CVE-2016-5148

Blink, as used in Chromium before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, mishandles deferred page loads, which allows remote attackers to inject arbitrary web script or HTML via a crafted web site, aka "Universal XSS (UXSS)." (CVE-2016-5147)

Cross-site scripting (XSS) vulnerability in Blink, as used in Chromium before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allows remote attackers to inject arbitrary web script or HTML via vectors related to widget updates, aka "Universal XSS (UXSS)." (CVE-2016-5148)

The extensions subsystem in Chromium before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux relies on an IFRAME source URL to identify an associated extension, which allows remote attackers to conduct extension-bindings injection attacks by leveraging script access to a resource that initially has the about:blank URL. (CVE-2016-5149)

WebKit/Source/bindings/modules/v8/V8BindingForModules.cpp in Blink, as used in Chromium before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, has an Indexed Database (aka IndexedDB) API implementation that does not properly restrict key-path evaluation, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted JavaScript code that leverages certain side effects. (CVE-2016-5150)

PDFium in Chromium before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux mishandles timers, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted PDF document, related to fpdfsdk/javascript/JS_Object.cpp and fpdfsdk/javascript/app.cpp. (CVE-2016-5151)

Integer overflow in the opj_tcd_get_decoded_tile_size function in tcd.c in OpenJPEG, as used in PDFium in Chromium before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted JPEG 2000 data. (CVE-2016-5152)

The Web Animations implementation in Blink, as used in Chromium before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, improperly relies on list iteration, which allows remote attackers to cause a denial of service (use-after-destruction) or possibly have unspecified other impact via a crafted web site. (CVE-2016-5153)

Multiple heap-based buffer overflows in PDFium, as used in Chromium before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted JBig2 image. (CVE-2016-5154)

Chromium before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux does not properly validate access to the initial document, which allows remote attackers to spoof the address bar via a crafted web site. (CVE-2016-5155)

extensions/renderer/event_bindings.cc in the event bindings in Chromium before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux attempts to process filtered events after failure to add an event matcher, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via unknown vectors. (CVE-2016-5156)

Heap-based buffer overflow in the opj_dwt_interleave_v function in dwt.c in OpenJPEG, as used in PDFium in Chromium before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allows remote attackers to execute arbitrary code via crafted coordinate values in JPEG 2000 data. (CVE-2016-5157)

Multiple integer overflows in the opj_tcd_init_tile function in tcd.c in OpenJPEG, as used in PDFium in Chromium before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted JPEG 2000 data. (CVE-2016-5158) …

Chromium was updated to 53.0.2785.89 to fix a number of security issues.

The following vulnerabilities were fixed: (boo#996648)

• CVE-2016-5147: Universal XSS in Blink.
• CVE-2016-5148: Universal XSS in Blink.
• CVE-2016-5149: Script injection in extensions.
• CVE-2016-5150: Use after free in Blink.
• CVE-2016-5151: Use after free in PDFium.
• CVE-2016-5152: Heap overflow in PDFium.
• CVE-2016-5153: Use after destruction in Blink.
• CVE-2016-5154: Heap overflow in PDFium.
• CVE-2016-5155: Address bar spoofing.
• CVE-2016-5156: Use after free in event bindings.
• CVE-2016-5157: Heap overflow in PDFium.
• CVE-2016-5158: Heap overflow in PDFium.
• CVE-2016-5159: Heap overflow in PDFium.
• CVE-2016-5161: Type confusion in Blink.
• CVE-2016-5162: Extensions web accessible resources bypass.
• CVE-2016-5163: Address bar spoofing.
• CVE-2016-5164: Universal XSS using DevTools.
• CVE-2016-5165: Script injection in DevTools.
• CVE-2016-5166: SMB Relay Attack via Save Page As.
• CVE-2016-5160: Extensions web accessible resources bypass.

A number of tracked build system fixes are included. (boo#996032, boo#99606, boo#995932)

These are all security issues fixed in the chromedriver-55.0.2883.75-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ungoogled-chromium-113.0.5672.92-1.1 package on the GA media of openSUSE Tumbleweed.

Chromium was updated to 53.0.2785.89 to fix a number of security issues.

The following vulnerabilities were fixed: (boo#996648)

• CVE-2016-5147: Universal XSS in Blink.
• CVE-2016-5148: Universal XSS in Blink.
• CVE-2016-5149: Script injection in extensions.
• CVE-2016-5150: Use after free in Blink.
• CVE-2016-5151: Use after free in PDFium.
• CVE-2016-5152: Heap overflow in PDFium.
• CVE-2016-5153: Use after destruction in Blink.
• CVE-2016-5154: Heap overflow in PDFium.
• CVE-2016-5155: Address bar spoofing.
• CVE-2016-5156: Use after free in event bindings.
• CVE-2016-5157: Heap overflow in PDFium.
• CVE-2016-5158: Heap overflow in PDFium.
• CVE-2016-5159: Heap overflow in PDFium.
• CVE-2016-5161: Type confusion in Blink.
• CVE-2016-5162: Extensions web accessible resources bypass.
• CVE-2016-5163: Address bar spoofing.
• CVE-2016-5164: Universal XSS using DevTools.
• CVE-2016-5165: Script injection in DevTools.
• CVE-2016-5166: SMB Relay Attack via Save Page As.
• CVE-2016-5160: Extensions web accessible resources bypass.

A number of tracked build system fixes are included. (boo#996032, boo#99606, boo#995932)

Chromium was updated to 53.0.2785.89 to fix a number of security issues.

The following vulnerabilities were fixed: (boo#996648)

• CVE-2016-5147: Universal XSS in Blink.
• CVE-2016-5148: Universal XSS in Blink.
• CVE-2016-5149: Script injection in extensions.
• CVE-2016-5150: Use after free in Blink.
• CVE-2016-5151: Use after free in PDFium.
• CVE-2016-5152: Heap overflow in PDFium.
• CVE-2016-5153: Use after destruction in Blink.
• CVE-2016-5154: Heap overflow in PDFium.
• CVE-2016-5155: Address bar spoofing.
• CVE-2016-5156: Use after free in event bindings.
• CVE-2016-5157: Heap overflow in PDFium.
• CVE-2016-5158: Heap overflow in PDFium.
• CVE-2016-5159: Heap overflow in PDFium.
• CVE-2016-5161: Type confusion in Blink.
• CVE-2016-5162: Extensions web accessible resources bypass.
• CVE-2016-5163: Address bar spoofing.
• CVE-2016-5164: Universal XSS using DevTools.
• CVE-2016-5165: Script injection in DevTools.
• CVE-2016-5166: SMB Relay Attack via Save Page As.
• CVE-2016-5160: Extensions web accessible resources bypass.

A number of tracked build system fixes are included. (boo#996032, boo#99606, boo#995932)

An issue was discovered in Blink involving the provisional URL for an initially empty document. An attacker could potentially exploit this to spoof the currently displayed URL. (CVE-2016-5141)

A use-after-free was discovered in the WebCrypto implementation in Blink. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-5142)

It was discovered that the devtools subsystem in Blink mishandles various parameters. An attacker could exploit this to bypass intended access restrictions. (CVE-2016-5143, CVE-2016-5144)

It was discovered that Blink does not ensure that a taint property is preserved after a structure-clone operation on an ImageBitmap object derived from a cross-origin image. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass same origin restrictions. (CVE-2016-5145)

Multiple security issues were discovered in Chromium. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-5146, CVE-2016-5167)

It was discovered that Blink mishandles deferred page loads. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to conduct cross-site scripting (XSS) attacks. (CVE-2016-5147)

An issue was discovered in Blink related to widget updates. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to conduct cross-site scripting (XSS) attacks. (CVE-2016-5148)

A use-after-free was discovered in Blink. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-5150)

A use-after-free was discovered in Blink. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-5153)

It was discovered that Chromium does not correctly validate access to the initial document. An attacker could potentially exploit this to spoof the currently displayed URL. (CVE-2016-5155)

A use-after-free was discovered in the event bindings in Blink. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-5156)

A type confusion bug was discovered in Blink. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-5161)

An issue was discovered with the devtools implementation. An attacker could potentially exploit this to conduct cross-site scripting (XSS) attacks. (CVE-2016-5164)

An issue was discovered with the devtools implementation. An attacker could potentially exploit this to conduct cross-site scripting (XSS) attacks. (CVE-2016-5165)