Google Chrome: Multiple vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
                         AUSCERT Security Bulletin

                               ASB-2015.0034
     A number of vulnerabilities have been identified in Google Chrome
                               15 April 2015

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              Google Chrome
Operating System:     Windows
                      OS X
                      Linux variants
Impact/Access:        Execute Arbitrary Code/Commands -- Remote with User Interaction
                      Modify Arbitrary Files          -- Remote with User Interaction
                      Denial of Service               -- Remote with User Interaction
                      Provide Misleading Information  -- Remote with User Interaction
                      Access Confidential Data        -- Remote with User Interaction
Resolution:           Patch/Upgrade
CVE Names:            CVE-2015-1249 CVE-2015-1248 CVE-2015-1247
                      CVE-2015-1246 CVE-2015-1245 CVE-2015-1244
                      CVE-2015-1242 CVE-2015-1241 CVE-2015-1240
                      CVE-2015-1238 CVE-2015-1237 CVE-2015-1236
                      CVE-2015-1235  
Member content until: Friday, May 15 2015

OVERVIEW

        A number of vulnerabilities have been identified in Google Chrome
        prior to version 42.0.2311.90. [1]


IMPACT

        This update includes 45 security fixes. Below, we highlight fixes that were 
        contributed by external researchers. Please see the Chromium security page 
        for more information.
        
        [$7500][456518] High CVE-2015-1235: Cross-origin-bypass in HTML parser. 
        [$Credit to anonymous.
        
        [$4000][313939] Medium CVE-2015-1236: Cross-origin-bypass in Blink. Credit to 
        [$Amitay Dobo.
        
        [$3000][461191] High CVE-2015-1237: Use-after-free in IPC. Credit to Khalil 
        Zhani.
        
        [$2000][445808] High CVE-2015-1238: Out-of-bounds write in Skia. Credit to 
        cloudfuzzer.
        
        [$1000][463599] Medium CVE-2015-1240: Out-of-bounds read in WebGL. Credit to 
        w3bd3vil.
        
        [$1000][418402] Medium CVE-2015-1241: Tap-Jacking. Credit to Phillip Moon and 
        [$Matt Weston of Sandfield Information Systems.
        
        [$500][460917] High CVE-2015-1242: Type confusion in V8. Credit to 
        fcole@onshape.com.
        
        [$500][455215] Medium CVE-2015-1244: HSTS bypass in WebSockets. Credit to 
        Mike Ruddy.
        
        [$500][444957] Medium CVE-2015-1245: Use-after-free in PDFium. Credit to 
        Khalil Zhani.
        
        [$500][437399] Medium CVE-2015-1246: Out-of-bounds read in Blink. Credit to 
        Atte Kettunen of OUSPG.
        
        [$500][429838] Medium CVE-2015-1247: Scheme issues in OpenSearch. Credit to 
        Jann Horn.
        
        [$500][380663] Medium CVE-2015-1248: SafeBrowsing bypass. Credit to Vittorio 
        Gambaletta (VittGam).
        
        We would also like to thank all security researchers that worked with us 
        during the development cycle to prevent security bugs from ever reaching the 
        stable channel. The total value of additional rewards and their recipients 
        will updated here when all reports have gone through the reward panel.
        
        As usual, our ongoing internal security work was responsible for a wide range 
        of fixes: [476786] CVE-2015-1249: Various fixes from internal audits, fuzzing 
        and other initiatives. Multiple vulnerabilities in V8 fixed at the tip of the 
        4.2 branch (currently 4.2.77.14).


MITIGATION

        The vendor recommends updating Google Chrome to correct these
        issues. [1]


REFERENCES

        [1] Stable Channel Update
            http://googlechromereleases.blogspot.com.au/2015/04/stable-channel-update_14.html

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours 
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBVS3e3hLndAQH1ShLAQL28A//dArlw7+jMaMWZu2Gu6Ifq22w8iu9YEa5
rjUWd1/8SkckveaGjv349snFCdwsM6GT2dWIWdF/v1eFNa6oTVDQ0H5rn3WKx9IM
yB0WIhQirNGO8eOEvfZPFXxn/K9qeRMPjwYtcAJXlYIrJZnNwYd0P1mKFxjoVL4k
ssp00pgfOuJF0qLwh8dlQDN+pGkiole4Clpj0UYrLCPsid9iNBen3/HWRiHQKxCp
PWXfnFz8IBifNDk/z2bNoSWor+/spNajCzCdJ+5Dfxj9qgmgFRAtbdbWEB/Bp+W/
FcE83XlCZGQS53biGY2lEtkhcqqMtwRe4sCBjAikGCH92n2xwjpNK0h4yg+lcaHt
1f5iEVoT0uCxrTVjQPIhpBOnOpfPsEA50Xfa6dqKg3wsQG2jzfYPchNHeGdpFs44
6JNfpUXZLTjhgP50SPwsBb7ZUZCzKAwkmA/kOlpeJUJVsxUE3SUZKfyHW+Z5bkH1
ifQKhA7U03HyuzcuudIwOKqZOsr4lqX+LHhNpcilNr+hTgpzZDJy7Ps74hdApWD+
+GTz9EOogDTB+WmKynR5xg79f42/OHRdoaVNpwDinJqgPdN6LJmxMDpWGpGOAtRU
ys8Tsnp0bPWtfXfBXaWUMe2cPnH5R2BBBqLgvCTWF13XES1+etc3d343i247xKI2
dDYckSbYg8c=
=xH0k
-----END PGP SIGNATURE-----