Multiple vulnerabilities in Google Chrome

Beschreibung

Multiple serious vulnerabilities have been found in Google Chrome prior to 55.0.2883.75. Malicious users can exploit these vulnerabilities to bypass security restrictions, make code injections and possibly cause denial of service, obtain sensitive information.

Below is a complete list of vulnerabilities:

1. Incorrectly handled iframes in Blink can be exploited remotely via a specially designed HTML page to bypass security restrictions (a no-referrer policy);
2. A use-after-free vulnerability in PDFium can be exploited remotely to possibly cause a denial of service or obtain sensitive information;
3. Corruption of the DOM tree in Blink can be exploited remotely via a specially designed HTML page to inject HTML (UXSS) or arbitrary scripts;
4. Incorrect handling of deferred page loads in Blink can be exploited remotely via a specially designed HTML page to inject HTML (UXSS) or arbitrary scripts.

---

Technical details

Vulnerability (3) can be triggered by leaking of an SVG shadow tree.

Ursprüngliche Informationshinweise

• Stable Channel Update for Desktop

CVE Liste

• CVE-2016-5205
  high
• CVE-2016-5204
  high
• CVE-2016-5203
  high
• CVE-2016-9650
  high

Mehr erfahren

Informieren Sie sich über die Statistiken der in Ihrer Region verbreiteten Sicherheitslücken statistics.securelist.com