漏洞信息
Multiple security issues were discovered in Chromium.
It was discovered that the PPAPI implementation does not validate the origin of IPC messages to the plugin broker process.
It was discovered that Blink does not prevent window creation by a deferred frame.
It was discovered that Blink does not disable frame navigation during a detach operation on a DocumentLoader object.
A use-after-free was discovered in Blink.
It was discovered that objects.
A memory corruption was discovered in V8.
A security issue was discovered in Chromium.
A use-after-free was discovered in libxml.
The Service Workers implementation in Chromium does not properly implement the Secure Contexts specification during decisions about whether to control a subframe.
It was discovered that Chromium mishandles origin information during proxy authentication.
It was discovered that the Proxy Auto-Config (PAC) feature in Chromium does not ensure that URL information is restricted to a scheme, host and port.
It was discovered that Blink does not consider referrer-policy information inside an HTML document during a preload request.
It was discovered that the Content Security Policy (CSP) implementation in Blink does not apply http :80 policies to https :443 URLs.
漏洞危害
If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial of service (application crash) or execute arbitrary code. (CVE-2016-1705)
A remote attacker could potentially exploit this to bypass sandbox protection mechanisms. (CVE-2016-1706)
A remote attacker could potentially exploit this to bypass same origin restrictions. (CVE-2016-1710)
A remote attacker could potentially exploit this to bypass same origin restrictions. (CVE-2016-1711)
If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via renderer process crash, or execute arbitrary code. (CVE-2016-5127)
cc in V8 does not prevent API interceptors from modifying a store target without setting a property. A remote attacker could potentially exploit this to bypass same origin restrictions. (CVE-2016-5128)
If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via renderer process crash, or execute arbitrary code. (CVE-2016-5129)
A remote attacker could potentially exploit this to spoof the currently displayed URL. (CVE-2016-5130)
If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via renderer process crash, or execute arbitrary code. (CVE-2016-5131)
A remote attacker could potentially exploit this to bypass same origin restrictions. (CVE-2016-5132)
A man-in-the-middle attacker could potentially exploit this to spoof a proxy authentication login prompt. (CVE-2016-5133)
A remote attacker could potentially exploit this to obtain sensitive information. (CVE-2016-5134)
A remote attacker could potentially exploit this to bypass Content Security Policy (CSP) protections. (CVE-2016-5135)
A remote attacker could potentially exploit this to determine whether a specific HSTS web site has been visited by reading a CSP report. (CVE-2016-5137)
解决方案
Refer to Ubuntu advisory USN-3041-1 for affected packages and patching details, or update with your package manager.
Patch:
Following are links for downloading patches to fix the vulnerabilities:
www.0daybank.org
文章评论