{"references": ["http://googlechromereleases.blogspot.com/2016/01/stable-channel-update_20.html", "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00036.html", "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00035.html", "https://codereview.chromium.org/1564773003", "https://security.gentoo.org/glsa/201603-09", "https://pdfium.googlesource.com/pdfium/+/dcac57bc8b64fdc870d79d11a498ae7021cf8ae7", "https://code.google.com/p/chromium/issues/detail?id=572871", "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00046.html", "http://www.securityfocus.com/bid/81430", "http://rhn.redhat.com/errata/RHSA-2016-0072.html", "http://www.debian.org/security/2016/dsa-3456", "http://www.securitytracker.com/id/1034801"], "modified": "2016-12-07T13:32:56", "assessment": {"href": "", "system": "", "name": ""}, "cvelist": ["CVE-2016-1613"], "objectVersion": "1.2", "history": [], "type": "cve", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "id": "CVE-2016-1613", "viewCount": 8, "edition": 1, "scanner": [], "reporter": "NVD", "published": "2016-01-25T06:59:01", "lastseen": "2016-12-08T10:01:24", "hashmap": [{"key": "assessment", "hash": "65d5a89e1c9e4fd39cccde5dde742638"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "8e6fb0fbcc9e71f6fd4fb8f4b7efce22"}, {"key": "cvelist", "hash": "845fef42ea440021864fb64486dc6bab"}, {"key": "cvss", "hash": "737e2591b537c46d1ca7ce6f0cea5cb9"}, {"key": "description", "hash": "0d4c66b7f0acbed5380cccdf0474c468"}, {"key": "href", "hash": "abf8a3554ee4c5cc64fd7eb1521dddd0"}, {"key": "modified", "hash": "ebb61f885552c0012d5e1d98d9fc2c1b"}, {"key": "objectVersion", "hash": "56765472680401499c79732468ba4340"}, {"key": "published", "hash": "959cbdbcbdcf92e2d42d5cf069c67348"}, {"key": "references", "hash": "e9b65e724a66d9bb178e35ac69d91c46"}, {"key": "reporter", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "scanner", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "title", "hash": "370f9cc9ce4ad75bc84a7b4d3c35741e"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "cpe": ["cpe:/a:google:chrome:47.0.2526.106"], "hash": "e9a75c2f8bddad658776a539a912efff541561b7811c4b1f6dd660e17a9c7218", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1613", "bulletinFamily": "NVD", "description": "Multiple use-after-free vulnerabilities in the formfiller implementation in PDFium, as used in Google Chrome before 48.0.2564.82, allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document, related to improper tracking of the destruction of (1) IPWL_FocusHandler and (2) IPWL_Provider objects.", "title": "CVE-2016-1613", "enchantments": {"score": {"value": 6.8, "vector": "NONE", "modified": "2016-12-08T10:01:24"}, "dependencies": {"references": [{"type": "openvas", "idList": ["OPENVAS:1361412562310851169", "OPENVAS:1361412562310851172", "OPENVAS:1361412562310131200", "OPENVAS:703456", "OPENVAS:1361412562310806668", "OPENVAS:1361412562310806666", "OPENVAS:1361412562310806667", "OPENVAS:1361412562310703456", "OPENVAS:1361412562310121451"]}, {"type": "suse", "idList": ["OPENSUSE-SU-2016:0249-1", "OPENSUSE-SU-2016:0250-1", "OPENSUSE-SU-2016:0271-1"]}, {"type": "nessus", "idList": ["FREEBSD_PKG_371BBEA9383648329E70E8E928727F8C.NASL", "MACOSX_GOOGLE_CHROME_48_0_2564_82.NASL", "OPENSUSE-2016-109.NASL", "GOOGLE_CHROME_48_0_2564_82.NASL", "OPENSUSE-2016-99.NASL", "DEBIAN_DSA-3456.NASL", "REDHAT-RHSA-2016-0072.NASL", "GENTOO_GLSA-201603-09.NASL"]}, {"type": "freebsd", "idList": ["371BBEA9-3836-4832-9E70-E8E928727F8C"]}, {"type": "archlinux", "idList": ["ASA-201601-28"]}, {"type": "debian", "idList": ["DEBIAN:DSA-3456-1:35708"]}, {"type": "redhat", "idList": ["RHSA-2016:0072"]}, {"type": "kaspersky", "idList": ["KLA10745"]}, {"type": "gentoo", "idList": ["GLSA-201603-09"]}], "modified": "2016-12-08T10:01:24"}, "vulnersScore": 6.8}}

{"openvas": [{"lastseen": "2018-11-19T13:00:25", "bulletinFamily": "scanner", "description": "The remote host is missing an update for the ", "modified": "2018-11-16T00:00:00", "published": "2016-01-27T00:00:00", "id": "OPENVAS:1361412562310851169", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310851169", "title": "SuSE Update for Chromium openSUSE-SU-2016:0250-1 (Chromium)", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_suse_2016_0250_1.nasl 12381 2018-11-16 11:16:30Z cfischer $\n#\n# SuSE Update for Chromium openSUSE-SU-2016:0250-1 (Chromium)\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2016 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.851169\");\n script_version(\"$Revision: 12381 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-11-16 12:16:30 +0100 (Fri, 16 Nov 2018) $\");\n script_tag(name:\"creation_date\", value:\"2016-01-27 05:13:13 +0100 (Wed, 27 Jan 2016)\");\n script_cve_id(\"CVE-2016-1612\", \"CVE-2016-1613\", \"CVE-2016-1614\", \"CVE-2016-1615\",\n \"CVE-2016-1616\", \"CVE-2016-1617\", \"CVE-2016-1618\", \"CVE-2016-1619\",\n \"CVE-2016-1620\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"SuSE Update for Chromium openSUSE-SU-2016:0250-1 (Chromium)\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'Chromium'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"insight\", value:\"Chromium was updated to 48.0.2564.82 to fix security issues and bugs.\n\n The following vulnerabilities were fixed:\n\n - CVE-2016-1612: Bad cast in V8 (boo#963184)\n\n - CVE-2016-1613: Use-after-free in PDFium (boo#963185)\n\n - CVE-2016-1614: Information leak in Blink (boo#963186)\n\n - CVE-2016-1615: Origin confusion in Omnibox (boo#963187)\n\n - CVE-2016-1616: URL Spoofing (boo#963188)\n\n - CVE-2016-1617: History sniffing with HSTS and CSP (boo#963189)\n\n - CVE-2016-1618: Weak random number generator in Blink (boo#963190)\n\n - CVE-2016-1619: Out-of-bounds read in PDFium (boo#963191)\n\n - CVE-2016-1620 chromium-browser: various fixes (boo#963192)\n\n This update also enables SSE2 support on x86_64, VA-API hardware\n acceleration and fixes a crash when trying to enable the Chromecast\n extension.\");\n script_tag(name:\"affected\", value:\"Chromium on openSUSE 13.2\");\n script_tag(name:\"solution\", value:\"Please install the updated packages.\");\n\n script_xref(name:\"openSUSE-SU\", value:\"2016:0250_1\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2016 Greenbone Networks GmbH\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse\", \"ssh/login/rpms\", re:\"ssh/login/release=openSUSE13\\.2\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release) exit(0);\nres = \"\";\n\nif(release == \"openSUSE13.2\")\n{\n\n if ((res = isrpmvuln(pkg:\"chromedriver\", rpm:\"chromedriver~48.0.2564.82~67.1\", rls:\"openSUSE13.2\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"chromedriver-debuginfo\", rpm:\"chromedriver-debuginfo~48.0.2564.82~67.1\", rls:\"openSUSE13.2\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"chromium\", rpm:\"chromium~48.0.2564.82~67.1\", rls:\"openSUSE13.2\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"chromium-debuginfo\", rpm:\"chromium-debuginfo~48.0.2564.82~67.1\", rls:\"openSUSE13.2\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"chromium-debugsource\", rpm:\"chromium-debugsource~48.0.2564.82~67.1\", rls:\"openSUSE13.2\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"chromium-desktop-gnome\", rpm:\"chromium-desktop-gnome~48.0.2564.82~67.1\", rls:\"openSUSE13.2\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"chromium-desktop-kde\", rpm:\"chromium-desktop-kde~48.0.2564.82~67.1\", rls:\"openSUSE13.2\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"chromium-ffmpegsumo\", rpm:\"chromium-ffmpegsumo~48.0.2564.82~67.1\", rls:\"openSUSE13.2\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"chromium-ffmpegsumo-debuginfo\", rpm:\"chromium-ffmpegsumo-debuginfo~48.0.2564.82~67.1\", rls:\"openSUSE13.2\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-11-19T13:00:10", "bulletinFamily": "scanner", "description": "The remote host is missing an update for the ", "modified": "2018-11-16T00:00:00", "published": "2016-01-28T00:00:00", "id": "OPENVAS:1361412562310851172", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310851172", "title": "SuSE Update for Chromium openSUSE-SU-2016:0271-1 (Chromium)", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_suse_2016_0271_1.nasl 12381 2018-11-16 11:16:30Z cfischer $\n#\n# SuSE Update for Chromium openSUSE-SU-2016:0271-1 (Chromium)\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2016 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.851172\");\n script_version(\"$Revision: 12381 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-11-16 12:16:30 +0100 (Fri, 16 Nov 2018) $\");\n script_tag(name:\"creation_date\", value:\"2016-01-28 06:33:45 +0100 (Thu, 28 Jan 2016)\");\n script_cve_id(\"CVE-2016-1612\", \"CVE-2016-1613\", \"CVE-2016-1614\", \"CVE-2016-1615\",\n \"CVE-2016-1616\", \"CVE-2016-1617\", \"CVE-2016-1618\", \"CVE-2016-1619\",\n \"CVE-2016-1620\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"SuSE Update for Chromium openSUSE-SU-2016:0271-1 (Chromium)\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'Chromium'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"insight\", value:\"Chromium was updated to 48.0.2564.82 to fix security issues and bugs.\n\n The following vulnerabilities were fixed:\n\n - CVE-2016-1612: Bad cast in V8 (boo#963184)\n\n - CVE-2016-1613: Use-after-free in PDFium (boo#963185)\n\n - CVE-2016-1614: Information leak in Blink (boo#963186)\n\n - CVE-2016-1615: Origin confusion in Omnibox (boo#963187)\n\n - CVE-2016-1616: URL Spoofing (boo#963188)\n\n - CVE-2016-1617: History sniffing with HSTS and CSP (boo#963189)\n\n - CVE-2016-1618: Weak random number generator in Blink (boo#963190)\n\n - CVE-2016-1619: Out-of-bounds read in PDFium (boo#963191)\n\n - CVE-2016-1620 chromium-browser: various fixes (boo#963192)\n\n This update also enables SSE2 support on x86_64, VA-API hardware\n acceleration and fixes a crash when trying to enable the Chromecast\n extension.\");\n script_tag(name:\"affected\", value:\"Chromium on openSUSE 13.1\");\n script_tag(name:\"solution\", value:\"Please install the updated packages.\");\n\n script_xref(name:\"openSUSE-SU\", value:\"2016:0271_1\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2016 Greenbone Networks GmbH\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse\", \"ssh/login/rpms\", re:\"ssh/login/release=openSUSE13\\.1\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release) exit(0);\nres = \"\";\n\nif(release == \"openSUSE13.1\")\n{\n\n if ((res = isrpmvuln(pkg:\"chromedriver\", rpm:\"chromedriver~48.0.2564.82~122.1\", rls:\"openSUSE13.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"chromedriver-debuginfo\", rpm:\"chromedriver-debuginfo~48.0.2564.82~122.1\", rls:\"openSUSE13.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"chromium\", rpm:\"chromium~48.0.2564.82~122.1\", rls:\"openSUSE13.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"chromium-debuginfo\", rpm:\"chromium-debuginfo~48.0.2564.82~122.1\", rls:\"openSUSE13.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"chromium-debugsource\", rpm:\"chromium-debugsource~48.0.2564.82~122.1\", rls:\"openSUSE13.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"chromium-desktop-gnome\", rpm:\"chromium-desktop-gnome~48.0.2564.82~122.1\", rls:\"openSUSE13.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"chromium-desktop-kde\", rpm:\"chromium-desktop-kde~48.0.2564.82~122.1\", rls:\"openSUSE13.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"chromium-ffmpegsumo\", rpm:\"chromium-ffmpegsumo~48.0.2564.82~122.1\", rls:\"openSUSE13.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"chromium-ffmpegsumo-debuginfo\", rpm:\"chromium-ffmpegsumo-debuginfo~48.0.2564.82~122.1\", rls:\"openSUSE13.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-10-01T10:26:05", "bulletinFamily": "scanner", "description": "Mageia Linux Local Security Checks mgasa-2016-0042", "modified": "2018-09-28T00:00:00", "published": "2016-02-02T00:00:00", "id": "OPENVAS:1361412562310131200", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310131200", "title": "Mageia Linux Local Check: mgasa-2016-0042", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: mgasa-2016-0042.nasl 11692 2018-09-28 16:55:19Z cfischer $\n#\n# Mageia Linux security check\n#\n# Authors:\n# Eero Volotinen <eero.volotinen@solinor.com>\n#\n# Copyright:\n# Copyright (c) 2015 Eero Volotinen, http://www.solinor.com\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.131200\");\n script_version(\"$Revision: 11692 $\");\n script_tag(name:\"creation_date\", value:\"2016-02-02 07:44:17 +0200 (Tue, 02 Feb 2016)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-09-28 18:55:19 +0200 (Fri, 28 Sep 2018) $\");\n script_name(\"Mageia Linux Local Check: mgasa-2016-0042\");\n script_tag(name:\"solution\", value:\"Update the affected packages to the latest available version.\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name:\"URL\", value:\"https://advisories.mageia.org/MGASA-2016-0042.html\");\n script_cve_id(\"CVE-2016-1612\", \"CVE-2016-1613\", \"CVE-2016-1614\", \"CVE-2016-1615\", \"CVE-2016-1616\", \"CVE-2016-1617\", \"CVE-2016-1618\", \"CVE-2016-1619\", \"CVE-2016-1620\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mageia_linux\", \"ssh/login/release\", re:\"ssh/login/release=MAGEIA5\");\n script_category(ACT_GATHER_INFO);\n script_tag(name:\"summary\", value:\"Mageia Linux Local Security Checks mgasa-2016-0042\");\n script_copyright(\"Eero Volotinen\");\n script_family(\"Mageia Linux Local Security Checks\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release) exit(0);\n\nres = \"\";\n\nif(release == \"MAGEIA5\")\n{\nif ((res = isrpmvuln(pkg:\"chromium-browser-stable\", rpm:\"chromium-browser-stable~48.0.2564.97~1.mga5\", rls:\"MAGEIA5\")) != NULL) {\n security_message(data:res);\n exit(0);\n}\nif (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-07-24T12:55:11", "bulletinFamily": "scanner", "description": "Several vulnerabilities were\ndiscovered in the chromium web browser.\n\nCVE-2015-6792\nAn issue was found in the handling of MIDI files.\n\nCVE-2016-1612\ncloudfuzzer discovered a logic error related to receiver\ncompatibility in the v8 javascript library.\n\nCVE-2016-1613\nA use-after-free issue was discovered in the pdfium library.\n\nCVE-2016-1614\nChristoph Diehl discovered an information leak in Webkit/Blink.\n\nCVE-2016-1615\nRon Masas discovered a way to spoof URLs.\n\nCVE-2016-1616\nLuan Herrera discovered a way to spoof URLs.\n\nCVE-2016-1617\njenuis discovered a way to discover whether an HSTS web site had\nbeen visited.\n\nCVE-2016-1618\nAaron Toponce discovered the use of weak random number\ngenerator.\n\nCVE-2016-1619\nKeve Nagy discovered an out-of-bounds-read issue in the pdfium\nlibrary.\n\nCVE-2016-1620\nThe chrome 48 development team found and fixed various issues\nduring internal auditing. Also multiple issues were fixed in\nthe v8 javascript library, version 4.7.271.17.", "modified": "2017-07-07T00:00:00", "published": "2016-01-27T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=703456", "id": "OPENVAS:703456", "title": "Debian Security Advisory DSA 3456-1 (chromium-browser - security update)", "type": "openvas", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_3456.nasl 6608 2017-07-07 12:05:05Z cfischer $\n# Auto-generated from advisory DSA 3456-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2016 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\n\nif(description)\n{\n script_id(703456);\n script_version(\"$Revision: 6608 $\");\n script_cve_id(\"CVE-2015-6792\", \"CVE-2016-1612\", \"CVE-2016-1613\", \"CVE-2016-1614\",\n \"CVE-2016-1615\", \"CVE-2016-1616\", \"CVE-2016-1617\", \"CVE-2016-1618\",\n \"CVE-2016-1619\", \"CVE-2016-1620\");\n script_name(\"Debian Security Advisory DSA 3456-1 (chromium-browser - security update)\");\n script_tag(name: \"last_modification\", value: \"$Date: 2017-07-07 14:05:05 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name: \"creation_date\", value: \"2016-01-27 00:00:00 +0100 (Wed, 27 Jan 2016)\");\n script_tag(name: \"cvss_base\", value: \"10.0\");\n script_tag(name: \"cvss_base_vector\", value: \"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name: \"solution_type\", value: \"VendorFix\");\n script_tag(name: \"qod_type\", value: \"package\");\n\n script_xref(name: \"URL\", value: \"http://www.debian.org/security/2016/dsa-3456.html\");\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2016 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name: \"affected\", value: \"chromium-browser on Debian Linux\");\n script_tag(name: \"solution\", value: \"For the stable distribution (jessie),\nthese problems have been fixed in version 48.0.2564.82-1~deb8u1.\n\nFor the testing distribution (stretch), these problems will be fixed soon.\n\nFor the unstable distribution (sid), these problems have been fixed in\nversion 48.0.2564.82-1.\n\nWe recommend that you upgrade your chromium-browser packages.\");\n script_tag(name: \"summary\", value: \"Several vulnerabilities were\ndiscovered in the chromium web browser.\n\nCVE-2015-6792\nAn issue was found in the handling of MIDI files.\n\nCVE-2016-1612\ncloudfuzzer discovered a logic error related to receiver\ncompatibility in the v8 javascript library.\n\nCVE-2016-1613\nA use-after-free issue was discovered in the pdfium library.\n\nCVE-2016-1614\nChristoph Diehl discovered an information leak in Webkit/Blink.\n\nCVE-2016-1615\nRon Masas discovered a way to spoof URLs.\n\nCVE-2016-1616\nLuan Herrera discovered a way to spoof URLs.\n\nCVE-2016-1617\njenuis discovered a way to discover whether an HSTS web site had\nbeen visited.\n\nCVE-2016-1618\nAaron Toponce discovered the use of weak random number\ngenerator.\n\nCVE-2016-1619\nKeve Nagy discovered an out-of-bounds-read issue in the pdfium\nlibrary.\n\nCVE-2016-1620\nThe chrome 48 development team found and fixed various issues\nduring internal auditing. Also multiple issues were fixed in\nthe v8 javascript library, version 4.7.271.17.\");\n script_tag(name: \"vuldetect\", value: \"This check tests the installed\nsoftware version using the apt package manager.\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"chromedriver\", ver:\"48.0.2564.82-1~deb8u1\", rls_regex:\"DEB8.[0-9]+\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"chromium\", ver:\"48.0.2564.82-1~deb8u1\", rls_regex:\"DEB8.[0-9]+\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"chromium-dbg\", ver:\"48.0.2564.82-1~deb8u1\", rls_regex:\"DEB8.[0-9]+\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"chromium-inspector\", ver:\"48.0.2564.82-1~deb8u1\", rls_regex:\"DEB8.[0-9]+\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"chromium-l10n\", ver:\"48.0.2564.82-1~deb8u1\", rls_regex:\"DEB8.[0-9]+\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-10-22T16:36:46", "bulletinFamily": "scanner", "description": "The host is installed with Google Chrome\n and is prone to multiple vulnerabilities.", "modified": "2018-10-18T00:00:00", "published": "2016-01-22T00:00:00", "id": "OPENVAS:1361412562310806666", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310806666", "title": "Google Chrome Multiple Vulnerabilities-02 Jan16 (Windows)", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_google_chrome_mult_vuln02_jan16_win.nasl 11969 2018-10-18 14:53:42Z asteins $\n#\n# Google Chrome Multiple Vulnerabilities-02 Jan16 (Windows)\n#\n# Authors:\n# Shakeel <bshakeel@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2016 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:google:chrome\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.806666\");\n script_version(\"$Revision: 11969 $\");\n script_cve_id(\"CVE-2016-1612\", \"CVE-2016-1613\", \"CVE-2016-1614\", \"CVE-2016-1615\",\n \"CVE-2016-1616\", \"CVE-2016-1617\", \"CVE-2016-1618\", \"CVE-2016-1619\",\n \"CVE-2016-1620\", \"CVE-2016-2051\", \"CVE-2016-2052\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-10-18 16:53:42 +0200 (Thu, 18 Oct 2018) $\");\n script_tag(name:\"creation_date\", value:\"2016-01-22 14:46:18 +0530 (Fri, 22 Jan 2016)\");\n script_name(\"Google Chrome Multiple Vulnerabilities-02 Jan16 (Windows)\");\n\n script_tag(name:\"summary\", value:\"The host is installed with Google Chrome\n and is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exist due to,\n\n - Bad cast in V8.\n\n - Use-after-free error in PDFium.\n\n - Information leak error in Blink.\n\n - Origin confusion error in Omnibox.\n\n - URL Spoofing.\n\n - History sniffing with HSTS and CSP.\n\n - Weak random number generator in Blink.\n\n - Out-of-bounds read in PDFium.\n\n - Multiple Other Vulnerabilities.\n\n - Other Unspecified Vulnerabilities.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation would allow a remote\n attacker to conduct URL spoofing attacks, bypass certain security restrictions,\n gain access to sensitive information, cause a denial of service condition or\n possibly have unspecified other impact.\");\n\n script_tag(name:\"affected\", value:\"Google Chrome versions prior to 48.0.2564.82\n on Windows.\");\n\n script_tag(name:\"solution\", value:\"Upgrade to Google Chrome version\n 48.0.2564.82 or later.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_tag(name:\"qod_type\", value:\"registry\");\n\n script_xref(name:\"URL\", value:\"http://googlechromereleases.blogspot.in/2016/01/stable-channel-update_20.html\");\n\n script_copyright(\"Copyright (C) 2016 Greenbone Networks GmbH\");\n script_category(ACT_GATHER_INFO);\n script_family(\"General\");\n script_dependencies(\"gb_google_chrome_detect_portable_win.nasl\");\n script_mandatory_keys(\"GoogleChrome/Win/Ver\");\n script_xref(name:\"URL\", value:\"http://www.google.com/chrome\");\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nif(!chromeVer = get_app_version(cpe:CPE)){\n exit(0);\n}\n\nif(version_is_less(version:chromeVer, test_version:\"48.0.2564.82\"))\n{\n report = 'Installed version: ' + chromeVer + '\\n' +\n 'Fixed version: 48.0.2564.82' + '\\n';\n security_message(data:report);\n exit(0);\n}\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-10-22T16:36:56", "bulletinFamily": "scanner", "description": "The host is installed with Google Chrome\n and is prone to multiple vulnerabilities.", "modified": "2018-10-18T00:00:00", "published": "2016-01-22T00:00:00", "id": "OPENVAS:1361412562310806668", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310806668", "title": "Google Chrome Multiple Vulnerabilities-02 Jan16 (Linux)", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_google_chrome_mult_vuln02_jan16_lin.nasl 11969 2018-10-18 14:53:42Z asteins $\n#\n# Google Chrome Multiple Vulnerabilities-02 Jan16 (Linux)\n#\n# Authors:\n# Shakeel <bshakeel@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2016 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:google:chrome\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.806668\");\n script_version(\"$Revision: 11969 $\");\n script_cve_id(\"CVE-2016-1612\", \"CVE-2016-1613\", \"CVE-2016-1614\", \"CVE-2016-1615\",\n \"CVE-2016-1616\", \"CVE-2016-1617\", \"CVE-2016-1618\", \"CVE-2016-1619\",\n \"CVE-2016-1620\", \"CVE-2016-2051\", \"CVE-2016-2052\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-10-18 16:53:42 +0200 (Thu, 18 Oct 2018) $\");\n script_tag(name:\"creation_date\", value:\"2016-01-22 14:59:52 +0530 (Fri, 22 Jan 2016)\");\n script_name(\"Google Chrome Multiple Vulnerabilities-02 Jan16 (Linux)\");\n\n script_tag(name:\"summary\", value:\"The host is installed with Google Chrome\n and is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exist due to,\n\n - Bad cast in V8.\n\n - Use-after-free error in PDFium.\n\n - Information leak error in Blink.\n\n - Origin confusion error in Omnibox.\n\n - URL Spoofing.\n\n - History sniffing with HSTS and CSP.\n\n - Weak random number generator in Blink.\n\n - Out-of-bounds read in PDFium.\n\n - Multiple Other Vulnerabilities.\n\n - Other Unspecified Vulnerabilities.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation would allow a remote\n attacker to conduct URL spoofing attacks, bypass certain security restrictions,\n gain access to sensitive information, cause a denial of service condition or\n possibly have unspecified other impact.\");\n\n script_tag(name:\"affected\", value:\"Google Chrome versions prior to 48.0.2564.82\n on Linux.\");\n\n script_tag(name:\"solution\", value:\"Upgrade to Google Chrome version\n 48.0.2564.82 or later.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_tag(name:\"qod_type\", value:\"executable_version\");\n\n script_xref(name:\"URL\", value:\"http://googlechromereleases.blogspot.in/2016/01/stable-channel-update_20.html\");\n\n script_copyright(\"Copyright (C) 2016 Greenbone Networks GmbH\");\n script_category(ACT_GATHER_INFO);\n script_family(\"General\");\n script_dependencies(\"gb_google_chrome_detect_lin.nasl\");\n script_mandatory_keys(\"Google-Chrome/Linux/Ver\");\n script_xref(name:\"URL\", value:\"http://www.google.com/chrome\");\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nif(!chromeVer = get_app_version(cpe:CPE)){\n exit(0);\n}\n\nif(version_is_less(version:chromeVer, test_version:\"48.0.2564.82\"))\n{\n report = 'Installed version: ' + chromeVer + '\\n' +\n 'Fixed version: 48.0.2564.82' + '\\n';\n security_message(data:report);\n exit(0);\n}\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-10-22T16:37:29", "bulletinFamily": "scanner", "description": "The host is installed with Google Chrome\n and is prone to multiple vulnerabilities.", "modified": "2018-10-18T00:00:00", "published": "2016-01-22T00:00:00", "id": "OPENVAS:1361412562310806667", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310806667", "title": "Google Chrome Multiple Vulnerabilities-02 Jan16 (Mac OS X)", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_google_chrome_mult_vuln02_jan16_macosx.nasl 11969 2018-10-18 14:53:42Z asteins $\n#\n# Google Chrome Multiple Vulnerabilities-02 Jan16 (Mac OS X)\n#\n# Authors:\n# Shakeel <bshakeel@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2016 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:google:chrome\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.806667\");\n script_version(\"$Revision: 11969 $\");\n script_cve_id(\"CVE-2016-1612\", \"CVE-2016-1613\", \"CVE-2016-1614\", \"CVE-2016-1615\",\n \"CVE-2016-1616\", \"CVE-2016-1617\", \"CVE-2016-1618\", \"CVE-2016-1619\",\n \"CVE-2016-1620\", \"CVE-2016-2051\", \"CVE-2016-2052\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-10-18 16:53:42 +0200 (Thu, 18 Oct 2018) $\");\n script_tag(name:\"creation_date\", value:\"2016-01-22 14:58:05 +0530 (Fri, 22 Jan 2016)\");\n script_name(\"Google Chrome Multiple Vulnerabilities-02 Jan16 (Mac OS X)\");\n\n script_tag(name:\"summary\", value:\"The host is installed with Google Chrome\n and is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exist due to,\n\n - Bad cast in V8.\n\n - Use-after-free error in PDFium.\n\n - Information leak error in Blink.\n\n - Origin confusion error in Omnibox.\n\n - URL Spoofing.\n\n - History sniffing with HSTS and CSP.\n\n - Weak random number generator in Blink.\n\n - Out-of-bounds read in PDFium.\n\n - Multiple Other Vulnerabilities.\n\n - Other Unspecified Vulnerabilities.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation would allow a remote\n attacker to conduct URL spoofing attacks, bypass certain security restrictions,\n gain access to sensitive information, cause a denial of service condition or\n possibly have unspecified other impact.\");\n\n script_tag(name:\"affected\", value:\"Google Chrome versions prior to 48.0.2564.82\n on Mac OS X.\");\n\n script_tag(name:\"solution\", value:\"Upgrade to Google Chrome version\n 48.0.2564.82 or later.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_tag(name:\"qod_type\", value:\"executable_version\");\n\n script_xref(name:\"URL\", value:\"http://googlechromereleases.blogspot.in/2016/01/stable-channel-update_20.html\");\n\n script_copyright(\"Copyright (C) 2016 Greenbone Networks GmbH\");\n script_category(ACT_GATHER_INFO);\n script_family(\"General\");\n script_dependencies(\"gb_google_chrome_detect_macosx.nasl\");\n script_mandatory_keys(\"GoogleChrome/MacOSX/Version\");\n script_xref(name:\"URL\", value:\"http://www.google.com/chrome\");\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nif(!chromeVer = get_app_version(cpe:CPE)){\n exit(0);\n}\n\nif(version_is_less(version:chromeVer, test_version:\"48.0.2564.82\"))\n{\n report = 'Installed version: ' + chromeVer + '\\n' +\n 'Fixed version: 48.0.2564.82' + '\\n';\n security_message(data:report);\n exit(0);\n}\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-09-01T23:47:32", "bulletinFamily": "scanner", "description": "Several vulnerabilities were\ndiscovered in the chromium web browser.\n\nCVE-2015-6792\nAn issue was found in the handling of MIDI files.\n\nCVE-2016-1612\ncloudfuzzer discovered a logic error related to receiver\ncompatibility in the v8 javascript library.\n\nCVE-2016-1613\nA use-after-free issue was discovered in the pdfium library.\n\nCVE-2016-1614\nChristoph Diehl discovered an information leak in Webkit/Blink.\n\nCVE-2016-1615\nRon Masas discovered a way to spoof URLs.\n\nCVE-2016-1616\nLuan Herrera discovered a way to spoof URLs.\n\nCVE-2016-1617\njenuis discovered a way to discover whether an HSTS web site had\nbeen visited.\n\nCVE-2016-1618\nAaron Toponce discovered the use of weak random number\ngenerator.\n\nCVE-2016-1619\nKeve Nagy discovered an out-of-bounds-read issue in the pdfium\nlibrary.\n\nCVE-2016-1620\nThe chrome 48 development team found and fixed various issues\nduring internal auditing. Also multiple issues were fixed in\nthe v8 javascript library, version 4.7.271.17.", "modified": "2017-12-15T00:00:00", "published": "2016-01-27T00:00:00", "id": "OPENVAS:1361412562310703456", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310703456", "title": "Debian Security Advisory DSA 3456-1 (chromium-browser - security update)", "type": "openvas", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_3456.nasl 8131 2017-12-15 07:30:28Z teissa $\n# Auto-generated from advisory DSA 3456-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2016 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.703456\");\n script_version(\"$Revision: 8131 $\");\n script_cve_id(\"CVE-2015-6792\", \"CVE-2016-1612\", \"CVE-2016-1613\", \"CVE-2016-1614\",\n \"CVE-2016-1615\", \"CVE-2016-1616\", \"CVE-2016-1617\", \"CVE-2016-1618\",\n \"CVE-2016-1619\", \"CVE-2016-1620\");\n script_name(\"Debian Security Advisory DSA 3456-1 (chromium-browser - security update)\");\n script_tag(name: \"last_modification\", value: \"$Date: 2017-12-15 08:30:28 +0100 (Fri, 15 Dec 2017) $\");\n script_tag(name: \"creation_date\", value: \"2016-01-27 00:00:00 +0100 (Wed, 27 Jan 2016)\");\n script_tag(name: \"cvss_base\", value: \"10.0\");\n script_tag(name: \"cvss_base_vector\", value: \"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name: \"solution_type\", value: \"VendorFix\");\n script_tag(name: \"qod_type\", value: \"package\");\n\n script_xref(name: \"URL\", value: \"http://www.debian.org/security/2016/dsa-3456.html\");\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2016 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name: \"affected\", value: \"chromium-browser on Debian Linux\");\n script_tag(name: \"solution\", value: \"For the stable distribution (jessie),\nthese problems have been fixed in version 48.0.2564.82-1~deb8u1.\n\nFor the testing distribution (stretch), these problems will be fixed soon.\n\nFor the unstable distribution (sid), these problems have been fixed in\nversion 48.0.2564.82-1.\n\nWe recommend that you upgrade your chromium-browser packages.\");\n script_tag(name: \"summary\", value: \"Several vulnerabilities were\ndiscovered in the chromium web browser.\n\nCVE-2015-6792\nAn issue was found in the handling of MIDI files.\n\nCVE-2016-1612\ncloudfuzzer discovered a logic error related to receiver\ncompatibility in the v8 javascript library.\n\nCVE-2016-1613\nA use-after-free issue was discovered in the pdfium library.\n\nCVE-2016-1614\nChristoph Diehl discovered an information leak in Webkit/Blink.\n\nCVE-2016-1615\nRon Masas discovered a way to spoof URLs.\n\nCVE-2016-1616\nLuan Herrera discovered a way to spoof URLs.\n\nCVE-2016-1617\njenuis discovered a way to discover whether an HSTS web site had\nbeen visited.\n\nCVE-2016-1618\nAaron Toponce discovered the use of weak random number\ngenerator.\n\nCVE-2016-1619\nKeve Nagy discovered an out-of-bounds-read issue in the pdfium\nlibrary.\n\nCVE-2016-1620\nThe chrome 48 development team found and fixed various issues\nduring internal auditing. Also multiple issues were fixed in\nthe v8 javascript library, version 4.7.271.17.\");\n script_tag(name: \"vuldetect\", value: \"This check tests the installed\nsoftware version using the apt package manager.\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"chromedriver\", ver:\"48.0.2564.82-1~deb8u1\", rls_regex:\"DEB8.[0-9]+\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"chromium\", ver:\"48.0.2564.82-1~deb8u1\", rls_regex:\"DEB8.[0-9]+\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"chromium-dbg\", ver:\"48.0.2564.82-1~deb8u1\", rls_regex:\"DEB8.[0-9]+\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"chromium-inspector\", ver:\"48.0.2564.82-1~deb8u1\", rls_regex:\"DEB8.[0-9]+\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"chromium-l10n\", ver:\"48.0.2564.82-1~deb8u1\", rls_regex:\"DEB8.[0-9]+\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-10-12T12:38:39", "bulletinFamily": "scanner", "description": "Gentoo Linux Local Security Checks", "modified": "2018-10-12T00:00:00", "published": "2016-03-14T00:00:00", "id": "OPENVAS:1361412562310121451", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310121451", "title": "Gentoo Security Advisory GLSA 201603-09", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: glsa-201603-09.nasl 11856 2018-10-12 07:45:29Z cfischer $\n#\n# Gentoo Linux security check\n#\n# Authors:\n# Eero Volotinen <eero.volotinen@solinor.fi>\n#\n# Copyright:\n# Copyright (c) 2016 Eero Volotinen, http://solinor.com\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.121451\");\n script_version(\"$Revision: 11856 $\");\n script_tag(name:\"creation_date\", value:\"2016-03-14 15:52:45 +0200 (Mon, 14 Mar 2016)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-10-12 09:45:29 +0200 (Fri, 12 Oct 2018) $\");\n script_name(\"Gentoo Security Advisory GLSA 201603-09\");\n script_tag(name:\"insight\", value:\"Multiple vulnerabilities have been discovered in the Chromium web browser. Please review the CVE identifiers referenced below for details.\");\n script_tag(name:\"solution\", value:\"Update the affected packages to the latest available version.\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name:\"URL\", value:\"https://security.gentoo.org/glsa/201603-09\");\n script_cve_id(\"CVE-2015-1270\", \"CVE-2015-1271\", \"CVE-2015-1272\", \"CVE-2015-1273\", \"CVE-2015-1274\", \"CVE-2015-1275\", \"CVE-2015-1276\", \"CVE-2015-1277\", \"CVE-2015-1278\", \"CVE-2015-1279\", \"CVE-2015-1280\", \"CVE-2015-1281\", \"CVE-2015-1282\", \"CVE-2015-1283\", \"CVE-2015-1284\", \"CVE-2015-1285\", \"CVE-2015-1286\", \"CVE-2015-1287\", \"CVE-2015-1288\", \"CVE-2015-1289\", \"CVE-2015-1291\", \"CVE-2015-1292\", \"CVE-2015-1293\", \"CVE-2015-1294\", \"CVE-2015-1295\", \"CVE-2015-1296\", \"CVE-2015-1297\", \"CVE-2015-1298\", \"CVE-2015-1299\", \"CVE-2015-1300\", \"CVE-2015-1302\", \"CVE-2015-1303\", \"CVE-2015-1304\", \"CVE-2015-6755\", \"CVE-2015-6756\", \"CVE-2015-6757\", \"CVE-2015-6758\", \"CVE-2015-6759\", \"CVE-2015-6760\", \"CVE-2015-6761\", \"CVE-2015-6762\", \"CVE-2015-6763\", \"CVE-2015-6764\", \"CVE-2015-6765\", \"CVE-2015-6766\", \"CVE-2015-6767\", \"CVE-2015-6768\", \"CVE-2015-6769\", \"CVE-2015-6770\", \"CVE-2015-6771\", \"CVE-2015-6772\", \"CVE-2015-6773\", \"CVE-2015-6774\", \"CVE-2015-6775\", \"CVE-2015-6776\", \"CVE-2015-6777\", \"CVE-2015-6778\", \"CVE-2015-6779\", \"CVE-2015-6780\", \"CVE-2015-6781\", \"CVE-2015-6782\", \"CVE-2015-6783\", \"CVE-2015-6784\", \"CVE-2015-6785\", \"CVE-2015-6786\", \"CVE-2015-6787\", \"CVE-2015-6788\", \"CVE-2015-6789\", \"CVE-2015-6790\", \"CVE-2015-6791\", \"CVE-2015-6792\", \"CVE-2015-8126\", \"CVE-2016-1612\", \"CVE-2016-1613\", \"CVE-2016-1614\", \"CVE-2016-1615\", \"CVE-2016-1616\", \"CVE-2016-1617\", \"CVE-2016-1618\", \"CVE-2016-1619\", \"CVE-2016-1620\", \"CVE-2016-1621\", \"CVE-2016-1622\", \"CVE-2016-1623\", \"CVE-2016-1624\", \"CVE-2016-1625\", \"CVE-2016-1626\", \"CVE-2016-1627\", \"CVE-2016-1628\", \"CVE-2016-1629\", \"CVE-2016-1630\", \"CVE-2016-1631\", \"CVE-2016-1632\", \"CVE-2016-1633\", \"CVE-2016-1634\", \"CVE-2016-1635\", \"CVE-2016-1636\", \"CVE-2016-1637\", \"CVE-2016-1638\", \"CVE-2016-1639\", \"CVE-2016-1640\", \"CVE-2016-1641\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/gentoo\", \"ssh/login/pkg\");\n script_category(ACT_GATHER_INFO);\n script_tag(name:\"summary\", value:\"Gentoo Linux Local Security Checks\");\n script_copyright(\"Eero Volotinen\");\n script_family(\"Gentoo Local Security Checks\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-gentoo.inc\");\n\nres = \"\";\nreport = \"\";\n\nif((res=ispkgvuln(pkg:\"www-client/chromium\", unaffected: make_list(\"ge 49.0.2623.87\"), vulnerable: make_list(\"lt 49.0.2623.87\"))) != NULL) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99);\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "freebsd": [{"lastseen": "2018-08-31T01:14:25", "bulletinFamily": "unix", "description": "\nGoogle Chrome Releases reports:\n\nThis update includes 37 security fixes, including:\n\n[497632] High CVE-2016-1612: Bad cast in V8.\n[572871] High CVE-2016-1613: Use-after-free in PDFium.\n[544691] Medium CVE-2016-1614: Information leak in Blink.\n[468179] Medium CVE-2016-1615: Origin confusion in Omnibox.\n[541415] Medium CVE-2016-1616: URL Spoofing.\n[544765] Medium CVE-2016-1617: History sniffing with HSTS and\n\t CSP.\n[552749] Medium CVE-2016-1618: Weak random number generator in\n\t Blink.\n[557223] Medium CVE-2016-1619: Out-of-bounds read in\n\t PDFium.\n[579625] CVE-2016-1620: Various fixes from internal audits,\n\t fuzzing and other initiatives.\nMultiple vulnerabilities in V8 fixed at the tip of the 4.8\n\t branch.\n\n\n", "modified": "2016-01-20T00:00:00", "published": "2016-01-20T00:00:00", "id": "371BBEA9-3836-4832-9E70-E8E928727F8C", "href": "https://vuxml.freebsd.org/freebsd/371bbea9-3836-4832-9e70-e8e928727f8c.html", "title": "chromium -- multiple vulnerabilities", "type": "freebsd", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "nessus": [{"lastseen": "2019-01-16T20:23:09", "bulletinFamily": "scanner", "description": "The version of Google Chrome installed on the remote Mac OS X host is\nprior to 48.0.2564.82. It is, therefore, affected by multiple\nvulnerabilities :\n\n - A unspecified vulnerability exists in Google V8 when\n handling compatible receiver checks hidden behind\n receptors. An attacker can exploit this to have an\n unspecified impact. No other details are available.\n (CVE-2016-1612)\n\n - A user-after-free error exists in PDFium due to improper\n invalidation of IPWL_FocusHandler and IPWL_Provider upon\n destruction. An attacker can exploit this to deference\n already freed memory, resulting in the execution of\n arbitrary code. (CVE-2016-1613)\n\n - An unspecified vulnerability exists in Blink that is\n related to the handling of bitmaps. An attacker can\n exploit this to access sensitive information. No other\n details are available. (CVE-2016-1614)\n\n - An unspecified vulnerability exists in omnibox that is\n related to origin confusion. An attacker can exploit\n this to have an unspecified impact. No other details are\n available. (CVE-2016-1615)\n\n - An unspecified vulnerability exists that allows an\n attacker to spoof a displayed URL. No other details are\n available. (CVE-2016-1616)\n\n - An unspecified vulnerability exists that is related to\n history sniffing with HSTS and CSP. No other details\n are available. (CVE-2016-1617)\n\n - A flaw exists in Blink due to the weak generation of\n random numbers by the ARC4-based random number\n generator. An attacker can exploit this to gain\n access to sensitive information. No other details are\n available. (CVE-2016-1618)\n\n - A out-of-bounds read error exists in PDFium in file\n fx_codec_jpx_opj.cpp in the sycc4{22,44}_to_rgb()\n functions. An attacker can exploit this to cause a\n denial of service by crashing the application linked\n using the library. (CVE-2016-1619)\n\n - Multiple vulnerabilities exist, the most serious of\n which allow an attacker to execute arbitrary code via a\n crafted web page. (CVE-2016-1620)", "modified": "2018-07-14T00:00:00", "published": "2016-01-22T00:00:00", "id": "MACOSX_GOOGLE_CHROME_48_0_2564_82.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=88089", "title": "Google Chrome < 48.0.2564.82 Multiple Vulnerabilities (Mac OS X)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(88089);\n script_version(\"1.9\");\n script_cvs_date(\"Date: 2018/07/14 1:59:36\");\n\n script_cve_id(\n \"CVE-2016-1612\",\n \"CVE-2016-1613\",\n \"CVE-2016-1614\",\n \"CVE-2016-1615\",\n \"CVE-2016-1616\",\n \"CVE-2016-1617\",\n \"CVE-2016-1618\",\n \"CVE-2016-1619\",\n \"CVE-2016-1620\"\n );\n\n script_name(english:\"Google Chrome < 48.0.2564.82 Multiple Vulnerabilities (Mac OS X)\");\n script_summary(english:\"Checks the version number of Google Chrome.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Mac OS X host contains a web browser that is affected by\nmultiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of Google Chrome installed on the remote Mac OS X host is\nprior to 48.0.2564.82. It is, therefore, affected by multiple\nvulnerabilities :\n\n - A unspecified vulnerability exists in Google V8 when\n handling compatible receiver checks hidden behind\n receptors. An attacker can exploit this to have an\n unspecified impact. No other details are available.\n (CVE-2016-1612)\n\n - A user-after-free error exists in PDFium due to improper\n invalidation of IPWL_FocusHandler and IPWL_Provider upon\n destruction. An attacker can exploit this to deference\n already freed memory, resulting in the execution of\n arbitrary code. (CVE-2016-1613)\n\n - An unspecified vulnerability exists in Blink that is\n related to the handling of bitmaps. An attacker can\n exploit this to access sensitive information. No other\n details are available. (CVE-2016-1614)\n\n - An unspecified vulnerability exists in omnibox that is\n related to origin confusion. An attacker can exploit\n this to have an unspecified impact. No other details are\n available. (CVE-2016-1615)\n\n - An unspecified vulnerability exists that allows an\n attacker to spoof a displayed URL. No other details are\n available. (CVE-2016-1616)\n\n - An unspecified vulnerability exists that is related to\n history sniffing with HSTS and CSP. No other details\n are available. (CVE-2016-1617)\n\n - A flaw exists in Blink due to the weak generation of\n random numbers by the ARC4-based random number\n generator. An attacker can exploit this to gain\n access to sensitive information. No other details are\n available. (CVE-2016-1618)\n\n - A out-of-bounds read error exists in PDFium in file\n fx_codec_jpx_opj.cpp in the sycc4{22,44}_to_rgb()\n functions. An attacker can exploit this to cause a\n denial of service by crashing the application linked\n using the library. (CVE-2016-1619)\n\n - Multiple vulnerabilities exist, the most serious of\n which allow an attacker to execute arbitrary code via a\n crafted web page. (CVE-2016-1620)\");\n # http://googlechromereleases.blogspot.com/2016/01/stable-channel-update_20.html\n script_set_attribute(attribute:\"see_also\",value:\"http://www.nessus.org/u?7f4ae8d4\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to Google Chrome version 48.0.2564.82 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2015/10/29\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/01/20\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/01/22\");\n\n script_set_attribute(attribute:\"plugin_type\",value:\"local\");\n script_set_attribute(attribute:\"cpe\",value:\"cpe:/a:google:chrome\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"MacOS X Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2016-2018 Tenable Network Security, Inc.\");\n\n script_dependencies(\"macosx_google_chrome_installed.nbin\");\n script_require_keys(\"MacOSX/Google Chrome/Installed\");\n\n exit(0);\n}\n\ninclude(\"google_chrome_version.inc\");\n\nget_kb_item_or_exit(\"MacOSX/Google Chrome/Installed\");\n\ngoogle_chrome_check_version(fix:'48.0.2564.82', severity:SECURITY_HOLE);\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2019-01-16T20:23:08", "bulletinFamily": "scanner", "description": "Google Chrome Releases reports :\n\nThis update includes 37 security fixes, including :\n\n- [497632] High CVE-2016-1612: Bad cast in V8.\n\n- [572871] High CVE-2016-1613: Use-after-free in PDFium.\n\n- [544691] Medium CVE-2016-1614: Information leak in Blink.\n\n- [468179] Medium CVE-2016-1615: Origin confusion in Omnibox.\n\n- [541415] Medium CVE-2016-1616: URL Spoofing.\n\n- [544765] Medium CVE-2016-1617: History sniffing with HSTS and CSP.\n\n- [552749] Medium CVE-2016-1618: Weak random number generator in\nBlink.\n\n- [557223] Medium CVE-2016-1619: Out-of-bounds read in PDFium.\n\n- [579625] CVE-2016-1620: Various fixes from internal audits, fuzzing\nand other initiatives.\n\n- Multiple vulnerabilities in V8 fixed at the tip of the 4.8 branch.", "modified": "2018-11-10T00:00:00", "published": "2016-01-22T00:00:00", "id": "FREEBSD_PKG_371BBEA9383648329E70E8E928727F8C.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=88067", "title": "FreeBSD : chromium -- multiple vulnerabilities (371bbea9-3836-4832-9e70-e8e928727f8c)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the FreeBSD VuXML database :\n#\n# Copyright 2003-2018 Jacques Vidrine and contributors\n#\n# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,\n# HTML, PDF, PostScript, RTF and so forth) with or without modification,\n# are permitted provided that the following conditions are met:\n# 1. Redistributions of source code (VuXML) must retain the above\n# copyright notice, this list of conditions and the following\n# disclaimer as the first lines of this file unmodified.\n# 2. Redistributions in compiled form (transformed to other DTDs,\n# published online in any format, converted to PDF, PostScript,\n# RTF and other formats) must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer\n# in the documentation and/or other materials provided with the\n# distribution.\n# \n# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \"AS IS\"\n# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,\n# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS\n# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,\n# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\n# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\n# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\n# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,\n# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(88067);\n script_version(\"2.7\");\n script_cvs_date(\"Date: 2018/11/10 11:49:45\");\n\n script_cve_id(\"CVE-2016-1612\", \"CVE-2016-1613\", \"CVE-2016-1614\", \"CVE-2016-1615\", \"CVE-2016-1616\", \"CVE-2016-1617\", \"CVE-2016-1618\", \"CVE-2016-1619\", \"CVE-2016-1620\");\n\n script_name(english:\"FreeBSD : chromium -- multiple vulnerabilities (371bbea9-3836-4832-9e70-e8e928727f8c)\");\n script_summary(english:\"Checks for updated packages in pkg_info output\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote FreeBSD host is missing one or more security-related\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Google Chrome Releases reports :\n\nThis update includes 37 security fixes, including :\n\n- [497632] High CVE-2016-1612: Bad cast in V8.\n\n- [572871] High CVE-2016-1613: Use-after-free in PDFium.\n\n- [544691] Medium CVE-2016-1614: Information leak in Blink.\n\n- [468179] Medium CVE-2016-1615: Origin confusion in Omnibox.\n\n- [541415] Medium CVE-2016-1616: URL Spoofing.\n\n- [544765] Medium CVE-2016-1617: History sniffing with HSTS and CSP.\n\n- [552749] Medium CVE-2016-1618: Weak random number generator in\nBlink.\n\n- [557223] Medium CVE-2016-1619: Out-of-bounds read in PDFium.\n\n- [579625] CVE-2016-1620: Various fixes from internal audits, fuzzing\nand other initiatives.\n\n- Multiple vulnerabilities in V8 fixed at the tip of the 4.8 branch.\"\n );\n # http://googlechromereleases.blogspot.de/2016/01/stable-channel-update_20.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?be197a18\"\n );\n # https://vuxml.freebsd.org/freebsd/371bbea9-3836-4832-9e70-e8e928727f8c.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?c8407975\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:chromium\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:chromium-npapi\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:chromium-pulse\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:freebsd:freebsd\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/01/20\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/01/21\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/01/22\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"FreeBSD Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/FreeBSD/release\", \"Host/FreeBSD/pkg_info\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"freebsd_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/FreeBSD/release\")) audit(AUDIT_OS_NOT, \"FreeBSD\");\nif (!get_kb_item(\"Host/FreeBSD/pkg_info\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (pkg_test(save_report:TRUE, pkg:\"chromium<48.0.2564.82\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"chromium-npapi<48.0.2564.82\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"chromium-pulse<48.0.2564.82\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:pkg_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2019-01-16T20:23:13", "bulletinFamily": "scanner", "description": "Chromium was updated to 48.0.2564.82 to fix security issues and bugs.\n\nThe following vulnerabilities were fixed :\n\n - CVE-2016-1612: Bad cast in V8 (boo#963184)\n\n - CVE-2016-1613: Use-after-free in PDFium (boo#963185)\n\n - CVE-2016-1614: Information leak in Blink (boo#963186)\n\n - CVE-2016-1615: Origin confusion in Omnibox (boo#963187)\n\n - CVE-2016-1616: URL Spoofing (boo#963188)\n\n - CVE-2016-1617: History sniffing with HSTS and CSP\n (boo#963189)\n\n - CVE-2016-1618: Weak random number generator in Blink\n (boo#963190)\n\n - CVE-2016-1619: Out-of-bounds read in PDFium (boo#963191)\n\n - CVE-2016-1620 chromium-browser: various fixes\n (boo#963192)\n\nThis update also enables SSE2 support on x86_64, VA-API hardware\nacceleration and fixes a crash when trying to enable the Chromecast\nextension.", "modified": "2016-10-13T00:00:00", "published": "2016-02-03T00:00:00", "id": "OPENSUSE-2016-109.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=88539", "title": "openSUSE Security Update : Chromium (openSUSE-2016-109)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2016-109.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(88539);\n script_version(\"$Revision: 2.5 $\");\n script_cvs_date(\"$Date: 2016/10/13 14:27:27 $\");\n\n script_cve_id(\"CVE-2016-1612\", \"CVE-2016-1613\", \"CVE-2016-1614\", \"CVE-2016-1615\", \"CVE-2016-1616\", \"CVE-2016-1617\", \"CVE-2016-1618\", \"CVE-2016-1619\", \"CVE-2016-1620\");\n\n script_name(english:\"openSUSE Security Update : Chromium (openSUSE-2016-109)\");\n script_summary(english:\"Check for the openSUSE-2016-109 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Chromium was updated to 48.0.2564.82 to fix security issues and bugs.\n\nThe following vulnerabilities were fixed :\n\n - CVE-2016-1612: Bad cast in V8 (boo#963184)\n\n - CVE-2016-1613: Use-after-free in PDFium (boo#963185)\n\n - CVE-2016-1614: Information leak in Blink (boo#963186)\n\n - CVE-2016-1615: Origin confusion in Omnibox (boo#963187)\n\n - CVE-2016-1616: URL Spoofing (boo#963188)\n\n - CVE-2016-1617: History sniffing with HSTS and CSP\n (boo#963189)\n\n - CVE-2016-1618: Weak random number generator in Blink\n (boo#963190)\n\n - CVE-2016-1619: Out-of-bounds read in PDFium (boo#963191)\n\n - CVE-2016-1620 chromium-browser: various fixes\n (boo#963192)\n\nThis update also enables SSE2 support on x86_64, VA-API hardware\nacceleration and fixes a crash when trying to enable the Chromecast\nextension.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=963184\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=963185\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=963186\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=963187\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=963188\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=963189\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=963190\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=963191\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=963192\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected Chromium packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:chromedriver\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:chromedriver-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:chromium\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:chromium-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:chromium-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:chromium-desktop-gnome\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:chromium-desktop-kde\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:chromium-ffmpegsumo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:chromium-ffmpegsumo-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:13.1\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/01/27\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/02/03\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016 Tenable Network Security, Inc.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE13\\.1)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"13.1\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE13.1\", reference:\"chromedriver-48.0.2564.82-122.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"chromedriver-debuginfo-48.0.2564.82-122.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"chromium-48.0.2564.82-122.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"chromium-debuginfo-48.0.2564.82-122.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"chromium-debugsource-48.0.2564.82-122.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"chromium-desktop-gnome-48.0.2564.82-122.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"chromium-desktop-kde-48.0.2564.82-122.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"chromium-ffmpegsumo-48.0.2564.82-122.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"chromium-ffmpegsumo-debuginfo-48.0.2564.82-122.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"chromedriver / chromedriver-debuginfo / chromium / etc\");\n}\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2019-01-16T20:23:11", "bulletinFamily": "scanner", "description": "Chromium was updated to 48.0.2564.82 to fix security issues and bugs.\n\nThe following vulnerabilities were fixed :\n\n - CVE-2016-1612: Bad cast in V8 (boo#963184)\n\n - CVE-2016-1613: Use-after-free in PDFium (boo#963185)\n\n - CVE-2016-1614: Information leak in Blink (boo#963186)\n\n - CVE-2016-1615: Origin confusion in Omnibox (boo#963187)\n\n - CVE-2016-1616: URL Spoofing (boo#963188)\n\n - CVE-2016-1617: History sniffing with HSTS and CSP\n (boo#963189)\n\n - CVE-2016-1618: Weak random number generator in Blink\n (boo#963190)\n\n - CVE-2016-1619: Out-of-bounds read in PDFium (boo#963191)\n\n - CVE-2016-1620 chromium-browser: various fixes\n (boo#963192)\n\nThis update also enables SSE2 support on x86_64, VA-API hardware\nacceleration and fixes a crash when trying to enable the Chromecast\nextension.", "modified": "2016-10-13T00:00:00", "published": "2016-01-27T00:00:00", "id": "OPENSUSE-2016-99.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=88402", "title": "openSUSE Security Update : Chromium (openSUSE-2016-99)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2016-99.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(88402);\n script_version(\"$Revision: 2.7 $\");\n script_cvs_date(\"$Date: 2016/10/13 14:37:13 $\");\n\n script_cve_id(\"CVE-2016-1612\", \"CVE-2016-1613\", \"CVE-2016-1614\", \"CVE-2016-1615\", \"CVE-2016-1616\", \"CVE-2016-1617\", \"CVE-2016-1618\", \"CVE-2016-1619\", \"CVE-2016-1620\");\n\n script_name(english:\"openSUSE Security Update : Chromium (openSUSE-2016-99)\");\n script_summary(english:\"Check for the openSUSE-2016-99 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Chromium was updated to 48.0.2564.82 to fix security issues and bugs.\n\nThe following vulnerabilities were fixed :\n\n - CVE-2016-1612: Bad cast in V8 (boo#963184)\n\n - CVE-2016-1613: Use-after-free in PDFium (boo#963185)\n\n - CVE-2016-1614: Information leak in Blink (boo#963186)\n\n - CVE-2016-1615: Origin confusion in Omnibox (boo#963187)\n\n - CVE-2016-1616: URL Spoofing (boo#963188)\n\n - CVE-2016-1617: History sniffing with HSTS and CSP\n (boo#963189)\n\n - CVE-2016-1618: Weak random number generator in Blink\n (boo#963190)\n\n - CVE-2016-1619: Out-of-bounds read in PDFium (boo#963191)\n\n - CVE-2016-1620 chromium-browser: various fixes\n (boo#963192)\n\nThis update also enables SSE2 support on x86_64, VA-API hardware\nacceleration and fixes a crash when trying to enable the Chromecast\nextension.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=963184\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=963185\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=963186\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=963187\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=963188\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=963189\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=963190\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=963191\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=963192\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected Chromium packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:chromedriver\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:chromedriver-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:chromium\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:chromium-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:chromium-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:chromium-desktop-gnome\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:chromium-desktop-kde\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:chromium-ffmpegsumo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:chromium-ffmpegsumo-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:13.2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:42.1\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/01/26\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/01/27\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016 Tenable Network Security, Inc.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE13\\.2|SUSE42\\.1)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"13.2 / 42.1\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE13.2\", reference:\"chromedriver-48.0.2564.82-67.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"chromedriver-debuginfo-48.0.2564.82-67.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"chromium-48.0.2564.82-67.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"chromium-debuginfo-48.0.2564.82-67.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"chromium-debugsource-48.0.2564.82-67.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"chromium-desktop-gnome-48.0.2564.82-67.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"chromium-desktop-kde-48.0.2564.82-67.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"chromium-ffmpegsumo-48.0.2564.82-67.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"chromium-ffmpegsumo-debuginfo-48.0.2564.82-67.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"chromedriver-48.0.2564.82-13.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"chromedriver-debuginfo-48.0.2564.82-13.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"chromium-48.0.2564.82-13.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"chromium-debuginfo-48.0.2564.82-13.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"chromium-debugsource-48.0.2564.82-13.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"chromium-desktop-gnome-48.0.2564.82-13.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"chromium-desktop-kde-48.0.2564.82-13.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"chromium-ffmpegsumo-48.0.2564.82-13.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"chromium-ffmpegsumo-debuginfo-48.0.2564.82-13.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"chromedriver / chromedriver-debuginfo / chromium / etc\");\n}\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2019-01-16T20:23:09", "bulletinFamily": "scanner", "description": "The version of Google Chrome installed on the remote Windows host is\nprior to 48.0.2564.82. It is, therefore, affected by multiple\nvulnerabilities :\n\n - A unspecified vulnerability exists in Google V8 when\n handling compatible receiver checks hidden behind\n receptors. An attacker can exploit this to have an\n unspecified impact. No other details are available.\n (CVE-2016-1612)\n\n - A user-after-free error exists in PDFium due to improper\n invalidation of IPWL_FocusHandler and IPWL_Provider upon\n destruction. An attacker can exploit this to deference\n already freed memory, resulting in the execution of\n arbitrary code. (CVE-2016-1613)\n\n - An unspecified vulnerability exists in Blink that is\n related to the handling of bitmaps. An attacker can\n exploit this to access sensitive information. No other\n details are available. (CVE-2016-1614)\n\n - An unspecified vulnerability exists in omnibox that is\n related to origin confusion. An attacker can exploit\n this to have an unspecified impact. No other details are\n available. (CVE-2016-1615)\n\n - An unspecified vulnerability exists that allows an\n attacker to spoof a displayed URL. No other details are\n available. (CVE-2016-1616)\n\n - An unspecified vulnerability exists that is related to\n history sniffing with HSTS and CSP. No other details\n are available. (CVE-2016-1617)\n\n - A flaw exists in Blink due to the weak generation of\n random numbers by the ARC4-based random number\n generator. An attacker can exploit this to gain\n access to sensitive information. No other details are\n available. (CVE-2016-1618)\n\n - A out-of-bounds read error exists in PDFium in file\n fx_codec_jpx_opj.cpp in the sycc4{22,44}_to_rgb()\n functions. An attacker can exploit this to cause a\n denial of service by crashing the application linked\n using the library. (CVE-2016-1619)\n\n - Multiple vulnerabilities exist, the most serious of\n which allow an attacker to execute arbitrary code via a\n crafted web page. (CVE-2016-1620)", "modified": "2018-07-12T00:00:00", "published": "2016-01-22T00:00:00", "id": "GOOGLE_CHROME_48_0_2564_82.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=88088", "title": "Google Chrome < 48.0.2564.82 Multiple Vulnerabilities", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(88088);\n script_version(\"1.9\");\n script_cvs_date(\"Date: 2018/07/12 19:01:16\");\n\n script_cve_id(\n \"CVE-2016-1612\",\n \"CVE-2016-1613\",\n \"CVE-2016-1614\",\n \"CVE-2016-1615\",\n \"CVE-2016-1616\",\n \"CVE-2016-1617\",\n \"CVE-2016-1618\",\n \"CVE-2016-1619\",\n \"CVE-2016-1620\"\n );\n\n script_name(english:\"Google Chrome < 48.0.2564.82 Multiple Vulnerabilities\");\n script_summary(english:\"Checks the version number of Google Chrome.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Windows host contains a web browser that is affected by\nmultiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of Google Chrome installed on the remote Windows host is\nprior to 48.0.2564.82. It is, therefore, affected by multiple\nvulnerabilities :\n\n - A unspecified vulnerability exists in Google V8 when\n handling compatible receiver checks hidden behind\n receptors. An attacker can exploit this to have an\n unspecified impact. No other details are available.\n (CVE-2016-1612)\n\n - A user-after-free error exists in PDFium due to improper\n invalidation of IPWL_FocusHandler and IPWL_Provider upon\n destruction. An attacker can exploit this to deference\n already freed memory, resulting in the execution of\n arbitrary code. (CVE-2016-1613)\n\n - An unspecified vulnerability exists in Blink that is\n related to the handling of bitmaps. An attacker can\n exploit this to access sensitive information. No other\n details are available. (CVE-2016-1614)\n\n - An unspecified vulnerability exists in omnibox that is\n related to origin confusion. An attacker can exploit\n this to have an unspecified impact. No other details are\n available. (CVE-2016-1615)\n\n - An unspecified vulnerability exists that allows an\n attacker to spoof a displayed URL. No other details are\n available. (CVE-2016-1616)\n\n - An unspecified vulnerability exists that is related to\n history sniffing with HSTS and CSP. No other details\n are available. (CVE-2016-1617)\n\n - A flaw exists in Blink due to the weak generation of\n random numbers by the ARC4-based random number\n generator. An attacker can exploit this to gain\n access to sensitive information. No other details are\n available. (CVE-2016-1618)\n\n - A out-of-bounds read error exists in PDFium in file\n fx_codec_jpx_opj.cpp in the sycc4{22,44}_to_rgb()\n functions. An attacker can exploit this to cause a\n denial of service by crashing the application linked\n using the library. (CVE-2016-1619)\n\n - Multiple vulnerabilities exist, the most serious of\n which allow an attacker to execute arbitrary code via a\n crafted web page. (CVE-2016-1620)\");\n # http://googlechromereleases.blogspot.com/2016/01/stable-channel-update_20.html\n script_set_attribute(attribute:\"see_also\",value:\"http://www.nessus.org/u?7f4ae8d4\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to Google Chrome version 48.0.2564.82 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2015/10/29\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/01/20\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/01/22\");\n\n script_set_attribute(attribute:\"plugin_type\",value:\"local\");\n script_set_attribute(attribute:\"cpe\",value:\"cpe:/a:google:chrome\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows\");\n\n script_copyright(english:\"This script is Copyright (C) 2016-2018 Tenable Network Security, Inc.\");\n\n script_dependencies(\"google_chrome_installed.nasl\");\n script_require_keys(\"SMB/Google_Chrome/Installed\");\n\n exit(0);\n}\n\ninclude(\"google_chrome_version.inc\");\n\nget_kb_item_or_exit(\"SMB/Google_Chrome/Installed\");\ninstalls = get_kb_list(\"SMB/Google_Chrome/*\");\n\ngoogle_chrome_check_version(installs:installs, fix:'48.0.2564.82', severity:SECURITY_HOLE);\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2019-01-16T20:23:11", "bulletinFamily": "scanner", "description": "Several vulnerabilities were discovered in the chromium web browser.\n\n - CVE-2015-6792\n An issue was found in the handling of MIDI files.\n\n - CVE-2016-1612\n cloudfuzzer discovered a logic error related to receiver\n compatibility in the v8 JavaScript library.\n\n - CVE-2016-1613\n A use-after-free issue was discovered in the pdfium\n library.\n\n - CVE-2016-1614\n Christoph Diehl discovered an information leak in\n Webkit/Blink.\n\n - CVE-2016-1615\n Ron Masas discovered a way to spoof URLs.\n\n - CVE-2016-1616\n Luan Herrera discovered a way to spoof URLs.\n\n - CVE-2016-1617\n jenuis discovered a way to discover whether an HSTS\n website had been visited.\n\n - CVE-2016-1618\n Aaron Toponce discovered the use of weak random number\n generator.\n\n - CVE-2016-1619\n Keve Nagy discovered an out-of-bounds-read issue in the\n pdfium library.\n\n - CVE-2016-1620\n The chrome 48 development team found and fixed various\n issues during internal auditing. Also multiple issues\n were fixed in the v8 JavaScript library, version\n 4.7.271.17.", "modified": "2018-11-10T00:00:00", "published": "2016-01-28T00:00:00", "id": "DEBIAN_DSA-3456.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=88425", "title": "Debian DSA-3456-1 : chromium-browser - security update", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-3456. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\nif (NASL_LEVEL < 3000) exit(0);\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(88425);\n script_version(\"1.11\");\n script_cvs_date(\"Date: 2018/11/10 11:49:37\");\n\n script_cve_id(\"CVE-2015-6792\", \"CVE-2016-1612\", \"CVE-2016-1613\", \"CVE-2016-1614\", \"CVE-2016-1615\", \"CVE-2016-1616\", \"CVE-2016-1617\", \"CVE-2016-1618\", \"CVE-2016-1619\", \"CVE-2016-1620\");\n script_xref(name:\"DSA\", value:\"3456\");\n\n script_name(english:\"Debian DSA-3456-1 : chromium-browser - security update\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Several vulnerabilities were discovered in the chromium web browser.\n\n - CVE-2015-6792\n An issue was found in the handling of MIDI files.\n\n - CVE-2016-1612\n cloudfuzzer discovered a logic error related to receiver\n compatibility in the v8 JavaScript library.\n\n - CVE-2016-1613\n A use-after-free issue was discovered in the pdfium\n library.\n\n - CVE-2016-1614\n Christoph Diehl discovered an information leak in\n Webkit/Blink.\n\n - CVE-2016-1615\n Ron Masas discovered a way to spoof URLs.\n\n - CVE-2016-1616\n Luan Herrera discovered a way to spoof URLs.\n\n - CVE-2016-1617\n jenuis discovered a way to discover whether an HSTS\n website had been visited.\n\n - CVE-2016-1618\n Aaron Toponce discovered the use of weak random number\n generator.\n\n - CVE-2016-1619\n Keve Nagy discovered an out-of-bounds-read issue in the\n pdfium library.\n\n - CVE-2016-1620\n The chrome 48 development team found and fixed various\n issues during internal auditing. Also multiple issues\n were fixed in the v8 JavaScript library, version\n 4.7.271.17.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2015-6792\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2016-1612\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2016-1613\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2016-1614\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2016-1615\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2016-1616\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2016-1617\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2016-1618\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2016-1619\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2016-1620\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/jessie/chromium-browser\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2016/dsa-3456\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the chromium-browser packages.\n\nFor the stable distribution (jessie), these problems have been fixed\nin version 48.0.2564.82-1~deb8u1.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:chromium-browser\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:8.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/01/27\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/01/28\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"8.0\", prefix:\"chromedriver\", reference:\"48.0.2564.82-1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"chromium\", reference:\"48.0.2564.82-1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"chromium-dbg\", reference:\"48.0.2564.82-1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"chromium-inspector\", reference:\"48.0.2564.82-1~deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"chromium-l10n\", reference:\"48.0.2564.82-1~deb8u1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2019-01-16T20:23:11", "bulletinFamily": "scanner", "description": "Updated chromium-browser packages that fix multiple security issues\nare now available for Red Hat Enterprise Linux 6 Supplementary.\n\nRed Hat Product Security has rated this update as having Important\nsecurity impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.\n\nChromium is an open source web browser, powered by WebKit (Blink).\n\nSeveral flaws were found in the processing of malformed web content. A\nweb page containing malicious content could cause Chromium to crash,\nexecute arbitrary code, or disclose sensitive information when visited\nby the victim. (CVE-2016-1612, CVE-2016-1613, CVE-2016-1614,\nCVE-2016-1615, CVE-2016-1616, CVE-2016-1617, CVE-2016-1618,\nCVE-2016-1619, CVE-2016-1620, CVE-2016-2051, CVE-2016-2052)\n\nAll Chromium users should upgrade to these updated packages, which\ncontain Chromium version 48.0.2564.82, which corrects these issues.\nAfter installing the update, Chromium must be restarted for the\nchanges to take effect.", "modified": "2018-12-20T00:00:00", "published": "2016-01-28T00:00:00", "id": "REDHAT-RHSA-2016-0072.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=88447", "title": "RHEL 6 : chromium-browser (RHSA-2016:0072)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2016:0072. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(88447);\n script_version(\"1.14\");\n script_cvs_date(\"Date: 2018/12/20 11:08:45\");\n\n script_cve_id(\"CVE-2015-8947\", \"CVE-2016-1612\", \"CVE-2016-1613\", \"CVE-2016-1614\", \"CVE-2016-1615\", \"CVE-2016-1616\", \"CVE-2016-1617\", \"CVE-2016-1618\", \"CVE-2016-1619\", \"CVE-2016-1620\", \"CVE-2016-2051\", \"CVE-2016-2052\");\n script_xref(name:\"RHSA\", value:\"2016:0072\");\n\n script_name(english:\"RHEL 6 : chromium-browser (RHSA-2016:0072)\");\n script_summary(english:\"Checks the rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated chromium-browser packages that fix multiple security issues\nare now available for Red Hat Enterprise Linux 6 Supplementary.\n\nRed Hat Product Security has rated this update as having Important\nsecurity impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.\n\nChromium is an open source web browser, powered by WebKit (Blink).\n\nSeveral flaws were found in the processing of malformed web content. A\nweb page containing malicious content could cause Chromium to crash,\nexecute arbitrary code, or disclose sensitive information when visited\nby the victim. (CVE-2016-1612, CVE-2016-1613, CVE-2016-1614,\nCVE-2016-1615, CVE-2016-1616, CVE-2016-1617, CVE-2016-1618,\nCVE-2016-1619, CVE-2016-1620, CVE-2016-2051, CVE-2016-2052)\n\nAll Chromium users should upgrade to these updated packages, which\ncontain Chromium version 48.0.2564.82, which corrects these issues.\nAfter installing the update, Chromium must be restarted for the\nchanges to take effect.\"\n );\n # http://googlechromereleases.blogspot.com/2016/01/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://chromereleases.googleblog.com/2016/01/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2016:0072\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-8947\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2016-1612\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2016-1613\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2016-1614\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2016-1615\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2016-1616\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2016-1617\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2016-1618\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2016-1619\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2016-1620\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2016-2051\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2016-2052\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Update the affected chromium-browser and / or\nchromium-browser-debuginfo packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:chromium-browser\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:chromium-browser-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:6.7\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/01/27\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/01/28\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = eregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^6([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 6.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2016:0072\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"chromium-browser-48.0.2564.82-1.el6\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"chromium-browser-48.0.2564.82-1.el6\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"chromium-browser-debuginfo-48.0.2564.82-1.el6\")) flag++;\n\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"chromium-browser-debuginfo-48.0.2564.82-1.el6\")) flag++;\n\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"chromium-browser / chromium-browser-debuginfo\");\n }\n}\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2019-01-16T20:23:39", "bulletinFamily": "scanner", "description": "The remote host is affected by the vulnerability described in GLSA-201603-09\n(Chromium: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been discovered in the Chromium web\n browser. Please review the CVE identifiers referenced below for details.\nImpact :\n\n A remote attacker could possibly execute arbitrary code with the\n privileges of the process, cause a Denial of Service condition, obtain\n sensitive information, or bypass security restrictions.\nWorkaround :\n\n There is no known workaround at this time.", "modified": "2016-10-10T00:00:00", "published": "2016-03-14T00:00:00", "id": "GENTOO_GLSA-201603-09.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=89902", "title": "GLSA-201603-09 : Chromium: Multiple vulnerabilities", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Gentoo Linux Security Advisory GLSA 201603-09.\n#\n# The advisory text is Copyright (C) 2001-2016 Gentoo Foundation, Inc.\n# and licensed under the Creative Commons - Attribution / Share Alike \n# license. See http://creativecommons.org/licenses/by-sa/3.0/\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(89902);\n script_version(\"$Revision: 2.4 $\");\n script_cvs_date(\"$Date: 2016/10/10 14:25:16 $\");\n\n script_cve_id(\"CVE-2015-1270\", \"CVE-2015-1271\", \"CVE-2015-1272\", \"CVE-2015-1273\", \"CVE-2015-1274\", \"CVE-2015-1275\", \"CVE-2015-1276\", \"CVE-2015-1277\", \"CVE-2015-1278\", \"CVE-2015-1279\", \"CVE-2015-1280\", \"CVE-2015-1281\", \"CVE-2015-1282\", \"CVE-2015-1283\", \"CVE-2015-1284\", \"CVE-2015-1285\", \"CVE-2015-1286\", \"CVE-2015-1287\", \"CVE-2015-1288\", \"CVE-2015-1289\", \"CVE-2015-1291\", \"CVE-2015-1292\", \"CVE-2015-1293\", \"CVE-2015-1294\", \"CVE-2015-1295\", \"CVE-2015-1296\", \"CVE-2015-1297\", \"CVE-2015-1298\", \"CVE-2015-1299\", \"CVE-2015-1300\", \"CVE-2015-1302\", \"CVE-2015-1303\", \"CVE-2015-1304\", \"CVE-2015-6755\", \"CVE-2015-6756\", \"CVE-2015-6757\", \"CVE-2015-6758\", \"CVE-2015-6759\", \"CVE-2015-6760\", \"CVE-2015-6761\", \"CVE-2015-6762\", \"CVE-2015-6763\", \"CVE-2015-6764\", \"CVE-2015-6765\", \"CVE-2015-6766\", \"CVE-2015-6767\", \"CVE-2015-6768\", \"CVE-2015-6769\", \"CVE-2015-6770\", \"CVE-2015-6771\", \"CVE-2015-6772\", \"CVE-2015-6773\", \"CVE-2015-6774\", \"CVE-2015-6775\", \"CVE-2015-6776\", \"CVE-2015-6777\", \"CVE-2015-6778\", \"CVE-2015-6779\", \"CVE-2015-6780\", \"CVE-2015-6781\", \"CVE-2015-6782\", \"CVE-2015-6783\", \"CVE-2015-6784\", \"CVE-2015-6785\", \"CVE-2015-6786\", \"CVE-2015-6787\", \"CVE-2015-6788\", \"CVE-2015-6789\", \"CVE-2015-6790\", \"CVE-2015-6791\", \"CVE-2015-6792\", \"CVE-2015-8126\", \"CVE-2016-1612\", \"CVE-2016-1613\", \"CVE-2016-1614\", \"CVE-2016-1615\", \"CVE-2016-1616\", \"CVE-2016-1617\", \"CVE-2016-1618\", \"CVE-2016-1619\", \"CVE-2016-1620\", \"CVE-2016-1621\", \"CVE-2016-1622\", \"CVE-2016-1623\", \"CVE-2016-1624\", \"CVE-2016-1625\", \"CVE-2016-1626\", \"CVE-2016-1627\", \"CVE-2016-1628\", \"CVE-2016-1629\", \"CVE-2016-1630\", \"CVE-2016-1631\", \"CVE-2016-1632\", \"CVE-2016-1633\", \"CVE-2016-1634\", \"CVE-2016-1635\", \"CVE-2016-1636\", \"CVE-2016-1637\", \"CVE-2016-1638\", \"CVE-2016-1639\", \"CVE-2016-1640\", \"CVE-2016-1641\");\n script_xref(name:\"GLSA\", value:\"201603-09\");\n\n script_name(english:\"GLSA-201603-09 : Chromium: Multiple vulnerabilities\");\n script_summary(english:\"Checks for updated package(s) in /var/db/pkg\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Gentoo host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote host is affected by the vulnerability described in GLSA-201603-09\n(Chromium: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been discovered in the Chromium web\n browser. Please review the CVE identifiers referenced below for details.\n \nImpact :\n\n A remote attacker could possibly execute arbitrary code with the\n privileges of the process, cause a Denial of Service condition, obtain\n sensitive information, or bypass security restrictions.\n \nWorkaround :\n\n There is no known workaround at this time.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security.gentoo.org/glsa/201603-09\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"All Chromium users should upgrade to the latest version:\n # emerge --sync\n # emerge --ask --oneshot --verbose\n '>=www-client/chromium-49.0.2623.87'\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:chromium\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:gentoo:linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/03/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/03/14\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016 Tenable Network Security, Inc.\");\n script_family(english:\"Gentoo Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Gentoo/release\", \"Host/Gentoo/qpkg-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"qpkg.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Gentoo/release\")) audit(AUDIT_OS_NOT, \"Gentoo\");\nif (!get_kb_item(\"Host/Gentoo/qpkg-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (qpkg_check(package:\"www-client/chromium\", unaffected:make_list(\"ge 49.0.2623.87\"), vulnerable:make_list(\"lt 49.0.2623.87\"))) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = qpkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"Chromium\");\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "archlinux": [{"lastseen": "2016-09-02T18:44:35", "bulletinFamily": "unix", "description": "- CVE-2016-1612:\n\nThe LoadIC::UpdateCaches function in ic/ic.cc in Google V8 does not\nensure receiver compatibility before performing a cast of an unspecified\nvariable, which allows remote attackers to cause a denial of service or\npossibly have unknown other impact via crafted JavaScript code. Credit\nto cloudfuzzer.\n\n- CVE-2016-1613:\n\nMultiple use-after-free vulnerabilities in the formfiller implementation\nin PDFium allow remote attackers to cause a denial of service or\npossibly have unspecified other impact via a crafted PDF document,\nrelated to improper tracking of the destruction of (1) IPWL_FocusHandler\nand (2) IPWL_Provider objects.\n\n- CVE-2016-1614:\n\nThe UnacceleratedImageBufferSurface class in\nWebKit/Source/platform/graphics/UnacceleratedImageBufferSurface.cpp in\nBlink mishandles the initialization mode, which allows remote attackers\nto obtain sensitive information from process memory via a crafted web\nsite. Credit to Christoph Diehl.\n\n- CVE-2016-1615:\n\nThe Omnibox implementation allows remote attackers to spoof a document's\norigin via unspecified vectors. Credit to Ron Masas.\n\n- CVE-2016-1616:\n\nThe CustomButton::AcceleratorPressed function in\nui/views/controls/button/custom_button.cc allows remote attackers to\nspoof URLs via vectors involving an unfocused custom button. Credit to\nLuan Herrera.\n\n- CVE-2016-1617:\n\nThe CSPSource::schemeMatches function in\nWebKit/Source/core/frame/csp/CSPSource.cpp in the Content Security\nPolicy (CSP) implementation in Blink does not apply http policies to\nhttps URLs and does not apply ws policies to wss URLs, which makes it\neasier for remote attackers to determine whether a specific HSTS web\nsite has been visited by reading a CSP report. Credit to Yan Zhu.\n\n- CVE-2016-1618:\n\nBlink does not ensure that a proper cryptographicallyRandomValues random\nnumber generator is used, which makes it easier for remote attackers to\ndefeat cryptographic protection mechanisms via unspecified vectors.\nCredit to Aaron Toponce.\n\n- CVE-2016-1619:\n\nMultiple integer overflows in the sycc422_to_rgb and sycc444_to_rgb\nfunctions in fxcodec/codec/fx_codec_jpx_opj.cpp in PDFium allow remote\nattackers to cause a denial of service (out-of-bounds read) or possibly\nhave unspecified other impact via a crafted PDF document. Credit to Keve\nNagy.\n\n- CVE-2016-1620:\n\nVarious fixes from internal audits, fuzzing and other initiatives.", "modified": "2016-01-25T00:00:00", "published": "2016-01-25T00:00:00", "href": "https://lists.archlinux.org/pipermail/arch-security/2016-January/000533.html", "id": "ASA-201601-28", "title": "chromium: multiple issues", "type": "archlinux", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "suse": [{"lastseen": "2016-09-04T11:50:47", "bulletinFamily": "unix", "description": "Chromium was updated to 48.0.2564.82 to fix security issues and bugs.\n\n The following vulnerabilities were fixed:\n\n - CVE-2016-1612: Bad cast in V8 (boo#963184)\n - CVE-2016-1613: Use-after-free in PDFium (boo#963185)\n - CVE-2016-1614: Information leak in Blink (boo#963186)\n - CVE-2016-1615: Origin confusion in Omnibox (boo#963187)\n - CVE-2016-1616: URL Spoofing (boo#963188)\n - CVE-2016-1617: History sniffing with HSTS and CSP (boo#963189)\n - CVE-2016-1618: Weak random number generator in Blink (boo#963190)\n - CVE-2016-1619: Out-of-bounds read in PDFium (boo#963191)\n - CVE-2016-1620 chromium-browser: various fixes (boo#963192)\n\n This update also enables SSE2 support on x86_64, VA-API hardware\n acceleration and fixes a crash when trying to enable the Chromecast\n extension.\n\n", "modified": "2016-01-27T22:11:24", "published": "2016-01-27T22:11:24", "id": "OPENSUSE-SU-2016:0271-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00046.html", "title": "Security update for Chromium (important)", "type": "suse", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2016-09-04T11:43:03", "bulletinFamily": "unix", "description": "Chromium was updated to 48.0.2564.82 to fix security issues and bugs.\n\n The following vulnerabilities were fixed:\n\n - CVE-2016-1612: Bad cast in V8 (boo#963184)\n - CVE-2016-1613: Use-after-free in PDFium (boo#963185)\n - CVE-2016-1614: Information leak in Blink (boo#963186)\n - CVE-2016-1615: Origin confusion in Omnibox (boo#963187)\n - CVE-2016-1616: URL Spoofing (boo#963188)\n - CVE-2016-1617: History sniffing with HSTS and CSP (boo#963189)\n - CVE-2016-1618: Weak random number generator in Blink (boo#963190)\n - CVE-2016-1619: Out-of-bounds read in PDFium (boo#963191)\n - CVE-2016-1620 chromium-browser: various fixes (boo#963192)\n\n This update also enables SSE2 support on x86_64, VA-API hardware\n acceleration and fixes a crash when trying to enable the Chromecast\n extension.\n\n", "modified": "2016-01-26T18:13:18", "published": "2016-01-26T18:13:18", "id": "OPENSUSE-SU-2016:0250-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00036.html", "type": "suse", "title": "Security update for Chromium (important)", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2016-09-04T12:22:35", "bulletinFamily": "unix", "description": "Chromium was updated to 48.0.2564.82 to fix security issues and bugs.\n\n The following vulnerabilities were fixed:\n\n - CVE-2016-1612: Bad cast in V8 (boo#963184)\n - CVE-2016-1613: Use-after-free in PDFium (boo#963185)\n - CVE-2016-1614: Information leak in Blink (boo#963186)\n - CVE-2016-1615: Origin confusion in Omnibox (boo#963187)\n - CVE-2016-1616: URL Spoofing (boo#963188)\n - CVE-2016-1617: History sniffing with HSTS and CSP (boo#963189)\n - CVE-2016-1618: Weak random number generator in Blink (boo#963190)\n - CVE-2016-1619: Out-of-bounds read in PDFium (boo#963191)\n - CVE-2016-1620 chromium-browser: various fixes (boo#963192)\n\n This update also enables SSE2 support on x86_64, VA-API hardware\n acceleration and fixes a crash when trying to enable the Chromecast\n extension.\n\n", "modified": "2016-01-26T18:11:38", "published": "2016-01-26T18:11:38", "id": "OPENSUSE-SU-2016:0249-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00035.html", "type": "suse", "title": "Security update for Chromium (important)", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "debian": [{"lastseen": "2018-10-16T22:15:06", "bulletinFamily": "unix", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-3456-1 security@debian.org\nhttps://www.debian.org/security/ Michael Gilbert\nJanuary 27, 2016 https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : chromium-browser\nCVE ID : CVE-2015-6792 CVE-2016-1612 CVE-2016-1613 CVE-2016-1614\n CVE-2016-1615 CVE-2016-1616 CVE-2016-1617 CVE-2016-1618\n CVE-2016-1619 CVE-2016-1620\n\nSeveral vulnerabilities were discovered in the chromium web browser.\n\nCVE-2015-6792\n\n An issue was found in the handling of MIDI files.\n\nCVE-2016-1612\n\n cloudfuzzer discovered a logic error related to receiver\n compatibility in the v8 javascript library.\n\nCVE-2016-1613\n\n A use-after-free issue was discovered in the pdfium library.\n\nCVE-2016-1614\n\n Christoph Diehl discovered an information leak in Webkit/Blink.\n\nCVE-2016-1615\n\n Ron Masas discovered a way to spoof URLs.\n\nCVE-2016-1616\n\n Luan Herrera discovered a way to spoof URLs.\n\nCVE-2016-1617\n\n jenuis discovered a way to discover whether an HSTS web site had\n been visited.\n\nCVE-2016-1618\n\n Aaron Toponce discovered the use of weak random number generator.\n\nCVE-2016-1619\n\n Keve Nagy discovered an out-of-bounds-read issue in the pdfium library.\n\nCVE-2016-1620\n\n The chrome 48 development team found and fixed various issues\n during internal auditing. Also multiple issues were fixed in\n the v8 javascript library, version 4.7.271.17.\n\nFor the stable distribution (jessie), these problems have been fixed in\nversion 48.0.2564.82-1~deb8u1.\n\nFor the testing distribution (stretch), these problems will be fixed soon.\n\nFor the unstable distribution (sid), these problems have been fixed in\nversion 48.0.2564.82-1.\n\nWe recommend that you upgrade your chromium-browser packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n", "modified": "2016-01-27T12:58:36", "published": "2016-01-27T12:58:36", "id": "DEBIAN:DSA-3456-1:35708", "href": "https://lists.debian.org/debian-security-announce/debian-security-announce-2016/msg00026.html", "title": "[SECURITY] [DSA 3456-1] chromium-browser security update", "type": "debian", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "redhat": [{"lastseen": "2018-12-11T19:40:42", "bulletinFamily": "unix", "description": "Chromium is an open-source web browser, powered by WebKit (Blink).\n\nSeveral flaws were found in the processing of malformed web content. A web\npage containing malicious content could cause Chromium to crash, execute\narbitrary code, or disclose sensitive information when visited by the\nvictim. (CVE-2016-1612, CVE-2016-1613, CVE-2016-1614, CVE-2016-1615,\nCVE-2016-1616, CVE-2016-1617, CVE-2016-1618, CVE-2016-1619, CVE-2016-1620,\nCVE-2016-2051, CVE-2016-2052)\n\nAll Chromium users should upgrade to these updated packages, which\ncontain Chromium version 48.0.2564.82, which corrects these issues.\nAfter installing the update, Chromium must be restarted for the changes\nto take effect.\n", "modified": "2018-06-07T09:04:21", "published": "2016-01-27T05:00:00", "id": "RHSA-2016:0072", "href": "https://access.redhat.com/errata/RHSA-2016:0072", "type": "redhat", "title": "(RHSA-2016:0072) Important: chromium-browser security update", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "kaspersky": [{"lastseen": "2019-02-15T12:33:39", "bulletinFamily": "info", "description": "### *Detect date*:\n01/20/2016\n\n### *Severity*:\nCritical\n\n### *Description*:\nMultiple serious vulnerabilities have been found in Google Chrome. Malicious users can exploit these vulnerabilities to spoof user interface, cause denial of service or execute arbitrary code.\n\n### *Affected products*:\nGoogle Chrome versions earlier than 48.0.2564.82\n\n### *Solution*:\nUpdate to the latest version. File with name old_chrome can be still detected after update. It caused by Google Chrome update policy which does not remove old versions when installing updates. Try to contact vendor for further delete instructions or ignore such kind of alerts at your own risk. \n[Get Chrome](<https://www.google.com/chrome/browser/desktop/>)\n\n### *Original advisories*:\n[Google Chrome releases blog](<http://googlechromereleases.blogspot.ru/2016/01/stable-channel-update_20.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed:+GoogleChromeReleases+\\(Google+Chrome+Releases\\)>) \n\n\n### *Impacts*:\nACE \n\n### *Related products*:\n[Google Chrome](<https://threats.kaspersky.com/en/product/Google-Chrome/>)\n\n### *CVE-IDS*:\n[CVE-2016-2051](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2051>) \n[CVE-2016-1620](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1620>) \n[CVE-2016-1619](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1619>) \n[CVE-2016-1618](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1618>) \n[CVE-2016-1617](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1617>) \n[CVE-2016-1616](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1616>) \n[CVE-2016-1615](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1615>) \n[CVE-2016-1614](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1614>) \n[CVE-2016-1613](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1613>) \n[CVE-2016-1612](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1612>) \n[CVE-2016-2052](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2052>)", "modified": "2019-02-13T00:00:00", "published": "2016-01-20T00:00:00", "id": "KLA10745", "href": "https://threats.kaspersky.com/en/vulnerability/KLA10745", "title": "\r KLA10745Multiple vulnerabilities in Google Chrome ", "type": "kaspersky", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "gentoo": [{"lastseen": "2016-09-06T19:46:50", "bulletinFamily": "unix", "description": "### Background\n\nChromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web. \n\n### Description\n\nMultiple vulnerabilities have been discovered in the Chromium web browser. Please review the CVE identifiers referenced below for details. \n\n### Impact\n\nA remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, obtain sensitive information, or bypass security restrictions. \n\n### Workaround\n\nThere is no known workaround at this time.\n\n### Resolution\n\nAll Chromium users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose\n \">=www-client/chromium-49.0.2623.87\"", "modified": "2016-03-12T00:00:00", "published": "2016-03-12T00:00:00", "id": "GLSA-201603-09", "href": "https://security.gentoo.org/glsa/201603-09", "type": "gentoo", "title": "Chromium: Multiple vulnerabilities", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}]}