| Descripción: | Summary:
The host is installed with Google Chrome
and is prone to multiple vulnerabilities.
Vulnerability Insight:
Multiple flaws are due to:
- Multiple heap based buffer-overflow in pdfium.
- An error which allows executable files to run immediately after download.
- A use-after-free error in IndexedDB.
- A memory corruption error in skia.
- An error allowing content security policy (CSP) bypass.
- A use-after-free error in pdfium.
- A heap based buffer-overflow in expat.
- A use-after-free error in blink.
- Universal cross-site scripting (UXSS) error in blink.
- An error in cascading style sheets (CSS) allowing to bypass same origin
policy.
- Uninitialized memory read error in ICU.
- A use-after-free error related to unexpected GPU process termination.
- A use-after-free error in accessibility.
- An error leading to URL spoofing using pdf files.
- An error leading to information leak in XSS auditor.
- An error allowing spell checking dictionaries to be fetched over HTTP.
- The regular-expression implementation in Google V8 mishandles interrupts.
- Various other unspecified errors.
Vulnerability Impact:
Successful exploitation will allow remote
attackers to bypass security restrictions, cause a denial of service condition
or potentially execute arbitrary code, conduct spoofing attack, gain sensitive
information and other unspecified impacts.
Affected Software/OS:
Google Chrome version prior to
44.0.2403.89 on Mac OS X.
Solution:
Upgrade to Google Chrome version
44.0.2403.89 or later.
CVSS Score:
9.3
CVSS Vector:
AV:N/AC:M/Au:N/C:C/I:C/A:C
|
