CVE-2016-5175

Blink, as used in Chromium before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, mishandles deferred page loads, which allows remote attackers to inject arbitrary web script or HTML via a crafted web site, aka "Universal XSS (UXSS)." (CVE-2016-5147)

Cross-site scripting (XSS) vulnerability in Blink, as used in Chromium before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allows remote attackers to inject arbitrary web script or HTML via vectors related to widget updates, aka "Universal XSS (UXSS)." (CVE-2016-5148)

The extensions subsystem in Chromium before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux relies on an IFRAME source URL to identify an associated extension, which allows remote attackers to conduct extension-bindings injection attacks by leveraging script access to a resource that initially has the about:blank URL. (CVE-2016-5149)

WebKit/Source/bindings/modules/v8/V8BindingForModules.cpp in Blink, as used in Chromium before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, has an Indexed Database (aka IndexedDB) API implementation that does not properly restrict key-path evaluation, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted JavaScript code that leverages certain side effects. (CVE-2016-5150)

PDFium in Chromium before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux mishandles timers, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted PDF document, related to fpdfsdk/javascript/JS_Object.cpp and fpdfsdk/javascript/app.cpp. (CVE-2016-5151)

Integer overflow in the opj_tcd_get_decoded_tile_size function in tcd.c in OpenJPEG, as used in PDFium in Chromium before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted JPEG 2000 data. (CVE-2016-5152)

The Web Animations implementation in Blink, as used in Chromium before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, improperly relies on list iteration, which allows remote attackers to cause a denial of service (use-after-destruction) or possibly have unspecified other impact via a crafted web site. (CVE-2016-5153)

Multiple heap-based buffer overflows in PDFium, as used in Chromium before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted JBig2 image. (CVE-2016-5154)

Chromium before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux does not properly validate access to the initial document, which allows remote attackers to spoof the address bar via a crafted web site. (CVE-2016-5155)

extensions/renderer/event_bindings.cc in the event bindings in Chromium before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux attempts to process filtered events after failure to add an event matcher, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via unknown vectors. (CVE-2016-5156)

Heap-based buffer overflow in the opj_dwt_interleave_v function in dwt.c in OpenJPEG, as used in PDFium in Chromium before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allows remote attackers to execute arbitrary code via crafted coordinate values in JPEG 2000 data. (CVE-2016-5157)

Multiple integer overflows in the opj_tcd_init_tile function in tcd.c in OpenJPEG, as used in PDFium in Chromium before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted JPEG 2000 data. (CVE-2016-5158) …

Chromium was updated to 53.0.2785.113 to fix a number of security issues and bugs.

The following vulnerabilities were fixed:

• CVE-2016-5170: Use after free in Blink
• CVE-2016-5171: Use after free in Blink
• CVE-2016-5172: Arbitrary Memory Read in v8
• CVE-2016-5173: Extension resource access
• CVE-2016-5174: Popup not correctly suppressed
• CVE-2016-5175: Various fixes from internal audits, fuzzing and other initiatives.

The following upstream fixes are included:

• SPDY crasher fixes
• Disable NV12 DXGI video on AMD
• Forward --password-store switch to os_crypt
• Tell the kernel to discard USB requests when they time out.
• disallow WKBackForwardListItem navigations for pushState pages
• arc: bluetooth: Fix advertised uuid
• fix conflicting PendingIntent for stop button and swipe away

The widevine plugin was re-enabled (boo#998328).

Chromium was updated to 53.0.2785.113 to fix a number of security issues and bugs.

The following vulnerabilities were fixed:

• CVE-2016-5170: Use after free in Blink
• CVE-2016-5171: Use after free in Blink
• CVE-2016-5172: Arbitrary Memory Read in v8
• CVE-2016-5173: Extension resource access
• CVE-2016-5174: Popup not correctly suppressed
• CVE-2016-5175: Various fixes from internal audits, fuzzing and other initiatives.

The following upstream fixes are included:

• SPDY crasher fixes
• Disable NV12 DXGI video on AMD
• Forward --password-store switch to os_crypt
• Tell the kernel to discard USB requests when they time out.
• disallow WKBackForwardListItem navigations for pushState pages
• arc: bluetooth: Fix advertised uuid
• fix conflicting PendingIntent for stop button and swipe away

The widevine plugin was re-enabled (boo#998328).

These are all security issues fixed in the chromedriver-55.0.2883.75-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ungoogled-chromium-113.0.5672.92-1.1 package on the GA media of openSUSE Tumbleweed.

A use-after-free was discovered in the V8 bindings in Blink. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-5170)

A use-after-free was discovered in the V8 bindings in Blink. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-5171)

An issue was discovered in V8. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to ontain sensitive information from arbitrary memory locations. (CVE-2016-5172)

Multiple security issues were discovered in Chromium. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-5175, CVE-2016-5178)

A use-after-free was discovered in V8. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-5177)

It was discovered that Chromium does not ensure the recipient of a certain IPC message is a valid RenderFrame or RenderWidget. An attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitary code. (CVE-2016-7549)