ALT Linux Team

Branch sisyphus update on 2016-01-16

2016-01-16

ALT-BU-2016-2540-1

Branch sisyphus update bulletin.

ALT-PU-2016-1029-1

Package chromium updated to version 47.0.2526.111-alt1 for branch sisyphus in task 155937.

Closed vulnerabilities

Published: 2016-01-25

BDU:2016-00385

Уязвимости браузера Google Chrome, позволяющие нарушителю вызвать отказ в обслуживании или оказать другое воздействие

Severity: CRITICAL (9.3)
References:
Published: 2016-01-25

BDU:2016-00389

Уязвимости браузера Google Chrome и библиотеки форматирования текста HarfBuzz, позволяющие нарушителю вызвать отказ в обслуживании или оказать другое воздействие

Severity: HIGH (7.5)
References:
Published: 2016-01-25

BDU:2016-00397

Уязвимость браузера Google Chrome, позволяющая нарушителю вызвать отказ в обслуживании или оказать другое воздействие

Severity: MEDIUM (6.8)
References:
Published: 2016-01-25

BDU:2016-00398

Уязвимости браузера Google Chrome, позволяющие нарушителю вызвать отказ в обслуживании или оказать другое воздействие

Severity: MEDIUM (6.8)
References:
Published: 2016-01-25

BDU:2016-00399

Уязвимость браузера Google Chrome, позволяющая нарушителю получить конфиденциальную информацию

Severity: MEDIUM (4.3)
References:
Published: 2016-01-25

BDU:2016-00400

Уязвимость браузера Google Chrome, позволяющая нарушителю подменить источник документа

Severity: MEDIUM (4.3)
References:
Published: 2016-01-25

BDU:2016-00401

Уязвимость браузера Google Chrome, позволяющая нарушителю подменить URL-адреса

Severity: MEDIUM (4.3)
References:
Published: 2016-01-25

BDU:2016-00402

Уязвимость браузера Google Chrome, позволяющая нарушителю определить, какой веб-сайт был посещен с использованием HSTS-соединения

Severity: MEDIUM (4.3)
References:
Published: 2016-01-25

BDU:2016-00403

Уязвимость браузера Google Chrome, позволяющая нарушителю взломать криптографический механизм защиты

Severity: MEDIUM (4.3)
References:
Published: 2016-01-25

BDU:2016-00404

Уязвимости браузера Google Chrome, позволяющие нарушителю вызвать отказ в обслуживании или оказать другое воздействие

Severity: MEDIUM (6.8)
References:
Published: 2016-01-25
Modified: 2024-11-21

CVE-2016-1612

The LoadIC::UpdateCaches function in ic/ic.cc in Google V8, as used in Google Chrome before 48.0.2564.82, does not ensure receiver compatibility before performing a cast of an unspecified variable, which allows remote attackers to cause a denial of service or possibly have unknown other impact via crafted JavaScript code.

Severity: HIGH (7.6) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
References:
Published: 2016-01-25
Modified: 2024-11-21

CVE-2016-1613

Multiple use-after-free vulnerabilities in the formfiller implementation in PDFium, as used in Google Chrome before 48.0.2564.82, allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document, related to improper tracking of the destruction of (1) IPWL_FocusHandler and (2) IPWL_Provider objects.

Severity: HIGH (7.6) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
References:
Published: 2016-01-25
Modified: 2024-11-21

CVE-2016-1614

The UnacceleratedImageBufferSurface class in WebKit/Source/platform/graphics/UnacceleratedImageBufferSurface.cpp in Blink, as used in Google Chrome before 48.0.2564.82, mishandles the initialization mode, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.

Severity: MEDIUM (4.3) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
References:
Published: 2016-01-25
Modified: 2024-11-21

CVE-2016-1615

The Omnibox implementation in Google Chrome before 48.0.2564.82 allows remote attackers to spoof a document's origin via unspecified vectors.

Severity: MEDIUM (6.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
References:
Published: 2016-01-25
Modified: 2024-11-21

CVE-2016-1616

The CustomButton::AcceleratorPressed function in ui/views/controls/button/custom_button.cc in Google Chrome before 48.0.2564.82 allows remote attackers to spoof URLs via vectors involving an unfocused custom button.

Severity: MEDIUM (4.3) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References:
Published: 2016-01-25
Modified: 2024-11-21

CVE-2016-1617

The CSPSource::schemeMatches function in WebKit/Source/core/frame/csp/CSPSource.cpp in the Content Security Policy (CSP) implementation in Blink, as used in Google Chrome before 48.0.2564.82, does not apply http policies to https URLs and does not apply ws policies to wss URLs, which makes it easier for remote attackers to determine whether a specific HSTS web site has been visited by reading a CSP report.

Severity: MEDIUM (4.3) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
References:
Published: 2016-01-25
Modified: 2024-11-21

CVE-2016-1618

Blink, as used in Google Chrome before 48.0.2564.82, does not ensure that a proper cryptographicallyRandomValues random number generator is used, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors.

Severity: MEDIUM (6.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
References:
Published: 2016-01-25
Modified: 2024-11-21

CVE-2016-1619

Multiple integer overflows in the (1) sycc422_to_rgb and (2) sycc444_to_rgb functions in fxcodec/codec/fx_codec_jpx_opj.cpp in PDFium, as used in Google Chrome before 48.0.2564.82, allow remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted PDF document.

Severity: HIGH (7.6) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
References:
Published: 2016-01-25
Modified: 2024-11-21

CVE-2016-1620

Multiple unspecified vulnerabilities in Google Chrome before 48.0.2564.82 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

Severity: HIGH (8.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References:
Published: 2016-01-25
Modified: 2024-11-21

CVE-2016-2052

Multiple unspecified vulnerabilities in HarfBuzz before 1.0.6, as used in Google Chrome before 48.0.2564.82, allow attackers to cause a denial of service or possibly have other impact via crafted data, as demonstrated by a buffer over-read resulting from an inverted length check in hb-ot-font.cc, a different issue than CVE-2015-8947.

Severity: HIGH (7.6) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
References:
VKontakte | Telegram | YouTube | Forum | GitHub | Bugzilla
Version: 2.1.0
Back to top