SB2013071002 - Multiple vulnerabilities in Techland Chrome 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2013071002

SB2013071002 - Multiple vulnerabilities in Techland Chrome

Published: July 10, 2013 Updated: January 25, 2023

Security Bulletin ID SB2013071002
Severity
Medium
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 secuirty vulnerabilities.


1) Buffer overflow (CVE-ID: CVE-2013-2875)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

core/rendering/svg/SVGInlineTextBox.cpp in the SVG implementation in Blink, as used in Google Chrome before 28.0.1500.71, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


2) Input validation error (CVE-ID: CVE-2013-2880)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Multiple unspecified vulnerabilities in Google Chrome before 28.0.1500.71 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.


3) Input validation error (CVE-ID: CVE-2013-2853)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The HTTPS implementation in Google Chrome before 28.0.1500.71 does not ensure that headers are terminated by (carriage return, newline, carriage return, newline), which allows man-in-the-middle attackers to have an unspecified impact via vectors that trigger header truncation.


4) Use-after-free (CVE-ID: CVE-2013-2871)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing vectors related to the handling of input. A remote attackers can cause a denial of service or possibly have unspecified other impact.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


Remediation

Install update from vendor's website.

References