chromium-browser: Out-of-bounds write in skia filters

Integer overflow in the SkAutoSTArray implementation in include/core/SkTemplates.h in the filters implementation in Skia, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a reset...

chromium-browser: Out-of-bounds write in skia filters

The filters implementation in Skia, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an out-of-bounds write operation...

chromium-browser: Out-of-bounds read in pdfium

PDFium, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service out-of-bounds read via unspecified vectors...

chromium-browser: Type confusion in v8

The getHiddenProperty function in bindings/core/v8/V8EventListenerList.h in Blink, as used in Google Chrome before 41.0.2272.76, has a name conflict with the AudioContext class, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via JavaScript cod...

chromium-browser: Various fixes from internal audits, fuzzing and other initiatives.

Multiple unspecified vulnerabilities in Google Chrome before 41.0.2272.76 allow attackers to cause a denial of service or possibly have other impact via unknown vectors...

chromium-browser: Cookie injection in proxies

net/http/proxyclientsocket.cc in Google Chrome before 41.0.2272.76 does not properly handle a 407 aka Proxy Authentication Required HTTP status code accompanied by a Set-Cookie header, which allows remote proxy servers to conduct cookie-injection attacks via a crafted response...

RHEL 6 : chromium-browser (RHSA-2015:0163)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2015:0163 advisory. Chromium is an open-source web browser, powered by WebKit Blink. Several flaws were found in the processing of malformed web content. A web...

chromium-browser: privilege escalation in service workers

The OriginCanAccessServiceWorkers function in content/browser/serviceworker/serviceworkerdispatcherhost.cc in Google Chrome before 40.0.2214.111 on Windows, OS X, and Linux and before 40.0.2214.109 on Android does not properly restrict the URI scheme during a ServiceWorker registration, which...

RHEL 6 : chromium-browser (RHSA-2015:0093)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2015:0093 advisory. Chromium is an open-source web browser, powered by WebKit Blink. Several flaws were found in the processing of malformed web content. A web...

chromium-browser: out-of-bounds read in Fonts

The RenderTable::simplifiedNormalFlowLayout function in core/rendering/RenderTable.cpp in Blink, as used in Google Chrome before 40.0.2214.91, skips captions during table layout in certain situations, which allows remote attackers to cause a denial of service out-of-bounds read via unspecified...

chromium-browser: out-of-bounds read in PDFium

OpenJPEG before r2944, as used in PDFium in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service out-of-bounds read via a crafted PDF document, related to j2k.c, jp2.c, pi.c, t1.c, t2.c, and tcd.c...

chromium-browser: caching error in AppCache

The AppCacheUpdateJob::URLFetcher::OnResponseStarted function in content/browser/appcache/appcacheupdatejob.cc in Google Chrome before 40.0.2214.91 proceeds with AppCache caching for SSL sessions even if there is an X.509 certificate error, which allows man-in-the-middle attackers to spoof HTML5...

chromium-browser: same-origin-bypass in V8

Google Chrome before 40.0.2214.91, when the Harmony proxy in Google V8 is enabled, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code with Proxy.create and console.log calls, related to HTTP responses that lack an "X-Content-Type-Options: nosniff" header...

chromium-browser: out-of-bounds read in UI

The SelectionOwner::ProcessTarget function in ui/base/x/selectionowner.cc in the UI implementation in Google Chrome before 40.0.2214.91 uses an incorrect data type for a certain length value, which allows remote attackers to cause a denial of service out-of-bounds read via crafted X11 data...

chromium-browser: out-of-bounds read in Skia

Skia, as used in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service out-of-bounds read via unspecified vectors...

chromium-browser: out-of-bounds read in PDFium

OpenJPEG before r2908, as used in PDFium in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service out-of-bounds read via a crafted PDF document, related to j2k.c, jp2.c, and t2.c...

chromium-browser: unspecified vulnerability in Google V8

Multiple unspecified vulnerabilities in Google V8 before 3.30.33.15, as used in Google Chrome before 40.0.2214.91, allow attackers to cause a denial of service or possibly have other impact via unknown vectors...

chromium-browser: use-after-free in Views

Use-after-free vulnerability in the ZoomBubbleView::Close function in browser/ui/views/locationbar/zoombubbleview.cc in the Views implementation in Google Chrome before 40.0.2214.91 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted docume...

chromium-browser: memory corruption in Fonts

The Fonts implementation in Google Chrome before 40.0.2214.91 allows remote attackers to cause a denial of service memory corruption or possibly have unspecified other impact via unknown vectors...

chromium-browser: uninitialized-value in Fonts

The Fonts implementation in Google Chrome before 40.0.2214.91 does not initialize memory for a data structure, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors...