Advisories ยป MGASA-2015-0062

Updated chromium-browser-stable packages fix security vulnerabilities

Publication date: 11 Feb 2015
Modification date: 11 Feb 2015
Type: security
Affected Mageia releases : 4
CVE: CVE-2015-1209 , CVE-2015-1210 , CVE-2015-1211 , CVE-2015-1212

Description

Updated chromium-browser packages fix security vulnerabilities:

Use-after-free vulnerability in the
VisibleSelection::nonBoundaryShadowTreeRootNode function in
core/editing/VisibleSelection.cpp in the DOM implementation in Blink, as used
in Google Chrome before 40.0.2214.111 allows remote attackers to cause a
denial of service or possibly have unspecified other impact via crafted
JavaScript code that triggers improper handling of a shadow-root anchor
(CVE-2015-1209).

The V8ThrowException::createDOMException function in
bindings/core/v8/V8ThrowException.cpp in the V8 bindings in Blink, as used in
Google Chrome before 40.0.2214.111 does not properly consider frame access
restrictions during the throwing of an exception, which allows remote
attackers to bypass the Same Origin Policy via a crafted web site
(CVE-2015-1210).

The OriginCanAccessServiceWorkers function in
content/browser/service_worker/service_worker_dispatcher_host.cc in Google
Chrome before 40.0.2214.111 does not properly restrict the URI scheme during
a ServiceWorker registration, which allows remote attackers to gain
privileges via a filesystem: URI (CVE-2015-1211).

Multiple unspecified vulnerabilities in Google Chrome before 40.0.2214.111
allow attackers to cause a denial of service or possibly have other impact
via unknown vectors (CVE-2015-1212).

References

SRPMS

4/core