[IT-SecNots] [SECURITY] [DSA 3564-1] chromium-browser security update

[Michael Gilbert <mgilbert AT debian.org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3564-1                   security AT debian.org
https://www.debian.org/security/                          Michael Gilbert
May 02, 2016                          https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : chromium-browser
CVE ID         : CVE-2016-1660 CVE-2016-1661 CVE-2016-1662 CVE-2016-1663
                 CVE-2016-1664 CVE-2016-1665 CVE-2016-1666

Several vulnerabilities have been discovered in the chromium web browser.

CVE-2016-1660

    Atte Kettunen discovered an out-of-bounds write issue.

CVE-2016-1661

    Wadih Matar discovered a memory corruption issue.

CVE-2016-1662

    Rob Wu discovered a use-after-free issue related to extensions.

CVE-2016-1663

    A use-after-free issue was discovered in Blink's bindings to V8.

CVE-2016-1664

    Wadih Matar discovered a way to spoof URLs.

CVE-2016-1665

    gksgudtjr456 discovered an information leak in the v8 javascript
    library.

CVE-2016-1666

    The chrome development team found and fixed various issues during
    internal auditing.

For the stable distribution (jessie), these problems have been fixed in
version 50.0.2661.94-1~deb8u1.

For the testing distribution (stretch), these problems will be fixed soon.

For the unstable distribution (sid), these problems have been fixed in
version 50.0.2661.94-1.

We recommend that you upgrade your chromium-browser packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce AT lists.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQQcBAEBCgAGBQJXJ0boAAoJELjWss0C1vRzu90f/A33N+vaag1Ykl1wdVujSSHW
bTBVW4MgqoAlef30CL0EXx5FxV5Lq6oBwnHSfSTTpyZaA89KtWwFiqWdPhAzq1Kv
M5O8+ggQrkxEt+tWkbVaS38lPUPkvQIRqykLE7777r2j4FEZyyp0/JAGBkoDNJZ8
FuDCxJtqbV/bAPw8WkmDVdd3FP3HOrlhy2Wxwnne5896IkWG7Itus8alf+lLIstI
trzspkVpHGFao3iNA6h4bZvUk/RGvEZc3KphPW3qStRnIa9WhY43uGItX4/2F9Ct
E7ZcLemhzSzFTGYCQ9fBUrLwizC4WFdy66nba4ul2NbxGWxFspWAXkKgSOnl8AoX
h08/VeTLix9J6NVVOVahf0FyimHhoVo7zghmg5p4y3pugir+UigQeo3JHNac7F5Y
CnBKaKcrjKo1EYhH+UTmmnGMiEJoHcmop5tKEynf9oSAb74sszXNWIE37CC5GBao
eL3vTkDFQ7bsNhqvnPom9KeIP+D62HaThFVpEigffgferpDlw1Kk+kdjS6u5RsQS
k0ObDZgmQNzKj6Lp/fg6YIbcGXzCYx8TViYTEGJpWnl3sQ8EqGqKqywQpGUnssTe
yRTvQOVHHV224FcbqkcstJ9DQjuvAibz848KpEDgxrqu6oU9vzJt2gUjxWOU+ovj
igR9B/SKsWLhe5buPNuWhabiASnb3GOu/PEHUzxzLerK9JhiumuVK7Ni01S+WkkK
8DVr+dD6UuyjzZl5JMtFf1DUDjPlOKnFoGUKeFIaCYpbuZ9fbY32i8FIS+A0AJK+
JLuwo7+2eelpOI5TfGN4iffyS1S2w+iEUKPhx58Pp5wuoTxuGwi23/35Ab52FkZ3
U+PZGtJ5zv3otQX67KtwAbSSaju+PEmrJI4vGKYVB1+lm/T5wFYFer7GZAspLuzD
bsNKYp47jeNimyvWVbSSP75qZ5I/BAfOWunSMdvM/wtEnAnUrVUetX0xwDuqh9cu
FB0yn3CrPuVmTe9BLd5Fx81dH9IHHSauU6CXt7QtkrmNWfCE1fOmnkdyQZsJSPfk
qasuoOwyOV1S2GukKD/97SWIRVlAxjin5bIxsDnZ5746kuPUeegMNbxY9hxvmt73
+bYAtiC/g/Eh3MpdxCr1Or4QW6nr1RSkJbKbiciS6eV36gg7I8r4PZSa0uo2eYMr
a0I18Dtw1d050i/4lyqlKuUfnLuBP1Le6tjCBqJi6n4iIMAOy00ne4zO89lZZLfY
oMExEVICvXDdmxlMfi5ZwO64JDgnUk33sz9tZxyN8aKUpe99HO/J1K8xLrRVklAi
Trc5kkVWFvDz5kmazfke39OmLllFHhf3bYnxBp1s/pfHjVvVTO2QcKaWOSUe9Vs=
=zpNw
-----END PGP SIGNATURE-----