[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

[SECURITY] [DSA 3731-1] chromium-browser security update



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3731-1                   security@debian.org
https://www.debian.org/security/                          Michael Gilbert
December 11, 2016                     https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : chromium-browser
CVE ID         : CVE-2016-5181 CVE-2016-5182 CVE-2016-5183 CVE-2016-5184
                 CVE-2016-5185 CVE-2016-5186 CVE-2016-5187 CVE-2016-5188
                 CVE-2016-5189 CVE-2016-5190 CVE-2016-5191 CVE-2016-5192
                 CVE-2016-5193 CVE-2016-5194 CVE-2016-5198 CVE-2016-5199
                 CVE-2016-5200 CVE-2016-5201 CVE-2016-5202 CVE-2016-5203
                 CVE-2016-5204 CVE-2016-5205 CVE-2016-5206 CVE-2016-5207
                 CVE-2016-5208 CVE-2016-5209 CVE-2016-5210 CVE-2016-5211
                 CVE-2016-5212 CVE-2016-5213 CVE-2016-5214 CVE-2016-5215
                 CVE-2016-5216 CVE-2016-5217 CVE-2016-5218 CVE-2016-5219
                 CVE-2016-5220 CVE-2016-5221 CVE-2016-5222 CVE-2016-5223
                 CVE-2016-5224 CVE-2016-5225 CVE-2016-5226 CVE-2016-9650
                 CVE-2016-9651 CVE-2016-9652

Several vulnerabilities have been discovered in the chromium web browser.

CVE-2016-5181

    A cross-site scripting issue was discovered.

CVE-2016-5182

    Giwan Go discovered a heap overflow issue.

CVE-2016-5183

    A use-after-free issue was discovered in the pdfium library.

CVE-2016-5184

    Another use-after-free issue was discovered in the pdfium library.

CVE-2016-5185

    cloudfuzzer discovered a use-after-free issue in Blink/Webkit.

CVE-2016-5186

    Abdulrahman Alqabandi discovered an out-of-bounds read issue in the
    developer tools.

CVE-2016-5187

    Luan Herrera discovered a URL spoofing issue.

CVE-2016-5188

    Luan Herrera discovered that some drop down menus can be used to
    hide parts of the user interface.

CVE-2016-5189

    xisigr discovered a URL spoofing issue.

CVE-2016-5190

    Atte Kettunen discovered a use-after-free issue.

CVE-2016-5191

    Gareth Hughes discovered a cross-site scripting issue.

CVE-2016-5192

    haojunhou@gmail.com discovered a same-origin bypass.

CVE-2016-5193

    Yuyang Zhou discovered a way to pop open a new window.

CVE-2016-5194

    The chrome development team found and fixed various issues during
    internal auditing.

CVE-2016-5198

    Tencent Keen Security Lab discovered an out-of-bounds memory access
    issue in the v8 javascript library.

CVE-2016-5199

    A heap corruption issue was discovered in the ffmpeg library.

CVE-2016-5200

    Choongwoo Han discovered an out-of-bounds memory access issue in
    the v8 javascript library.

CVE-2016-5201

    Rob Wu discovered an information leak.

CVE-2016-5202

    The chrome development team found and fixed various issues during
    internal auditing.

CVE-2016-5203

    A use-after-free issue was discovered in the pdfium library.

CVE-2016-5204

    Mariusz Mlynski discovered a cross-site scripting issue in SVG
    image handling.

CVE-2016-5205

    A cross-site scripting issue was discovered.

CVE-2016-5206

    Rob Wu discovered a same-origin bypass in the pdfium library.

CVE-2016-5207

    Mariusz Mlynski discovered a cross-site scripting issue.

CVE-2016-5208

    Mariusz Mlynski discovered another cross-site scripting issue.

CVE-2016-5209

    Giwan Go discovered an out-of-bounds write issue in Blink/Webkit.

CVE-2016-5210

    Ke Liu discovered an out-of-bounds write in the pdfium library.

CVE-2016-5211

    A use-after-free issue was discovered in the pdfium library.

CVE-2016-5212

    Khalil Zhani discovered an information disclosure issue in the
    developer tools.

CVE-2016-5213

    Khalil Zhani discovered a use-after-free issue in the v8 javascript
    library.

CVE-2016-5214

    Jonathan Birch discovered a file download protection bypass.

CVE-2016-5215

    Looben Yang discovered a use-after-free issue.

CVE-2016-5216

    A use-after-free issue was discovered in the pdfium library.

CVE-2016-5217

    Rob Wu discovered a condition where data was not validated by
    the pdfium library.

CVE-2016-5218

    Abdulrahman Alqabandi discovered a URL spoofing issue.

CVE-2016-5219

    Rob Wu discovered a use-after-free issue in the v8 javascript
    library.

CVE-2016-5220

    Rob Wu discovered a way to access files on the local system.

CVE-2016-5221

    Tim Becker discovered an integer overflow issue in the angle
    library.

CVE-2016-5222

    xisigr discovered a URL spoofing issue.

CVE-2016-5223

    Hwiwon Lee discovered an integer overflow issue in the pdfium
    library.

CVE-2016-5224

    Roeland Krak discovered a same-origin bypass in SVG image handling.

CVE-2016-5225

    Scott Helme discovered a Content Security Protection bypass.

CVE-2016-5226

    Jun Kokatsu discovered a cross-scripting issue.

CVE-2016-9650

    Jakub Żoczek discovered a Content Security Protection information
    disclosure.

CVE-2016-9651

    Guang Gong discovered a way to access private data in the v8
    javascript library.

CVE-2016-9652

    The chrome development team found and fixed various issues during
    internal auditing.

For the stable distribution (jessie), these problems have been fixed in
version 55.0.2883.75-1~deb8u1.

For the testing distribution (stretch), these problems will be fixed soon.

For the unstable distribution (sid), these problems have been fixed in
version 55.0.2883.75-1.

We recommend that you upgrade your chromium-browser packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----

iQQzBAEBCgAdFiEEluhy7ASCBulP9FUWuNayzQLW9HMFAlhNu7wACgkQuNayzQLW
9HNrER//c8ZJouglb8ND39PIIOXvIdGTHqem9H/ki59b5T7MPP+izcMTqqdRE16O
cF03Sqbal6gTLApdbJDnGnpqTXO+4dVvr/JOQnYeS7bSn3HaCFmFUzAnS6VmbD4X
Gwndz4hR/HbiXmZGL9vDoIJQYJyK5KrGH6HRugLwCHXzdH3E5/PuOROFEHbEhA2d
vM5lcYL7m1fb8YNmhoWaHGz4YlpL+OntWGl0cJrRhL7hueEYtgQi+RwZLnxPAx19
raY/+gCNTGYKWveU8Ztb/D8uUyePl3rCbtH1ZxjT+VPORvKg4ILm9e675D/ApPol
evSe3CNj3rgp8MyjT8Lp6SJhx8lXnOAU3WgUoSfTblQWhI/5gXQGdGY5aCFXbunb
BcVYQ1ZUIqus5HNHml1ILkJ9o60sLdSPxo8oK9e+CwLjvPJOmDmwXNyRMUZW4g+L
D0HUpjT9++xLjKw6b4t+pS1OtxdQdIFgSJsFpp289sJ90vunnqjmfM5+rdpfr0hA
Vo20/DJFqfgbgPEeJj/xNGHUNuwULVDQ1Jj20burmWBxsjr5iu5Q1k1qyO0rffCw
DMCPuhmY2ghZGpg2KPZv5+WSl6HK4Kazi8h7G1Uc3LwX2AUPEwp4vVUwzYs8GWHk
mq5EU/Rbq2esZe9Mlwbs0pOLJ5HsjVu4QrSW1mWxLuN83c1t/mdf9xc9LvVlWdQh
yjuchJqGKix6RSlXHKV7DrKzL/yZpTRquGdXUHhnYinNtaiRK2hC4vzPDtXDcTuR
Qv2pnS67tDZv28a2HSQdLA0uNJaOYHGlY7Cugpo6RKq0im+RZT93wjxo/f+CA38I
iDG2wh9sTpAf1P58jdHjxwp/xcotOPmxn6vgE2huoeZSnFhENOZtVnG2UCVDKSdA
2MRX/qy1lJVlAr2RgHFpTjPyzaW/8NapKLbIbgzjcyeSo9YMuJDi7VUP3VM5Ptk8
3LZU9ohfySOSr8nZQAevphiUKRz5K3k389saPSjetGOij7//kya1ub5qOLEaxH8Y
WCjHj2f/pPl3eaG3yQPo0UhMMT9cC5PCkUzzFqwxC5dzzzjdvZ7hS9RZRM/RF+ne
+9zKHiK8mMVuIY98VOxHGzAnC/Y1vkC7Wk0OSjBMweDGbw6J/+xc0ku9mS2cOXaZ
czkgVFoNcLVrXB1ynLOz3WkZOMwTC74XmRE13JVWWhUbNBdcJLTyOal9iAxNY82c
vAqvqE5lPnAJ+H3HAd6G8MLM19wCBrsRDRF1k8CzvVQDEeLmfgMgfup5OxPEiWS9
Pi03o4T3+5jCtznqGrCF0cf9fvNT2lNm0D30KkgAG/hBCZFAENXr91LHVzuOh9zM
QQqxLmkAQ3dwCYvtcepAyQ3eYtePxQ==
=p9Ee
-----END PGP SIGNATURE-----


Reply to: