Debian: DSA-3315-1: chromium-browser security update

    Date24 Jul 2015
    CategoryDebian
    65
    Posted ByLinuxSecurity Advisories
    Several vulnerabilities were discovered in the chromium web browser. CVE-2015-1266
    
    - -------------------------------------------------------------------------
    Debian Security Advisory DSA-3315-1                   This email address is being protected from spambots. You need JavaScript enabled to view it.
    https://www.debian.org/security/                          Michael Gilbert
    July 23, 2015                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------
    
    Package        : chromium-browser
    CVE ID         : CVE-2015-1266 CVE-2015-1267 CVE-2015-1268 CVE-2015-1269
                     CVE-2015-1270 CVE-2015-1271 CVE-2015-1272 CVE-2015-1273
                     CVE-2015-1274 CVE-2015-1276 CVE-2015-1277 CVE-2015-1278
                     CVE-2015-1279 CVE-2015-1280 CVE-2015-1281 CVE-2015-1282
                     CVE-2015-1283 CVE-2015-1284 CVE-2015-1285 CVE-2015-1286
                     CVE-2015-1287 CVE-2015-1288 CVE-2015-1289
    
    Several vulnerabilities were discovered in the chromium web browser.
    
    CVE-2015-1266
    
        Intended access restrictions could be bypassed for certain URLs like
        chrome://gpu.
    
    CVE-2015-1267
    
        A way to bypass the Same Origin Policy was discovered.
    
    CVE-2015-1268
    
        Mariusz Mlynski also discovered a way to bypass the Same Origin Policy.
    
    CVE-2015-1269
    
        Mike Rudy discovered that hostnames were not properly compared in the
        HTTP Strict Transport Policy and HTTP Public Key Pinning features,
        which could allow those access restrictions to be bypassed.
    
    CVE-2015-1270
    
        Atte Kettunen discovered an uninitialized memory read in the ICU library.
    
    CVE-2015-1271
    
        cloudfuzzer discovered a buffer overflow in the pdfium library.
    
    CVE-2015-1272
    
        Chamal de Silva discovered race conditions in the GPU process
        implementation.
    
    CVE-2015-1273
    
        makosoft discovered a buffer overflow in openjpeg, which is used by
        the pdfium library embedded in chromium.
    
    CVE-2015-1274
    
        andrewm.bpi discovered that the auto-open list allowed certain file
        types to be executed immediately after download.
    
    CVE-2015-1276
    
        Colin Payne discovered a use-after-free issue in the IndexedDB
        implementation.
    
    CVE-2015-1277
    
        SkyLined discovered a use-after-free issue in chromium's accessibility
        implementation.
    
    CVE-2015-1278
    
        Chamal de Silva discovered a way to use PDF documents to spoof a URL.
    
    CVE-2015-1279
    
        mlafon discovered a buffer overflow in the pdfium library.
    
    CVE-2015-1280
    
        cloudfuzzer discovered a memory corruption issue in the SKIA library.
    
    CVE-2015-1281
    
        Masato Knugawa discovered a way to bypass the Content Security
        Policy.
    
    CVE-2015-1282
    
        Chamal de Silva discovered multiple use-after-free issues in the
        pdfium library.
    
    CVE-2015-1283
    
        Huzaifa Sidhpurwala discovered a buffer overflow in the expat
        library.
    
    CVE-2015-1284
    
        Atte Kettunen discovered that the maximum number of page frames
        was not correctly checked.
    
    CVE-2015-1285
    
        gazheyes discovered an information leak in the XSS auditor,
        which normally helps to prevent certain classes of cross-site
        scripting problems.
    
    CVE-2015-1286
    
        A cross-site scripting issue was discovered in the interface to
        the v8 javascript library.
    
    CVE-2015-1287
    
        filedescriptor discovered a way to bypass the Same Origin Policy.
    
    CVE-2015-1288
    
        Mike Ruddy discovered that the spellchecking dictionaries could
        still be downloaded over plain HTTP (related to CVE-2015-1263).
    
    CVE-2015-1289
    
        The chrome 44 development team found and fixed various issues
        during internal auditing.
    
    In addition to the above issues, Google disabled the hotword extension
    by default in this version, which if enabled downloads files without
    the user's intervention.
    
    For the stable distribution (jessie), these problems have been fixed in
    version 44.0.2403.89-1~deb8u1.
    
    For the testing distribution (stretch), these problems will be fixed soon.
    
    For the unstable distribution (sid), these problems have been fixed in
    version 44.0.2403.89-1.
    
    We recommend that you upgrade your chromium-browser packages.
    
    Further information about Debian Security Advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://www.debian.org/security/
    
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"39","type":"x","order":"1","pct":50.65,"resources":[]},{"id":"88","title":"Should be more technical","votes":"11","type":"x","order":"2","pct":14.29,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"27","type":"x","order":"3","pct":35.06,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.