DSA-3637-1 chromium-browser -- security update

Debian Security Advisory

DSA-3637-1 chromium-browser -- security update

Date Reported:

31 Jul 2016

Affected Packages:

chromium-browser

Vulnerable:

Yes

Security database references:

In Mitre's CVE dictionary: CVE-2016-1704, CVE-2016-1705, CVE-2016-1706, CVE-2016-1707, CVE-2016-1708, CVE-2016-1709, CVE-2016-1710, CVE-2016-1711, CVE-2016-5127, CVE-2016-5128, CVE-2016-5129, CVE-2016-5130, CVE-2016-5131, CVE-2016-5132, CVE-2016-5133, CVE-2016-5134, CVE-2016-5135, CVE-2016-5136, CVE-2016-5137.

More information:

Several vulnerabilities have been discovered in the chromium web browser.

• CVE-2016-1704

  The chrome development team found and fixed various issues during internal auditing.

• CVE-2016-1705

  The chrome development team found and fixed various issues during internal auditing.

• CVE-2016-1706

  Pinkie Pie discovered a way to escape the Pepper Plugin API sandbox.

• CVE-2016-1707

  xisigr discovered a URL spoofing issue.

• CVE-2016-1708

  Adam Varsan discovered a use-after-free issue.

• CVE-2016-1709

  ChenQin discovered a buffer overflow issue in the sfntly library.

• CVE-2016-1710

  Mariusz Mlynski discovered a same-origin bypass.

• CVE-2016-1711

  Mariusz Mlynski discovered another same-origin bypass.

• CVE-2016-5127

  cloudfuzzer discovered a use-after-free issue.

• CVE-2016-5128

  A same-origin bypass issue was discovered in the v8 javascript library.

• CVE-2016-5129

  Jeonghoon Shin discovered a memory corruption issue in the v8 javascript library.

• CVE-2016-5130

  Widih Matar discovered a URL spoofing issue.

• CVE-2016-5131

  Nick Wellnhofer discovered a use-after-free issue in the libxml2 library.

• CVE-2016-5132

  Ben Kelly discovered a same-origin bypass.

• CVE-2016-5133

  Patch Eudor discovered an issue in proxy authentication.

• CVE-2016-5134

  Paul Stone discovered an information leak in the Proxy Auto-Config feature.

• CVE-2016-5135

  ShenYeYinJiu discovered a way to bypass the Content Security Policy.

• CVE-2016-5136

  Rob Wu discovered a use-after-free issue.

• CVE-2016-5137

  Xiaoyin Liu discovered a way to discover whether an HSTS web site had been visited.

For the stable distribution (jessie), these problems have been fixed in version 52.0.2743.82-1~deb8u1.

For the testing (stretch) and unstable (sid) distributions, these problems have been fixed in version 52.0.2743.82-1.

We recommend that you upgrade your chromium-browser packages.