SB2013100201 - Multiple vulnerabilities in Chrome

Security Bulletin ID SB2013100201

Severity

Medium

Patch available

YES

Number of vulnerabilities 17

Exploitation vector Remote access

Highest impact Data manipulation

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 17 secuirty vulnerabilities.

1) Buffer overflow (CVE-ID: CVE-2013-2907)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The Window.prototype object implementation in Google Chrome before 30.0.1599.66 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.

2) Input validation error (CVE-ID: CVE-2013-2908)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

Google Chrome before 30.0.1599.66 uses incorrect function calls to determine the values of NavigationEntry objects, which allows remote attackers to spoof the address bar via vectors involving a response with a 204 (aka No Content) status code.

3) Use-after-free (CVE-ID: CVE-2013-2909)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing vectors related to inline-block rendering for bidirectional Unicode text in an element isolated from its siblings. A remote attackers can cause a denial of service or possibly have unspecified other impact.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

4) Use-after-free (CVE-ID: CVE-2013-2910)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing unknown vectors. A remote attackers can cause a denial of service or possibly have unspecified other impact.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

5) Resource management error (CVE-ID: CVE-2013-2911)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Use-after-free vulnerability in the XSLStyleSheet::compileStyleSheet function in core/xml/XSLStyleSheetLibxslt.cpp in Blink, as used in Google Chrome before 30.0.1599.66, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper handling of post-failure recompilation in unspecified libxslt versions.

6) Use-after-free (CVE-ID: CVE-2013-2912)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing vectors involving a resource-destruction message. A remote attackers can cause a denial of service or possibly have unspecified other impact.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

7) Use-after-free (CVE-ID: CVE-2013-2913)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing vectors involving an XML document. A remote attackers can cause a denial of service or possibly have unspecified other impact.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

8) Input validation error (CVE-ID: CVE-2013-2915)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

Google Chrome before 30.0.1599.66 preserves pending NavigationEntry objects in certain invalid circumstances, which allows remote attackers to spoof the address bar via a URL with a malformed scheme, as demonstrated by a nonexistent:12121 URL.

9) Input validation error (CVE-ID: CVE-2013-2916)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

Blink, as used in Google Chrome before 30.0.1599.66, allows remote attackers to spoof the address bar via vectors involving a response with a 204 (aka No Content) status code, in conjunction with a delay in notifying the user of an attempted spoof.

10) Buffer overflow (CVE-ID: CVE-2013-2917)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The ReverbConvolverStage::ReverbConvolverStage function in core/platform/audio/ReverbConvolverStage.cpp in the Web Audio implementation in Blink, as used in Google Chrome before 30.0.1599.66, allows remote attackers to cause a denial of service (out-of-bounds read) via vectors related to the impulseResponse array.

11) Resource management error (CVE-ID: CVE-2013-2918)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Use-after-free vulnerability in the RenderBlock::collapseAnonymousBlockChild function in core/rendering/RenderBlock.cpp in the DOM implementation in Blink, as used in Google Chrome before 30.0.1599.66, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging incorrect handling of parent-child relationships for anonymous blocks.

12) Buffer overflow (CVE-ID: CVE-2013-2920)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The DoResolveRelativeHost function in url/url_canon_relative.cc in Google Chrome before 30.0.1599.66 allows remote attackers to cause a denial of service (out-of-bounds read) via a relative URL containing a hostname, as demonstrated by a protocol-relative URL beginning with a //www.google.com/ substring.

13) Resource management error (CVE-ID: CVE-2013-2921)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Double free vulnerability in the ResourceFetcher::didLoadResource function in core/fetch/ResourceFetcher.cpp in the resource loader in Blink, as used in Google Chrome before 30.0.1599.66, allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering certain callback processing during the reporting of a resource entry.

14) Use-after-free (CVE-ID: CVE-2013-2922)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing crafted JavaScript code that operates on a TEMPLATE element. A remote attackers can cause a denial of service or possibly have unspecified other impact.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

15) Input validation error (CVE-ID: CVE-2013-2923)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Multiple unspecified vulnerabilities in Google Chrome before 30.0.1599.66 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

16) Use-after-free (CVE-ID: CVE-2013-2924)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing unknown vectors. A remote attackers can cause a denial of service or possibly have unspecified other impact.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

17) Race condition (CVE-ID: CVE-2013-2906)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Multiple race conditions in the Web Audio implementation in Blink, as used in Google Chrome before 30.0.1599.66, allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to threading in core/html/HTMLMediaElement.cpp, core/platform/audio/AudioDSPKernelProcessor.cpp, core/platform/audio/HRTFElevation.cpp, and modules/webaudio/ConvolverNode.cpp.

Remediation

Install update from vendor's website.

SB2013100201 - Multiple vulnerabilities in Chrome

Breakdown by Severity

Description

Remediation

References