chromium -- multiple vulnerabilities

2016-04-13T00:00:00
ID 6D8505F0-0614-11E6-B39C-00262D5ED8EE
Type freebsd
Reporter FreeBSD
Modified 2016-04-13T00:00:00

Description

Google Chrome Releases reports:

20 security fixes in this release, including:

[590275] High CVE-2016-1652: Universal XSS in extension bindings. Credit to anonymous. [589792] High CVE-2016-1653: Out-of-bounds write in V8. Credit to Choongwoo Han. [591785] Medium CVE-2016-1651: Out-of-bounds read in Pdfium JPEG2000 decoding. Credit to kdot working with HP's Zero Day Initiative. [589512] Medium CVE-2016-1654: Uninitialized memory read in media. Credit to Atte Kettunen of OUSPG. [582008] Medium CVE-2016-1655: Use-after-free related to extensions. Credit to Rob Wu. [570750] Medium CVE-2016-1656: Android downloaded file path restriction bypass. Credit to Dzmitry Lukyanenko. [567445] Medium CVE-2016-1657: Address bar spoofing. Credit to Luan Herrera. [573317] Low CVE-2016-1658: Potential leak of sensitive information to malicious extensions. Credit to Antonio Sanso (@asanso) of Adobe. [602697] CVE-2016-1659: Various fixes from internal audits, fuzzing and other initiatives.