Debian DSA-3315-1 High Severity: Multiple Browser Threats

debian

July 24, 2015

Several vulnerabilities were discovered in the chromium web browser

Topics Covered

security advisory high severity debian browser issue chromium

Summary

CVE-2015-1266

Intended access restrictions could be bypassed for certain URLs like
chrome://gpu.

CVE-2015-1267

A way to bypass the Same Origin Policy was discovered.

CVE-2015-1268

Mariusz Mlynski also discovered a way to bypass the Same Origin Policy.

CVE-2015-1269

Mike Rudy discovered that hostnames were not properly compared in the
HTTP Strict Transport Policy and HTTP Public Key Pinning features,
which could allow those access restrictions to be bypassed.

CVE-2015-1270

Atte Kettunen discovered an uninitialized memory read in the ICU library.

CVE-2015-1271

cloudfuzzer discovered a buffer overflow in the pdfium library.

CVE-2015-1272

Chamal de Silva discovered race conditions in the GPU process
implementation.

CVE-2015-1273

makosoft discovered a buffer overflow in openjpeg, which is used by
the pdfium library embedded in chromium.

CVE-2015-1274

andrewm.bpi discovered that the auto-open list allowed certain file
types to be executed immediately a...