-02
    plugin id94677
    published2016-11-10
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/94677
    titleGoogle Chrome < 54.0.2840.98 Multiple Vulnerabilities (macOS)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(94677);
      script_version("1.8");
      script_cvs_date("Date: 2019/11/14");
    
      script_cve_id(
        "CVE-2016-5199",
        "CVE-2016-5200",
        "CVE-2016-5201",
        "CVE-2016-5202"
      );
      script_bugtraq_id(94196);
    
      script_name(english:"Google Chrome < 54.0.2840.98 Multiple Vulnerabilities (macOS)");
      script_summary(english:"Checks the version of Google Chrome.");
    
      script_set_attribute(attribute:"synopsis", value:
    "A web browser installed on the remote macOS or Mac OS X host is
    affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The version of Google Chrome installed on the remote macOS or Mac OS X
    host is prior to 54.0.2840.98. It is, therefore, affected by the
    following vulnerabilities :
    
      - A remote code execution vulnerability exists in the
        FFmpeg component due to an integer overflow condition in
        the mov_read_keys() function in mov.c caused by improper
        validation of user-supplied input. An unauthenticated,
        remote attacker can exploit this, by convincing a user
        to visit a website containing specially crafted content,
        to cause a denial of service condition or the execution
        of arbitrary code. (CVE-2016-5199)
    
      - A denial of service vulnerability exists in the V8
        component due to an out-of-bounds read error that is
        triggered when handling 'Math.sign'. An unauthenticated,
        remote attacker can exploit this, by convincing a user
        to visit a website containing specially crafted content,
        to crash the browser or disclose memory contents.
        (CVE-2016-5200)
    
      - An information disclosure vulnerability exists due to a
        flaw in the expose() function in utils.js. An
        unauthenticated, remote attacker can exploit this, by
        convincing a user to visit a website containing
        specially crafted content, to disclose sensitive
        internal class information. (CVE-2016-5201)
    
      - An unspecified vulnerability exists in the
        PruneExpiredDevices() function in dial_registry.cc that
        allows an unauthenticated, remote attacker to have an
        unspecified impact. (CVE-2016-5202)
    
    Note that Nessus has not tested for these issues but has instead
    relied only on the application's self-reported version number.");
      # https://googlechromereleases.blogspot.com/2016/11/stable-channel-update-for-desktop_9.html
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?bdb7f5cb");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to Google Chrome version 54.0.2840.98 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-5202");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2016/11/09");
      script_set_attribute(attribute:"patch_publication_date", value:"2016/11/09");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/11/10");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:google:chrome");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"MacOS X Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("macosx_google_chrome_installed.nbin");
      script_require_keys("MacOSX/Google Chrome/Installed");
    
      exit(0);
    }
    
    include("google_chrome_version.inc");
    
    get_kb_item_or_exit("MacOSX/Google Chrome/Installed");
    
    google_chrome_check_version(fix:'54.0.2840.98', severity:SECURITY_HOLE);
    
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2016-1292.NASL
    descriptionThis update to Chromium 54.0.2840.100 fixes the following vulnerabilities : - CVE-2016-5199: Heap corruption in FFmpeg (boo#1009892) - CVE-2016-5200: out of bounds memory access in v8 (boo#1009893) - CVE-2016-5201: info leak in extensions (boo#1009894) - CVE-2016-5202: various fixes from internal audits (boo#1009895)
    last seen2020-06-05
    modified2016-11-15
    plugin id94894
    published2016-11-15
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/94894
    titleopenSUSE Security Update : Chromium (openSUSE-2016-1292)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update openSUSE-2016-1292.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(94894);
      script_version("2.7");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2016-5199", "CVE-2016-5200", "CVE-2016-5201", "CVE-2016-5202");
    
      script_name(english:"openSUSE Security Update : Chromium (openSUSE-2016-1292)");
      script_summary(english:"Check for the openSUSE-2016-1292 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "This update to Chromium 54.0.2840.100 fixes the following
    vulnerabilities :
    
      - CVE-2016-5199: Heap corruption in FFmpeg (boo#1009892)
    
      - CVE-2016-5200: out of bounds memory access in v8
        (boo#1009893)
    
      - CVE-2016-5201: info leak in extensions (boo#1009894)
    
      - CVE-2016-5202: various fixes from internal audits
        (boo#1009895)"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1009892"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1009893"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1009894"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1009895"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected Chromium packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:chromedriver");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:chromedriver-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:chromium");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:chromium-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:chromium-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:chromium-ffmpegsumo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:chromium-ffmpegsumo-debuginfo");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:13.2");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:42.1");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:42.2");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2017/01/19");
      script_set_attribute(attribute:"patch_publication_date", value:"2016/11/14");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/11/15");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE13\.2|SUSE42\.1|SUSE42\.2)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "13.2 / 42.1 / 42.2", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE13.2", reference:"chromedriver-54.0.2840.100-140.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"chromedriver-debuginfo-54.0.2840.100-140.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"chromium-54.0.2840.100-140.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"chromium-debuginfo-54.0.2840.100-140.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"chromium-debugsource-54.0.2840.100-140.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"chromium-ffmpegsumo-54.0.2840.100-140.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"chromium-ffmpegsumo-debuginfo-54.0.2840.100-140.1") ) flag++;
    if ( rpm_check(release:"SUSE42.1", cpu:"x86_64", reference:"chromedriver-54.0.2840.100-91.1") ) flag++;
    if ( rpm_check(release:"SUSE42.1", cpu:"x86_64", reference:"chromedriver-debuginfo-54.0.2840.100-91.1") ) flag++;
    if ( rpm_check(release:"SUSE42.1", cpu:"x86_64", reference:"chromium-54.0.2840.100-91.1") ) flag++;
    if ( rpm_check(release:"SUSE42.1", cpu:"x86_64", reference:"chromium-debuginfo-54.0.2840.100-91.1") ) flag++;
    if ( rpm_check(release:"SUSE42.1", cpu:"x86_64", reference:"chromium-debugsource-54.0.2840.100-91.1") ) flag++;
    if ( rpm_check(release:"SUSE42.1", cpu:"x86_64", reference:"chromium-ffmpegsumo-54.0.2840.100-91.1") ) flag++;
    if ( rpm_check(release:"SUSE42.1", cpu:"x86_64", reference:"chromium-ffmpegsumo-debuginfo-54.0.2840.100-91.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", cpu:"x86_64", reference:"chromedriver-54.0.2840.100-91.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", cpu:"x86_64", reference:"chromedriver-debuginfo-54.0.2840.100-91.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", cpu:"x86_64", reference:"chromium-54.0.2840.100-91.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", cpu:"x86_64", reference:"chromium-debuginfo-54.0.2840.100-91.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", cpu:"x86_64", reference:"chromium-debugsource-54.0.2840.100-91.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", cpu:"x86_64", reference:"chromium-ffmpegsumo-54.0.2840.100-91.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", cpu:"x86_64", reference:"chromium-ffmpegsumo-debuginfo-54.0.2840.100-91.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "chromedriver / chromedriver-debuginfo / chromium / etc");
    }
    
  • NASL familyWindows
    NASL idGOOGLE_CHROME_54_0_2840_99.NASL
    descriptionThe version of Google Chrome installed on the remote Windows host is prior to 54.0.2840.99. It is, therefore, affected by the following vulnerabilities : - A remote code execution vulnerability exists in the FFmpeg component due to an integer overflow condition in the mov_read_keys() function in mov.c caused by improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, by convincing a user to visit a website containing specially crafted content, to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-5199) - A denial of service vulnerability exists in the V8 component due to an out-of-bounds read error that is triggered when handling
    last seen2020-06-01
    modified2020-06-02
    plugin id94676
    published2016-11-10
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/94676
    titleGoogle Chrome < 54.0.2840.99 Multiple Vulnerabilities
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2017-AE1FDE5FB8.NASL
    descriptionThis update updates QtWebEngine to the 5.8.0 release. QtWebEngine 5.8.0 is part of the Qt 5.8.0 release, but only the QtWebEngine component is included in this update. The update fixes the following security issues in QtWebEngine 5.7.1: CVE-2016-5182, CVE-2016-5183, CVE-2016-5189, CVE-2016-5199, CVE-2016-5201, CVE-2016-5203, CVE-2016-5204, CVE-2016-5205, CVE-2016-5206, CVE-2016-5208, CVE-2016-5207, CVE-2016-5210, CVE-2016-5211, CVE-2016-5212, CVE-2016-5213, CVE-2016-5214, CVE-2016-5215. CVE-2016-5216, CVE-2016-5217, CVE-2016-5218, CVE-2016-5219, CVE-2016-5221, CVE-2016-5222, CVE-2016-5223, CVE-2016-5224, CVE-2016-5225, CVE-2016-9650 and CVE-2016-9651. Other immediately usable changes in QtWebEngine 5.8 include : - Based on Chromium 53.0.2785.148 with security fixes from Chromium up to version 55.0.2883.75. (5.7.1 was based on Chromium 49.0.2623.111 with security fixes from Chromium up to version 54.0.2840.87.) - The `view-source:` scheme is now supported. - User scripts now support metadata (`@include`, `@exclude`, `@match`) as in Greasemonkey. - Some `chrome:` schemes now supported, for instance `chrome://gpu`. - Several bugs were fixed, see https://code.qt.io/cgit/qt/qtwebengine.git/tree/dist/cha nges-5.8.0 for details. The following changes in QtWebEngine 5.8 require compile-time application support and will only be available after applications are rebuilt (and patched to remove the checks for Qt 5.8, because Qt is still version 5.7.1, only QtWebEngine is being updated) : - Spellchecking with a forked version of Hunspell. This Fedora package automatically converts system Hunspell dictionaries (installed by system RPMs into the systemwide location) to the Chromium `bdic` format used by QtWebEngine (using an RPM file trigger). If you wish to use dictionaries installed manually, use the included `qwebengine_convert_dict` tool. Alternatively, you can also download dictionaries directly in the Chromium `bdic` format. - Support for printing directly to a printer. (Note that QupZilla already supports printing to a printer, because it can use the printToPdf API that has existed since QtWebEngine 5.7 to print to a printer with the help of the `lpr` command-line tool. But other applications such as KMail require the new direct printing API.) - Added a setting to enable printing of CSS backgrounds. The following new QML APIs are available to developers : - Tooltips (HTML5 global title attribute) are now also supported in the QML API. - Qt WebEngine (QML) allows defining custom dialogs / context menus. - Qt WebEngine (QML) on `eglfs` uses builtin dialogs based on Qt Quick Controls 2. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2017-04-17
    plugin id99415
    published2017-04-17
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/99415
    titleFedora 25 : qt5-qtwebengine (2017-ae1fde5fb8)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2016-E0E1CB2B2B.NASL
    descriptionUpdate to Chromium 55. Security fix for CVE-2016-5199, CVE-2016-5200, CVE-2016-5201, CVE-2016-5202, CVE-2016-9651, CVE-2016-5208, CVE-2016-5207, CVE-2016-5206, CVE-2016-5205, CVE-2016-5204, CVE-2016-5209, CVE-2016-5203, CVE-2016-5210, CVE-2016-5212, CVE-2016-5211, CVE-2016-5213, CVE-2016-5214, CVE-2016-5216, CVE-2016-5215, CVE-2016-5217, CVE-2016-5218, CVE-2016-5219, CVE-2016-5221, CVE-2016-5220, CVE-2016-5222, CVE-2016-9650, CVE-2016-5223, CVE-2016-5226, CVE-2016-5225, CVE-2016-5224, CVE-2016-9652 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2016-12-16
    plugin id95906
    published2016-12-16
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/95906
    titleFedora 24 : chromium (2016-e0e1cb2b2b)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_A3473F5AA73911E6AFAAE8E0B747A45A.NASL
    descriptionGoogle Chrome Releases reports : 4 security fixes in this release, including : - [643948] High CVE-2016-5199: Heap corruption in FFmpeg. Credit to Paul Mehta - [658114] High CVE-2016-5200: Out of bounds memory access in V8. Credit to Choongwoo Han - [660678] Medium CVE-2016-5201: Info leak in extensions. Credit to Rob Wu - [662843] CVE-2016-5202: Various fixes from internal audits, fuzzing and other initiatives
    last seen2020-06-01
    modified2020-06-02
    plugin id94693
    published2016-11-11
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/94693
    titleFreeBSD : chromium -- multiple vulnerabilities (a3473f5a-a739-11e6-afaa-e8e0b747a45a)

Redhat

advisories
rhsa
idRHSA-2016:2718
rpms
  • chromium-browser-0:54.0.2840.100-1.el6
  • chromium-browser-debuginfo-0:54.0.2840.100-1.el6