Google Chrome < 54.0.2840.100 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(275856);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/11/24");

  script_cve_id(
    "CVE-2016-5199",
    "CVE-2016-5200",
    "CVE-2016-5201",
    "CVE-2016-5202"
  );
  script_xref(name:"IAVB", value:"2016-B-0159-S");

  script_name(english:"Google Chrome < 54.0.2840.100 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"A web browser installed on the remote Windows host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Google Chrome installed on the remote Windows host is prior to 54.0.2840.100. It is, therefore, affected
by multiple vulnerabilities as referenced in the 2016_11_stable-channel-update-for-desktop_9 advisory.

  - browser/extensions/api/dial/dial_registry.cc in Google Chrome before 54.0.2840.98 on macOS, before
    54.0.2840.99 on Windows, and before 54.0.2840.100 on Linux neglects to copy a device ID before an erase()
    call, which causes the erase operation to access data that that erase operation will destroy.
    (CVE-2016-5202)

  - An off by one error resulting in an allocation of zero size in FFmpeg in Google Chrome prior to
    54.0.2840.98 for Mac, and 54.0.2840.99 for Windows, and 54.0.2840.100 for Linux, and 55.0.2883.84 for
    Android allowed a remote attacker to potentially exploit heap corruption via a crafted video file.
    (CVE-2016-5199)

  - V8 in Google Chrome prior to 54.0.2840.98 for Mac, and 54.0.2840.99 for Windows, and 54.0.2840.100 for
    Linux, and 55.0.2883.84 for Android incorrectly applied type rules, which allowed a remote attacker to
    potentially exploit heap corruption via a crafted HTML page. (CVE-2016-5200)

  - A leak of privateClass in the extensions API in Google Chrome prior to 54.0.2840.100 for Linux, and
    54.0.2840.99 for Windows, and 54.0.2840.98 for Mac allowed a remote attacker to access privileged
    JavaScript code via a crafted HTML page. (CVE-2016-5201)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://chromereleases.googleblog.com/2016/11/stable-channel-update-for-desktop_9.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9b9ec16c");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/643948");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/658114");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/660678");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Google Chrome version 54.0.2840.100 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-5202");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2016/11/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2016/11/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/11/20");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:google:chrome");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("google_chrome_installed.nasl");
  script_require_keys("installed_sw/Google Chrome");

  exit(0);
}

include('vdf.inc');

# @tvdl-content-verify-only
var vuln_data = {
  "metadata": {
    "spec_version": "1.0"
  },
  "requires": [
    {
      "scope": "target",
      "match": {
        "os": "windows"
      }
    }
  ],
  "checks": [
    {
      "product": {
        "name": "Google Chrome",
        "type": "app"
      },
      "check_algorithm": "default",
      "constraints": [
        {
          "fixed_version": "54.0.2840.100"
        }
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);