Google Chrome < 4.2.77.14 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(276616);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/11/24");

  script_cve_id(
    "CVE-2015-1235",
    "CVE-2015-1236",
    "CVE-2015-1237",
    "CVE-2015-1238",
    "CVE-2015-1240",
    "CVE-2015-1241",
    "CVE-2015-1242",
    "CVE-2015-1244",
    "CVE-2015-1245",
    "CVE-2015-1246",
    "CVE-2015-1247",
    "CVE-2015-1248",
    "CVE-2015-1249"
  );
  script_xref(name:"IAVB", value:"2015-B-0048-S");

  script_name(english:"Google Chrome < 4.2.77.14 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"A web browser installed on the remote Windows host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Google Chrome installed on the remote Windows host is prior to 4.2.77.14. It is, therefore, affected by
multiple vulnerabilities as referenced in the 2015_04_stable-channel-update_14 advisory.

  - Multiple unspecified vulnerabilities in Google Chrome before 42.0.2311.90 allow attackers to cause a
    denial of service or possibly have other impact via unknown vectors. (CVE-2015-1249)

  - Use-after-free vulnerability in the OpenPDFInReaderView::Update function in
    browser/ui/views/location_bar/open_pdf_in_reader_view.cc in Google Chrome before 41.0.2272.76 might allow
    user-assisted remote attackers to cause a denial of service (heap memory corruption) or possibly have
    unspecified other impact by triggering interaction with a PDFium Open PDF in Reader button that has an
    invalid tab association. (CVE-2015-1245)

  - The ContainerNode::parserRemoveChild function in core/dom/ContainerNode.cpp in the HTML parser in Blink,
    as used in Google Chrome before 42.0.2311.90, allows remote attackers to bypass the Same Origin Policy via
    a crafted HTML document with an IFRAME element. (CVE-2015-1235)

  - The MediaElementAudioSourceNode::process function in modules/webaudio/MediaElementAudioSourceNode.cpp in
    the Web Audio API implementation in Blink, as used in Google Chrome before 42.0.2311.90, allows remote
    attackers to bypass the Same Origin Policy and obtain sensitive audio sample values via a crafted web site
    containing a media element. (CVE-2015-1236)

  - Use-after-free vulnerability in the RenderFrameImpl::OnMessageReceived function in
    content/renderer/render_frame_impl.cc in Google Chrome before 42.0.2311.90 allows remote attackers to
    cause a denial of service or possibly have unspecified other impact via vectors that trigger renderer IPC
    messages during a detach operation. (CVE-2015-1237)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://chromereleases.googleblog.com/2015/04/stable-channel-update_14.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d89c80c4");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/456518");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/313939");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/461191");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/445808");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/463599");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/418402");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/460917");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/455215");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/444957");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/437399");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/429838");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/380663");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Google Chrome version 4.2.77.14 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2015-1249");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2015-1245");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2015/04/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2015/04/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/11/24");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:google:chrome");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("google_chrome_installed.nasl");
  script_require_keys("installed_sw/Google Chrome");

  exit(0);
}

include('vdf.inc');

# @tvdl-content-verify-only
var vuln_data = {
  "metadata": {
    "spec_version": "1.0"
  },
  "requires": [
    {
      "scope": "target",
      "match": {
        "os": "windows"
      }
    }
  ],
  "checks": [
    {
      "product": {
        "name": "Google Chrome",
        "type": "app"
      },
      "check_algorithm": "default",
      "constraints": [
        {
          "fixed_version": "4.2.77.14"
        }
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);