WebKit in Google Chrome before 25.0.1364.160 allows remote attackers to execute arbitrary code via vectors that leverage "type confusion."

The remote host is affected by the vulnerability described in GLSA-201309-16 (Chromium, V8: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and V8. Please       review the CVE identifiers and release notes referenced below for       details.
  Impact :

    A context-dependent attacker could entice a user to open a specially       crafted website or JavaScript program using Chromium or V8, possibly       resulting in the execution of arbitrary code with the privileges of the       process or a Denial of Service condition. Furthermore, a remote attacker       may be able to bypass security restrictions or have other, unspecified,       impact.
  Workaround :

    There is no known workaround at this time.

Versions of iTunes earlier than 11.0.3 are reportedly affected by several vulnerabilities:

  - An error exists related to certificate validation that could allow disclosure of sensitive information and could allow the application to trust data from untrusted sources. (CVE-2013-1014)

  - The included version of WebKit contains several errors that could lead to memory corruption and possibly arbitrary code execution. The vendor notes one possible attack vector is a man-in-the-middle attack while the application browses the 'iTunes Store'. (CVE-2012-2824, CVE-2012-2857, CVE-2012-3748, CVE-2012-5112, CVE-2013-0879, CVE-2013-0912, CVE-2013-0948, CVE-2013-0949, CVE-2013-0950, CVE-2013-0951, CVE-2013-0952, CVE-2013-0953, CVE-2013-0954, CVE-2013-0955, CVE-2013-0956, CVE-2013-0958, CVE-2013-0959, CVE-2013-0960, CVE-2013-0961, CVE-2013-0991, CVE-2013-0992, CVE-2013-0993, CVE-2013-0994, CVE-2013-0995, CVE-2013-0996, CVE-2013-0997, CVE-2013-0998, CVE-2013-0999, CVE-2013-1000, CVE-2013-1001, CVE-2013-1002, CVE-2013-1003, CVE-2013-1004, CVE-2013-1005, CVE-2013-1006, CVE-2013-1007, CVE-2013-1008, CVE-2013-1010, CVE-2013-1011) 

The version of Apple iTunes on the remote host is prior to version 11.0.3. It is, therefore, affected by multiple vulnerabilities :

  - An error exists related to certificate validation. A     man-in-the-middle attacker can exploit this to spoof     HTTPS servers, which allows the disclosure of sensitive     information or the application to trust data from     untrusted sources. Note that this issue affects the     application regardless of the operating system.
    (CVE-2013-1014)

  - The version of WebKit included in iTunes contains     several errors that can lead to memory corruption and     arbitrary code execution. The vendor states that one     possible vector is a man-in-the-middle attack while the     application browses the 'iTunes Store'. Please note that     these vulnerabilities only affect the application when     it is running on a Windows host.
    (CVE-2012-2824, CVE-2012-2857, CVE-2012-3748,     CVE-2012-5112, CVE-2013-0879, CVE-2013-0912,     CVE-2013-0948, CVE-2013-0949, CVE-2013-0950,     CVE-2013-0951, CVE-2013-0952, CVE-2013-0953,     CVE-2013-0954, CVE-2013-0955, CVE-2013-0956,     CVE-2013-0958, CVE-2013-0959, CVE-2013-0960,     CVE-2013-0961, CVE-2013-0991, CVE-2013-0992,     CVE-2013-0993, CVE-2013-0994, CVE-2013-0995,     CVE-2013-0996, CVE-2013-0997, CVE-2013-0998,     CVE-2013-0999, CVE-2013-1000, CVE-2013-1001,     CVE-2013-1002, CVE-2013-1003, CVE-2013-1004,     CVE-2013-1005, CVE-2013-1006, CVE-2013-1007,     CVE-2013-1008, CVE-2013-1010, CVE-2013-1011)

The version of Apple iTunes installed on the remote Windows host is older than 11.0.3.  It therefore is potentially affected by several issues :

  - An error exists related to certificate validation     that could allow disclosure of sensitive information     and could allow the application to trust data from     untrusted sources. (CVE-2013-1014)

  - The included version of WebKit contains several errors     that could lead to memory corruption and possibly     arbitrary code execution. The vendor notes one possible     attack vector is a man-in-the-middle attack while the     application browses the 'iTunes Store'.
    (CVE-2012-2824, CVE-2012-2857, CVE-2012-3748,     CVE-2012-5112, CVE-2013-0879, CVE-2013-0912,     CVE-2013-0948, CVE-2013-0949, CVE-2013-0950,     CVE-2013-0951, CVE-2013-0952, CVE-2013-0953,     CVE-2013-0954, CVE-2013-0955, CVE-2013-0956,     CVE-2013-0958, CVE-2013-0959, CVE-2013-0960,     CVE-2013-0961, CVE-2013-0991, CVE-2013-0992,     CVE-2013-0993, CVE-2013-0994, CVE-2013-0995,     CVE-2013-0996, CVE-2013-0997, CVE-2013-0998,     CVE-2013-0999, CVE-2013-1000, CVE-2013-1001,     CVE-2013-1002, CVE-2013-1003, CVE-2013-1004,     CVE-2013-1005, CVE-2013-1006, CVE-2013-1007,     CVE-2013-1008, CVE-2013-1010, CVE-2013-1011)

The remote Mac OS X host has Safari installed. 

Versions of Safari earlier than 6.0.4 are reportedly affected by an arbitrary code execution vulnerability  in WebKit related to handling SVG files that can be exploited by tricking a victim into visiting a specially crafted web page

The remote host has Safari installed. Versions of Safari earlier than 6.0.4 are reportedly affected by an arbitrary code execution vulnerability  in WebKit related to handling SVG files that can be exploited by tricking a victim into visiting a specially crafted web page

The version of Apple Safari installed on the remote Mac OS X 10.7 or 10.8 host is earlier than 6.0.4. It is, therefore, affected by an arbitrary code execution vulnerability in WebKit related to handling SVG files that can be exploited by tricking a victim into visiting a specially crafted web page.

According to its banner, the remote Apple iOS device is missing a security update.  It is, therefore, affected by the following vulnerabilities :

 - A state management issue exists in the handling of Mach-O executable files with overlapping segments. (CVE-2013-0977)
 - An information disclosure issue exists in the ARM prefetch abort handler. (CVE-2013-0978)
 - When restoring from backup, lockdownd changes permissions on certain files even if the path to the file included a symbolic link. (CVE-2013-0979)
 - A logic issue exists in the handling of emergency calls from the lock screen. (CVE-2013-0980)
 - The IOUSBDeviceFamily driver uses pipe object pointers that come from an untrusted source. (CVE-2013-0981)
 - An invalid cast issue exists in the handling of SVG files. (CVE-2013-0912)

The mobile device is running a version of iOS that is older than version 6.1.3.  This version contains security-related fixes for the following issues :

  - A state management error exists related to 'Mach-O'     files and overlapping segments that could allow     execution of unsigned code. (CVE-2013-0977)

  - An error exists related to the ARM prefetch abort     handler that could allow disclosure of sensitive     information. (CVE-2013-0978)

  - An error exists related to 'lockdownd' and file     permissions restrictions. (CVE-2013-0979)

  - An error exists related to screen locking that could     allow unauthorized access. (CVE-2013-0980)

  - An error exists related to IOUSBDeviceFamily driver used     pipe object pointers that could allow execution of     arbitrary code. (CVE-2013-0981)

  - A variable casting error exists related to the bundled     'WebKit' component and SVG handling. (CVE-2013-0912)

Google Chrome Releases reports :

[180763] High CVE-2013-0912: Type confusion in WebKit. Credit to Nils and Jon of MWR Labs.

Versions of Google Chrome prior to 25.0.1364.160 include a vulnerable WebKit version that is affected by a type confusion issue that could allow remote code execution.

The version of Google Chrome installed on the remote host is a version prior to 25.0.1364.160.  It includes a vulnerable WebKit version that is affected by a type confusion issue that could allow remote code execution.

ID	Name	Product	Family	Severity
70112	GLSA-201309-16 : Chromium, V8: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
6831	iTunes < 11.0.3 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
66499	Apple iTunes < 11.0.3 Multiple Vulnerabilities (uncredentialed check)	Nessus	Peer-To-Peer File Sharing	critical
66498	Apple iTunes < 11.0.3 Multiple Vulnerabilities (credentialed check)	Nessus	Windows	critical
800995	Mac OS X : Safari < 6.0.4 SVG File Handling Arbitrary Code Execution	Log Correlation Engine	Web Clients	high
6762	Safari < 6.0.4 SVG File Handling Arbitrary Code Execution	Nessus Network Monitor	Web Clients	high
66000	Mac OS X : Apple Safari < 6.0.4 SVG File Handling Arbitrary Code Execution	Nessus	MacOS X Local Security Checks	high
6718	Apple iOS < 6.1.3 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	high
65633	Apple iOS < 6.1.3 Multiple Vulnerabilities	Nessus	Mobile Devices	high
65170	FreeBSD : chromium -- WebKit vulnerability (54bed676-87ce-11e2-b528-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	high
800891	Google Chrome < 25.0.1364.160 WebKit Type Confusion Code Execution	Log Correlation Engine	Web Clients	high
6709	Google Chrome < 25.0.1364.160 WebKit Type Confusion Code Execution	Nessus Network Monitor	Web Clients	high
65097	Google Chrome < 25.0.1364.160 WebKit Type Confusion Code Execution	Nessus	Windows	high

Detections

Analytics

CVE-2013-0912

high

Tenable Plugins

critical

high

critical

critical

high

high

high

high

high

high

high

high

high