Candidate: CVE-2016-5173
PublicDate: 2016-09-25 20:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5173
 https://googlechromereleases.blogspot.com/2016/09/stable-channel-update-for-desktop_13.html
Description:
 The extensions subsystem in Google Chrome before 53.0.2785.113 does not
 properly restrict access to Object.prototype, which allows remote attackers
 to load unintended resources, and consequently trigger unintended
 JavaScript function calls and bypass the Same Origin Policy via an indirect
 interception attack.
Ubuntu-Description:
Notes:
Bugs:
 https://crbug.com/468931
Priority: medium
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L [7.1 HIGH]

Patches_chromium-browser:
upstream_chromium-browser: released (53.0.2785.113)
precise_chromium-browser: ignored
trusty_chromium-browser: released (53.0.2785.143-0ubuntu0.14.04.1.1142)
trusty/esm_chromium-browser: DNE (trusty was released [53.0.2785.143-0ubuntu0.14.04.1.1142])
vivid/ubuntu-core_chromium-browser: DNE
vivid/stable-phone-overlay_chromium-browser: DNE
xenial_chromium-browser: released (53.0.2785.143-0ubuntu0.16.04.1.1254)
yakkety_chromium-browser: released (53.0.2785.143-0ubuntu1.1307)
devel_chromium-browser: released (53.0.2785.143-0ubuntu1.1307)

Patches_oxide-qt:
upstream_oxide-qt: not-affected
precise_oxide-qt: DNE
trusty_oxide-qt: not-affected
trusty/esm_oxide-qt: DNE (trusty was not-affected)
vivid/ubuntu-core_oxide-qt: DNE
vivid/stable-phone-overlay_oxide-qt: not-affected
xenial_oxide-qt: not-affected
esm-infra/xenial_oxide-qt: not-affected
yakkety_oxide-qt: not-affected
devel_oxide-qt: not-affected