| Summary: | <www-client/chromium-40.0.2214.111: multiple vulnerabilities (CVE-2015-{1209,1210,1211,1212}) | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Agostino Sarubbo <ago> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | critical | CC: | chromium |
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | http://googlechromereleases.blogspot.com/2015/02/stable-channel-update.html | ||
| Whiteboard: | A1 [glsa] | ||
| Package list: | Runtime testing required: | --- | |
I'm build-testing 40.0.2214.111 now. Please stabilize on amd64 and x86. =www-client/chromium-40.0.2214.111 amd64 stable CVE-2015-1212 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-1212): Multiple unspecified vulnerabilities in Google Chrome before 40.0.2214.111 on Windows, OS X, and Linux and before 40.0.2214.109 on Android allow attackers to cause a denial of service or possibly have other impact via unknown vectors. CVE-2015-1211 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-1211): The OriginCanAccessServiceWorkers function in content/browser/service_worker/service_worker_dispatcher_host.cc in Google Chrome before 40.0.2214.111 on Windows, OS X, and Linux and before 40.0.2214.109 on Android does not properly restrict the URI scheme during a ServiceWorker registration, which allows remote attackers to gain privileges via a filesystem: URI. CVE-2015-1210 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-1210): The V8ThrowException::createDOMException function in bindings/core/v8/V8ThrowException.cpp in the V8 bindings in Blink, as used in Google Chrome before 40.0.2214.111 on Windows, OS X, and Linux and before 40.0.2214.109 on Android, does not properly consider frame access restrictions during the throwing of an exception, which allows remote attackers to bypass the Same Origin Policy via a crafted web site. CVE-2015-1209 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-1209): Use-after-free vulnerability in the VisibleSelection::nonBoundaryShadowTreeRootNode function in core/editing/VisibleSelection.cpp in the DOM implementation in Blink, as used in Google Chrome before 40.0.2214.111 on Windows, OS X, and Linux and before 40.0.2214.109 on Android, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers improper handling of a shadow-root anchor. x86 stable. Maintainer(s), please cleanup. Security, please add it to the existing request, or file a new one. (In reply to Agostino Sarubbo from comment #5) > x86 stable. > > Maintainer(s), please cleanup. > Security, please add it to the existing request, or file a new one. Added to existing request for bug 537366 This issue was resolved and addressed in GLSA 201502-13 at http://security.gentoo.org/glsa/glsa-201502-13.xml by GLSA coordinator Kristian Fiskerstrand (K_F). |
From ${URL} : he stable channel has been updated to 40.0.2214.111 for Windows, Mac and Linux. A full list of changes is available in the log. Security Fixes and Rewards Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven't yet fixed. This update includes 11 security fixes. Below, we highlight fixes that were contributed by external researchers. Please see the Chromium security page for more information. [$TBD][447906] High CVE-2015-1209: Use-after-free in DOM. Credit to Maksymillian Motyl. [$TBD][453979] High CVE-2015-1210: Cross-origin-bypass in V8 bindings. Credit to anonymous. [$TBD][453982] High CVE-2015-1211: Privilege escalation using service workers. Credit to anonymous. As usual, our ongoing internal security work was responsible for a wide range of fixes: [455225] CVE-2015-1212: Various fixes from internal audits, fuzzing and other initiatives. Many of the above bugs were detected using AddressSanitizer or MemorySanitizer. @maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.