Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2017.0708
chromium-browser security update
16 March 2017
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: chromium-browser
Publisher: Debian
Operating System: Debian GNU/Linux 8
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Denial of Service -- Remote with User Interaction
Provide Misleading Information -- Remote with User Interaction
Access Confidential Data -- Remote with User Interaction
Reduced Security -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2017-5046 CVE-2017-5045 CVE-2017-5044
CVE-2017-5043 CVE-2017-5042 CVE-2017-5041
CVE-2017-5040 CVE-2017-5039 CVE-2017-5038
CVE-2017-5037 CVE-2017-5036 CVE-2017-5035
CVE-2017-5034 CVE-2017-5033 CVE-2017-5032
CVE-2017-5031 CVE-2017-5030 CVE-2017-5029
Reference: ASB-2017.0024
ESB-2017.0679
Original Bulletin:
http://www.debian.org/security/2017/dsa-3810
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-3810-1 security@debian.org
https://www.debian.org/security/ Michael Gilbert
March 15, 2017 https://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : chromium-browser
CVE ID : CVE-2017-5029 CVE-2017-5030 CVE-2017-5031 CVE-2017-5032
CVE-2017-5033 CVE-2017-5034 CVE-2017-5035 CVE-2017-5036
CVE-2017-5037 CVE-2017-5038 CVE-2017-5039 CVE-2017-5040
CVE-2017-5041 CVE-2017-5042 CVE-2017-5043 CVE-2017-5044
CVE-2017-5045 CVE-2017-5046
Several vulnerabilities have been discovered in the chromium web browser.
CVE-2017-5029
Holger Fuhrmannek discovered an integer overflow issue in the libxslt
library.
CVE-2017-5030
Brendon Tiszka discovered a memory corruption issue in the v8 javascript
library.
CVE-2017-5031
Looben Yang discovered a use-after-free issue in the ANGLE library.
CVE-2017-5032
Ashfaq Ansari discovered an out-of-bounds write in the pdfium library.
CVE-2017-5033
Nicolai Grødum discovered a way to bypass the Content Security Policy.
CVE-2017-5034
Ke Liu discovered an integer overflow issue in the pdfium library.
CVE-2017-5035
Enzo Aguado discovered an issue with the omnibox.
CVE-2017-5036
A use-after-free issue was discovered in the pdfium library.
CVE-2017-5037
Yongke Wang discovered multiple out-of-bounds write issues.
CVE-2017-5038
A use-after-free issue was discovered in the guest view.
CVE-2017-5039
jinmo123 discovered a use-after-free issue in the pdfium library.
CVE-2017-5040
Choongwoo Han discovered an information disclosure issue in the v8
javascript library.
CVE-2017-5041
Jordi Chancel discovered an address spoofing issue.
CVE-2017-5042
Mike Ruddy discovered incorrect handling of cookies.
CVE-2017-5043
Another use-after-free issue was discovered in the guest view.
CVE-2017-5044
Kushal Arvind Shah discovered a heap overflow issue in the skia
library.
CVE-2017-5045
Dhaval Kapil discovered an information disclosure issue.
CVE-2017-5046
Masato Kinugawa discovered an information disclosure issue.
For the stable distribution (jessie), these problems have been fixed in
version 57.0.2987.98-1~deb8u1.
For the upcoming stable (stretch) and unstable (sid) distributions, these
problems have been fixed in version 57.0.2987.98-1.
We recommend that you upgrade your chromium-browser packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
iQQzBAEBCgAdFiEEluhy7ASCBulP9FUWuNayzQLW9HMFAljJMRkACgkQuNayzQLW
9HM36B/+NXUUQ3TCDWQt+FYXtqla6j+BnUTBAsKTbmZwbz5/gAxRymzm835ilVyw
r0sn4JOffZdKEmkdkHSSXwk8UQqPL2vfnQq8PQKbWvZlkmoMmxDdMNWoggRx/c6c
LTUAjE/tpy1P3VBd4YdFa7fpb/M5LSpHxs36O25ZvuN6woi8zbKYLJBD+jQ5U4F+
pVO6Lgdou/26TJGq/lZ0Lfypj1esndfwxoIKCJBS845o1bdZusRynUbSyI1fV/YL
Y9mkwEO1LsoGBFqlroOMlzcfRY8/pG0tRN++mebSEsh6TOFQpq+1qq1/DkyhCFKS
o6deeZjYYy5CGdbx6gxPp7J8HQry4JvjV5Rj1g8vfVdJwb6i33dTZEKDghPm48pu
gr2BfF2EXlGwhe+JaXmZkoEVOpX4dPnOcVgrpD0FXDJoVyqrVCo410L0MZug90Xr
eTCOPVrnCHRhCfRoYyRlZASuH+HtgrD8Qy+NGUx/ZxK5Zg2Ck1+XDJLMLdwn3Y7N
5s+beUU4n0rR6O7tX8JDwx0qieloCqg2ZOACOCjy312gDt4R7kxcr+P4RxQ9tXgc
o8AN1NIWNxQPovLYMD2JGD0iWt1hUmNHtbscl8MllugKv+nfgFpTNpviAqEFOpw/
9W/o10h+lIO/yr4Den75h3QU+vPR/7V4zOlyr6PtDbIo8EwWKvy4BCGMNKtREaB2
42vGXuBqzup91wIR9YU8ZWNhdtL1tWLJQZFDnMY3RurpFmH37m4G0Ni8+vvzXwWK
mEtjC9wLfTWZQ+mWXHjBGXlkRivpnppOCYhfNvGOQ9HtPKX6YBZrM+k5afzKS+z4
uZKMxN5EcA+/6s8d3h5oyzg9auvu4Zf/ifBNSzc8XF7sE6MgxU5KtMpwsBvsUwcR
VGIVBzJFZAADbBQxF24+lSxA/fMkfrZC61CEZEHdMBWN/k5UUH1tjUviE5pRusuc
3SRQ2/PSCOZ2uTbJsv4J4KooOlgMl2wJCL7nyww7OaHSB7WXqxg+QWh+dMI3oQt9
k3SJcbc9y94FNPUPWzY2CZo1/Nr/7jJLOnXYtZvb000lEF+cYgpX35u+gfIf9a+R
bgSPbkY1B6vRmlTJ0zt/eC0ENV23D0wrG/JT4AysW1P1zQF+AH8pUiFsKfGcF1zF
RFPsMzkfI6K+hFZdfV02eznaL89jQqPmk09ZN558NoTu43ct1QLJMSzVqK1K4ORQ
39C54f6x5j1zy+fl3IvUsbGY6PKfMwDPo+W2X5ze7wI9wHcgSKEmkCMEw0DGvsKy
8SjOyJKN0YDTvyFN6hFcIJO+HHnfvWOy2et3FxZyQWudYvYjnGnFcDDz1yzxuda+
SkaB2j+BgAQPYBXZoylBjGc+izT9qA==
=8dUe
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBWMoj4Yx+lLeg9Ub1AQjAXA/+PvCbbV9toOnvGW+My446bySjjlAPYszw
xVZiA0r5fgcnEjbRipb23xkkSNbnJayfCvPgzVALvhhCKLyqZ1jBj0FAuP27gS95
F5z5kO2jJT9H9oPt397835Wu2NQfcmXsv5z6caWiSny0ODK5R7tk1f8h/JqUyw1Q
JLuqmOrGKT78x4uyIeHYHsM/DNTGVibcWPy+eyV7YAjlPxvER2lh103DYkTfGWcm
BnLhVdcEu+0XY5ZVHYb2I25qoahFZFG/hnTlDY2Lx7canpWS3NiubG5GcMVxMGfr
0icQn6FWFFP69GRgBpWdKofzPYO8NzsPcKkySCfHsRbZDM82VTM1gQXHbMo5dy9N
uD/TOodqAj+fsUWRDec2kgTKyrtydm4s9S9tiW024dzZa39AwfOuG4NYCPHxA8pE
v3o5Q6/EmymNzPgfwU4MyMFrH4Cez9EVw1IfFcA8GfKmvE/bjqzEJI8EEsISKYGf
kiO7qm5jFsmwyckDP5J7y8z4OivrEzCD2gc5WOZ8n2jfAIEgPUiAwWnXAdVHtkYf
Ojsx++EGLnFbpeSTy0v2YuJEzrvCXEMgM9t+pm7WzuYd5tnSVVc1FzF89gRnI7UZ
sxe4e9NV8GX/dprU0Y+k2U5BCuhfxQwvaYEZDY3jNAlS20ejzlZLZLXPcBrot7SY
NT+pucfUdUg=
=oGIr
-----END PGP SIGNATURE-----