CVE-2016-5143
chromium-browser: Parameter sanitization failure in DevTools
Severidad por fuente
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según Red Hat (media), Ubuntu (media).
Descripción
The Developer Tools (aka DevTools) subsystem in Blink, as used in Google Chrome before 52.0.2743.116, mishandles the script-path hostname, remoteBase parameter, and remoteFrontendUrl parameter, which allows remote attackers to bypass intended access restrictions via a crafted URL, a different vulnerability than CVE-2016-5144.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| debian 7 | chromium-browser | sin corrección indicada |
| debian 8 | chromium-browser | 52.0.2743.116-1~deb8u1 |
| ubuntu 14.04 | chromium-browser, oxide-qt | 52.0.2743.116-0ubuntu0.14.04.1.1134 y 1 más |
| ubuntu 16.04 | chromium-browser, oxide-qt | 52.0.2743.116-0ubuntu0.16.04.1.1250 y 1 más |
| ubuntu 16.04-ESM | oxide-qt | 1.17.7-0ubuntu0.16.04.1 |
| ubuntu 16.10 | chromium-browser, oxide-qt | 53.0.2785.143-0ubuntu1.1307 y 1 más |
Mostrar las 9 entradas de 6 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| debian 7 | chromium-browser | sin corrección indicada |
| debian 8 | chromium-browser | 52.0.2743.116-1~deb8u1 |
| ubuntu 14.04 | chromium-browser | 52.0.2743.116-0ubuntu0.14.04.1.1134 |
| ubuntu 14.04 | oxide-qt | 1.17.7-0ubuntu0.14.04.1 |
| ubuntu 16.04 | chromium-browser | 52.0.2743.116-0ubuntu0.16.04.1.1250 |
| ubuntu 16.04 | oxide-qt | 1.17.7-0ubuntu0.16.04.1 |
| ubuntu 16.04-ESM | oxide-qt | 1.17.7-0ubuntu0.16.04.1 |
| ubuntu 16.10 | chromium-browser | 53.0.2785.143-0ubuntu1.1307 |
| ubuntu 16.10 | oxide-qt | 1.16.7-0ubuntu1 |
Referencias
- http://googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00006.html
- http://rhn.redhat.com/errata/RHSA-2016-1580.html
- http://www.debian.org/security/2016/dsa-3645
- http://www.securityfocus.com/bid/92276
- http://www.securitytracker.com/id/1036547
- https://access.redhat.com/security/cve/CVE-2016-5143
Las 16 referencias
- https://codereview.chromium.org/2065823004
- https://crbug.com/619414
- https://googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4KMX62M7UNRLWO4FEQ6YIMPMTKXXJV6A/
- https://nvd.nist.gov/vuln/detail/CVE-2016-5143
- https://security.gentoo.org/glsa/201610-09
- https://ubuntu.com/security/notices/USN-3058-1
- https://www.cve.org/CVERecord?id=CVE-2016-5143