Use-after-free vulnerability in the Document::finishedParsing function in core/dom/Document.cpp in Blink, as used in Google Chrome before 29.0.1547.57, allows remote attackers to cause a denial of service or possibly have unspecified other impact via an onload event that changes an IFRAME element so that its src attribute is no longer an XML document, leading to unintended garbage collection of this document.

The version of Google Chrome installed on the remote host is a version prior to 29.0.1547.57.  It is, therefore, affected by multiple vulnerabilities :

  - Various unspecified errors exist. No further details     have been provided. (CVE-2013-2887)

  - An input validation error exists related to incomplete     paths and file handling. (CVE-2013-2900)

  - An integer overflow error exists related to 'ANGLE'.
    (CVE-2013-2901)

  - Use-after-free errors exist related to 'XSLT', the     'media' element and document parsing. (CVE-2013-2902,     CVE-2013-2903, CVE-2013-2904)

  - An error exists related to shared memory files that     could lead to the disclosure of sensitive information.
    (CVE-2013-2905)

The remote host is affected by the vulnerability described in GLSA-201309-16 (Chromium, V8: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and V8. Please       review the CVE identifiers and release notes referenced below for       details.
  Impact :

    A context-dependent attacker could entice a user to open a specially       crafted website or JavaScript program using Chromium or V8, possibly       resulting in the execution of arbitrary code with the privileges of the       process or a Denial of Service condition. Furthermore, a remote attacker       may be able to bypass security restrictions or have other, unspecified,       impact.
  Workaround :

    There is no known workaround at this time.

Starting from version 15, the Opera web browser uses Google's open-source Chromium rendering engine. Versions older than Opera 16 do not contain the myriad of security fixes from the contemporary version of Chromium, which is version 29. Users are advised to upgrade to Opera 16 or the latest version of Opera for security updates.

Several vulnerabilities have been discovered in the Chromium web browser.

  - CVE-2013-2887     The chrome 29 development team found various issues from     internal fuzzing, audits, and other studies.

  - CVE-2013-2900     Krystian Bigaj discovered a file handling path     sanitization issue.

  - CVE-2013-2901     Alex Chapman discovered an integer overflow issue in     ANGLE, the Almost Native Graphics Layer.

  - CVE-2013-2902     cloudfuzzer discovered a use-after-free issue in XSLT.

  - CVE-2013-2903     cloudfuzzer discovered a use-after-free issue in     HTMLMediaElement.

  - CVE-2013-2904     cloudfuzzer discovered a use-after-free issue in XML     document parsing.

  - CVE-2013-2905     Christian Jaeger discovered an information leak due to     insufficient file permissions.

Google Chrome Releases reports :

25 security fixes in this release, including :

- [181617] High CVE-2013-2900: Incomplete path sanitization in file handling. Credit to Krystian Bigaj.

- [254159] Low CVE-2013-2905: Information leak via overly broad permissions on shared memory files. Credit to Christian Jaeger.

- [257363] High CVE-2013-2901: Integer overflow in ANGLE. Credit to Alex Chapman.

- [260105] High CVE-2013-2902: Use after free in XSLT. Credit to cloudfuzzer.

- [260156] High CVE-2013-2903: Use after free in media element. Credit to cloudfuzzer.

- [260428] High CVE-2013-2904: Use after free in document parsing.
Credit to cloudfuzzer.

- [274602] CVE-2013-2887: Various fixes from internal audits, fuzzing and other initiatives (Chrome 29).

The version of Google Chrome installed on the remote host is a version prior to 29.0.1547.57.  It is, therefore, affected by multiple vulnerabilities :

  - Various unspecified errors exist. No further details     have been provided. (CVE-2013-2887)

  - An input validation error exists related to incomplete     paths and file handling. (CVE-2013-2900)

  - An integer overflow error exists related to 'ANGLE'.
    (CVE-2013-2901)

  - Use-after-free errors exist related to 'XSLT', the     'media' element and document parsing. (CVE-2013-2902,     CVE-2013-2903, CVE-2013-2904)

  - An error exists related to shared memory files that     could lead to the disclosure of sensitive information.
    (CVE-2013-2905)

  - An error exists related to HTTP Cookie headers and     validation that could allow denial of service attacks.
    (CVE-2013-6166)

ID	Name	Product	Family	Severity
70891	Google Chrome < 29.0.1547.57 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
70112	GLSA-201309-16 : Chromium, V8: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
801522	Opera < 16.0 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
8002	Opera < 16.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
69470	Debian DSA-2741-1 : chromium-browser - several vulnerabilities	Nessus	Debian Local Security Checks	high
69437	FreeBSD : chromium -- multiple vulnerabilities (ae651a4b-0a42-11e3-ba52-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	high
69423	Google Chrome < 29.0.1547.57 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2013-2904

high

Tenable Plugins

high

critical

high

high

high

high

high