Redhat Enterprise Linux Server Supplementary vulnerabilities

CVE-2015-1286 [MEDIUM] CWE-79 CVE-2015-1286: Cross-site scripting (XSS) vulnerability in the V8ContextNativeHandler::GetModuleSystem function in Cross-site scripting (XSS) vulnerability in the V8ContextNativeHandler::GetModuleSystem function in extensions/renderer/v8_context_native_handler.cc in Google Chrome before 44.0.2403.89 allows remote attackers to inject arbitrary web script or HTML by leveraging the lack of a certain V8 context restriction, aka a Blink "Universal XSS (UXSS)."

CVE-2015-1278 [MEDIUM] CWE-254 CVE-2015-1278: content/browser/web_contents/web_contents_impl.cc in Google Chrome before 44.0.2403.89 does not ensu content/browser/web_contents/web_contents_impl.cc in Google Chrome before 44.0.2403.89 does not ensure that a PDF document's modal dialog is closed upon navigation to an interstitial page, which allows remote attackers to spoof URLs via a crafted document, as demonstrated by the alert_dialog.pdf document.

CVE-2015-1287 [MEDIUM] CWE-17 CVE-2015-1287: Blink, as used in Google Chrome before 44.0.2403.89, enables a quirks-mode exception that limits the Blink, as used in Google Chrome before 44.0.2403.89, enables a quirks-mode exception that limits the cases in which a Cascading Style Sheets (CSS) document is required to have the text/css content type, which allows remote attackers to bypass the Same Origin Policy via a crafted web site, related to core/fetch/CSSStyleSheetResource.cpp.

CVE-2016-1664 [MEDIUM] CWE-254 CVE-2016-1664: The HistoryController::UpdateForCommit function in content/renderer/history_controller.cc in Google The HistoryController::UpdateForCommit function in content/renderer/history_controller.cc in Google Chrome before 50.0.2661.94 mishandles the interaction between subframe forward navigations and other forward navigations, which allows remote attackers to spoof the address bar via a crafted web site.