SB2014061103 - Multiple vulnerabilities in Chrome 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2014061103

SB2014061103 - Multiple vulnerabilities in Chrome

Published: June 11, 2014 Updated: February 8, 2023

Security Bulletin ID SB2014061103
Severity
Medium
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 secuirty vulnerabilities.


1) Input validation error (CVE-ID: CVE-2014-3154)

The vulnerability allows remote attackers to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can cause a denial of service or possibly have unspecified other impact via vectors related to a Blink shutdown.


2) Input validation error (CVE-ID: CVE-2014-3155)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

net/spdy/spdy_write_queue.cc in the SPDY implementation in Google Chrome before 35.0.1916.153 allows remote attackers to cause a denial of service (out-of-bounds read) by leveraging incorrect queue maintenance. Per http://cwe.mitre.org/data/definitions/125.html: "CWE-125: Out-of-bounds Read"


3) Buffer overflow (CVE-ID: CVE-2014-3156)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Buffer overflow in the clipboard implementation in Google Chrome before 35.0.1916.153 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger unexpected bitmap data, related to content/renderer/renderer_clipboard_client.cc and content/renderer/webclipboard_impl.cc.


4) Buffer overflow (CVE-ID: CVE-2014-3157)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Heap-based buffer overflow in the FFmpegVideoDecoder::GetVideoBuffer function in media/filters/ffmpeg_video_decoder.cc in Google Chrome before 35.0.1916.153 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging VideoFrame data structures that are too small for proper interaction with an underlying FFmpeg library.


Remediation

Install update from vendor's website.

References