DSA-3594-1 chromium-browser -- security update

Debian Security Advisory

DSA-3594-1 chromium-browser -- security update

Date Reported:

04 Jun 2016

Affected Packages:

chromium-browser

Vulnerable:

Yes

Security database references:

In Mitre's CVE dictionary: CVE-2016-1696, CVE-2016-1697, CVE-2016-1698, CVE-2016-1699, CVE-2016-1700, CVE-2016-1701, CVE-2016-1702, CVE-2016-1703.

More information:

Several vulnerabilities have been discovered in the chromium web browser.

• CVE-2016-1696

  A cross-origin bypass was found in the bindings to extensions.

• CVE-2016-1697

  Mariusz Mlynski discovered a cross-origin bypass in Blink/Webkit.

• CVE-2016-1698

  Rob Wu discovered an information leak.

• CVE-2016-1699

  Gregory Panakkal discovered an issue in the Developer Tools feature.

• CVE-2016-1700

  Rob Wu discovered a use-after-free issue in extensions.

• CVE-2016-1701

  Rob Wu discovered a use-after-free issue in the autofill feature.

• CVE-2016-1702

  cloudfuzzer discovered an out-of-bounds read issue in the skia library.

For the stable distribution (jessie), these problems have been fixed in version 51.0.2704.79-1~deb8u1.

For the testing distribution (stretch), these problems will be fixed soon.

For the unstable distribution (sid), these problems have been fixed in version 51.0.2704.79-1.

We recommend that you upgrade your chromium-browser packages.