Debian Security Advisory

DSA-3731-1 chromium-browser -- security update

Date Reported:
11 Dec 2016
Affected Packages:
chromium-browser
Vulnerable:
Yes
Security database references:
In Mitre's CVE dictionary: CVE-2016-5181, CVE-2016-5182, CVE-2016-5183, CVE-2016-5184, CVE-2016-5185, CVE-2016-5186, CVE-2016-5187, CVE-2016-5188, CVE-2016-5189, CVE-2016-5190, CVE-2016-5191, CVE-2016-5192, CVE-2016-5193, CVE-2016-5194, CVE-2016-5198, CVE-2016-5199, CVE-2016-5200, CVE-2016-5201, CVE-2016-5202, CVE-2016-5203, CVE-2016-5204, CVE-2016-5205, CVE-2016-5206, CVE-2016-5207, CVE-2016-5208, CVE-2016-5209, CVE-2016-5210, CVE-2016-5211, CVE-2016-5212, CVE-2016-5213, CVE-2016-5214, CVE-2016-5215, CVE-2016-5216, CVE-2016-5217, CVE-2016-5218, CVE-2016-5219, CVE-2016-5220, CVE-2016-5221, CVE-2016-5222, CVE-2016-5223, CVE-2016-5224, CVE-2016-5225, CVE-2016-5226, CVE-2016-9650, CVE-2016-9651, CVE-2016-9652.
More information:

Several vulnerabilities have been discovered in the chromium web browser.

  • CVE-2016-5181

    A cross-site scripting issue was discovered.

  • CVE-2016-5182

    Giwan Go discovered a heap overflow issue.

  • CVE-2016-5183

    A use-after-free issue was discovered in the pdfium library.

  • CVE-2016-5184

    Another use-after-free issue was discovered in the pdfium library.

  • CVE-2016-5185

    cloudfuzzer discovered a use-after-free issue in Blink/Webkit.

  • CVE-2016-5186

    Abdulrahman Alqabandi discovered an out-of-bounds read issue in the developer tools.

  • CVE-2016-5187

    Luan Herrera discovered a URL spoofing issue.

  • CVE-2016-5188

    Luan Herrera discovered that some drop down menus can be used to hide parts of the user interface.

  • CVE-2016-5189

    xisigr discovered a URL spoofing issue.

  • CVE-2016-5190

    Atte Kettunen discovered a use-after-free issue.

  • CVE-2016-5191

    Gareth Hughes discovered a cross-site scripting issue.

  • CVE-2016-5192

    haojunhou@gmail.com discovered a same-origin bypass.

  • CVE-2016-5193

    Yuyang Zhou discovered a way to pop open a new window.

  • CVE-2016-5194

    The chrome development team found and fixed various issues during internal auditing.

  • CVE-2016-5198

    Tencent Keen Security Lab discovered an out-of-bounds memory access issue in the v8 javascript library.

  • CVE-2016-5199

    A heap corruption issue was discovered in the ffmpeg library.

  • CVE-2016-5200

    Choongwoo Han discovered an out-of-bounds memory access issue in the v8 javascript library.

  • CVE-2016-5201

    Rob Wu discovered an information leak.

  • CVE-2016-5202

    The chrome development team found and fixed various issues during internal auditing.

  • CVE-2016-5203

    A use-after-free issue was discovered in the pdfium library.

  • CVE-2016-5204

    Mariusz Mlynski discovered a cross-site scripting issue in SVG image handling.

  • CVE-2016-5205

    A cross-site scripting issue was discovered.

  • CVE-2016-5206

    Rob Wu discovered a same-origin bypass in the pdfium library.

  • CVE-2016-5207

    Mariusz Mlynski discovered a cross-site scripting issue.

  • CVE-2016-5208

    Mariusz Mlynski discovered another cross-site scripting issue.

  • CVE-2016-5209

    Giwan Go discovered an out-of-bounds write issue in Blink/Webkit.

  • CVE-2016-5210

    Ke Liu discovered an out-of-bounds write in the pdfium library.

  • CVE-2016-5211

    A use-after-free issue was discovered in the pdfium library.

  • CVE-2016-5212

    Khalil Zhani discovered an information disclosure issue in the developer tools.

  • CVE-2016-5213

    Khalil Zhani discovered a use-after-free issue in the v8 javascript library.

  • CVE-2016-5214

    Jonathan Birch discovered a file download protection bypass.

  • CVE-2016-5215

    Looben Yang discovered a use-after-free issue.

  • CVE-2016-5216

    A use-after-free issue was discovered in the pdfium library.

  • CVE-2016-5217

    Rob Wu discovered a condition where data was not validated by the pdfium library.

  • CVE-2016-5218

    Abdulrahman Alqabandi discovered a URL spoofing issue.

  • CVE-2016-5219

    Rob Wu discovered a use-after-free issue in the v8 javascript library.

  • CVE-2016-5220

    Rob Wu discovered a way to access files on the local system.

  • CVE-2016-5221

    Tim Becker discovered an integer overflow issue in the angle library.

  • CVE-2016-5222

    xisigr discovered a URL spoofing issue.

  • CVE-2016-5223

    Hwiwon Lee discovered an integer overflow issue in the pdfium library.

  • CVE-2016-5224

    Roeland Krak discovered a same-origin bypass in SVG image handling.

  • CVE-2016-5225

    Scott Helme discovered a Content Security Protection bypass.

  • CVE-2016-5226

    Jun Kokatsu discovered a cross-scripting issue.

  • CVE-2016-9650

    Jakub Żoczek discovered a Content Security Protection information disclosure.

  • CVE-2016-9651

    Guang Gong discovered a way to access private data in the v8 javascript library.

  • CVE-2016-9652

    The chrome development team found and fixed various issues during internal auditing.

For the stable distribution (jessie), these problems have been fixed in version 55.0.2883.75-1~deb8u1.

For the testing distribution (stretch), these problems will be fixed soon.

For the unstable distribution (sid), these problems have been fixed in version 55.0.2883.75-1.

We recommend that you upgrade your chromium-browser packages.