ID CVE-2016-5201
Summary A leak of privateClass in the extensions API in Google Chrome prior to 54.0.2840.100 for Linux, and 54.0.2840.99 for Windows, and 54.0.2840.98 for Mac allowed a remote attacker to access privileged JavaScript code via a crafted HTML page.
References
Vulnerable Configurations
  • Google Chrome 54.0.2840.87
    cpe:2.3:a:google:chrome:54.0.2840.87
CVSS
Base: 4.3 (as of 19-01-2017 - 18:00)
Impact:
Exploitability:
CWE CWE-200
CAPEC
  • Subverting Environment Variable Values
    The attacker directly or indirectly modifies environment variables used by or controlling the target software. The attacker's goal is to cause the target software to deviate from its expected operation in a manner that benefits the attacker.
  • Footprinting
    An attacker engages in probing and exploration activity to identify constituents and properties of the target. Footprinting is a general term to describe a variety of information gathering techniques, often used by attackers in preparation for some attack. It consists of using tools to learn as much as possible about the composition, configuration, and security mechanisms of the targeted application, system or network. Information that might be collected during a footprinting effort could include open ports, applications and their versions, network topology, and similar information. While footprinting is not intended to be damaging (although certain activities, such as network scans, can sometimes cause disruptions to vulnerable applications inadvertently) it may often pave the way for more damaging attacks.
  • Exploiting Trust in Client (aka Make the Client Invisible)
    An attack of this type exploits a programs' vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by placing themselves in the communication channel between client and server such that communication directly to the server is possible where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
  • Browser Fingerprinting
    An attacker carefully crafts small snippets of Java Script to efficiently detect the type of browser the potential victim is using. Many web-based attacks need prior knowledge of the web browser including the version of browser to ensure successful exploitation of a vulnerability. Having this knowledge allows an attacker to target the victim with attacks that specifically exploit known or zero day weaknesses in the type and version of the browser used by the victim. Automating this process via Java Script as a part of the same delivery system used to exploit the browser is considered more efficient as the attacker can supply a browser fingerprinting method and integrate it with exploit code, all contained in Java Script and in response to the same web page request by the browser.
  • Session Credential Falsification through Prediction
    This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.
  • Reusing Session IDs (aka Session Replay)
    This attack targets the reuse of valid session ID to spoof the target system in order to gain privileges. The attacker tries to reuse a stolen session ID used previously during a transaction to perform spoofing and session hijacking. Another name for this type of attack is Session Replay.
  • Using Slashes in Alternate Encoding
    This attack targets the encoding of the Slash characters. An attacker would try to exploit common filtering problems related to the use of the slashes characters to gain access to resources on the target host. Directory-driven systems, such as file systems and databases, typically use the slash character to indicate traversal between directories or other container components. For murky historical reasons, PCs (and, as a result, Microsoft OSs) choose to use a backslash, whereas the UNIX world typically makes use of the forward slash. The schizophrenic result is that many MS-based systems are required to understand both forms of the slash. This gives the attacker many opportunities to discover and abuse a number of common filtering problems. The goal of this pattern is to discover server software that only applies filters to one version, but not the other.
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL NONE NONE
nessus via4
  • NASL family Windows
    NASL id GOOGLE_CHROME_54_0_2840_99.NASL
    description The version of Google Chrome installed on the remote Windows host is prior to 54.0.2840.99. It is, therefore, affected by the following vulnerabilities : - A remote code execution vulnerability exists in the FFmpeg component due to an integer overflow condition in the mov_read_keys() function in mov.c caused by improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, by convincing a user to visit a website containing specially crafted content, to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-5199) - A denial of service vulnerability exists in the V8 component due to an out-of-bounds read error that is triggered when handling 'Math.sign'. An unauthenticated, remote attacker can exploit this, by convincing a user to visit a website containing specially crafted content, to crash the browser or disclose memory contents. (CVE-2016-5200) - An information disclosure vulnerability exists due to a flaw in the expose() function in utils.js. An unauthenticated, remote attacker can exploit this, by convincing a user to visit a website containing specially crafted content, to disclose sensitive internal class information. (CVE-2016-5201) - An unspecified vulnerability exists in the PruneExpiredDevices() function in dial_registry.cc that allows an unauthenticated, remote attacker to have an unspecified impact. (CVE-2016-5202) Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
    last seen 2019-02-21
    modified 2018-07-12
    plugin id 94676
    published 2016-11-10
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=94676
    title Google Chrome < 54.0.2840.99 Multiple Vulnerabilities
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-3731.NASL
    description Several vulnerabilities have been discovered in the chromium web browser. - CVE-2016-5181 A cross-site scripting issue was discovered. - CVE-2016-5182 Giwan Go discovered a heap overflow issue. - CVE-2016-5183 A use-after-free issue was discovered in the pdfium library. - CVE-2016-5184 Another use-after-free issue was discovered in the pdfium library. - CVE-2016-5185 cloudfuzzer discovered a use-after-free issue in Blink/Webkit. - CVE-2016-5186 Abdulrahman Alqabandi discovered an out-of-bounds read issue in the developer tools. - CVE-2016-5187 Luan Herrera discovered a URL spoofing issue. - CVE-2016-5188 Luan Herrera discovered that some drop down menus can be used to hide parts of the user interface. - CVE-2016-5189 xisigr discovered a URL spoofing issue. - CVE-2016-5190 Atte Kettunen discovered a use-after-free issue. - CVE-2016-5191 Gareth Hughes discovered a cross-site scripting issue. - CVE-2016-5192 haojunhou@gmail.com discovered a same-origin bypass. - CVE-2016-5193 Yuyang Zhou discovered a way to pop open a new window. - CVE-2016-5194 The chrome development team found and fixed various issues during internal auditing. - CVE-2016-5198 Tencent Keen Security Lab discovered an out-of-bounds memory access issue in the v8 JavaScript library. - CVE-2016-5199 A heap corruption issue was discovered in the ffmpeg library. - CVE-2016-5200 Choongwoo Han discovered an out-of-bounds memory access issue in the v8 JavaScript library. - CVE-2016-5201 Rob Wu discovered an information leak. - CVE-2016-5202 The chrome development team found and fixed various issues during internal auditing. - CVE-2016-5203 A use-after-free issue was discovered in the pdfium library. - CVE-2016-5204 Mariusz Mlynski discovered a cross-site scripting issue in SVG image handling. - CVE-2016-5205 A cross-site scripting issue was discovered. - CVE-2016-5206 Rob Wu discovered a same-origin bypass in the pdfium library. - CVE-2016-5207 Mariusz Mlynski discovered a cross-site scripting issue. - CVE-2016-5208 Mariusz Mlynski discovered another cross-site scripting issue. - CVE-2016-5209 Giwan Go discovered an out-of-bounds write issue in Blink/Webkit. - CVE-2016-5210 Ke Liu discovered an out-of-bounds write in the pdfium library. - CVE-2016-5211 A use-after-free issue was discovered in the pdfium library. - CVE-2016-5212 Khalil Zhani discovered an information disclosure issue in the developer tools. - CVE-2016-5213 Khalil Zhani discovered a use-after-free issue in the v8 JavaScript library. - CVE-2016-5214 Jonathan Birch discovered a file download protection bypass. - CVE-2016-5215 Looben Yang discovered a use-after-free issue. - CVE-2016-5216 A use-after-free issue was discovered in the pdfium library. - CVE-2016-5217 Rob Wu discovered a condition where data was not validated by the pdfium library. - CVE-2016-5218 Abdulrahman Alqabandi discovered a URL spoofing issue. - CVE-2016-5219 Rob Wu discovered a use-after-free issue in the v8 JavaScript library. - CVE-2016-5220 Rob Wu discovered a way to access files on the local system. - CVE-2016-5221 Tim Becker discovered an integer overflow issue in the angle library. - CVE-2016-5222 xisigr discovered a URL spoofing issue. - CVE-2016-5223 Hwiwon Lee discovered an integer overflow issue in the pdfium library. - CVE-2016-5224 Roeland Krak discovered a same-origin bypass in SVG image handling. - CVE-2016-5225 Scott Helme discovered a Content Security Protection bypass. - CVE-2016-5226 Jun Kokatsu discovered a cross-scripting issue. - CVE-2016-9650 Jakub Zoczek discovered a Content Security Protection information disclosure. - CVE-2016-9651 Guang Gong discovered a way to access private data in the v8 JavaScript library. - CVE-2016-9652 The chrome development team found and fixed various issues during internal auditing.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 95667
    published 2016-12-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=95667
    title Debian DSA-3731-1 : chromium-browser - security update
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_GOOGLE_CHROME_54_0_2840_98.NASL
    description The version of Google Chrome installed on the remote macOS or Mac OS X host is prior to 54.0.2840.98. It is, therefore, affected by the following vulnerabilities : - A remote code execution vulnerability exists in the FFmpeg component due to an integer overflow condition in the mov_read_keys() function in mov.c caused by improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, by convincing a user to visit a website containing specially crafted content, to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-5199) - A denial of service vulnerability exists in the V8 component due to an out-of-bounds read error that is triggered when handling 'Math.sign'. An unauthenticated, remote attacker can exploit this, by convincing a user to visit a website containing specially crafted content, to crash the browser or disclose memory contents. (CVE-2016-5200) - An information disclosure vulnerability exists due to a flaw in the expose() function in utils.js. An unauthenticated, remote attacker can exploit this, by convincing a user to visit a website containing specially crafted content, to disclose sensitive internal class information. (CVE-2016-5201) - An unspecified vulnerability exists in the PruneExpiredDevices() function in dial_registry.cc that allows an unauthenticated, remote attacker to have an unspecified impact. (CVE-2016-5202) Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
    last seen 2019-02-21
    modified 2018-07-14
    plugin id 94677
    published 2016-11-10
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=94677
    title Google Chrome < 54.0.2840.98 Multiple Vulnerabilities (macOS)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2016-2718.NASL
    description An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Chromium is an open source web browser, powered by WebKit (Blink). This update upgrades Chromium to version 54.0.2840.100. Security Fix(es) : * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when visited by the victim. (CVE-2016-5199, CVE-2016-5200, CVE-2016-5202, CVE-2016-5201)
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 94897
    published 2016-11-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=94897
    title RHEL 6 : chromium-browser (RHSA-2016:2718)
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201611-16.NASL
    description The remote host is affected by the vulnerability described in GLSA-201611-16 (Chromium: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in the Chromium web browser. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, obtain sensitive information, or bypass security restrictions. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2017-01-23
    plugin id 95267
    published 2016-11-23
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=95267
    title GLSA-201611-16 : Chromium: Multiple vulnerabilities
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2016-1292.NASL
    description This update to Chromium 54.0.2840.100 fixes the following vulnerabilities : - CVE-2016-5199: Heap corruption in FFmpeg (boo#1009892) - CVE-2016-5200: out of bounds memory access in v8 (boo#1009893) - CVE-2016-5201: info leak in extensions (boo#1009894) - CVE-2016-5202: various fixes from internal audits (boo#1009895)
    last seen 2019-02-21
    modified 2017-01-23
    plugin id 94894
    published 2016-11-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=94894
    title openSUSE Security Update : Chromium (openSUSE-2016-1292)
  • NASL family FreeBSD Local Security Checks
    NASL id FREEBSD_PKG_A3473F5AA73911E6AFAAE8E0B747A45A.NASL
    description Google Chrome Releases reports : 4 security fixes in this release, including : - [643948] High CVE-2016-5199: Heap corruption in FFmpeg. Credit to Paul Mehta - [658114] High CVE-2016-5200: Out of bounds memory access in V8. Credit to Choongwoo Han - [660678] Medium CVE-2016-5201: Info leak in extensions. Credit to Rob Wu - [662843] CVE-2016-5202: Various fixes from internal audits, fuzzing and other initiatives
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 94693
    published 2016-11-11
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=94693
    title FreeBSD : chromium -- multiple vulnerabilities (a3473f5a-a739-11e6-afaa-e8e0b747a45a)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2016-E0E1CB2B2B.NASL
    description Update to Chromium 55. Security fix for CVE-2016-5199, CVE-2016-5200, CVE-2016-5201, CVE-2016-5202, CVE-2016-9651, CVE-2016-5208, CVE-2016-5207, CVE-2016-5206, CVE-2016-5205, CVE-2016-5204, CVE-2016-5209, CVE-2016-5203, CVE-2016-5210, CVE-2016-5212, CVE-2016-5211, CVE-2016-5213, CVE-2016-5214, CVE-2016-5216, CVE-2016-5215, CVE-2016-5217, CVE-2016-5218, CVE-2016-5219, CVE-2016-5221, CVE-2016-5220, CVE-2016-5222, CVE-2016-9650, CVE-2016-5223, CVE-2016-5226, CVE-2016-5225, CVE-2016-5224, CVE-2016-9652 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-05-23
    plugin id 95906
    published 2016-12-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=95906
    title Fedora 24 : chromium (2016-e0e1cb2b2b)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2017-AE1FDE5FB8.NASL
    description This update updates QtWebEngine to the 5.8.0 release. QtWebEngine 5.8.0 is part of the Qt 5.8.0 release, but only the QtWebEngine component is included in this update. The update fixes the following security issues in QtWebEngine 5.7.1: CVE-2016-5182, CVE-2016-5183, CVE-2016-5189, CVE-2016-5199, CVE-2016-5201, CVE-2016-5203, CVE-2016-5204, CVE-2016-5205, CVE-2016-5206, CVE-2016-5208, CVE-2016-5207, CVE-2016-5210, CVE-2016-5211, CVE-2016-5212, CVE-2016-5213, CVE-2016-5214, CVE-2016-5215. CVE-2016-5216, CVE-2016-5217, CVE-2016-5218, CVE-2016-5219, CVE-2016-5221, CVE-2016-5222, CVE-2016-5223, CVE-2016-5224, CVE-2016-5225, CVE-2016-9650 and CVE-2016-9651. Other immediately usable changes in QtWebEngine 5.8 include : - Based on Chromium 53.0.2785.148 with security fixes from Chromium up to version 55.0.2883.75. (5.7.1 was based on Chromium 49.0.2623.111 with security fixes from Chromium up to version 54.0.2840.87.) - The `view-source:` scheme is now supported. - User scripts now support metadata (`@include`, `@exclude`, `@match`) as in Greasemonkey. - Some `chrome:` schemes now supported, for instance `chrome://gpu`. - Several bugs were fixed, see https://code.qt.io/cgit/qt/qtwebengine.git/tree/dist/cha nges-5.8.0 for details. The following changes in QtWebEngine 5.8 require compile-time application support and will only be available after applications are rebuilt (and patched to remove the checks for Qt 5.8, because Qt is still version 5.7.1, only QtWebEngine is being updated) : - Spellchecking with a forked version of Hunspell. This Fedora package automatically converts system Hunspell dictionaries (installed by system RPMs into the systemwide location) to the Chromium `bdic` format used by QtWebEngine (using an RPM file trigger). If you wish to use dictionaries installed manually, use the included `qwebengine_convert_dict` tool. Alternatively, you can also download dictionaries directly in the Chromium `bdic` format. - Support for printing directly to a printer. (Note that QupZilla already supports printing to a printer, because it can use the printToPdf API that has existed since QtWebEngine 5.7 to print to a printer with the help of the `lpr` command-line tool. But other applications such as KMail require the new direct printing API.) - Added a setting to enable printing of CSS backgrounds. The following new QML APIs are available to developers : - Tooltips (HTML5 global title attribute) are now also supported in the QML API. - Qt WebEngine (QML) allows defining custom dialogs / context menus. - Qt WebEngine (QML) on `eglfs` uses builtin dialogs based on Qt Quick Controls 2. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-05-23
    plugin id 99415
    published 2017-04-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99415
    title Fedora 25 : qt5-qtwebengine (2017-ae1fde5fb8)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2017-C5B2C9A435.NASL
    description This update updates QtWebEngine to the 5.8.0 release. QtWebEngine 5.8.0 is part of the Qt 5.8.0 release, but only the QtWebEngine component is included in this update. The update fixes the following security issues in QtWebEngine 5.7.1: CVE-2016-5182, CVE-2016-5183, CVE-2016-5189, CVE-2016-5199, CVE-2016-5201, CVE-2016-5203, CVE-2016-5204, CVE-2016-5205, CVE-2016-5206, CVE-2016-5208, CVE-2016-5207, CVE-2016-5210, CVE-2016-5211, CVE-2016-5212, CVE-2016-5213, CVE-2016-5214, CVE-2016-5215. CVE-2016-5216, CVE-2016-5217, CVE-2016-5218, CVE-2016-5219, CVE-2016-5221, CVE-2016-5222, CVE-2016-5223, CVE-2016-5224, CVE-2016-5225, CVE-2016-9650 and CVE-2016-9651. Other immediately usable changes in QtWebEngine 5.8 include : - Based on Chromium 53.0.2785.148 with security fixes from Chromium up to version 55.0.2883.75. (5.7.1 was based on Chromium 49.0.2623.111 with security fixes from Chromium up to version 54.0.2840.87.) - The `view-source:` scheme is now supported. - User scripts now support metadata (`@include`, `@exclude`, `@match`) as in Greasemonkey. - Some `chrome:` schemes now supported, for instance `chrome://gpu`. - Several bugs were fixed, see https://code.qt.io/cgit/qt/qtwebengine.git/tree/dist/cha nges-5.8.0 for details. The following changes in QtWebEngine 5.8 require compile-time application support and will only be available after applications are rebuilt (and patched to remove the checks for Qt 5.8, because Qt is still version 5.7.1, only QtWebEngine is being updated) : - Spellchecking with a forked version of Hunspell. This Fedora package automatically converts system Hunspell dictionaries (installed by system RPMs into the systemwide location) to the Chromium `bdic` format used by QtWebEngine (using an RPM file trigger). If you wish to use dictionaries installed manually, use the included `qwebengine_convert_dict` tool. Alternatively, you can also download dictionaries directly in the Chromium `bdic` format. - Support for printing directly to a printer. (Note that QupZilla already supports printing to a printer, because it can use the printToPdf API that has existed since QtWebEngine 5.7 to print to a printer with the help of the `lpr` command-line tool. But other applications such as KMail require the new direct printing API.) - Added a setting to enable printing of CSS backgrounds. The following new QML APIs are available to developers : - Tooltips (HTML5 global title attribute) are now also supported in the QML API. - Qt WebEngine (QML) allows defining custom dialogs / context menus. - Qt WebEngine (QML) on `eglfs` uses builtin dialogs based on Qt Quick Controls 2. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-05-23
    plugin id 101716
    published 2017-07-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=101716
    title Fedora 26 : qt5-qtwebengine (2017-c5b2c9a435)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2016-A815B7BF5D.NASL
    description Update to Chromium 55. Security fix for CVE-2016-5199, CVE-2016-5200, CVE-2016-5201, CVE-2016-5202, CVE-2016-9651, CVE-2016-5208, CVE-2016-5207, CVE-2016-5206, CVE-2016-5205, CVE-2016-5204, CVE-2016-5209, CVE-2016-5203, CVE-2016-5210, CVE-2016-5212, CVE-2016-5211, CVE-2016-5213, CVE-2016-5214, CVE-2016-5216, CVE-2016-5215, CVE-2016-5217, CVE-2016-5218, CVE-2016-5219, CVE-2016-5221, CVE-2016-5220, CVE-2016-5222, CVE-2016-9650, CVE-2016-5223, CVE-2016-5226, CVE-2016-5225, CVE-2016-5224, CVE-2016-9652 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-05-23
    plugin id 95903
    published 2016-12-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=95903
    title Fedora 25 : chromium (2016-a815b7bf5d)
redhat via4
advisories
rhsa
id RHSA-2016:2718
refmap via4
bid 94196
confirm
gentoo GLSA-201611-16
sectrack 1037273
Last major update 20-01-2017 - 10:22
Published 19-01-2017 - 00:59
Last modified 04-01-2018 - 21:30
Back to Top