‫ Google Chrome Multiple Vulnerabilities

ID: IRCAD2015074016
Release Date: 2015-07-22
Software:
Google Chrome 43.x
Description:
Multiple vulnerabilities have been reported in Google Chrome, where multiple have an unknown impact and the others can be exploited by malicious people to conduct spoofing and cross-site scripting attacks, disclose potentially sensitive information, bypass certain security restrictions, and compromise a user's system.
1) An unspecified error in pdfium can be exploited to cause a heap-based buffer overflow.
2) Another unspecified error in pdfium can be exploited to cause a heap-based buffer overflow.
3) An error related to Settings can be exploited to execute otherwise restricted downloaded executables.
4) A use-after-free error in IndexedDB can be exploited to cause memory corruption.
5) Another unspecified error in pdfium can be exploited to cause a heap-based buffer overflow.
6) An unspecified error in skia can be exploited to cause memory corruption.
7) An unspecified error can be exploited to bypass CSP.
8) A use-after-free error in pdfium can be exploited to cause memory corruption.
9) An unspecified error in expat can be exploited to cause a heap-based buffer overflow.
10) A use-after-free error in blink can be exploited to cause memory corruption.
11) An unspecified error in blink can be exploited to conduct cross-site scripting attacks.
12) An unspecified error can be exploited to bypass the Same Origin Policy via a specially crafted CSS file.
13) An unspecified error in ICU can be exploited to trigger use of uninitialised memory.
14) A use-after-free error related to unexpected GPU process termination can be exploited to cause memory corruption.
15) A use-after-free error in the "ui::AXTree::Unserialize()" method can be exploited to cause memory corruption.
Successful exploitation of the vulnerabilities #1, #2, #4, #5, #6, #8, #9, #‫10, #‫14, and #‫15 may allow execution of arbitrary code.
16) An error related to PDF files can be exploited to spoof contents of the address bar.
17) An error in XSS auditor can be exploited to disclose unspecified information.
18) Some unspecified errors exist. No further information is currently available.
The vulnerabilities are reported in versions prior to 44.0.2403.89.
Solution
Upgrade to version 44.0.2403.89.
References:
Secunia:
 
 
 

نظرات

بدون نظر
شما برای نظر دادن باید وارد شوید

نوشته

 
تاریخ ایجاد: 10 مرداد 1394

امتیاز

امتیاز شما
تعداد امتیازها:0