Test ID:	1.3.6.1.4.1.25623.1.0.805457
Category:	General
Title:	Google Chrome Multiple Vulnerabilities-02 (Apr 2015) - Windows
Summary:	Google Chrome is prone to multiple vulnerabilities.
Description:	Summary: Google Chrome is prone to multiple vulnerabilities. Vulnerability Insight: Multiple flaws are due to: - Missing address space usage limitation in the NaCl process. - Permissions for camera and microphone are merged into a single 'Media' permission instead of treated as two separate permission. - Flaw in the 'SearchEngineTabHelper::OnPageHasOSDD' function in ui/search_engines/search_engine_tab_helper.cc script that is triggered when handling URLs for OpenSearch descriptor. - An unspecified out-of-bounds read flaw in Blink. - A flaw related to WebSocket connections as HSTS (HTTP Strict Transport Security) is not enforced. - A type confusion flaw in the 'ReduceTransitionElementsKind' function in hydrogen-check-elimination.cc script related to HTransitionElementsKind handling. - A Tap-Jacking flaw that is triggered as certain synthetic Tap events aren't preceded by TapDown events. - An unspecified out-of-bounds read flaw in WebGL related to handling of ES3 commands. - An unspecified out-of-bounds write flaw in Skia. - A use-after-free error in content/renderer/render_frame_impl.cc script. - A flaw in the 'MediaElementAudioSourceNode::process' function in modules/webaudio/MediaElementAudioSourceNode.cpp script. - An unspecified flaw in the HTML Parser. - Multiple unspecified Vulnerabilities - Browser does not confirm with the user before setting CONTENT_SETTINGS_TYPE_FULLSCREEN and CONTENT_SETTINGS_TYPE_MOUSELOCK. Vulnerability Impact: Successful exploitation will allow remote attackers to bypass security restrictions, conduct row-hammer attacks, obtain sensitive data, trigger unintended UI actions via crafted dimension, cause a denial of service and other unspecified impacts. Affected Software/OS: Google Chrome version prior to 42.0.2311.90 on Windows. Solution: Upgrade to Google Chrome version 42.0.2311.90 or later. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2015-3335 BugTraq ID: 72715 http://www.securityfocus.com/bid/72715 SuSE Security Announcement: openSUSE-SU-2015:0748 (Google Search) http://lists.opensuse.org/opensuse-updates/2015-04/msg00040.html Common Vulnerability Exposure (CVE) ID: CVE-2015-3334 BugTraq ID: 74225 http://www.securityfocus.com/bid/74225 Debian Security Information: DSA-3238 (Google Search) http://www.debian.org/security/2015/dsa-3238 Common Vulnerability Exposure (CVE) ID: CVE-2015-3333 BugTraq ID: 74221 http://www.securityfocus.com/bid/74221 http://ubuntu.com/usn/usn-2570-1 Common Vulnerability Exposure (CVE) ID: CVE-2015-1249 RedHat Security Advisories: RHSA-2015:0816 http://rhn.redhat.com/errata/RHSA-2015-0816.html http://www.securitytracker.com/id/1032209 SuSE Security Announcement: openSUSE-SU-2015:1887 (Google Search) http://lists.opensuse.org/opensuse-updates/2015-11/msg00024.html Common Vulnerability Exposure (CVE) ID: CVE-2015-1247 https://security.gentoo.org/glsa/201506-04 Common Vulnerability Exposure (CVE) ID: CVE-2015-1246 Common Vulnerability Exposure (CVE) ID: CVE-2015-1244 Common Vulnerability Exposure (CVE) ID: CVE-2015-1242 Common Vulnerability Exposure (CVE) ID: CVE-2015-1241 Common Vulnerability Exposure (CVE) ID: CVE-2015-1240 Common Vulnerability Exposure (CVE) ID: CVE-2015-1238 Common Vulnerability Exposure (CVE) ID: CVE-2015-1237 Common Vulnerability Exposure (CVE) ID: CVE-2015-1236 Common Vulnerability Exposure (CVE) ID: CVE-2015-1235 http://ubuntu.com/usn/USN-2570-1 Common Vulnerability Exposure (CVE) ID: CVE-2015-3336 BugTraq ID: 74227 http://www.securityfocus.com/bid/74227
Copyright	Copyright (C) 2015 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.