ID

VAR-201502-0409

CVE

CVE-2015-1210

TITLE

Google Chrome Used in Blink of V8 Vulnerability to bypass same origin policy in binding

DESCRIPTION

The V8ThrowException::createDOMException function in bindings/core/v8/V8ThrowException.cpp in the V8 bindings in Blink, as used in Google Chrome before 40.0.2214.111 on Windows, OS X, and Linux and before 40.0.2214.109 on Android, does not properly consider frame access restrictions during the throwing of an exception, which allows remote attackers to bypass the Same Origin Policy via a crafted web site. Google Chrome is prone to multiple vulnerabilities. Attackers may exploit these issues to execute arbitrary code, bypass the same-origin policy and gain elevated privileges; other attacks are also possible. Google Chrome is a web browser developed by Google (Google). Blink is a browser typesetting engine (rendering engine) jointly developed by Google and Opera Software. There is a security vulnerability in the 'V8ThrowException::createDOMException' function in the bindings/core/v8/V8ThrowException.cpp file in the bindings/core/v8/V8ThrowException.cpp file of Blink used in Google Chrome. Framework access restrictions. The following versions are affected: Google Chrome 40.0.2214.93 and earlier for Windows, OS X, and Linux, and Google Chrome 40.0.2214.89 and earlier for Android. ============================================================================ Ubuntu Security Notice USN-2495-1 February 10, 2015 oxide-qt vulnerabilities ============================================================================ A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 14.10 - Ubuntu 14.04 LTS Summary: Several security issues were fixed in Oxide. (CVE-2015-1209) It was discovered that V8 did not properly consider frame access restrictions when throwing exceptions in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass same origin restrictions. (CVE-2015-1210) It was discovered that Chromium did not properly restrict the URI scheme during ServiceWorker registration. If a user were tricked in to downloading and opening a specially crafted HTML file, an attacker could potentially exploit this to bypass security restrictions. (CVE-2015-1212) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 14.10: liboxideqtcore0 1.4.3-0ubuntu0.14.10.1 oxideqt-codecs 1.4.3-0ubuntu0.14.10.1 oxideqt-codecs-extra 1.4.3-0ubuntu0.14.10.1 Ubuntu 14.04 LTS: liboxideqtcore0 1.4.3-0ubuntu0.14.04.1 oxideqt-codecs 1.4.3-0ubuntu0.14.04.1 oxideqt-codecs-extra 1.4.3-0ubuntu0.14.04.1 In general, a standard system update will make all the necessary changes. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: chromium-browser security update Advisory ID: RHSA-2015:0163-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-0163.html Issue date: 2015-02-10 CVE Names: CVE-2015-1209 CVE-2015-1210 CVE-2015-1211 CVE-2015-1212 ===================================================================== 1. Summary: Updated chromium-browser packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. Description: Chromium is an open-source web browser, powered by WebKit (Blink). Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash or, potentially, execute arbitrary code with the privileges of the user running Chromium. (CVE-2015-1209, CVE-2015-1210, CVE-2015-1211, CVE-2015-1212) All Chromium users should upgrade to these updated packages, which contain Chromium version 40.0.2214.111, which corrects these issues. After installing the update, Chromium must be restarted for the changes to take effect. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1190123 - CVE-2015-1209 chromium-browser: use-after-free in DOM 1190124 - CVE-2015-1210 chromium-browser: cross-origin-bypass in V8 bindings 1190125 - CVE-2015-1211 chromium-browser: privilege escalation in service workers 1190158 - CVE-2015-1212 chromium-browser: various security fixes in Chrome 40.0.2214.111 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 6): Source: chromium-browser-40.0.2214.111-1.el6_6.src.rpm i386: chromium-browser-40.0.2214.111-1.el6_6.i686.rpm chromium-browser-debuginfo-40.0.2214.111-1.el6_6.i686.rpm x86_64: chromium-browser-40.0.2214.111-1.el6_6.x86_64.rpm chromium-browser-debuginfo-40.0.2214.111-1.el6_6.x86_64.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): Source: chromium-browser-40.0.2214.111-1.el6_6.src.rpm i386: chromium-browser-40.0.2214.111-1.el6_6.i686.rpm chromium-browser-debuginfo-40.0.2214.111-1.el6_6.i686.rpm x86_64: chromium-browser-40.0.2214.111-1.el6_6.x86_64.rpm chromium-browser-debuginfo-40.0.2214.111-1.el6_6.x86_64.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): Source: chromium-browser-40.0.2214.111-1.el6_6.src.rpm i386: chromium-browser-40.0.2214.111-1.el6_6.i686.rpm chromium-browser-debuginfo-40.0.2214.111-1.el6_6.i686.rpm x86_64: chromium-browser-40.0.2214.111-1.el6_6.x86_64.rpm chromium-browser-debuginfo-40.0.2214.111-1.el6_6.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-1209 https://access.redhat.com/security/cve/CVE-2015-1210 https://access.redhat.com/security/cve/CVE-2015-1211 https://access.redhat.com/security/cve/CVE-2015-1212 https://access.redhat.com/security/updates/classification/#important http://googlechromereleases.blogspot.com/2015/02/stable-channel-update.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFU2oc6XlSAg2UNWIIRArgRAJ0UDk0z8qCzqVFIRSEuiIgr3tP9swCfdFO2 59ank3BbCLmfdBRtQ9lpFz4= =mT/S -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201502-13 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Chromium: Multiple vulnerabilities Date: February 17, 2015 Bugs: #537366, #539094 ID: 201502-13 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been found in Chromium, the worst of which can allow remote attackers to cause Denial of Service or gain escalated privileges. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 www-client/chromium < 40.0.2214.111 >= 40.0.2214.111 Description =========== Multiple vulnerabilities have been discovered in Chromium. Please review the CVE identifiers referenced below for details. Impact ====== A remote attacker may be able to cause a Denial of Service condition, gain privileges via a filesystem: URI, or have other unspecified impact. Workaround ========== There is no known workaround at this time. Resolution ========== All Chromium users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-client/chromium-40.0.2214.111" References ========== [ 1 ] CVE-2014-7923 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-7923 [ 2 ] CVE-2014-7924 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-7924 [ 3 ] CVE-2014-7925 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-7925 [ 4 ] CVE-2014-7926 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-7926 [ 5 ] CVE-2014-7927 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-7927 [ 6 ] CVE-2014-7928 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-7928 [ 7 ] CVE-2014-7929 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-7929 [ 8 ] CVE-2014-7930 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-7930 [ 9 ] CVE-2014-7931 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-7931 [ 10 ] CVE-2014-7932 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-7932 [ 11 ] CVE-2014-7933 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-7933 [ 12 ] CVE-2014-7934 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-7934 [ 13 ] CVE-2014-7935 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-7935 [ 14 ] CVE-2014-7936 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-7936 [ 15 ] CVE-2014-7937 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-7937 [ 16 ] CVE-2014-7938 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-7938 [ 17 ] CVE-2014-7939 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-7939 [ 18 ] CVE-2014-7940 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-7940 [ 19 ] CVE-2014-7941 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-7941 [ 20 ] CVE-2014-7942 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-7942 [ 21 ] CVE-2014-7943 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-7943 [ 22 ] CVE-2014-7944 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-7944 [ 23 ] CVE-2014-7945 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-7945 [ 24 ] CVE-2014-7946 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-7946 [ 25 ] CVE-2014-7947 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-7947 [ 26 ] CVE-2014-7948 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-7948 [ 27 ] CVE-2014-9646 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-9646 [ 28 ] CVE-2014-9647 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-9647 [ 29 ] CVE-2014-9648 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-9648 [ 30 ] CVE-2015-1205 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-1205 [ 31 ] CVE-2015-1209 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-1209 [ 32 ] CVE-2015-1210 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-1210 [ 33 ] CVE-2015-1211 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-1211 [ 34 ] CVE-2015-1212 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-1212 [ 35 ] CVE-2015-1346 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-1346 [ 36 ] CVE-2015-1359 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-1359 [ 37 ] CVE-2015-1360 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-1360 [ 38 ] CVE-2015-1361 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-1361 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-201502-13.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5

AFFECTED PRODUCTS