Use-after-free vulnerability in Google Chrome before 24.0.1312.56 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of fonts in CANVAS elements.

The remote host is affected by the vulnerability described in GLSA-201309-16 (Chromium, V8: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and V8. Please       review the CVE identifiers and release notes referenced below for       details.
  Impact :

    A context-dependent attacker could entice a user to open a specially       crafted website or JavaScript program using Chromium or V8, possibly       resulting in the execution of arbitrary code with the privileges of the       process or a Denial of Service condition. Furthermore, a remote attacker       may be able to bypass security restrictions or have other, unspecified,       impact.
  Workaround :

    There is no known workaround at this time.

Versions of Google Chrome earlier than 24.0.1312.56 are potentially affected by the following vulnerabilities :

  - A use-after-free vulnerability exists related to font handling and canvas. (CVE-2013-0839)

  - An error exists related to URL validation and the opening of new browser windows. (CVE-2013-0840)

  - An array index is not properly checked in relation to content blocking. (CVE-2013-0841)

  - An unspecified error exists related to handling null characters in embedded paths. (CVE-2013-0842)

  - An issue occurs when handling unsupported RTC sampling rates. Note: This particular issue only affects versions for Mac only. (CVE-2013-0843)
Successful exploitation of some of these issues could lead to an application crash or even allow arbitrary code execution, subject to the user's privileges.

Google Chrome Releases reports :

[151008] High CVE-2013-0839: Use-after-free in canvas font handling.
Credit to Atte Kettunen of OUSPG.

[170532] Medium CVE-2013-0840: Missing URL validation when opening new windows.

[169770] High CVE-2013-0841: Unchecked array index in content blocking. Credit to Google Chrome Security Team (Chris Evans).

[166867] Medium CVE-2013-0842: Problems with NULL characters embedded in paths. Credit to Google Chrome Security Team (Juri Aedla).

The version of Google Chrome installed on the remote host is earlier than 24.0.1312.56 and is, therefore, affected by the following vulnerabilities :

  - A use-after-free vulnerability exists related to font     handling and canvas. (CVE-2013-0839)

  - An error exists related to URL validation and the     opening of new browser windows. (CVE-2013-0840)

  - An array index is not properly checked in relation to     content blocking. (CVE-2013-0841)

  - An unspecified error exists related to handling null     characters in embedded paths. (CVE-2013-0842)

Successful exploitation of some of these issues could lead to an application crash or even allow arbitrary code execution, subject to the user's privileges.

ID	Name	Product	Family	Severity
70112	GLSA-201309-16 : Chromium, V8: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
800934	Google Chrome < 24.0.1312.56 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
6673	Google Chrome < 24.0.1312.56 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
63674	FreeBSD : chromium -- multiple vulnerabilities (8d03202c-6559-11e2-a389-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	critical
63645	Google Chrome < 24.0.1312.56 Multiple Vulnerabilities	Nessus	Windows	critical

Detections

Analytics

CVE-2013-0839

critical

Tenable Plugins

critical

high

high

critical

critical