Chromium was updated to 49.0.2623.75 to fix the following security issues: (boo#969333)

  - CVE-2016-1630: Same-origin bypass in Blink

  - CVE-2016-1631: Same-origin bypass in Pepper Plugin

  - CVE-2016-1632: Bad cast in Extensions

  - CVE-2016-1633: Use-after-free in Blink

  - CVE-2016-1634: Use-after-free in Blink

  - CVE-2016-1635: Use-after-free in Blink

  - CVE-2016-1636: SRI Validation Bypass

  - CVE-2015-8126: Out-of-bounds access in libpng

  - CVE-2016-1637: Information Leak in Skia

  - CVE-2016-1638: WebAPI Bypass

  - CVE-2016-1639: Use-after-free in WebRTC

  - CVE-2016-1640: Origin confusion in Extensions UI

  - CVE-2016-1641: Use-after-free in Favicon

  - CVE-2016-1642: Various fixes from internal audits,     fuzzing and other initiatives

  - Multiple vulnerabilities in V8 fixed at the tip of the     4.9 branch (currently 4.9.385.26)

The remote host is affected by the vulnerability described in GLSA-201603-09 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in the Chromium web       browser. Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information, or bypass security restrictions.
  Workaround :

    There is no known workaround at this time.

The version of Google Chrome installed on the remote Windows host is prior to 49.0.2623.75. It is, therefore, affected by multiple vulnerabilities as referenced in the 2016_03_stable-channel-update advisory.

  - Multiple unspecified vulnerabilities in Google Chrome before 49.0.2623.75 allow attackers to cause a     denial of service or possibly have other impact via unknown vectors. (CVE-2016-1642)

  - The ContainerNode::parserRemoveChild function in WebKit/Source/core/dom/ContainerNode.cpp in Blink, as     used in Google Chrome before 49.0.2623.75, mishandles widget updates, which makes it easier for remote     attackers to bypass the Same Origin Policy via a crafted web site. (CVE-2016-1630)

  - The PPB_Flash_MessageLoop_Impl::InternalRun function in     content/renderer/pepper/ppb_flash_message_loop_impl.cc in the Pepper plugin in Google Chrome before     49.0.2623.75 mishandles nested message loops, which allows remote attackers to bypass the Same Origin     Policy via a crafted web site. (CVE-2016-1631)

  - The Extensions subsystem in Google Chrome before 49.0.2623.75 does not properly maintain own properties,     which allows remote attackers to bypass intended access restrictions via crafted JavaScript code that     triggers an incorrect cast, related to extensions/renderer/v8_helpers.h and gin/converter.h.
    (CVE-2016-1632)

  - Use-after-free vulnerability in Blink, as used in Google Chrome before 49.0.2623.75, allows remote     attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
    (CVE-2016-1633)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
89912	openSUSE Security Update : Chromium (openSUSE-2016-330)	Nessus	SuSE Local Security Checks	2016/3/14	2021/1/19	critical
89902	GLSA-201603-09 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2016/3/14	2021/1/11	critical
89685	Google Chrome < 49.0.2623.75 Multiple Vulnerabilities	Nessus	Windows	2016/3/4	2025/11/24	critical

偵測

搜尋 Plugin

critical

critical

critical