ID

VAR-201606-0298

CVE

CVE-2016-1699

TITLE

Google Chrome Used in Blink of Developer Tools Subsystem WebKit/Source/devtools/front_end/devtools.js Vulnerable to access restrictions

DESCRIPTION

WebKit/Source/devtools/front_end/devtools.js in the Developer Tools (aka DevTools) subsystem in Blink, as used in Google Chrome before 51.0.2704.79, does not ensure that the remoteFrontendUrl parameter is associated with a chrome-devtools-frontend.appspot.com URL, which allows remote attackers to bypass intended access restrictions via a crafted URL. Supplementary information : CWE Vulnerability type by CWE-284: Improper Access Control ( Inappropriate access control ) Has been identified. http://cwe.mitre.org/data/definitions/284.htmlSkillfully crafted by a third party URL Access restrictions may be circumvented via. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Trend Micro Maximum Security. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the analysis of web pages. By performing actions in script matching a large array against a RegEx, an attacker can cause a pointer to be reused after it has been freed. An attacker can leverage this vulnerability to execute code under the context of SYSTEM. Google Chrome is prone to multiple security vulnerabilities. Attackers can exploit these issues to bypass security restriction and perform unauthorized actions, cause denial-of-service conditions, retrieve sensitive information; other attacks may also be possible. Versions prior to Chrome 51.0.2704.79 are vulnerable. CVE-2016-1696 A cross-origin bypass was found in the bindings to extensions. CVE-2016-1698 Rob Wu discovered an information leak. CVE-2016-1700 Rob Wu discovered a use-after-free issue in extensions. CVE-2016-1701 Rob Wu discovered a use-after-free issue in the autofill feature. For the stable distribution (jessie), these problems have been fixed in version 51.0.2704.79-1~deb8u1. For the testing distribution (stretch), these problems will be fixed soon. For the unstable distribution (sid), these problems have been fixed in version 51.0.2704.79-1. We recommend that you upgrade your chromium-browser packages. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: chromium-browser security update Advisory ID: RHSA-2016:1201-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://access.redhat.com/errata/RHSA-2016:1201 Issue date: 2016-06-02 CVE Names: CVE-2016-1696 CVE-2016-1697 CVE-2016-1698 CVE-2016-1699 CVE-2016-1700 CVE-2016-1701 CVE-2016-1702 CVE-2016-1703 ===================================================================== 1. Summary: An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. This update upgrades Chromium to version 51.0.2704.79. (CVE-2016-1696, CVE-2016-1697, CVE-2016-1703, CVE-2016-1698, CVE-2016-1699, CVE-2016-1700, CVE-2016-1701, CVE-2016-1702) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing the update, Chromium must be restarted for the changes to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 1342001 - CVE-2016-1696 chromium-browser: cross-origin bypass in extension bindings 1342002 - CVE-2016-1697 chromium-browser: cross-origin bypass in blink 1342003 - CVE-2016-1698 chromium-browser: information leak in extension bindings 1342004 - CVE-2016-1699 chromium-browser: parameter sanitization failure in devtools 1342005 - CVE-2016-1700 chromium-browser: use-after-free in extensions 1342007 - CVE-2016-1701 chromium-browser: use-after-free in autofill 1342008 - CVE-2016-1702 chromium-browser: out-of-bounds read in skia 1342009 - CVE-2016-1703 chromium-browser: various fixes from internal audits 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: chromium-browser-51.0.2704.79-1.el6.i686.rpm chromium-browser-debuginfo-51.0.2704.79-1.el6.i686.rpm x86_64: chromium-browser-51.0.2704.79-1.el6.x86_64.rpm chromium-browser-debuginfo-51.0.2704.79-1.el6.x86_64.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: chromium-browser-51.0.2704.79-1.el6.i686.rpm chromium-browser-debuginfo-51.0.2704.79-1.el6.i686.rpm x86_64: chromium-browser-51.0.2704.79-1.el6.x86_64.rpm chromium-browser-debuginfo-51.0.2704.79-1.el6.x86_64.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: chromium-browser-51.0.2704.79-1.el6.i686.rpm chromium-browser-debuginfo-51.0.2704.79-1.el6.i686.rpm x86_64: chromium-browser-51.0.2704.79-1.el6.x86_64.rpm chromium-browser-debuginfo-51.0.2704.79-1.el6.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFXUICpXlSAg2UNWIIRAs1+AJ9Us24LC+Oop/AuL5JbTtWNW9e4dQCcC5/Y lbqCxyEQCwttZzdF4gEzJDA= =OPtc -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . From: Chris Coulson <chris.coulson@canonical.com> Reply-To: Ubuntu Security <security@ubuntu.com> To: ubuntu-security-announce@lists.ubuntu.com Message-ID: <9c9730ff-923d-99dc-e9ee-6867bc48bb31@canonical.com> Subject: [USN-2992-1] Oxide vulnerabilities ============================================================================ Ubuntu Security Notice USN-2992-1 June 06, 2016 oxide-qt vulnerabilities ============================================================================ A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.04 LTS - Ubuntu 15.10 - Ubuntu 14.04 LTS Summary: Several security issues were fixed in Oxide. Software Description: - oxide-qt: Web browser engine for Qt (QML plugin) Details: An unspecified security issue was discovered in Blink. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass same-origin restrictions. (CVE-2016-1673) An issue was discovered with Document reattachment in Blink in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass same-origin restrictions. (CVE-2016-1675) A type confusion bug was discovered in V8. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to obtain sensitive information. (CVE-2016-1677) A heap overflow was discovered in V8. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service (application crash) or execute arbitrary code. (CVE-2016-1678) A use-after-free was discovered in the V8ValueConverter implementation in Chromium in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service (application crash) or execute arbitrary code. (CVE-2016-1679) A use-after-free was discovered in Skia. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service (application crash) or execute arbitrary code. (CVE-2016-1680) A security issue was discovered in ServiceWorker registration in Blink in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass Content Security Policy (CSP) protections. (CVE-2016-1682) An out-of-bounds memory access was discovered in libxslt. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service (application crash) or execute arbitrary code. (CVE-2016-1683) An integer overflow was discovered in libxslt. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service (application crash or resource consumption). (CVE-2016-1684) An out-of-bounds read was discovered in the regular expression implementation in V8. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service (application crash). (CVE-2016-1688) A heap overflow was discovered in Chromium. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service (application crash) or execute arbitrary code. (CVE-2016-1689) A heap overflow was discovered in Skia. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service (application crash) or execute arbitrary code. (CVE-2016-1691) It was discovered that Blink permits cross-origin loading of stylesheets by a service worker even when the stylesheet download has an incorrect MIME type. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass same-origin restrictions. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial of service (application crash) or execute arbitrary code. (CVE-2016-1695, CVE-2016-1703) It was discovered that Blink does not prevent frame navigation during DocumentLoader detach operations. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass same-origin restrictions. (CVE-2016-1697) A parameter sanitization bug was discovered in the devtools subsystem in Blink. An attacker could potentially exploit this to bypass intended access restrictions. (CVE-2016-1699) An out-of-bounds read was discovered in Skia. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service (application crash). (CVE-2016-1702) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 LTS: liboxideqtcore0 1.15.7-0ubuntu0.16.04.1 Ubuntu 15.10: liboxideqtcore0 1.15.7-0ubuntu0.15.10.1 Ubuntu 14.04 LTS: liboxideqtcore0 1.15.7-0ubuntu0.14.04.1 In general, a standard system update will make all the necessary changes. References: http://www.ubuntu.com/usn/usn-2992-1 CVE-2016-1673, CVE-2016-1675, CVE-2016-1677, CVE-2016-1678, CVE-2016-1679, CVE-2016-1680, CVE-2016-1682, CVE-2016-1683, CVE-2016-1684, CVE-2016-1688, CVE-2016-1689, CVE-2016-1691, CVE-2016-1692, CVE-2016-1695, CVE-2016-1697, CVE-2016-1699, CVE-2016-1702, CVE-2016-1703 Package Information: https://launchpad.net/ubuntu/+source/oxide-qt/1.15.7-0ubuntu0.16.04.1 https://launchpad.net/ubuntu/+source/oxide-qt/1.15.7-0ubuntu0.15.10.1 https://launchpad.net/ubuntu/+source/oxide-qt/1.15.7-0ubuntu0.14.04.1 --8W6UvL1N3AKIHxvSN46PkVqsvg1CjmqQX

AFFECTED PRODUCTS