Multiple race conditions in the Web Audio implementation in Blink, as used in Google Chrome before 30.0.1599.66, allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to threading in core/html/HTMLMediaElement.cpp, core/platform/audio/AudioDSPKernelProcessor.cpp, core/platform/audio/HRTFElevation.cpp, and modules/webaudio/ConvolverNode.cpp.

- Update to Chromium 31.0.1650.63 Stable channel update :

  - Security fixes :

  - CVE-2013-6634: Session fixation in sync related to 302     redirects

  - CVE-2013-6635: Use-after-free in editing

  - CVE-2013-6636: Address bar spoofing related to modal     dialogs

  - CVE-2013-6637: Various fixes from internal audits,     fuzzing and other initiatives.

  - CVE-2013-6638: Buffer overflow in v8

  - CVE-2013-6639: Out of bounds write in v8.

  - CVE-2013-6640: Out of bounds read in v8

  - and 12 other security fixes.

  - Remove the build flags to build according to the Chrome     ffmpeg branding and the proprietary codecs. (bnc#847971)

  - Update to Chromium 31.0.1650.57 Stable channel update :

  - Security Fixes :

  - CVE-2013-6632: Multiple memory corruption issues.

  - Update to Chromium 31.0.1650.48 Stable Channel update :

  - Security fixes :

  - CVE-2013-6621: Use after free related to speech input     elements..

  - CVE-2013-6622: Use after free related to media elements. 

  - CVE-2013-6623: Out of bounds read in SVG.

  - CVE-2013-6624: Use after free related to     &ldquo;id&rdquo; attribute strings.

  - CVE-2013-6625: Use after free in DOM ranges.

  - CVE-2013-6626: Address bar spoofing related to     interstitial warnings.

  - CVE-2013-6627: Out of bounds read in HTTP parsing.

  - CVE-2013-6628: Issue with certificates not being checked     during TLS renegotiation.

  - CVE-2013-2931: Various fixes from internal audits,     fuzzing and other initiatives.

  - CVE-2013-6629: Read of uninitialized memory in libjpeg     and libjpeg-turbo.

  - CVE-2013-6630: Read of uninitialized memory in     libjpeg-turbo.

  - CVE-2013-6631: Use after free in libjingle.

  - Added patch chromium-fix-chromedriver-build.diff to fix     the chromedriver build

  - Enable ARM build for Chromium. 

  - Added patches chromium-arm-webrtc-fix.patch,     chromium-fix-arm-icu.patch and     chromium-fix-arm-sysroot.patch to resolve ARM specific     build issues

  - Update to Chromium 30.0.1599.114 Stable Channel update:
    fix build for 32bit systems

  - Drop patch chromium-fix-chromedriver-build.diff. This is     now fixed upstream

  - For openSUSE versions lower than 13.1, build against the     in-tree libicu

  - Update to Chromium 30.0.1599.101

  - Security Fixes :

  + CVE-2013-2925: Use after free in XHR

  + CVE-2013-2926: Use after free in editing

  + CVE-2013-2927: Use after free in forms.

  + CVE-2013-2928: Various fixes from internal audits,     fuzzing and other initiatives.

  - Update to Chromium 30.0.1599.66

  - Easier searching by image 

  - A number of new apps/extension APIs 

  - Lots of under the hood changes for stability and     performance

  - Security fixes :

  + CVE-2013-2906: Races in Web Audio

  + CVE-2013-2907: Out of bounds read in Window.prototype     object

  + CVE-2013-2908: Address bar spoofing related to the     &ldquo;204 No Content&rdquo; status code

  + CVE-2013-2909: Use after free in inline-block rendering

  + CVE-2013-2910: Use-after-free in Web Audio

  + CVE-2013-2911: Use-after-free in XSLT

  + CVE-2013-2912: Use-after-free in PPAPI

  + CVE-2013-2913: Use-after-free in XML document parsing

  + CVE-2013-2914: Use after free in the Windows color     chooser dialog

  + CVE-2013-2915: Address bar spoofing via a malformed     scheme

  + CVE-2013-2916: Address bar spoofing related to the     &ldquo;204 No Content&rdquo; status code

  + CVE-2013-2917: Out of bounds read in Web Audio

  + CVE-2013-2918: Use-after-free in DOM

  + CVE-2013-2919: Memory corruption in V8

  + CVE-2013-2920: Out of bounds read in URL parsing

  + CVE-2013-2921: Use-after-free in resource loader

  + CVE-2013-2922: Use-after-free in template element

  + CVE-2013-2923: Various fixes from internal audits,     fuzzing and other initiatives 

  + CVE-2013-2924: Use-after-free in ICU. Upstream bug

Chromium was updated to 31.0.1650.57: Stable channel update :

  - Security Fixes :

  - CVE-2013-6632: Multiple memory corruption issues.

  - Update to Chromium 31.0.1650.48 Stable Channel update :

  - Security fixes :

  - CVE-2013-6621: Use after free related to speech input     elements..

  - CVE-2013-6622: Use after free related to media elements. 

  - CVE-2013-6623: Out of bounds read in SVG.

  - CVE-2013-6624: Use after free related to     &ldquo;id&rdquo; attribute strings.

  - CVE-2013-6625: Use after free in DOM ranges.

  - CVE-2013-6626: Address bar spoofing related to     interstitial warnings.

  - CVE-2013-6627: Out of bounds read in HTTP parsing.

  - CVE-2013-6628: Issue with certificates not being checked     during TLS renegotiation.

  - CVE-2013-2931: Various fixes from internal audits,     fuzzing and other initiatives.

  - CVE-2013-6629: Read of uninitialized memory in libjpeg     and libjpeg-turbo.

  - CVE-2013-6630: Read of uninitialized memory in     libjpeg-turbo.

  - CVE-2013-6631: Use after free in libjingle.

  - Added patch chromium-fix-chromedriver-build.diff to fix     the chromedriver build

  - Enable ARM build for Chromium. 

  - Added patches chromium-arm-webrtc-fix.patch,     chromium-fix-arm-icu.patch and     chromium-fix-arm-sysroot.patch to resolve ARM specific     build issues

  - Update to Chromium 30.0.1599.114 Stable Channel update:
    fix build for 32bit systems

  - Drop patch chromium-fix-chromedriver-build.diff. This is     now fixed upstream

  - For openSUSE versions lower than 13.1, build against the     in-tree libicu

  - Update to Chromium 30.0.1599.101

  - Security Fixes :

  + CVE-2013-2925: Use after free in XHR

  + CVE-2013-2926: Use after free in editing

  + CVE-2013-2927: Use after free in forms.

  + CVE-2013-2928: Various fixes from internal audits,     fuzzing and other initiatives.

  - Update to Chromium 30.0.1599.66

  - Easier searching by image 

  - A number of new apps/extension APIs 

  - Lots of under the hood changes for stability and     performance

  - Security fixes :

  + CVE-2013-2906: Races in Web Audio

  + CVE-2013-2907: Out of bounds read in Window.prototype     object

  + CVE-2013-2908: Address bar spoofing related to the     &ldquo;204 No Content&rdquo; status code

  + CVE-2013-2909: Use after free in inline-block rendering

  + CVE-2013-2910: Use-after-free in Web Audio

  + CVE-2013-2911: Use-after-free in XSLT

  + CVE-2013-2912: Use-after-free in PPAPI

  + CVE-2013-2913: Use-after-free in XML document parsing

  + CVE-2013-2914: Use after free in the Windows color     chooser dialog

  + CVE-2013-2915: Address bar spoofing via a malformed     scheme

  + CVE-2013-2916: Address bar spoofing related to the     &ldquo;204 No Content&rdquo; status code

  + CVE-2013-2917: Out of bounds read in Web Audio

  + CVE-2013-2918: Use-after-free in DOM

  + CVE-2013-2919: Memory corruption in V8

  + CVE-2013-2920: Out of bounds read in URL parsing

  + CVE-2013-2921: Use-after-free in resource loader

  + CVE-2013-2922: Use-after-free in template element

  + CVE-2013-2923: Various fixes from internal audits,     fuzzing and other initiatives 

  + CVE-2013-2924: Use-after-free in ICU. Upstream bug

Update to Chromium 30.0.1599.66 :

  - Easier searching by image 

  - A number of new apps/extension APIs 

  - Lots of under the hood changes for stability and     performance

  - Security fixes :

  + CVE-2013-2906: Races in Web Audio

  + CVE-2013-2907: Out of bounds read in Window.prototype     object

  + CVE-2013-2908: Address bar spoofing related to the     &ldquo;204 No Content&rdquo; status code

  + CVE-2013-2909: Use after free in inline-block rendering

  + CVE-2013-2910: Use-after-free in Web Audio

  + CVE-2013-2911: Use-after-free in XSLT

  + CVE-2013-2912: Use-after-free in PPAPI

  + CVE-2013-2913: Use-after-free in XML document parsing

  + CVE-2013-2914: Use after free in the Windows color     chooser dialog

  + CVE-2013-2915: Address bar spoofing via a malformed     scheme

  + CVE-2013-2916: Address bar spoofing related to the     &ldquo;204 No Content&rdquo; status code

  + CVE-2013-2917: Out of bounds read in Web Audio

  + CVE-2013-2918: Use-after-free in DOM

  + CVE-2013-2919: Memory corruption in V8

  + CVE-2013-2920: Out of bounds read in URL parsing

  + CVE-2013-2921: Use-after-free in resource loader

  + CVE-2013-2922: Use-after-free in template element

  + CVE-2013-2923: Various fixes from internal audits,     fuzzing and other initiatives 

  + CVE-2013-2924: Use-after-free in ICU. Upstream bug

  - Add patch chromium-fix-altgrkeys.diff 

  - Make sure that AltGr is treated correctly (issue#296835)

  - Do not build with system libxml (bnc#825157)

  - Update to Chromium 31.0.1640.0

  - Bug and Stability Fixes

  - Fix destkop file for chromium by removing extension from     icon

  - Change the methodology for the Chromium packages. Build     is now based on an official tarball. As soon as the Beta     channel catches up with the current version, Chromium     will be based on the Beta channel instead of svn     snapshots

  - Update to 31.0.1632

  - Bug and Stability fixes

  - Added the flag --enable-threaded-compositing to the     startup script. This flag seems to be required when     hardware acceleration is in use. This prevents websites     from locking up on users in certain cases.

  - Update to 31.0.1627

  - Bug and Stability fixes

  - Update to 31.0.1619

  - bug and Stability fixes

  - require mozilla-nss-devel >= 3.14 and mozilla-nspr-devel     >= 4.9.5

  - Add patch exclude_ymp.diff to ensure that     1-click-install files are downloaded and NOT opened     (bnc#836059)

  - Update to 31.0.1611

  - Bug and stability fixes

  - Update to 31.0.1605

  - Bug and stability fixes

  - Change the startup script so that Chromium will not     start when the chrome_sandbox doesn't have the SETUID.
    (bnc#779448)

  - Update to 31.0.1601

  - Bug and stability fixes

  - Update to 30.0.1594

  - Bug and stability fixes

  - Correct specfile to properly own /usr/bin/chromium     (bnc#831584)

  - Chromium now expects the SUID-helper installed in the     same directory as chromium. So let's create a symlink to     the helper in /usr/lib

  - Update to 30.0.1587

  - Bug and stability fixes

  - Remove patch chromium-nss-compliant.diff (Upstream)

  - Update to 30.0.1575

  - Bug and stability fixes

  - Enable the gpu-sandbox again due to upstream fix     (chromium#255063)

  - Update to 30.0.1567

  - bug and Stability fixes

The remote host is affected by the vulnerability described in GLSA-201403-01 (Chromium, V8: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and V8. Please       review the CVE identifiers and release notes referenced below for       details.
  Impact :

    A context-dependent attacker could entice a user to open a specially       crafted website or JavaScript program using Chromium or V8, possibly       resulting in the execution of arbitrary code with the privileges of the       process or a Denial of Service condition. Furthermore, a remote attacker       may be able to bypass security restrictions or have other unspecified       impact.
  Workaround :

    There is no known workaround at this time.

The version of Google Chrome installed on the remote host is a version prior to 30.0.1599.66.  It is, therefore, affected by multiple vulnerabilities :

  - A race condition exists related to 'Web Audio'.
    (CVE-2013-2906)

  - Out-of-bounds read errors exist related to     the 'Window.prototype' object, 'Web Audio', and URL     parsing. (CVE-2013-2907, CVE-2013-2917, CVE-2013-2920)

  - Several errors exist related to the address bar that     could allow spoofing attacks. (CVE-2013-2908,     CVE-2013-2915, CVE-2013-2916)

  - Use-after-free errors exist related to 'inline-block'     rendering, 'Web Audio', XSLT, PPAPI, XML document     parsing, Windows color chooser dialog, DOM, the     resource loader, the 'template' element and ICU.
    (CVE-2013-2909, CVE-2013-2910, CVE-2013-2911,     CVE-2013-2912, CVE-2013-2913, CVE-2013-2914,     CVE-2013-2918, CVE-2013-2921, CVE-2013-2922,     CVE-2013-2924)

  - A memory corruption error exists in the V8     JavaScript engine. (CVE-2013-2919)

  - Various, unspecified errors exist. (CVE-2013-2923)

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2013-2906     Atte Kettunen of OUSPG discovered race conditions in Web     Audio.

  - CVE-2013-2907     Boris Zbarsky discovered an out-of-bounds read in     window.prototype.

  - CVE-2013-2908     Chamal de Silva discovered an address bar spoofing     issue.

  - CVE-2013-2909     Atte Kuttenen of OUSPG discovered a use-after-free issue     in inline-block.

  - CVE-2013-2910     Byoungyoung Lee of the Georgia Tech Information Security     Center discovered a use-after-free issue in Web Audio.

  - CVE-2013-2911     Atte Kettunen of OUSPG discovered a use-after-free in     Blink's XSLT handling.

  - CVE-2013-2912     Chamal de Silva and 41.w4r10r(at)garage4hackers.com     discovered a use-after-free issue in the Pepper Plug-in     API.

  - CVE-2013-2913     cloudfuzzer discovered a use-after-free issue in Blink's     XML document parsing.

  - CVE-2013-2915     Wander Groeneveld discovered an address bar spoofing     issue.

  - CVE-2013-2916     Masato Kinugawa discovered an address bar spoofing     issue.

  - CVE-2013-2917     Byoungyoung Lee and Tielei Wang discovered an     out-of-bounds read issue in Web Audio.

  - CVE-2013-2918     Byoungyoung Lee discoverd an out-of-bounds read in     Blink's DOM implementation.

  - CVE-2013-2919     Adam Haile of Concrete Data discovered a memory     corruption issue in the V8 JavaScript library.

  - CVE-2013-2920     Atte Kuttunen of OUSPG discovered an out-of-bounds read     in URL host resolving.

  - CVE-2013-2921     Byoungyoung Lee and Tielei Wang discovered a     use-after-free issue in resource loading.

  - CVE-2013-2922     Jon Butler discovered a use-after-free issue in Blink's     HTML template element implementation.

  - CVE-2013-2924     A use-after-free issue was discovered in the     International Components for Unicode (ICU) library. 

  - CVE-2013-2925     Atte Kettunen of OUSPG discover a use-after-free issue     in Blink's XML HTTP request implementation.

  - CVE-2013-2926     cloudfuzzer discovered a use-after-free issue in the     list indenting implementation.

  - CVE-2013-2927     cloudfuzzer discovered a use-after-free issue in the     HTML form submission implementation. 

  - CVE-2013-2923 and CVE-2013-2928     The chrome 30 development team found various issues from     internal fuzzing, audits, and other studies.

Google Chrome Releases reports :

50 security fixes in this release, including :

- [223962][270758][271161][284785][284786] Medium CVE-2013-2906 :
Races in Web Audio. Credit to Atte Kettunen of OUSPG.

- [260667] Medium CVE-2013-2907: Out of bounds read in Window.prototype object. Credit to Boris Zbarsky.

- [265221] Medium CVE-2013-2908: Address bar spoofing related to the '204 No Content' status code. Credit to Chamal de Silva.

- [265838][279277] High CVE-2013-2909: Use after free in inline-block rendering. Credit to Atte Kettunen of OUSPG.

- [269753] Medium CVE-2013-2910: Use-after-free in Web Audio. Credit to Byoungyoung Lee of Georgia Tech Information Security Center (GTISC).

- [271939] High CVE-2013-2911: Use-after-free in XSLT. Credit to Atte Kettunen of OUSPG.

- [276368] High CVE-2013-2912: Use-after-free in PPAPI. Credit to Chamal de Silva and 41.w4r10r(at)garage4hackers.com.

- [278908] High CVE-2013-2913: Use-after-free in XML document parsing.
Credit to cloudfuzzer.

- [279263] High CVE-2013-2914: Use after free in the Windows color chooser dialog. Credit to Khalil Zhani.

- [280512] Low CVE-2013-2915: Address bar spoofing via a malformed scheme. Credit to Wander Groeneveld. 

- [281256] High CVE-2013-2916: Address bar spoofing related to the '204 No Content' status code. Credit to Masato Kinugawa.

- [281480] Medium CVE-2013-2917: Out of bounds read in Web Audio.
Credit to Byoungyoung Lee and Tielei Wang of Georgia Tech Information Security Center (GTISC).

- [282088] High CVE-2013-2918: Use-after-free in DOM. Credit to Byoungyoung Lee of Georgia Tech Information Security Center (GTISC).

- [282736] High CVE-2013-2919: Memory corruption in V8. Credit to Adam Haile of Concrete Data.

- [285742] Medium CVE-2013-2920: Out of bounds read in URL parsing.
Credit to Atte Kettunen of OUSPG.

- [286414] High CVE-2013-2921: Use-after-free in resource loader.
Credit to Byoungyoung Lee and Tielei Wang of Georgia Tech Information Security Center (GTISC).

- [286975] High CVE-2013-2922: Use-after-free in template element.
Credit to Jon Butler.

- [299016] CVE-2013-2923: Various fixes from internal audits, fuzzing and other initiatives (Chrome 30).

- [275803] Medium CVE-2013-2924: Use-after-free in ICU. Upstream bug here.

The remote host has Google Chrome browser installed. Versions of Google Chrome prior to 30.0.1599.66 are affected by the following vulnerabilities :

  - A security vulnerability exists due to races in web audio. (CVE-2013-2906)

  - An out-of-bounds read error in 'Window.prototype' object. (CVE-2013-2907)

  - Multiple address bar spoofing vulnerabilities exists related to the '204 No Content' status code. (CVE-2013-2908, CVE-2013-2916)

  - A use-after-free issue in inline-block rendering. (CVE-2013-2909)

  - A use-after-free issue in Web Audio. (CVE-2013-2910)

  - A use-after-free issue in XSLT. (CVE-2013-2911)

  - A use-after-free issue in PPAPI. (CVE-2013-2912)

  - A use-after-free issue in XML document parsing. (CVE-2013-2913)

  - A use-after-free issue in the Windows color chooser dialog. (CVE-2013-2914)

  - An address bar spoofing vulnerability occurs though a malformed scheme (CVE-2013-2915)

  - An out-of-bounds read error in web audio. (CVE-2013-2917)

  - A use-after-free issue in Dom. (CVE-2013-2918)

  - A memory-corruption vulnerability exists in V8

  - (CVE-2013-2919)

  - An out-of-bounds read error in URL parsing. (CVE-2013-2920)

  - A use-after-free issue in resource loader. (CVE-2013-2921)

  - A use-after-free issue in template element. (CVE-2013-2922)

  - Multiple unspecified issues affect the application. (CVE-2013-2923)

  - A use-after-free issue in ICU. (CVE-2013-2924)

ID	Name	Product	Family	Severity
75366	openSUSE Security Update : chromium (openSUSE-SU-2014:0065-1)	Nessus	SuSE Local Security Checks	critical
75225	openSUSE Security Update : chromium (openSUSE-SU-2013:1861-1)	Nessus	SuSE Local Security Checks	critical
75170	openSUSE Security Update : chromium (openSUSE-SU-2013:1556-1)	Nessus	SuSE Local Security Checks	high
72851	GLSA-201403-01 : Chromium, V8: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
70893	Google Chrome < 30.0.1599.66 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
70636	Debian DSA-2785-1 : chromium-browser - several vulnerabilities	Nessus	Debian Local Security Checks	high
70273	Google Chrome < 30.0.1599.66 Multiple Vulnerabilities	Nessus	Windows	high
70265	FreeBSD : chromium -- multiple vulnerabilities (e5414d0c-2ade-11e3-821d-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	high
801606	Google Chrome < 30.0.1599.66 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
8015	Google Chrome < 30.0.1599.66 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high

Detections

Analytics

CVE-2013-2906

high

Tenable Plugins

critical

critical

high

critical

high

high

high

high

high

high