CVE-2015-6772

The DOM implementation in Blink, as used in Google Chrome before 47.0.2526.73, does not prevent javascript: URL navigation while a document is being detached, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code that improperly interacts with a plugin.

The DOM implementation in Blink, as used in Google Chrome before 47.0.2526.73, does not prevent javascript: URL navigation while a document is being detached, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code that improperly interacts with a plugin.

The DOM implementation in Blink, as used in Google Chrome before 47.0.2526.73, does not prevent javascript: URL navigation while a document is being detached, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code that improperly interacts with a plugin.

The DOM implementation in Blink, as used in Google Chrome before 47.0.2526.73, does not prevent javascript: URL navigation while a document is being detached, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code that improperly interacts with a plugin.

Chromium-browser 47.0.2526.73 fixes several security issues:

Use-after-free bugs in AppCache (CVE-2015-6765, CVE-2015-6766, CVE-2015-6767).

Cross-origin bypass problems in DOM (CVE-2015-6768, CVE-2015-6770, CVE-2015-6772).

A cross-origin bypass problem in core (CVE-2015-6769).

Out of bounds access bugs in v8 (CVE-2015-6771, CVE-2015-6764).

An out of bounds access in Skia (CVE-2015-6773).

A use-after-free bug in the Extensions component (CVE-2015-6774).

Type confusion in PDFium (CVE-2015-6775).

Out of bounds accesses in PDFium (CVE-2015-6776, CVE-2015-6778).

A use-after-free bug in DOM (CVE-2015-6777).

A scheme bypass in PDFium (CVE-2015-6779).

A use-after-free bug in Infobars (CVE-2015-6780).

An integer overflow in Sfntly (CVE-2015-6781).

Content spoofing in Omnibox (CVE-2015-6782).

An escaping issue in saved pages (CVE-2015-6784).

A wildcard matching issue in CSP (CVE-2015-6785).

A scheme bypass in CSP (CVE-2015-6786).

Various fixes from internal audits, fuzzing and other initiatives (CVE-2015-6787).

Multiple vulnerabilities in V8 fixed in the 4.7 branch, up to version 4.7.80.23.

These are all security issues fixed in the chromedriver-55.0.2883.75-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ungoogled-chromium-113.0.5672.92-1.1 package on the GA media of openSUSE Tumbleweed.

The DOM implementation in Blink, as used in Google Chrome before 47.0.2526.73, does not prevent javascript: URL navigation while a document is being detached, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code that improperly interacts with a plugin.

Multiple use-after-free bugs were discovered in the application cache implementation in Chromium. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking the program. (CVE-2015-6765, CVE-2015-6766, CVE-2015-6767)

Several security issues were discovered in the DOM implementation in Chromium. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to bypass same origin restrictions. (CVE-2015-6768, CVE-2015-6770)

A security issue was discovered in the provisional-load commit implementation in Chromium. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass same origin restrictions. (CVE-2015-6769)

An out-of-bounds read was discovered in the array map and filter operations in V8 in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via renderer crash. (CVE-2015-6771)

It was discovered that the DOM implementation in Chromium does not prevent javascript: URL navigation while a document is being detached. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass same origin restrictions. (CVE-2015-6772)

An out-of bounds read was discovered in Skia in some cirumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via renderer crash. (CVE-2015-6773)

A use-after-free was discovered in the DOM implementation in Chromium. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via renderer crash or execute arbitrary code with the privileges of the sandboxed render process. (CVE-2015-6777)

It was discovered that the Document::open function in Chromium did not ensure that page-dismissal event handling is compatible with modal dialog blocking. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to spoof application UI content. (CVE-2015-6782)

It was discovered that the page serializer in Chromium mishandled MOTW comments for URLs in some circumstances. An attacker could potentially exploit this to inject HTML content. (CVE-2015-6784)

It was discovered that the Content Security Policy (CSP) implementation in Chromium accepted an x.y hostname as a match for a *.x.y pattern. An attacker could potentially exploit this to bypass intended access restrictions. (CVE-2015-6785)

It was discovered that the Content Security Policy (CSP) implementation in Chromium accepted blob:, data: and filesystem: URLs as a match for a

• pattern. An attacker could potentially exploit this to bypass intended access restrictions. (CVE-2015-6786)

Multiple security issues were discovered in Chromium. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking the program. (CVE-2015-6787)

Multiple security issues were discovered in V8. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial of service via renderer crash or execute arbitrary code with the privileges of the sandboxed render process. (CVE-2015-8478)