Debian Security Advisory

DSA-3637-1 chromium-browser -- security update

Date Reported:
31 Jul 2016
Affected Packages:
chromium-browser
Vulnerable:
Yes
Security database references:
In Mitre's CVE dictionary: CVE-2016-1704, CVE-2016-1705, CVE-2016-1706, CVE-2016-1707, CVE-2016-1708, CVE-2016-1709, CVE-2016-1710, CVE-2016-1711, CVE-2016-5127, CVE-2016-5128, CVE-2016-5129, CVE-2016-5130, CVE-2016-5131, CVE-2016-5132, CVE-2016-5133, CVE-2016-5134, CVE-2016-5135, CVE-2016-5136, CVE-2016-5137.
More information:

Several vulnerabilities have been discovered in the chromium web browser.

  • CVE-2016-1704

    The chrome development team found and fixed various issues during internal auditing.

  • CVE-2016-1705

    The chrome development team found and fixed various issues during internal auditing.

  • CVE-2016-1706

    Pinkie Pie discovered a way to escape the Pepper Plugin API sandbox.

  • CVE-2016-1707

    xisigr discovered a URL spoofing issue.

  • CVE-2016-1708

    Adam Varsan discovered a use-after-free issue.

  • CVE-2016-1709

    ChenQin discovered a buffer overflow issue in the sfntly library.

  • CVE-2016-1710

    Mariusz Mlynski discovered a same-origin bypass.

  • CVE-2016-1711

    Mariusz Mlynski discovered another same-origin bypass.

  • CVE-2016-5127

    cloudfuzzer discovered a use-after-free issue.

  • CVE-2016-5128

    A same-origin bypass issue was discovered in the v8 javascript library.

  • CVE-2016-5129

    Jeonghoon Shin discovered a memory corruption issue in the v8 javascript library.

  • CVE-2016-5130

    Widih Matar discovered a URL spoofing issue.

  • CVE-2016-5131

    Nick Wellnhofer discovered a use-after-free issue in the libxml2 library.

  • CVE-2016-5132

    Ben Kelly discovered a same-origin bypass.

  • CVE-2016-5133

    Patch Eudor discovered an issue in proxy authentication.

  • CVE-2016-5134

    Paul Stone discovered an information leak in the Proxy Auto-Config feature.

  • CVE-2016-5135

    ShenYeYinJiu discovered a way to bypass the Content Security Policy.

  • CVE-2016-5136

    Rob Wu discovered a use-after-free issue.

  • CVE-2016-5137

    Xiaoyin Liu discovered a way to discover whether an HSTS web site had been visited.

For the stable distribution (jessie), these problems have been fixed in version 52.0.2743.82-1~deb8u1.

For the testing (stretch) and unstable (sid) distributions, these problems have been fixed in version 52.0.2743.82-1.

We recommend that you upgrade your chromium-browser packages.