{"id":"MGASA-2015-0235","summary":"Updated chromium-browser-stable packages fix security vulnerabilities","details":"Chromium-browser 43.0.2357.65 fixes a number of security issues:\n\nUse-after-free vulnerability in the SpeechRecognitionClient implementation \nin the Speech subsystem in Google Chrome before 43.0.2357.65 allows remote \nattackers to execute arbitrary code via a crafted document. (CVE-2015-1251)\n\ncommon/partial_circular_buffer.cc in Google Chrome before 43.0.2357.65 does \nnot properly handle wraps, which allows remote attackers to bypass a \nsandbox protection mechanism or cause a denial of service (out-of-bounds \nwrite) via vectors that trigger a write operation with a large amount of \ndata, related to the PartialCircularBuffer::Write and \nPartialCircularBuffer::DoWrite functions. (CVE-2015-1252)\n\ncore/html/parser/HTMLConstructionSite.cpp in the DOM implementation in \nBlink, as used in Google Chrome before 43.0.2357.65, allows remote \nattackers to bypass the Same Origin Policy via crafted JavaScript code that \nappends a child to a SCRIPT element, related to the insert and \nexecuteReparentTask functions. (CVE-2015-1253)\n\ncore/dom/Document.cpp in Blink, as used in Google Chrome before \n43.0.2357.65, enables the inheritance of the designMode attribute, which \nallows remote attackers to bypass the Same Origin Policy by leveraging the \navailability of editing. (CVE-2015-1254)\n\nUse-after-free vulnerability in \ncontent/renderer/media/webaudio_capturer_source.cc in the WebAudio \nimplementation in Google Chrome before 43.0.2357.65 allows remote attackers \nto cause a denial of service (heap memory corruption) or possibly have \nunspecified other impact by leveraging improper handling of a stop action \nfor an audio track. (CVE-2015-1255)\n\nUse-after-free vulnerability in the SVG implementation in Blink, as used in \nGoogle Chrome before 43.0.2357.65, allows remote attackers to cause a \ndenial of service or possibly have unspecified other impact via a crafted \ndocument that leverages improper handling of a shadow tree for a use \nelement. (CVE-2015-1256)\n\nplatform/graphics/filters/FEColorMatrix.cpp in the SVG implementation in \nBlink, as used in Google Chrome before 43.0.2357.65, does not properly \nhandle an insufficient number of values in an feColorMatrix filter, which \nallows remote attackers to cause a denial of service (container overflow) \nor possibly have unspecified other impact via a crafted document. \n(CVE-2015-1257)\n\nGoogle Chrome before 43.0.2357.65 relies on libvpx code that was not built \nwith an appropriate --size-limit value, which allows remote attackers to \ntrigger a negative value for a size field, and consequently cause a denial \nof service or possibly have unspecified other impact, via a crafted frame \nsize in VP9 video data. (CVE-2015-1258)\n\nPDFium, as used in Google Chrome before 43.0.2357.65, does not properly \ninitialize memory, which allows remote attackers to cause a denial of \nservice or possibly have unspecified other impact via unknown vectors. \n(CVE-2015-1259)\n\nMultiple use-after-free vulnerabilities in \ncontent/renderer/media/user_media_client_impl.cc in the WebRTC \nimplementation in Google Chrome before 43.0.2357.65 allow remote attackers \nto cause a denial of service or possibly have unspecified other impact via \ncrafted JavaScript code that executes upon completion of a getUserMedia \nrequest. (CVE-2015-1260)\n\nplatform/fonts/shaping/HarfBuzzShaper.cpp in Blink, as used in Google \nChrome before 43.0.2357.65, does not initialize a certain width field, \nwhich allows remote attackers to cause a denial of service or possibly have \nunspecified other impact via crafted Unicode text. (CVE-2015-1262)\n\nThe Spellcheck API implementation in Google Chrome before 43.0.2357.65 does \nnot use an HTTPS session for downloading a Hunspell dictionary, which \nallows man-in-the-middle attackers to deliver incorrect spelling \nsuggestions or possibly have unspecified other impact via a crafted file. \n(CVE-2015-1263)\n\nCross-site scripting (XSS) vulnerability in Google Chrome before \n43.0.2357.65 allows user-assisted remote attackers to inject arbitrary web \nscript or HTML via crafted data that is improperly handled by the Bookmarks \nfeature. (CVE-2015-1264)\n\nMultiple unspecified vulnerabilities in Google Chrome before 43.0.2357.65 \nallow attackers to cause a denial of service or possibly have other impact \nvia unknown vectors. (CVE-2015-1265)\n\nMultiple vulnerabilities in V8 have been fixed at the tip of the 4.3 branch \n(currently 4.3.61.21).\n","modified":"2026-04-16T06:23:39.671605882Z","published":"2015-05-23T18:53:02Z","upstream":["CVE-2015-1251","CVE-2015-1252","CVE-2015-1253","CVE-2015-1254","CVE-2015-1255","CVE-2015-1256","CVE-2015-1257","CVE-2015-1258","CVE-2015-1259","CVE-2015-1260","CVE-2015-1262","CVE-2015-1263","CVE-2015-1264","CVE-2015-1265"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2015-0235.html"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=15993"},{"type":"WEB","url":"http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html"}],"affected":[{"package":{"name":"chromium-browser-stable","ecosystem":"Mageia:4","purl":"pkg:rpm/mageia/chromium-browser-stable?arch=source&distro=mageia-4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"43.0.2357.65-1.mga4"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2015-0235.json"}}],"schema_version":"1.7.5","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}