DSA-3039-1: Chromium-Browser Security Update
Summary
DSA-3039-1: chromium-browser - security update. Affects chromium-browser versions < 37.0.2062.120-1~deb7u1. Fixed in 37.0.2062.120-1~deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Chromium-Browser is a web browser developed by Google and is the open-source project behind Google Chrome. It provides users with a fast and secure browsing experience, leveraging the latest web technologies. However, several vulnerabilities have been discovered in Chromium-Browser, which could potentially compromise user security and privacy.
Vulnerability Detail
The vulnerabilities discovered in Chromium-Browser include:
- CVE-2014-3160: Same origin bypass issue in SVG file resource fetching.
- CVE-2014-3162: Multiple issues with potential security impact.
- CVE-2014-3165: Use-after-free issue in the Web Sockets implementation.
- CVE-2014-3166: Information leak in the SPDY protocol implementation.
- CVE-2014-3167: Multiple issues with potential security impact.
- CVE-2014-3168: Use-after-free issue in SVG image file handling.
- CVE-2014-3169: Use-after-free issue in the Webkit/Blink Document Object Model implementation.
- CVE-2014-3170: URL spoofing in Chromium extensions.
- CVE-2014-3171: Use-after-free issue in Chromium's v8 bindings.
- CVE-2014-3172: Access restriction bypass using Chromium's Debugger extension API.
- CVE-2014-3173: Uninitialized read issue in WebGL.
- CVE-2014-3174: Uninitialized read issue in Web Audio.
- CVE-2014-3175: Multiple issues with potential security impact.
- CVE-2014-3176: Combination of flaws leading to remote code execution outside of Chromium's sandbox.
- CVE-2014-3177: Combination of flaws leading to remote code execution outside of Chromium's sandbox.
- CVE-2014-3178: Use-after-free issue in the Document Object Model implementation in Blink/Webkit.
- CVE-2014-3179: Multiple issues with potential security impact.
These vulnerabilities could potentially allow attackers to bypass security measures, execute remote code, leak information, or spoof URLs, among other security risks.
How To Fix
Minimum fixed version
37.0.2062.120-1~deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade chromium-browserTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Upgrading your Chromium-Browser packages to the recommended versions will ensure that the identified vulnerabilities are addressed, providing a more secure browsing experience. If you require further assistance or have any additional questions, please reach out to DevNack.com for support on vulnerability remediation.
See every vulnerability recorded for chromium-browser →
FAQ
Chromium-Browser is an open-source web browser developed by Google and serves as the foundation for Google Chrome. It offers users a fast and secure browsing experience.
The identified vulnerabilities in Chromium-Browser could allow attackers to bypass security measures, execute remote code, leak information, or spoof URLs, among other security risks. It is crucial to update to the latest version to mitigate these risks.
To fix these vulnerabilities, you should upgrade your Chromium-Browser packages to the recommended versions mentioned earlier. This will ensure that the identified vulnerabilities are patched and your browsing experience is more secure.
No specific workarounds have been mentioned for these vulnerabilities. It is recommended to apply the available updates to address the security issues.
You can find more information about these vulnerabilities, including their CVE identifiers, in the Debian Security Advisory DSA-3039-1. It is advisable to refer to the official advisory for detailed information on each vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for chromium-browser.
