From ${URL} : The Chrome team is happy to announce the promotion of Chrome 43 to the stable channel for Windows, Mac and Linux. Chrome 43.0.2357.65 contains a number of fixes and improvements. A list of changes is available in the log. Security Fixes and Rewards Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed. This update includes 37 security fixes. Below, we highlight fixes that were contributed by external researchers. Please see the Chromium security page for more information. [$16337][474029] High CVE-2015-1252: Sandbox escape in Chrome. Credit to anonymous. [$7500][464552] High CVE-2015-1253: Cross-origin bypass in DOM. Credit to anonymous. [$3000][444927] High CVE-2015-1254: Cross-origin bypass in Editing. Credit to armin@rawsec.net. [$3000][473253] High CVE-2015-1255: Use-after-free in WebAudio. Credit to Khalil Zhani. [$2000][478549] High CVE-2015-1256: Use-after-free in SVG. Credit to Atte Kettunen of OUSPG. [481015] High CVE-2015-1251: Use-after-free in Speech. Credit to SkyLined working with HP's Zero Day Initiative [$1500][468519] Medium CVE-2015-1257: Container-overflow in SVG. Credit to miaubiz. [$1000][450939] Medium CVE-2015-1258: Negative-size parameter in Libvpx. Credit to cloudfuzzer [$1000][468167] Medium CVE-2015-1259: Uninitialized value in PDFium. Credit to Atte Kettunen of OUSPG [$1000][474370] Medium CVE-2015-1260: Use-after-free in WebRTC. Credit to Khalil Zhani. [$500][466351] Medium CVE-2015-1261: URL bar spoofing. Credit to Juho Nurminen. [$500][476647] Medium CVE-2015-1262: Uninitialized value in Blink. Credit to miaubiz. [$500][479162] Low CVE-2015-1263: Insecure download of spellcheck dictionary. Credit to Mike Ruddy. [$500][481015] Low CVE-2015-1264: Cross-site scripting in bookmarks. Credit to K0r3Ph1L. We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel. The total value of additional rewards and their recipients will updated here when all reports have gone through the reward panel. As usual, our ongoing internal security work was responsible for a wide range of fixes: [489518] CVE-2015-1265: Various fixes from internal audits, fuzzing and other initiatives. Multiple vulnerabilities in V8 fixed at the tip of the 4.3 branch (currently 4.3.61.21). @maintainer(s): since the fixed package is already in the tree, please let us know if it is ready for the stabilization or not.
Consider also that newer libvpx needs to go stable as well.
Please go ahead and stabilize 43.0.2357.65.
amd64/x86 stable security go ahead with the glsa.
Added to an existing GLSA Request.
CVE-2015-1265 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-1265): Multiple unspecified vulnerabilities in Google Chrome before 43.0.2357.65 allow attackers to cause a denial of service or possibly have other impact via unknown vectors. CVE-2015-1264 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-1264): Cross-site scripting (XSS) vulnerability in Google Chrome before 43.0.2357.65 allows user-assisted remote attackers to inject arbitrary web script or HTML via crafted data that is improperly handled by the Bookmarks feature. CVE-2015-1263 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-1263): The Spellcheck API implementation in Google Chrome before 43.0.2357.65 does not use an HTTPS session for downloading a Hunspell dictionary, which allows man-in-the-middle attackers to deliver incorrect spelling suggestions or possibly have unspecified other impact via a crafted file. CVE-2015-1262 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-1262): platform/fonts/shaping/HarfBuzzShaper.cpp in Blink, as used in Google Chrome before 43.0.2357.65, does not initialize a certain width field, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted Unicode text. CVE-2015-1260 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-1260): Multiple use-after-free vulnerabilities in content/renderer/media/user_media_client_impl.cc in the WebRTC implementation in Google Chrome before 43.0.2357.65 allow remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that executes upon completion of a getUserMedia request. CVE-2015-1259 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-1259): PDFium, as used in Google Chrome before 43.0.2357.65, does not properly initialize memory, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors. CVE-2015-1258 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-1258): Google Chrome before 43.0.2357.65 relies on libvpx code that was not built with an appropriate --size-limit value, which allows remote attackers to trigger a negative value for a size field, and consequently cause a denial of service or possibly have unspecified other impact, via a crafted frame size in VP9 video data. CVE-2015-1257 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-1257): platform/graphics/filters/FEColorMatrix.cpp in the SVG implementation in Blink, as used in Google Chrome before 43.0.2357.65, does not properly handle an insufficient number of values in an feColorMatrix filter, which allows remote attackers to cause a denial of service (container overflow) or possibly have unspecified other impact via a crafted document. CVE-2015-1256 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-1256): Use-after-free vulnerability in the SVG implementation in Blink, as used in Google Chrome before 43.0.2357.65, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document that leverages improper handling of a shadow tree for a use element. CVE-2015-1255 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-1255): Use-after-free vulnerability in content/renderer/media/webaudio_capturer_source.cc in the WebAudio implementation in Google Chrome before 43.0.2357.65 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by leveraging improper handling of a stop action for an audio track. CVE-2015-1254 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-1254): core/dom/Document.cpp in Blink, as used in Google Chrome before 43.0.2357.65, enables the inheritance of the designMode attribute, which allows remote attackers to bypass the Same Origin Policy by leveraging the availability of editing. CVE-2015-1253 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-1253): core/html/parser/HTMLConstructionSite.cpp in the DOM implementation in Blink, as used in Google Chrome before 43.0.2357.65, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code that appends a child to a SCRIPT element, related to the insert and executeReparentTask functions. CVE-2015-1252 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-1252): common/partial_circular_buffer.cc in Google Chrome before 43.0.2357.65 does not properly handle wraps, which allows remote attackers to bypass a sandbox protection mechanism or cause a denial of service (out-of-bounds write) via vectors that trigger a write operation with a large amount of data, related to the PartialCircularBuffer::Write and PartialCircularBuffer::DoWrite functions. CVE-2015-1251 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-1251): Use-after-free vulnerability in the SpeechRecognitionClient implementation in the Speech subsystem in Google Chrome before 43.0.2357.65 allows remote attackers to execute arbitrary code via a crafted document.
This issue was resolved and addressed in GLSA 201506-04 at https://security.gentoo.org/glsa/201506-04 by GLSA coordinator Yury German (BlueKnight).
Remove invalid alias.
