CVE-2015-6762

La función CSSFontFaceSrcValue::fetch en core/css/CSSFontFaceSrcValue.cpp en la implementación Cascading Style Sheets (CSS) en Blink, como se utiliza en Google Chrome en versiones anteriores a 46.0.2490.71, no utiliza el algoritmo de petición de origen-cruzado CORS cuando la URL de una fuente parece ser una URL del mismo origen, lo que permite a servidores web remotos eludir la Same Origin Policy a través de un redireccionamiento.

USN-2770-1 fixed vulnerabilities in Oxide in Ubuntu 14.04 LTS and Ubuntu 15.04. This update provides the corresponding updates for Ubuntu 15.10. It was discovered that ContainerNode::parserInsertBefore in Blink would incorrectly proceed with a DOM tree insertion in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass same origin restrictions. A use-after-free was discovered in the service worker implementation in Chromium. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking the program. Various other issues were also addressed.