SB2013032805 - Multiple vulnerabilities in Techland Chrome 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2013032805

SB2013032805 - Multiple vulnerabilities in Techland Chrome

Published: March 28, 2013 Updated: January 25, 2023

Security Bulletin ID SB2013032805
Severity
Medium
Patch available
YES
Number of vulnerabilities 10
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 10 secuirty vulnerabilities.


1) Buffer overflow (CVE-ID: CVE-2013-0917)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The URL loader in Google Chrome before 26.0.1410.43 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


2) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2013-0918)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 26.0.1410.43 does not prevent navigation to developer tools in response to a drag-and-drop operation, which allows user-assisted remote attackers to have an unspecified impact via a crafted web site.


3) Use-after-free (CVE-ID: CVE-2013-0920)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing unknown vectors. A remote attackers can cause a denial of service or possibly have unspecified other impact.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


4) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2013-0921)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The Isolated Sites feature in Google Chrome before 26.0.1410.43 does not properly enforce the use of separate processes, which makes it easier for remote attackers to bypass intended access restrictions via a crafted web site.


5) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2013-0922)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 26.0.1410.43 does not properly restrict brute-force access attempts against web sites that require HTTP Basic Authentication, which has unspecified impact and attack vectors.


6) Buffer overflow (CVE-ID: CVE-2013-0923)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The USB Apps API in Google Chrome before 26.0.1410.43 allows remote attackers to cause a denial of service (memory corruption) via unspecified vectors.


7) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2013-0924)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The extension functionality in Google Chrome before 26.0.1410.43 does not verify that use of the permissions API is consistent with file permissions, which has unspecified impact and attack vectors.


8) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2013-0925)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 26.0.1410.43 does not ensure that an extension has the tabs (aka APIPermission::kTab) permission before providing a URL to this extension, which has unspecified impact and remote attack vectors.


9) Input validation error (CVE-ID: CVE-2013-0926)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 26.0.1410.43 does not properly handle active content in an EMBED element during a copy-and-paste operation, which allows user-assisted remote attackers to have an unspecified impact via a crafted web site.


10) Use-after-free (CVE-ID: CVE-2013-0916)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing unknown vectors. A remote attackers can cause a denial of service or possibly have unspecified other impact.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


Remediation

Install update from vendor's website.

References