Arch Linux Security Advisory ASA-201509-1
========================================
Severity: High
Date    : 2015-09-02
CVE-ID  : CVE-2015-1291 CVE-2015-1292 CVE-2015-1293 CVE-2015-1294
CVE-2015-1295 CVE-2015-1296 CVE-2015-1297 CVE-2015-1298 CVE-2015-1299
CVE-2015-1300 CVE-2015-1301
Package : chromium
Type    : multiple issues
Remote  : Yes
Link    : https://wiki.archlinux.org/title/CVE

Summary
======
The package chromium before version 45.0.2454.85-1 is vulnerable to
multiple issues including cross-origin bypass, use-after-free, character
spoofing and information leak.

Resolution
=========
Upgrade to 45.0.2454.85-1.

# pacman -Syu "chromium>=45.0.2454.85-1"

The problem has been fixed upstream in version 45.0.2454.85.

Workaround
=========
None.

Description
==========
- CVE-2015-1291, CVE-2015-1293:

Cross-origin bypass in DOM.

- CVE-2015-1292:

Cross-origin bypass in ServiceWorker.

- CVE-2015-1294:

Use-after-free in Skia.

- CVE-2015-1295:

Use-after-free in Printing.

- CVE-2015-1296:

Character spoofing in omnibox.

- CVE-2015-1297:

Permission scoping error in WebRequest.

- CVE-2015-1298:

URL validation error in extensions.

- CVE-2015-1299:

Use-after-free in Blink.

- CVE-2015-1300:

Information leak in Blink.

- CVE-2015-1301:

Various fixes from internal audits, fuzzing and other initiatives.

Impact
=====
A remote attacker can bypass the Same-Origin Policy of a website, spoof
character in omnibox to trick the user, leak information, cause a denial
of service or have other unspecified impact.

References
=========
https://chromereleases.googleblog.com/2015/09/stable-channel-update.html
https://access.redhat.com/security/cve/CVE-2015-1291
https://access.redhat.com/security/cve/CVE-2015-1292
https://access.redhat.com/security/cve/CVE-2015-1293
https://access.redhat.com/security/cve/CVE-2015-1294
https://access.redhat.com/security/cve/CVE-2015-1295
https://access.redhat.com/security/cve/CVE-2015-1296
https://access.redhat.com/security/cve/CVE-2015-1297
https://access.redhat.com/security/cve/CVE-2015-1298
https://access.redhat.com/security/cve/CVE-2015-1299
https://access.redhat.com/security/cve/CVE-2015-1300
https://access.redhat.com/security/cve/CVE-2015-1301

ArchLinux: 201509-1: chromium: multiple issues

September 2, 2015

Summary

- CVE-2015-1291, CVE-2015-1293: Cross-origin bypass in DOM.
- CVE-2015-1292:
Cross-origin bypass in ServiceWorker.
- CVE-2015-1294:
Use-after-free in Skia.
- CVE-2015-1295:
Use-after-free in Printing.
- CVE-2015-1296:
Character spoofing in omnibox.
- CVE-2015-1297:
Permission scoping error in WebRequest.
- CVE-2015-1298:
URL validation error in extensions.
- CVE-2015-1299:
Use-after-free in Blink.
- CVE-2015-1300:
Information leak in Blink.
- CVE-2015-1301:
Various fixes from internal audits, fuzzing and other initiatives.

Resolution

Upgrade to 45.0.2454.85-1. # pacman -Syu "chromium>=45.0.2454.85-1"
The problem has been fixed upstream in version 45.0.2454.85.

References

https://chromereleases.googleblog.com/2015/09/stable-channel-update.html https://access.redhat.com/security/cve/CVE-2015-1291 https://access.redhat.com/security/cve/CVE-2015-1292 https://access.redhat.com/security/cve/CVE-2015-1293 https://access.redhat.com/security/cve/CVE-2015-1294 https://access.redhat.com/security/cve/CVE-2015-1295 https://access.redhat.com/security/cve/CVE-2015-1296 https://access.redhat.com/security/cve/CVE-2015-1297 https://access.redhat.com/security/cve/CVE-2015-1298 https://access.redhat.com/security/cve/CVE-2015-1299 https://access.redhat.com/security/cve/CVE-2015-1300 https://access.redhat.com/security/cve/CVE-2015-1301

Severity
CVE-2015-1295 CVE-2015-1296 CVE-2015-1297 CVE-2015-1298 CVE-2015-1299
CVE-2015-1300 CVE-2015-1301
Package : chromium
Type : multiple issues
Remote : Yes
Link : https://wiki.archlinux.org/title/CVE

Workaround

None.

Related News

23.Tablet Connections Esm H320
2 - 3 min read
The release of Ubuntu 24.04 LTS , also known as Noble Numbat, brings various security enhancements and exciting new features . These improvements
4.Lock AbstractDigital Esm H320
2 - 3 min read
Tails 6.2 is a new Linux distribution release that expands its multilingual support and improves security features. The distribution is a
19.Laptop Bed Esm H320
2 - 3 min read
AlmaLinux 9.4 beta has been released and provides compelling reasons to consider it for desktop usage. While AlmaLinux is primarily known as a
32.Lock Code Circular Esm H320
2 - 3 min read
Linux admins and security practitioners face significant challenges in keeping their Linux systems secure amidst the constant threat of kernel bugs.
1.Penguin Landscape Esm H320
2 - 3 min read
A significant security threat, known as the Spectre v2 exploit, has been observed targeting Linux systems running on modern Intel processors. Let's
10.FingerPrint Locks Esm H320
2 - 3 min read
The recent release of I2P 2.5.0 , an anonymous P2P network that protects against online censorship, surveillance, and monitoring, has brought a slew
24.Key Code Esm H320
2 - 3 min read
The Akira ransomware group has extorted approximately $42 million from over 250 victims since January 1, 2024. The group initially focused on
5.ShakingHands Esm H320
2 - 3 min read
At The Linux Foundation's Open Source Summit North America , Linus Torvalds, the creator of Linux, discussed various topics related to Linux
Sign Up

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved