CVE-2016-1638

Name	CVE-2016-1638
Description	extensions/renderer/resources/platform_app.js in the Extensions subsystem in Google Chrome before 49.0.2623.75 does not properly restrict use of Web APIs, which allows remote attackers to bypass intended access restrictions via a crafted platform app.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
References	DSA-3507-1
NVD severity	medium

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
chromium-browser (PTS)	stretch	70.0.3538.110-1~deb9u1	fixed
	stretch (security)	71.0.3578.80-1~deb9u1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin
chromium-browser	source	squeeze	(unfixed)	end-of-life
chromium-browser	source	wheezy	(unfixed)	end-of-life
chromium-browser	source	jessie	49.0.2623.75-1~deb8u1		DSA-3507-1
chromium-browser	source	(unstable)	49.0.2623.75-1

[wheezy] - chromium-browser <end-of-life> (Not supported in Wheezy)
[squeeze] - chromium-browser <end-of-life> (Not supported in Squeeze LTS)