Race condition in the International Components for Unicode (ICU) functionality in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ICU: missing boundary checks in layout engine (OpenJDK 2D, 8132042) (CVE-2015-4844)

  - icu: Double free in i18n/zonemeta.cpp (CVE-2017-14952)

  - The International Components for Unicode (ICU) functionality in Google Chrome before 22.0.1229.92 allows     remote attackers to cause a denial of service (out-of-bounds read) via vectors related to a regular     expression. (CVE-2012-5109)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ICU: missing boundary checks in layout engine (OpenJDK 2D, 8132042) (CVE-2015-4844)

  - icu: Stack based buffer overflow in locid.cpp (CVE-2016-7415)

  - The International Components for Unicode (ICU) functionality in Google Chrome before 22.0.1229.92 allows     remote attackers to cause a denial of service (out-of-bounds read) via vectors related to a regular     expression. (CVE-2012-5109)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Solaris system is missing necessary patches to address security updates :

  - Race condition in the International Components for     Unicode (ICU) functionality in Google Chrome before     25.0.1364.97 on Windows and Linux, and before     25.0.1364.99 on Mac OS X, allows remote attackers to     cause a denial of service or possibly have unspecified     other impact via unknown vectors. (CVE-2013-0900)

chromium was updated to version 27.0.1425 having both stability and security fixes :

  - Bug and stability fixes :

  - Fixed crash after clicking through malware warning.
    (Issue: 173986)

  - Fixed broken command line to create extensions with     locale info (Issue: 176187)

  - Hosted apps in Chrome will always be opened from app     launcher. (Issue: 176267)

  - Added modal confirmation dialog to the enterprise     profile sign-in flow. (Issue: 171236)

  - Fixed a crash with autofill. (Issues: 175454, 176576)

  - Fixed issues with sign-in. (Issues: 175672, 175819,     175541, 176190)

  - Fixed spurious profile shortcuts created with a     system-level install. (Issue: 177047)

  - Fixed the background tab flashing with certain themes.
    (Issue: 175426)

  - Security Fixes: (bnc#804986)

  - High CVE-2013-0879: Memory corruption with web audio     node

  - High CVE-2013-0880: Use-after-free in database handling

  - Medium CVE-2013-0881: Bad read in Matroska handling

  - High CVE-2013-0882: Bad memory access with excessive SVG     parameters.

  - Medium CVE-2013-0883: Bad read in Skia.

  - Low CVE-2013-0884: Inappropriate load of NaCl.

  - Medium CVE-2013-0885: Too many API permissions granted     to web store

  - Medium CVE-2013-0886: Incorrect NaCl signal handling. 

  - Low CVE-2013-0887: Developer tools process has too many     permissions and places too much trust in the connected     server

  - Medium CVE-2013-0888: Out-of-bounds read in Skia

  - Low CVE-2013-0889: Tighten user gesture check for     dangerous file downloads.

  - High CVE-2013-0890: Memory safety issues across the IPC     layer.

  - High CVE-2013-0891: Integer overflow in blob handling.

  - Medium CVE-2013-0892: Lower severity issues across the     IPC layer

  - Medium CVE-2013-0893: Race condition in media handling.

  - High CVE-2013-0894: Buffer overflow in vorbis decoding.

  - High CVE-2013-0895: Incorrect path handling in file     copying.

  - High CVE-2013-0896: Memory management issues in plug-in     message handling

  - Low CVE-2013-0897: Off-by-one read in PDF

  - High CVE-2013-0898: Use-after-free in URL handling

  - Low CVE-2013-0899: Integer overflow in Opus handling

  - Medium CVE-2013-0900: Race condition in ICU

  - Make adjustment for autodetecting of the PepperFlash     library. The package with the PepperFlash hopefully will     be soon available through packman

  - Update to 26.0.1411

  - Bug and stability fixes

  - Update to 26.0.1403

  - Bug and stability fixes

  - Using system libxml2 requires system libxslt.

  - Using system MESA does not work in i586 for some reason.

  - Also use system MESA, factory version seems adecuate     now. 

  - Always use system libxml2.

  - Restrict the usage of system libraries instead of the     bundled ones to new products, too much hassle otherwise.

  - Also link kerberos and libgps directly, do not dlopen     them. 

  - Avoid using dlopen on system libraries, rpm or the     package Manager do not handle this at all. tested for a     few weeks and implemented with a macro so it can be     easily disabled if problems arise.

  - Use SOME system libraries instead of the bundled ones,     tested for several weeks and implemented with a macro     for easy enable/Disable in case of trouble.

  - Update to 26.0.1393

  - Bug and stability fixes

  - Security fixes 

  - Update to 26.0.1375

  - Bug and stability fixes

  - Update to 26.0.1371

  - Bug and stability fixes

  - Update to 26.0.1367

  - Bug and stability fixes

The remote host is affected by the vulnerability described in GLSA-201402-14 (International Components for Unicode: Denial of Service)

    Multiple vulnerabilities have been discovered in International       Components for Unicode. Please review the CVE identifiers referenced       below for details.
  Impact :

    A remote attacker could possibly cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Updated icu packages fix security vulnerabilities :

It was discovered that ICU contained a race condition affecting multi-threaded applications. If an application using ICU processed crafted data, an attacker could cause it to crash or potentially execute arbitrary code with the privileges of the user invoking the program (CVE-2013-0900).

It was discovered that ICU incorrectly handled memory operations. If an application using ICU processed crafted data, an attacker could cause it to crash or potentially execute arbitrary code with the privileges of the user invoking the program (CVE-2013-2924).

The Google Chrome Security Team discovered two issues (a race condition and a use-after-free issue) in the International Components for Unicode (ICU) library.

It was discovered that ICU contained a race condition affecting multi- threaded applications. If an application using ICU processed crafted data, an attacker could cause it to crash or potentially execute arbitrary code with the privileges of the user invoking the program.
This issue only affected Ubuntu 12.04 LTS and Ubuntu 12.10.
(CVE-2013-0900)

It was discovered that ICU incorrectly handled memory operations. If an application using ICU processed crafted data, an attacker could cause it to crash or potentially execute arbitrary code with the privileges of the user invoking the program. (CVE-2013-2924).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201309-16 (Chromium, V8: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and V8. Please       review the CVE identifiers and release notes referenced below for       details.
  Impact :

    A context-dependent attacker could entice a user to open a specially       crafted website or JavaScript program using Chromium or V8, possibly       resulting in the execution of arbitrary code with the privileges of the       process or a Denial of Service condition. Furthermore, a remote attacker       may be able to bypass security restrictions or have other, unspecified,       impact.
  Workaround :

    There is no known workaround at this time.

Resolves: rhbz#918168 CVE-2013-0900 race condition allows DoS

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Google Chrome Releases reports :

[172243] High CVE-2013-0879: Memory corruption with web audio node.
Credit to Atte Kettunen of OUSPG.

[171951] High CVE-2013-0880: Use-after-free in database handling.
Credit to Chamal de Silva.

[167069] Medium CVE-2013-0881: Bad read in Matroska handling. Credit to Atte Kettunen of OUSPG.

[165432] High CVE-2013-0882: Bad memory access with excessive SVG parameters. Credit to Renata Hodovan.

[142169] Medium CVE-2013-0883: Bad read in Skia. Credit to Atte Kettunen of OUSPG.

[172984] Low CVE-2013-0884: Inappropriate load of NaCl. Credit to Google Chrome Security Team (Chris Evans).

[172369] Medium CVE-2013-0885: Too many API permissions granted to web store.

[171065] [170836] Low CVE-2013-0887: Developer tools process has too many permissions and places too much trust in the connected server.

[170666] Medium CVE-2013-0888: Out-of-bounds read in Skia. Credit to Google Chrome Security Team (Inferno).

[170569] Low CVE-2013-0889: Tighten user gesture check for dangerous file downloads.

[169973] [169966] High CVE-2013-0890: Memory safety issues across the IPC layer. Credit to Google Chrome Security Team (Chris Evans).

[169685] High CVE-2013-0891: Integer overflow in blob handling. Credit to Google Chrome Security Team (Juri Aedla).

[169295] [168710] [166493] [165836] [165747] [164958] [164946] Medium CVE-2013-0892: Lower severity issues across the IPC layer. Credit to Google Chrome Security Team (Chris Evans).

[168570] Medium CVE-2013-0893: Race condition in media handling.
Credit to Andrew Scherkus of the Chromium development community.

[168473] High CVE-2013-0894: Buffer overflow in vorbis decoding.
Credit to Google Chrome Security Team (Inferno).

[Linux / Mac] [167840] High CVE-2013-0895: Incorrect path handling in file copying. Credit to Google Chrome Security Team (Juri Aedla).

[166708] High CVE-2013-0896: Memory management issues in plug-in message handling. Credit to Google Chrome Security Team (Cris Neckar).

[165537] Low CVE-2013-0897: Off-by-one read in PDF. Credit to Mateusz Jurczyk, with contributions by Gynvael Coldwind, both from Google Security Team.

[164643] High CVE-2013-0898: Use-after-free in URL handling. Credit to Alexander Potapenko of the Chromium development community.

[160480] Low CVE-2013-0899: Integer overflow in Opus handling. Credit to Google Chrome Security Team (Juri Aedla).

[152442] Medium CVE-2013-0900: Race condition in ICU. Credit to Google Chrome Security Team (Inferno).

Versions of Google Chrome earlier than 25.0.1364.97 are potentially affected by the following vulnerabilities :

  - An unspecified memory corruption error exists related to 'web audio node'. (CVE-2013-0879)

  - Use-after-free errors exist related to database and URL handling. (CVE-2013-0880, CVE-2013-0898)

  - Improper memory read errors exist related to Matroska, excessive SVG parameters, and Skia. (CVE-2013-0881, CVE-2013-0882, CVE-2013-0883, CVE-2013-0888)

  - An error exists related to improper loading of 'NaCl'. (CVE-2013-0884)

  - The 'web store' is granted too many API permissions. (CVE-2013-0885)

  - The developer tools process is granted too many permissions and trusts remote servers incorrectly. (CVE-2013-0887)

  - User gestures are not properly checked with respect to dangerous file downloads. (CVE-2013-0889)

  - An unspecified memory safety issue exists in the IPC layer. (CVE-2013-0890)

  - Integer overflow errors exist related to blob and 'Opus' handling. (CVE-2013-0891, CVE-2013-0899)

  - Numerous, unspecified, lower-severity issues exist related to the IPC layer. (CVE-2013-0892)

  - Race conditions exist related to media handling and ICU. (CVE-2013-0893, CVE-2013-0900)

  - A buffer overflow exists related to vorbis decoding. (CVE-2013-0894)

  - Memory management errors exist related to plugin message handling. (CVE-2013-0896)

  - An off-by-one read error exists related to PDF handling. (CVE-2013-0897)

Note that the vendor states that WebKit's MathML implementation has been disabled in this release.  This is due to several unspecified, high severity security issues.  Successful exploitation of some of these issues could lead to an application crash or even allow arbitrary code execution, subject to the user's privileges.

The version of Google Chrome installed on the remote host is a version prior to 25.0.1364.97. It is, therefore, affected by the following vulnerabilities :

  - An unspecified memory corruption error exists related     to 'web audio node'. (CVE-2013-0879)

  - Use-after-free errors exist related to database and     URL handling. (CVE-2013-0880, CVE-2013-0898)

  - Improper memory read errors exist related to Matroska,     excessive SVG parameters, and Skia. (CVE-2013-0881,     CVE-2013-0882, CVE-2013-0883, CVE-2013-0888)

  - An error exists related to improper loading of 'NaCl'.
    (CVE-2013-0884)

  - The 'web store' is granted too many API permissions.
    (CVE-2013-0885)

  - The developer tools process is granted too many     permissions and trusts remote servers incorrectly.
    (CVE-2013-0887)

  - User gestures are not properly checked with respect to     dangerous file downloads. (CVE-2013-0889)

  - An unspecified memory safety issue exists in the IPC     layer. (CVE-2013-0890)

  - Integer overflow errors exist related to blob and     'Opus' handling. (CVE-2013-0891, CVE-2013-0899)

  - Numerous, unspecified, lower-severity issues exist     related to the IPC layer. (CVE-2013-0892)

  - Race conditions exist related to media handling and     ICU. (CVE-2013-0893, CVE-2013-0900)

  - A buffer overflow exists related to vorbis decoding.
    (CVE-2013-0894)

  - Memory management errors exist related to plugin     message handling. (CVE-2013-0896)

  - An off-by-one read error exists related to PDF     handling. (CVE-2013-0897)

Note that the vendor states that WebKit's MathML implementation has been disabled in this release.  This is due to several unspecified, high severity security issues.  Successful exploitation of some of these issues could lead to an application crash or even allow arbitrary code execution, subject to the user's privileges.

ID	Name	Product	Family	Severity
199670	RHEL 6 : icu (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199595	RHEL 5 : icu (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
80642	Oracle Solaris Third-Party Patch Update : icu (cve_2013_0900_race_conditions)	Nessus	Solaris Local Security Checks	medium
74920	openSUSE Security Update : chromium (openSUSE-SU-2013:0454-1)	Nessus	SuSE Local Security Checks	high
72418	GLSA-201402-14 : International Components for Unicode: Denial of Service	Nessus	Gentoo Local Security Checks	high
70678	Mandriva Linux Security Advisory : icu (MDVSA-2013:258)	Nessus	Mandriva Local Security Checks	high
70664	Debian DSA-2786-1 : icu - several vulnerabilities	Nessus	Debian Local Security Checks	high
70452	Ubuntu 12.04 LTS / 12.10 / 13.04 : icu vulnerabilities (USN-1989-1)	Nessus	Ubuntu Local Security Checks	high
70112	GLSA-201309-16 : Chromium, V8: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
65593	Fedora 18 : icu-49.1.1-8.fc18 (2013-3546)	Nessus	Fedora Local Security Checks	medium
65592	Fedora 17 : icu-4.8.1.1-5.fc17 (2013-3538)	Nessus	Fedora Local Security Checks	medium
64859	FreeBSD : chromium -- multiple vulnerabilities (dfd92cb2-7d48-11e2-ad48-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	high
800930	Google Chrome < 25.0.1364.97 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
64813	Google Chrome < 25.0.1364.97 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2013-0900

high

Tenable Plugins

critical

critical

medium

high

high

high

high

high

critical

medium

medium

high

high

high