Advisories ยป MGASA-2015-0235

Updated chromium-browser-stable packages fix security vulnerabilities

Publication date: 23 May 2015
Modification date: 23 May 2015
Type: security
Affected Mageia releases : 4
CVE: CVE-2015-1251 , CVE-2015-1252 , CVE-2015-1253 , CVE-2015-1254 , CVE-2015-1255 , CVE-2015-1256 , CVE-2015-1257 , CVE-2015-1258 , CVE-2015-1259 , CVE-2015-1260 , CVE-2015-1262 , CVE-2015-1263 , CVE-2015-1264 , CVE-2015-1265

Description

Chromium-browser 43.0.2357.65 fixes a number of security issues:

Use-after-free vulnerability in the SpeechRecognitionClient implementation 
in the Speech subsystem in Google Chrome before 43.0.2357.65 allows remote 
attackers to execute arbitrary code via a crafted document. (CVE-2015-1251)

common/partial_circular_buffer.cc in Google Chrome before 43.0.2357.65 does 
not properly handle wraps, which allows remote attackers to bypass a 
sandbox protection mechanism or cause a denial of service (out-of-bounds 
write) via vectors that trigger a write operation with a large amount of 
data, related to the PartialCircularBuffer::Write and 
PartialCircularBuffer::DoWrite functions. (CVE-2015-1252)

core/html/parser/HTMLConstructionSite.cpp in the DOM implementation in 
Blink, as used in Google Chrome before 43.0.2357.65, allows remote 
attackers to bypass the Same Origin Policy via crafted JavaScript code that 
appends a child to a SCRIPT element, related to the insert and 
executeReparentTask functions. (CVE-2015-1253)

core/dom/Document.cpp in Blink, as used in Google Chrome before 
43.0.2357.65, enables the inheritance of the designMode attribute, which 
allows remote attackers to bypass the Same Origin Policy by leveraging the 
availability of editing. (CVE-2015-1254)

Use-after-free vulnerability in 
content/renderer/media/webaudio_capturer_source.cc in the WebAudio 
implementation in Google Chrome before 43.0.2357.65 allows remote attackers 
to cause a denial of service (heap memory corruption) or possibly have 
unspecified other impact by leveraging improper handling of a stop action 
for an audio track. (CVE-2015-1255)

Use-after-free vulnerability in the SVG implementation in Blink, as used in 
Google Chrome before 43.0.2357.65, allows remote attackers to cause a 
denial of service or possibly have unspecified other impact via a crafted 
document that leverages improper handling of a shadow tree for a use 
element. (CVE-2015-1256)

platform/graphics/filters/FEColorMatrix.cpp in the SVG implementation in 
Blink, as used in Google Chrome before 43.0.2357.65, does not properly 
handle an insufficient number of values in an feColorMatrix filter, which 
allows remote attackers to cause a denial of service (container overflow) 
or possibly have unspecified other impact via a crafted document. 
(CVE-2015-1257)

Google Chrome before 43.0.2357.65 relies on libvpx code that was not built 
with an appropriate --size-limit value, which allows remote attackers to 
trigger a negative value for a size field, and consequently cause a denial 
of service or possibly have unspecified other impact, via a crafted frame 
size in VP9 video data. (CVE-2015-1258)

PDFium, as used in Google Chrome before 43.0.2357.65, does not properly 
initialize memory, which allows remote attackers to cause a denial of 
service or possibly have unspecified other impact via unknown vectors. 
(CVE-2015-1259)

Multiple use-after-free vulnerabilities in 
content/renderer/media/user_media_client_impl.cc in the WebRTC 
implementation in Google Chrome before 43.0.2357.65 allow remote attackers 
to cause a denial of service or possibly have unspecified other impact via 
crafted JavaScript code that executes upon completion of a getUserMedia 
request. (CVE-2015-1260)

platform/fonts/shaping/HarfBuzzShaper.cpp in Blink, as used in Google 
Chrome before 43.0.2357.65, does not initialize a certain width field, 
which allows remote attackers to cause a denial of service or possibly have 
unspecified other impact via crafted Unicode text. (CVE-2015-1262)

The Spellcheck API implementation in Google Chrome before 43.0.2357.65 does 
not use an HTTPS session for downloading a Hunspell dictionary, which 
allows man-in-the-middle attackers to deliver incorrect spelling 
suggestions or possibly have unspecified other impact via a crafted file. 
(CVE-2015-1263)

Cross-site scripting (XSS) vulnerability in Google Chrome before 
43.0.2357.65 allows user-assisted remote attackers to inject arbitrary web 
script or HTML via crafted data that is improperly handled by the Bookmarks 
feature. (CVE-2015-1264)

Multiple unspecified vulnerabilities in Google Chrome before 43.0.2357.65 
allow attackers to cause a denial of service or possibly have other impact 
via unknown vectors. (CVE-2015-1265)

Multiple vulnerabilities in V8 have been fixed at the tip of the 4.3 branch 
(currently 4.3.61.21).

References

SRPMS

4/core