Heap-based buffer overflow in src/jsregexp.cc in Google V8 before 1.1.10.14, as used in Google Chrome before 2.0.172.37, allows remote attackers to execute arbitrary code in the Chrome sandbox via a crafted JavaScript regular expression.

The version of Google Chrome installed on the remote host is earlier than 2.0.172.37.  Such versions are reportedly affected by multiple issues :

  - A heap overflow exists when evaluating specially crafted     regular expressions in JavaScript. This could lead to a     denial of service or the execution of arbitrary code     within the Google Chrome sandbox. (Issue 14719)

  - A memory corruption issue exists in the renderer process     that could cause a denial of service or possibly allow     arbitrary code execution with the privileges of the     logged on user. (CVE-2009-2556)

  - Creating a Select object with a very large length can     result in memory exhaustion, causing a denial of service.

The version of Google Chrome installed on the remote host is earlier than 2.0.172.37. Such versions are reportedly affected by multiple vulnerabilities : 

  - A heap overflow exists when evaluating specially crafted regular expressions in Javascript. This could lead to a denial of service or the remote execution of arbitrary code withing the Google Chrome sandbox.

  - A memory corruption issue exists in the renderer process that could cause a denial of service or possibly allow arbitrary code execution with the privileges of the logged on user. 

  - A denial-of-service issue when the application handles a maliciously crafted webpage containing a 'HTMLSelectElement' object with a large length attribute.

ID	Name	Product	Family	Severity
39852	Google Chrome < 2.0.172.37 Multiple Vulnerabilities	Nessus	Windows	high
800904	Google Chrome < 2.0.172.37 Buffer Overflow	Log Correlation Engine	Web Clients	high
5099	Google Chrome < 2.0.172.37 Buffer Overflow	Nessus Network Monitor	Web Clients	medium

Detections

Analytics

CVE-2009-2555

high

Tenable Plugins

high

high

medium