Multiple unspecified vulnerabilities in Google Chrome before 27.0.1453.93 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

The remote host is affected by the vulnerability described in GLSA-201309-16 (Chromium, V8: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and V8. Please       review the CVE identifiers and release notes referenced below for       details.
  Impact :

    A context-dependent attacker could entice a user to open a specially       crafted website or JavaScript program using Chromium or V8, possibly       resulting in the execution of arbitrary code with the privileges of the       process or a Denial of Service condition. Furthermore, a remote attacker       may be able to bypass security restrictions or have other, unspecified,       impact.
  Workaround :

    There is no known workaround at this time.

Versions of Google Chrome prior to 27.0.1453.93 are affected by the following vulnerabilities :

  - Use-after-free errors exist in SVG, media loader, Pepper resource handling, widget handling, speech handling, style resolution, media loader, and related to race condition with workers.  (CVE-2013-2837, CVE-2013-2840, CVE-2013-2841, CVE-2013-2842, CVE-2013-2843, CVE-2013-2844, CVE-2013-2846, CVE-2013-2847)

  - An out-of-bounds read error exists in v8. (CVE-2013-2838)

  - A memory corruption vulnerability exists related to a bad casting in clipboard handling.  (CVE-2013-2839)

  - A memory safety issue exists related to Web Audio. (CVE-2013-2845)

  - An information disclosure vulnerability exists related to XSS Auditor.  (CVE-2013-2848)

  - A cross-site scripting vulnerability exists related to drag and drop or copy and paste. (CVE-2013-2849)

The version of Google Chrome installed on the remote host is a version prior to 27.0.1453.93 and is, therefore, affected by the following vulnerabilities :

  - Use-after-free errors exist in SVG, media loader,     Pepper resource handling, widget handling, speech     handling, style resolution, media loader, and related to     race condition with workers.  (CVE-2013-2837,     CVE-2013-2840, CVE-2013-2841, CVE-2013-2842,     CVE-2013-2843, CVE-2013-2844, CVE-2013-2846,     CVE-2013-2847)

  - An out-of-bounds read error exists in v8.
    (CVE-2013-2838)

  - A memory corruption vulnerability exists related to     a bad casting in clipboard handling.  (CVE-2013-2839)

  - A memory safety issue exists related to Web Audio.
    (CVE-2013-2845)

  - An information disclosure vulnerability exists related     to XSS Auditor.  (CVE-2013-2848)

  - A cross-site scripting vulnerability exists related to     drag and drop or copy and paste.  (CVE-2013-2849)

Google Chrome Releases reports :

[235638] High CVE-2013-2837: Use-after-free in SVG. Credit to Slawomir Blazek.

[235311] Medium CVE-2013-2838: Out-of-bounds read in v8. Credit to Christian Holler.

[230176] High CVE-2013-2839: Bad cast in clipboard handling. Credit to Jon of MWR InfoSecurity.

[230117] High CVE-2013-2840: Use-after-free in media loader. Credit to Nils of MWR InfoSecurity.

[227350] High CVE-2013-2841: Use-after-free in Pepper resource handling. Credit to Chamal de Silva.

[226696] High CVE-2013-2842: Use-after-free in widget handling. Credit to Cyril Cattiaux.

[222000] High CVE-2013-2843: Use-after-free in speech handling. Credit to Khalil Zhani.

[196393] High CVE-2013-2844: Use-after-free in style resolution.
Credit to Sachin Shinde (@cons0ul).

[188092] [179522] [222136] [188092] High CVE-2013-2845: Memory safety issues in Web Audio. Credit to Atte Kettunen of OUSPG.

[177620] High CVE-2013-2846: Use-after-free in media loader. Credit to Chamal de Silva.

[176692] High CVE-2013-2847: Use-after-free race condition with workers. Credit to Collin Payne.

[176137] Medium CVE-2013-2848: Possible data extraction with XSS Auditor. Credit to Egor Homakov.

[171392] Low CVE-2013-2849: Possible XSS with drag+drop or copy+paste.
Credit to Mario Heiderich.

[241595] High CVE-2013-2836: Various fixes from internal audits, fuzzing and other initiatives.

ID	Name	Product	Family	Severity
70112	GLSA-201309-16 : Chromium, V8: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
800944	Google Chrome < 27.0.1453.93 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
800797	Google Chrome < 27.0.1453.93 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
6835	Google Chrome < 27.0.1453.93 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
66556	Google Chrome < 27.0.1453.93 Multiple Vulnerabilities	Nessus	Windows	high
66549	FreeBSD : chromium -- multiple vulnerabilities (358133b5-c2b9-11e2-a738-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2013-2836

critical

Tenable Plugins

critical

high

high

high

high

high