{ "schema_version": "1.7.0", "id": "MGASA-2015-0123", "published": "2015-04-01T12:13:37Z", "modified": "2015-04-01T12:03:31Z", "summary": "Updated chromium-browser-stable packages fix security vulnerabilities", "details": "Updated chromium-browser packages fix security vulnerabilities:\n\nThe SkBitmap::ReadRawPixels function in core/SkBitmap.cpp in the filters\nimplementation in Skia, as used in Google Chrome before 41.0.2272.76, allows\nremote attackers to cause a denial of service or possibly have unspecified\nother impact via vectors that trigger an out-of-bounds write operation\n(CVE-2015-1213).\n\nInteger overflow in the SkAutoSTArray implementation in\ninclude/core/SkTemplates.h in the filters implementation in Skia, as used in\nGoogle Chrome before 41.0.2272.76, allows remote attackers to cause a denial\nof service or possibly have unspecified other impact via vectors that trigger\na reset action with a large count value, leading to an out-of-bounds write\noperation (CVE-2015-1214).\n\nThe filters implementation in Skia, as used in Google Chrome before\n41.0.2272.76, allows remote attackers to cause a denial of service or\npossibly have unspecified other impact via vectors that trigger an\nout-of-bounds write operation (CVE-2015-1215).\n\nUse-after-free vulnerability in the V8Window::namedPropertyGetterCustom\nfunction in bindings/core/v8/custom/V8WindowCustom.cpp in the V8 bindings in\nBlink, as used in Google Chrome before 41.0.2272.76, allows remote attackers\nto cause a denial of service or possibly have unspecified other impact via\nvectors that trigger a frame detachment (CVE-2015-1216).\n\nThe V8LazyEventListener::prepareListenerObject function in\nbindings/core/v8/V8LazyEventListener.cpp in the V8 bindings in Blink, as used\nin Google Chrome before 41.0.2272.76, does not properly compile listeners,\nwhich allows remote attackers to cause a denial of service or possibly have\nunspecified other impact via vectors that leverage \"type confusion\"\n(CVE-2015-1217).\n\nMultiple use-after-free vulnerabilities in the DOM implementation in Blink,\nas used in Google Chrome before 41.0.2272.76, allow remote attackers to cause\na denial of service or possibly have unspecified other impact via vectors\nthat trigger movement of a SCRIPT element to different documents, related to\nthe HTMLScriptElement::didMoveToNewDocument function in\ncore/html/HTMLScriptElement.cpp and the\nSVGScriptElement::didMoveToNewDocument function in\ncore/svg/SVGScriptElement.cpp (CVE-2015-1218).\n\nInteger overflow in the SkMallocPixelRef::NewAllocate function in\ncore/SkMallocPixelRef.cpp in Skia, as used in Google Chrome before\n41.0.2272.76, allows remote attackers to cause a denial of service or\npossibly have unspecified other impact via vectors that trigger an attempted\nallocation of a large amount of memory during WebGL rendering\n(CVE-2015-1219).\n\nUse-after-free vulnerability in the GIFImageReader::parseData function in\nplatform/image-decoders/gif/GIFImageReader.cpp in Blink, as used in Google\nChrome before 41.0.2272.76, allows remote attackers to cause a denial of\nservice or possibly have unspecified other impact via a crafted frame size in\na GIF image (CVE-2015-1220).\n\nUse-after-free vulnerability in Blink, as used in Google Chrome before\n41.0.2272.76, allows remote attackers to cause a denial of service or\npossibly have unspecified other impact by leveraging incorrect ordering of\noperations in the Web SQL Database thread relative to Blink's main thread,\nrelated to the shutdown function in web/WebKit.cpp (CVE-2015-1221).\n\nMultiple use-after-free vulnerabilities in the ServiceWorkerScriptCacheMap\nimplementation in\ncontent/browser/service_worker/service_worker_script_cache_map.cc in Google\nChrome before 41.0.2272.76 allow remote attackers to cause a denial of\nservice or possibly have unspecified other impact via vectors that trigger a\nServiceWorkerContextWrapper::DeleteAndStartOver call, related to the\nNotifyStartedCaching and NotifyFinishedCaching functions (CVE-2015-1222).\n\nMultiple use-after-free vulnerabilities in core/html/HTMLInputElement.cpp in\nthe DOM implementation in Blink, as used in Google Chrome before\n41.0.2272.76, allow remote attackers to cause a denial of service or possibly\nhave unspecified other impact via vectors that trigger extraneous change\nevents, as demonstrated by events for invalid input or input to read-only\nfields, related to the initializeTypeInParsing and updateType functions\n(CVE-2015-1223).\n\nThe VpxVideoDecoder::VpxDecode function in media/filters/vpx_video_decoder.cc\nin the vpxdecoder implementation in Google Chrome before 41.0.2272.76 does\nnot ensure that alpha-plane dimensions are identical to image dimensions,\nwhich allows remote attackers to cause a denial of service (out-of-bounds\nread) via crafted VPx video data (CVE-2015-1224).\n\nPDFium, as used in Google Chrome before 41.0.2272.76, allows remote attackers\nto cause a denial of service (out-of-bounds read) via unspecified vectors\n(CVE-2015-1225).\n\nThe DebuggerFunction::InitAgentHost function in\nbrowser/extensions/api/debugger/debugger_api.cc in Google Chrome before\n41.0.2272.76 does not properly restrict what URLs are available as debugger\ntargets, which allows remote attackers to bypass intended access restrictions\nvia a crafted extension (CVE-2015-1226).\n\nThe DragImage::create function in platform/DragImage.cpp in Blink, as used in\nGoogle Chrome before 41.0.2272.76, does not initialize memory for image\ndrawing, which allows remote attackers to have an unspecified impact by\ntriggering a failed image decoding, as demonstrated by an image for which the\ndefault orientation cannot be used (CVE-2015-1227).\n\nThe RenderCounter::updateCounter function in core/rendering/RenderCounter.cpp\nin Blink, as used in Google Chrome before 41.0.2272.76, does not force a\nrelayout operation and consequently does not initialize memory for a data\nstructure, which allows remote attackers to cause a denial of service\n(application crash) or possibly have unspecified other impact via a crafted\nCascading Style Sheets (CSS) token sequence (CVE-2015-1228).\n\nnet/http/proxy_client_socket.cc in Google Chrome before 41.0.2272.76 does not\nproperly handle a 407 (aka Proxy Authentication Required) HTTP status code\naccompanied by a Set-Cookie header, which allows remote proxy servers to\nconduct cookie-injection attacks via a crafted response (CVE-2015-1229).\n\nMultiple unspecified vulnerabilities in Google Chrome before 41.0.2272.76\nallow attackers to cause a denial of service or possibly have other impact\nvia unknown vectors (CVE-2015-1231).\n\nArray index error in the MidiManagerUsb::DispatchSendMidiData function in\nmedia/midi/midi_manager_usb.cc in Google Chrome before 41.0.2272.76 allows\nremote attackers to cause a denial of service or possibly have unspecified\nother impact by leveraging renderer access to provide an invalid port index\nthat triggers an out-of-bounds write operation (CVE-2015-1232).\n", "upstream": [ "CVE-2015-1213", "CVE-2015-1214", "CVE-2015-1215", "CVE-2015-1216", "CVE-2015-1217", "CVE-2015-1218", "CVE-2015-1219", "CVE-2015-1220", "CVE-2015-1221", "CVE-2015-1222", "CVE-2015-1223", "CVE-2015-1224", "CVE-2015-1225", "CVE-2015-1226", "CVE-2015-1227", "CVE-2015-1228", "CVE-2015-1229", "CVE-2015-1231", "CVE-2015-1232" ], "references": [ { "type": "ADVISORY", "url": "https://advisories.mageia.org/MGASA-2015-0123.html" }, { "type": "REPORT", "url": "https://bugs.mageia.org/show_bug.cgi?id=15433" }, { "type": "WEB", "url": "http://googlechromereleases.blogspot.com/2015/02/stable-channel-update_19.html" }, { "type": "WEB", "url": "http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html" }, { "type": "WEB", "url": "http://googlechromereleases.blogspot.com/2015/03/stable-channel-update_10.html" }, { "type": "WEB", "url": "http://googlechromereleases.blogspot.com/2015/03/stable-channel-update_19.html" }, { "type": "WEB", "url": "https://security.gentoo.org/glsa/201503-12" } ], "affected": [ { "package": { "ecosystem": "Mageia:4", "name": "chromium-browser-stable", "purl": "pkg:rpm/mageia/chromium-browser-stable?arch=source&distro=mageia-4" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "41.0.2272.101-1.mga4" } ] } ], "ecosystem_specific": { "section": "core" } } ], "credits": [ { "name": "Mageia", "type": "COORDINATOR", "contact": [ "https://wiki.mageia.org/en/Packages_Security_Team" ] } ] }