Multiple vulnerabilities in Chrome

1) Input validation error

EUVDB-ID: #VU42357

Risk: Medium

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2013-6631

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows remote attackers to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can cause a denial of service (heap memory corruption) or possibly have unspecified other impact via vectors that trigger the absence of certain statistics initialization, leading to the skipping of a required DeRegisterExternalTransport call.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 31.0.1650.0 - 31.0.1650.46

CPE2.3

External links

https://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html
https://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html
https://lists.opensuse.org/opensuse-security-announce/2013-11/msg00026.html
https://lists.opensuse.org/opensuse-security-announce/2013-12/msg00002.html
https://lists.opensuse.org/opensuse-updates/2014-01/msg00042.html
https://www.debian.org/security/2013/dsa-2799
https://code.google.com/p/chromium/issues/detail?id=296804
https://code.google.com/p/webrtc/source/detail?r=4827
https://webrtc-codereview.appspot.com/2275008

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Use-after-free

EUVDB-ID: #VU42370

Risk: Medium

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2013-6622

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing vectors involving the movement of a media element between documents. A remote attackers can cause a denial of service or possibly have unspecified other impact.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 31.0.1650.0 - 31.0.1650.46

CPE2.3

External links

https://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html
https://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html
https://lists.opensuse.org/opensuse-security-announce/2013-11/msg00026.html
https://lists.opensuse.org/opensuse-security-announce/2013-12/msg00002.html
https://lists.opensuse.org/opensuse-updates/2014-01/msg00042.html
https://www.debian.org/security/2013/dsa-2799
https://code.google.com/p/chromium/issues/detail?id=272786
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18335
https://src.chromium.org/viewvc/blink?revision=159031&view=revision

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Buffer overflow

EUVDB-ID: #VU42371

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2013-6623

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The SVG implementation in Blink, as used in Google Chrome before 31.0.1650.48, allows remote attackers to cause a denial of service (out-of-bounds read) by leveraging the use of tree order, rather than transitive dependency order, for layout.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 31.0.1650.0 - 31.0.1650.46

CPE2.3

External links

https://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html
https://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html
https://lists.opensuse.org/opensuse-security-announce/2013-11/msg00026.html
https://lists.opensuse.org/opensuse-security-announce/2013-12/msg00002.html
https://lists.opensuse.org/opensuse-updates/2014-01/msg00042.html
https://www.debian.org/security/2013/dsa-2799
https://code.google.com/p/chromium/issues/detail?id=282925
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19311
https://src.chromium.org/viewvc/blink?revision=158480&view=revision

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Input validation error

EUVDB-ID: #VU42372

Risk: Medium

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2013-6624

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows remote attackers to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can cause a denial of service or possibly have unspecified other impact via vectors involving the string values of id attributes.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 31.0.1650.0 - 31.0.1650.46

CPE2.3

External links

https://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html
https://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html
https://lists.opensuse.org/opensuse-security-announce/2013-11/msg00026.html
https://lists.opensuse.org/opensuse-security-announce/2013-12/msg00002.html
https://lists.opensuse.org/opensuse-updates/2014-01/msg00042.html
https://www.debian.org/security/2013/dsa-2799
https://code.google.com/p/chromium/issues/detail?id=290566
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19168

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Resource management error

EUVDB-ID: #VU42373

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2013-6625

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Use-after-free vulnerability in core/dom/ContainerNode.cpp in Blink, as used in Google Chrome before 31.0.1650.48, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper handling of DOM range objects in circumstances that require child node removal after a (1) mutation or (2) blur event.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 31.0.1650.0 - 31.0.1650.46

CPE2.3

External links

https://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html
https://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html
https://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html
https://lists.opensuse.org/opensuse-security-announce/2013-11/msg00026.html
https://lists.opensuse.org/opensuse-security-announce/2013-12/msg00002.html
https://lists.opensuse.org/opensuse-updates/2014-01/msg00042.html
https://support.apple.com/kb/HT6162
https://support.apple.com/kb/HT6163
https://www.debian.org/security/2013/dsa-2799
https://code.google.com/p/chromium/issues/detail?id=295010
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19257
https://src.chromium.org/viewvc/blink?revision=160037&view=revision
https://support.apple.com/kb/HT6537

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Input validation error

EUVDB-ID: #VU42374

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2013-6626

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The WebContentsImpl::AttachInterstitialPage function in content/browser/web_contents/web_contents_impl.cc in Google Chrome before 31.0.1650.48 does not cancel JavaScript dialogs upon generating an interstitial warning, which allows remote attackers to spoof the address bar via a crafted web site.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 31.0.1650.0 - 31.0.1650.46

CPE2.3

External links

https://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html
https://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html
https://lists.opensuse.org/opensuse-security-announce/2013-11/msg00026.html
https://lists.opensuse.org/opensuse-security-announce/2013-12/msg00002.html
https://lists.opensuse.org/opensuse-updates/2014-01/msg00042.html
https://www.debian.org/security/2013/dsa-2799
https://code.google.com/p/chromium/issues/detail?id=295695
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18401
https://src.chromium.org/viewvc/chrome?revision=225026&view=revision

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Buffer overflow

EUVDB-ID: #VU42375

Risk: Medium

CVSSv4.0: 5.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2013-6627

CWE-ID: CWE-119 - Memory corruption

Exploit availability: Yes

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

net/http/http_stream_parser.cc in Google Chrome before 31.0.1650.48 does not properly process HTTP Informational (aka 1xx) status codes, which allows remote web servers to cause a denial of service (out-of-bounds read) via a crafted response.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 31.0.1650.0 - 31.0.1650.46

CPE2.3

External links

https://blog.skylined.nl/20161219001.html
https://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html
https://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html
https://lists.opensuse.org/opensuse-security-announce/2013-11/msg00026.html
https://lists.opensuse.org/opensuse-security-announce/2013-12/msg00002.html
https://lists.opensuse.org/opensuse-updates/2014-01/msg00042.html
https://packetstormsecurity.com/files/140209/Chrome-HTTP-1xx-Out-Of-Bounds-Read.html
https://seclists.org/fulldisclosure/2016/Dec/65
https://www.debian.org/security/2013/dsa-2799
https://code.google.com/p/chromium/issues/detail?id=299892
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19113
https://src.chromium.org/viewvc/chrome?revision=226539&view=revision
https://www.exploit-db.com/exploits/40944/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

8) Input validation error

EUVDB-ID: #VU42376

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2013-6628

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to manipulate data.

net/socket/ssl_client_socket_nss.cc in the TLS implementation in Google Chrome before 31.0.1650.48 does not ensure that a server's X.509 certificate is the same during renegotiation as it was before renegotiation, which might allow remote web servers to interfere with trust relationships by renegotiating a session.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 31.0.1650.0 - 31.0.1650.46

CPE2.3

External links

https://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html
https://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html
https://lists.opensuse.org/opensuse-security-announce/2013-11/msg00026.html
https://lists.opensuse.org/opensuse-security-announce/2013-12/msg00002.html
https://lists.opensuse.org/opensuse-updates/2014-01/msg00042.html
https://www.debian.org/security/2013/dsa-2799
https://code.google.com/p/chromium/issues/detail?id=306959
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19108
https://secure-resumption.com/
https://src.chromium.org/viewvc/chrome?revision=229611&view=revision

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Input validation error

EUVDB-ID: #VU42377

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2013-2931

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Multiple unspecified vulnerabilities in Google Chrome before 31.0.1650.48 allow attackers to execute arbitrary code or possibly have other impact via unknown vectors.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 31.0.1650.0 - 31.0.1650.46

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Risk	High
Patch available	YES
Number of vulnerabilities	9
CVE-ID	CVE-2013-6631 CVE-2013-6622 CVE-2013-6623 CVE-2013-6624 CVE-2013-6625 CVE-2013-6626 CVE-2013-6627 CVE-2013-6628 CVE-2013-2931
CWE-ID	CWE-20 CWE-416 CWE-119 CWE-399
Exploitation vector	Network
Public exploit	Public exploit code for vulnerability #7 is available.
Vulnerable software	Google Chrome Client/Desktop applications / Web browsers
Vendor	Google