DSA-3486-1 chromium-browser -- security update

Debian Security Advisory

DSA-3486-1 chromium-browser -- security update

Date Reported:

21 Feb 2016

Affected Packages:

chromium-browser

Vulnerable:

Yes

Security database references:

In Mitre's CVE dictionary: CVE-2016-1622, CVE-2016-1623, CVE-2016-1624, CVE-2016-1625, CVE-2016-1626, CVE-2016-1627, CVE-2016-1628, CVE-2016-1629.

More information:

Several vulnerabilities have been discovered in the chromium web browser.

• CVE-2016-1622

  It was discovered that a maliciously crafted extension could bypass the Same Origin Policy.

• CVE-2016-1623

  Mariusz Mlynski discovered a way to bypass the Same Origin Policy.

• CVE-2016-1624

  lukezli discovered a buffer overflow issue in the Brotli library.

• CVE-2016-1625

  Jann Horn discovered a way to cause the Chrome Instant feature to navigate to unintended destinations.

• CVE-2016-1626

  An out-of-bounds read issue was discovered in the openjpeg library.

• CVE-2016-1627

  It was discovered that the Developer Tools did not validate URLs.

• CVE-2016-1628

  An out-of-bounds read issue was discovered in the pdfium library.

• CVE-2016-1629

  A way to bypass the Same Origin Policy was discovered in Blink/WebKit, along with a way to escape the chromium sandbox.

For the stable distribution (jessie), these problems have been fixed in version 48.0.2564.116-1~deb8u1.

For the testing distribution (stretch), these problems will be fixed soon.

For the unstable distribution (sid), these problems have been fixed in version 48.0.2564.116-1.

We recommend that you upgrade your chromium-browser packages.