Use-after-free vulnerability in the media loader in Google Chrome before 27.0.1453.93 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2013-2840.

The remote host is affected by the vulnerability described in GLSA-201309-16 (Chromium, V8: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and V8. Please       review the CVE identifiers and release notes referenced below for       details.
  Impact :

    A context-dependent attacker could entice a user to open a specially       crafted website or JavaScript program using Chromium or V8, possibly       resulting in the execution of arbitrary code with the privileges of the       process or a Denial of Service condition. Furthermore, a remote attacker       may be able to bypass security restrictions or have other, unspecified,       impact.
  Workaround :

    There is no known workaround at this time.

Several vulnerabilities have been discovered in the Chromium web browser. Multiple use-after-free, out-of-bounds read, memory safety, and cross-site scripting issues were discovered and corrected.

  - CVE-2013-2837     Use-after-free vulnerability in the SVG implementation     allows remote attackers to cause a denial of service or     possibly have unspecified other impact via unknown     vectors.

  - CVE-2013-2838     Google V8, as used in Chromium before 27.0.1453.93,     allows remote attackers to cause a denial of service     (out-of-bounds read) via unspecified vectors.

  - CVE-2013-2839     Chromium before 27.0.1453.93 does not properly perform a     cast of an unspecified variable during handling of     clipboard data, which allows remote attackers to cause a     denial of service or possibly have other impact via     unknown vectors.

  - CVE-2013-2840     Use-after-free vulnerability in the media loader in     Chromium before 27.0.1453.93 allows remote attackers to     cause a denial of service or possibly have unspecified     other impact via unknown vectors, a different     vulnerability than CVE-2013-2846.

  - CVE-2013-2841     Use-after-free vulnerability in Chromium before     27.0.1453.93 allows remote attackers to cause a denial     of service or possibly have unspecified other impact via     vectors related to the handling of Pepper resources.

  - CVE-2013-2842     Use-after-free vulnerability in Chromium before     27.0.1453.93 allows remote attackers to cause a denial     of service or possibly have unspecified other impact via     vectors related to the handling of widgets.

  - CVE-2013-2843     Use-after-free vulnerability in Chromium before     27.0.1453.93 allows remote attackers to cause a denial     of service or possibly have unspecified other impact via     vectors related to the handling of speech data.

  - CVE-2013-2844     Use-after-free vulnerability in the Cascading Style     Sheets (CSS) implementation in Chromium before     27.0.1453.93 allows remote attackers to cause a denial     of service or possibly have unspecified other impact via     vectors related to style resolution.

  - CVE-2013-2845     The Web Audio implementation in Chromium before     27.0.1453.93 allows remote attackers to cause a denial     of service (memory corruption) or possibly have     unspecified other impact via unknown vectors.

  - CVE-2013-2846     Use-after-free vulnerability in the media loader in     Chromium before 27.0.1453.93 allows remote attackers to     cause a denial of service or possibly have unspecified     other impact via unknown vectors, a different     vulnerability than CVE-2013-2840.

  - CVE-2013-2847     Race condition in the workers implementation in Chromium     before 27.0.1453.93 allows remote attackers to cause a     denial of service (use-after-free and application crash)     or possibly have unspecified other impact via unknown     vectors.

  - CVE-2013-2848     The XSS Auditor in Chromium before 27.0.1453.93 might     allow remote attackers to obtain sensitive information     via unspecified vectors.

  - CVE-2013-2849     Multiple cross-site scripting (XSS) vulnerabilities in     Chromium before 27.0.1453.93 allow user-assisted remote     attackers to inject arbitrary web script or HTML via     vectors involving a (1) drag-and-drop or (2)     copy-and-paste operation.

Versions of Google Chrome prior to 27.0.1453.93 are affected by the following vulnerabilities :

  - Use-after-free errors exist in SVG, media loader, Pepper resource handling, widget handling, speech handling, style resolution, media loader, and related to race condition with workers.  (CVE-2013-2837, CVE-2013-2840, CVE-2013-2841, CVE-2013-2842, CVE-2013-2843, CVE-2013-2844, CVE-2013-2846, CVE-2013-2847)

  - An out-of-bounds read error exists in v8. (CVE-2013-2838)

  - A memory corruption vulnerability exists related to a bad casting in clipboard handling.  (CVE-2013-2839)

  - A memory safety issue exists related to Web Audio. (CVE-2013-2845)

  - An information disclosure vulnerability exists related to XSS Auditor.  (CVE-2013-2848)

  - A cross-site scripting vulnerability exists related to drag and drop or copy and paste. (CVE-2013-2849)

The version of Google Chrome installed on the remote host is a version prior to 27.0.1453.93 and is, therefore, affected by the following vulnerabilities :

  - Use-after-free errors exist in SVG, media loader,     Pepper resource handling, widget handling, speech     handling, style resolution, media loader, and related to     race condition with workers.  (CVE-2013-2837,     CVE-2013-2840, CVE-2013-2841, CVE-2013-2842,     CVE-2013-2843, CVE-2013-2844, CVE-2013-2846,     CVE-2013-2847)

  - An out-of-bounds read error exists in v8.
    (CVE-2013-2838)

  - A memory corruption vulnerability exists related to     a bad casting in clipboard handling.  (CVE-2013-2839)

  - A memory safety issue exists related to Web Audio.
    (CVE-2013-2845)

  - An information disclosure vulnerability exists related     to XSS Auditor.  (CVE-2013-2848)

  - A cross-site scripting vulnerability exists related to     drag and drop or copy and paste.  (CVE-2013-2849)

Google Chrome Releases reports :

[235638] High CVE-2013-2837: Use-after-free in SVG. Credit to Slawomir Blazek.

[235311] Medium CVE-2013-2838: Out-of-bounds read in v8. Credit to Christian Holler.

[230176] High CVE-2013-2839: Bad cast in clipboard handling. Credit to Jon of MWR InfoSecurity.

[230117] High CVE-2013-2840: Use-after-free in media loader. Credit to Nils of MWR InfoSecurity.

[227350] High CVE-2013-2841: Use-after-free in Pepper resource handling. Credit to Chamal de Silva.

[226696] High CVE-2013-2842: Use-after-free in widget handling. Credit to Cyril Cattiaux.

[222000] High CVE-2013-2843: Use-after-free in speech handling. Credit to Khalil Zhani.

[196393] High CVE-2013-2844: Use-after-free in style resolution.
Credit to Sachin Shinde (@cons0ul).

[188092] [179522] [222136] [188092] High CVE-2013-2845: Memory safety issues in Web Audio. Credit to Atte Kettunen of OUSPG.

[177620] High CVE-2013-2846: Use-after-free in media loader. Credit to Chamal de Silva.

[176692] High CVE-2013-2847: Use-after-free race condition with workers. Credit to Collin Payne.

[176137] Medium CVE-2013-2848: Possible data extraction with XSS Auditor. Credit to Egor Homakov.

[171392] Low CVE-2013-2849: Possible XSS with drag+drop or copy+paste.
Credit to Mario Heiderich.

[241595] High CVE-2013-2836: Various fixes from internal audits, fuzzing and other initiatives.

ID	Name	Product	Family	Severity
70112	GLSA-201309-16 : Chromium, V8: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
66676	Debian DSA-2695-1 : chromium-browser - several issues	Nessus	Debian Local Security Checks	high
800944	Google Chrome < 27.0.1453.93 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
800797	Google Chrome < 27.0.1453.93 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
66556	Google Chrome < 27.0.1453.93 Multiple Vulnerabilities	Nessus	Windows	high
66549	FreeBSD : chromium -- multiple vulnerabilities (358133b5-c2b9-11e2-a738-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2013-2846

high

Tenable Plugins

critical

high

high

high

high

high