Google Chrome < 4.3.61.21 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(276611);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/11/24");

  script_cve_id(
    "CVE-2015-1251",
    "CVE-2015-1251",
    "CVE-2015-1252",
    "CVE-2015-1253",
    "CVE-2015-1254",
    "CVE-2015-1255",
    "CVE-2015-1256",
    "CVE-2015-1257",
    "CVE-2015-1258",
    "CVE-2015-1259",
    "CVE-2015-1260",
    "CVE-2015-1261",
    "CVE-2015-1262",
    "CVE-2015-1263",
    "CVE-2015-1264",
    "CVE-2015-1265"
  );
  script_xref(name:"IAVB", value:"2015-B-0066-S");

  script_name(english:"Google Chrome < 4.3.61.21 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"A web browser installed on the remote Windows host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Google Chrome installed on the remote Windows host is prior to 4.3.61.21. It is, therefore, affected by
multiple vulnerabilities as referenced in the 2015_05_stable-channel-update_19 advisory.

  - Multiple unspecified vulnerabilities in Google Chrome before 43.0.2357.65 allow attackers to cause a
    denial of service or possibly have other impact via unknown vectors. (CVE-2015-1265)

  - Multiple use-after-free vulnerabilities in content/renderer/media/user_media_client_impl.cc in the WebRTC
    implementation in Google Chrome before 43.0.2357.65 allow remote attackers to cause a denial of service or
    possibly have unspecified other impact via crafted JavaScript code that executes upon completion of a
    getUserMedia request. (CVE-2015-1260)

  - common/partial_circular_buffer.cc in Google Chrome before 43.0.2357.65 does not properly handle wraps,
    which allows remote attackers to bypass a sandbox protection mechanism or cause a denial of service (out-
    of-bounds write) via vectors that trigger a write operation with a large amount of data, related to the
    PartialCircularBuffer::Write and PartialCircularBuffer::DoWrite functions. (CVE-2015-1252)

  - core/html/parser/HTMLConstructionSite.cpp in the DOM implementation in Blink, as used in Google Chrome
    before 43.0.2357.65, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code
    that appends a child to a SCRIPT element, related to the insert and executeReparentTask functions.
    (CVE-2015-1253)

  - core/dom/Document.cpp in Blink, as used in Google Chrome before 43.0.2357.65, enables the inheritance of
    the designMode attribute, which allows remote attackers to bypass the Same Origin Policy by leveraging the
    availability of editing. (CVE-2015-1254)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://chromereleases.googleblog.com/2015/05/stable-channel-update_19.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?997faa52");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/474029");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/464552");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/444927");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/473253");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/478549");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/481015");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/468519");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/450939");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/468167");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/474370");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/466351");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/476647");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/479162");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/481015");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Google Chrome version 4.3.61.21 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2015-1265");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2015-1260");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2015/05/19");
  script_set_attribute(attribute:"patch_publication_date", value:"2015/05/19");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/11/24");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:google:chrome");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("google_chrome_installed.nasl");
  script_require_keys("installed_sw/Google Chrome");

  exit(0);
}

include('vdf.inc');

# @tvdl-content-verify-only
var vuln_data = {
  "metadata": {
    "spec_version": "1.0"
  },
  "requires": [
    {
      "scope": "target",
      "match": {
        "os": "windows"
      }
    }
  ],
  "checks": [
    {
      "product": {
        "name": "Google Chrome",
        "type": "app"
      },
      "check_algorithm": "default",
      "constraints": [
        {
          "fixed_version": "4.3.61.21"
        }
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);