Use-after-free vulnerability in core/dom/ContainerNode.cpp in Blink, as used in Google Chrome before 31.0.1650.48, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper handling of DOM range objects in circumstances that require child node removal after a (1) mutation or (2) blur event.

The version of Apple iTunes on the remote host is prior to version 12.0.1. It is, therefore, affected by multiple vulnerabilities related to the included version of WebKit. The errors could lead to application crashes or arbitrary code execution.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apple iTunes installed on the remote Windows host is prior to 12.0.1. It is, therefore, affected by multiple vulnerabilities due to the included version of WebKit. The errors could lead to application crashes or arbitrary code execution.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Versions of iTunes earlier than 12.0.1 are missing updates that patch memory corruption vulnerabilities within WebKit, as well as a patch that fixes a man-in-the-middle vulnerability that affects encrypted connections to the iTunes Store via iTunes. The most severe of these vulnerabilites can result in arbitrary remote code execution or unexpected application termination.

- Update to Chromium 31.0.1650.63 Stable channel update :

  - Security fixes :

  - CVE-2013-6634: Session fixation in sync related to 302     redirects

  - CVE-2013-6635: Use-after-free in editing

  - CVE-2013-6636: Address bar spoofing related to modal     dialogs

  - CVE-2013-6637: Various fixes from internal audits,     fuzzing and other initiatives.

  - CVE-2013-6638: Buffer overflow in v8

  - CVE-2013-6639: Out of bounds write in v8.

  - CVE-2013-6640: Out of bounds read in v8

  - and 12 other security fixes.

  - Remove the build flags to build according to the Chrome     ffmpeg branding and the proprietary codecs. (bnc#847971)

  - Update to Chromium 31.0.1650.57 Stable channel update :

  - Security Fixes :

  - CVE-2013-6632: Multiple memory corruption issues.

  - Update to Chromium 31.0.1650.48 Stable Channel update :

  - Security fixes :

  - CVE-2013-6621: Use after free related to speech input     elements..

  - CVE-2013-6622: Use after free related to media elements. 

  - CVE-2013-6623: Out of bounds read in SVG.

  - CVE-2013-6624: Use after free related to     &ldquo;id&rdquo; attribute strings.

  - CVE-2013-6625: Use after free in DOM ranges.

  - CVE-2013-6626: Address bar spoofing related to     interstitial warnings.

  - CVE-2013-6627: Out of bounds read in HTTP parsing.

  - CVE-2013-6628: Issue with certificates not being checked     during TLS renegotiation.

  - CVE-2013-2931: Various fixes from internal audits,     fuzzing and other initiatives.

  - CVE-2013-6629: Read of uninitialized memory in libjpeg     and libjpeg-turbo.

  - CVE-2013-6630: Read of uninitialized memory in     libjpeg-turbo.

  - CVE-2013-6631: Use after free in libjingle.

  - Added patch chromium-fix-chromedriver-build.diff to fix     the chromedriver build

  - Enable ARM build for Chromium. 

  - Added patches chromium-arm-webrtc-fix.patch,     chromium-fix-arm-icu.patch and     chromium-fix-arm-sysroot.patch to resolve ARM specific     build issues

  - Update to Chromium 30.0.1599.114 Stable Channel update:
    fix build for 32bit systems

  - Drop patch chromium-fix-chromedriver-build.diff. This is     now fixed upstream

  - For openSUSE versions lower than 13.1, build against the     in-tree libicu

  - Update to Chromium 30.0.1599.101

  - Security Fixes :

  + CVE-2013-2925: Use after free in XHR

  + CVE-2013-2926: Use after free in editing

  + CVE-2013-2927: Use after free in forms.

  + CVE-2013-2928: Various fixes from internal audits,     fuzzing and other initiatives.

  - Update to Chromium 30.0.1599.66

  - Easier searching by image 

  - A number of new apps/extension APIs 

  - Lots of under the hood changes for stability and     performance

  - Security fixes :

  + CVE-2013-2906: Races in Web Audio

  + CVE-2013-2907: Out of bounds read in Window.prototype     object

  + CVE-2013-2908: Address bar spoofing related to the     &ldquo;204 No Content&rdquo; status code

  + CVE-2013-2909: Use after free in inline-block rendering

  + CVE-2013-2910: Use-after-free in Web Audio

  + CVE-2013-2911: Use-after-free in XSLT

  + CVE-2013-2912: Use-after-free in PPAPI

  + CVE-2013-2913: Use-after-free in XML document parsing

  + CVE-2013-2914: Use after free in the Windows color     chooser dialog

  + CVE-2013-2915: Address bar spoofing via a malformed     scheme

  + CVE-2013-2916: Address bar spoofing related to the     &ldquo;204 No Content&rdquo; status code

  + CVE-2013-2917: Out of bounds read in Web Audio

  + CVE-2013-2918: Use-after-free in DOM

  + CVE-2013-2919: Memory corruption in V8

  + CVE-2013-2920: Out of bounds read in URL parsing

  + CVE-2013-2921: Use-after-free in resource loader

  + CVE-2013-2922: Use-after-free in template element

  + CVE-2013-2923: Various fixes from internal audits,     fuzzing and other initiatives 

  + CVE-2013-2924: Use-after-free in ICU. Upstream bug

Chromium was updated to 31.0.1650.57: Stable channel update :

  - Security Fixes :

  - CVE-2013-6632: Multiple memory corruption issues.

  - Update to Chromium 31.0.1650.48 Stable Channel update :

  - Security fixes :

  - CVE-2013-6621: Use after free related to speech input     elements..

  - CVE-2013-6622: Use after free related to media elements. 

  - CVE-2013-6623: Out of bounds read in SVG.

  - CVE-2013-6624: Use after free related to     &ldquo;id&rdquo; attribute strings.

  - CVE-2013-6625: Use after free in DOM ranges.

  - CVE-2013-6626: Address bar spoofing related to     interstitial warnings.

  - CVE-2013-6627: Out of bounds read in HTTP parsing.

  - CVE-2013-6628: Issue with certificates not being checked     during TLS renegotiation.

  - CVE-2013-2931: Various fixes from internal audits,     fuzzing and other initiatives.

  - CVE-2013-6629: Read of uninitialized memory in libjpeg     and libjpeg-turbo.

  - CVE-2013-6630: Read of uninitialized memory in     libjpeg-turbo.

  - CVE-2013-6631: Use after free in libjingle.

  - Added patch chromium-fix-chromedriver-build.diff to fix     the chromedriver build

  - Enable ARM build for Chromium. 

  - Added patches chromium-arm-webrtc-fix.patch,     chromium-fix-arm-icu.patch and     chromium-fix-arm-sysroot.patch to resolve ARM specific     build issues

  - Update to Chromium 30.0.1599.114 Stable Channel update:
    fix build for 32bit systems

  - Drop patch chromium-fix-chromedriver-build.diff. This is     now fixed upstream

  - For openSUSE versions lower than 13.1, build against the     in-tree libicu

  - Update to Chromium 30.0.1599.101

  - Security Fixes :

  + CVE-2013-2925: Use after free in XHR

  + CVE-2013-2926: Use after free in editing

  + CVE-2013-2927: Use after free in forms.

  + CVE-2013-2928: Various fixes from internal audits,     fuzzing and other initiatives.

  - Update to Chromium 30.0.1599.66

  - Easier searching by image 

  - A number of new apps/extension APIs 

  - Lots of under the hood changes for stability and     performance

  - Security fixes :

  + CVE-2013-2906: Races in Web Audio

  + CVE-2013-2907: Out of bounds read in Window.prototype     object

  + CVE-2013-2908: Address bar spoofing related to the     &ldquo;204 No Content&rdquo; status code

  + CVE-2013-2909: Use after free in inline-block rendering

  + CVE-2013-2910: Use-after-free in Web Audio

  + CVE-2013-2911: Use-after-free in XSLT

  + CVE-2013-2912: Use-after-free in PPAPI

  + CVE-2013-2913: Use-after-free in XML document parsing

  + CVE-2013-2914: Use after free in the Windows color     chooser dialog

  + CVE-2013-2915: Address bar spoofing via a malformed     scheme

  + CVE-2013-2916: Address bar spoofing related to the     &ldquo;204 No Content&rdquo; status code

  + CVE-2013-2917: Out of bounds read in Web Audio

  + CVE-2013-2918: Use-after-free in DOM

  + CVE-2013-2919: Memory corruption in V8

  + CVE-2013-2920: Out of bounds read in URL parsing

  + CVE-2013-2921: Use-after-free in resource loader

  + CVE-2013-2922: Use-after-free in template element

  + CVE-2013-2923: Various fixes from internal audits,     fuzzing and other initiatives 

  + CVE-2013-2924: Use-after-free in ICU. Upstream bug

Chromium was updated to 31.0.1650.57: Stable channel update :

  - Security Fixes :

  - CVE-2013-6632: Multiple memory corruption issues.

  - Update to Chromium 31.0.1650.48 (bnc#850430) Stable     Channel update :

  - Security fixes :

  - CVE-2013-6621: Use after free related to speech input     elements..

  - CVE-2013-6622: Use after free related to media elements. 

  - CVE-2013-6623: Out of bounds read in SVG.

  - CVE-2013-6624: Use after free related to     &ldquo;id&rdquo; attribute strings.

  - CVE-2013-6625: Use after free in DOM ranges.

  - CVE-2013-6626: Address bar spoofing related to     interstitial warnings.

  - CVE-2013-6627: Out of bounds read in HTTP parsing.

  - CVE-2013-6628: Issue with certificates not being checked     during TLS renegotiation.

  - CVE-2013-2931: Various fixes from internal audits,     fuzzing and other initiatives.

  - CVE-2013-6629: Read of uninitialized memory in libjpeg     and libjpeg-turbo.

  - CVE-2013-6630: Read of uninitialized memory in     libjpeg-turbo.

  - CVE-2013-6631: Use after free in libjingle.

  - Added patch chromium-fix-chromedriver-build.diff to fix     the chromedriver build

Security and bugfix update to Chromium 31.0.1650.57

  - Update to Chromium 31.0.1650.57 :

  - Security Fixes :

  - CVE-2013-6632: Multiple memory corruption issues.

  - Update to Chromium 31.0.1650.48 Stable Channel update :

  - Security fixes :

  - CVE-2013-6621: Use after free related to speech input     elements..

  - CVE-2013-6622: Use after free related to media elements. 

  - CVE-2013-6623: Out of bounds read in SVG.

  - CVE-2013-6624: Use after free related to     &ldquo;id&rdquo; attribute strings.

  - CVE-2013-6625: Use after free in DOM ranges.

  - CVE-2013-6626: Address bar spoofing related to     interstitial warnings.

  - CVE-2013-6627: Out of bounds read in HTTP parsing.

  - CVE-2013-6628: Issue with certificates not being checked     during TLS renegotiation.

  - CVE-2013-2931: Various fixes from internal audits,     fuzzing and other initiatives.

  - CVE-2013-6629: Read of uninitialized memory in libjpeg     and libjpeg-turbo.

  - CVE-2013-6630: Read of uninitialized memory in     libjpeg-turbo.

  - CVE-2013-6631: Use after free in libjingle.

  - Stable Channel update: fix build for 32bit systems

  - Update to Chromium 30.0.1599.101

  - Security Fixes :

  + CVE-2013-2925: Use after free in XHR

  + CVE-2013-2926: Use after free in editing

  + CVE-2013-2927: Use after free in forms.

  + CVE-2013-2928: Various fixes from internal audits,     fuzzing and other initiatives.

  - Enable ARM build for Chromium.

Versions earlier than the Apple TV 6.1 update are vulnerable to multiple issues, the most serious of which could be leveraged to result in arbitrary code execution.

The remote host has Safari installed that is older than 6.1.3 or 7.0.3, and is thus unpatched for the following WebKit vulnerabilities :

 - Unspecified errors exist that could allow memory corruption, application crashes and possibly arbitrary code execution. (CVE-2013-2871, CVE-2013-2926, CVE-2013-2928, CVE-2013-6625, CVE-2014-1289, CVE-2014-1290, CVE-2014-1291, CVE-2014-1292, CVE-2014-1293, CVE-2014-1294, CVE-2014-1298, CVE-2014-1299, CVE-2014-1300, CVE-2014-1301, CVE-2014-1302, CVE-2014-1303, CVE-2014-1304, CVE-2014-1305, CVE-2014-1307, CVE-2014-1308, CVE-2014-1309, CVE-2014-1310, CVE-2014-1311, CVE-2014-1312, CVE-2014-1313, CVE-2014-1713)
 - An error exists related to IPC messages and 'WebProcess' that could allow an attacker to read arbitrary files. (CVE-2014-1297)

The version of Apple Safari installed on the remote Mac OS X host is a version prior to 6.1.3 or 7.0.3. It is, therefore, potentially affected by the following vulnerabilities related to the included WebKit components :

  - Unspecified errors exist that could allow memory     corruption, application crashes and possibly arbitrary     code execution. (CVE-2013-2871, CVE-2013-2926,     CVE-2013-2928, CVE-2013-6625, CVE-2014-1289,     CVE-2014-1290, CVE-2014-1291, CVE-2014-1292,     CVE-2014-1293, CVE-2014-1294, CVE-2014-1298,     CVE-2014-1299, CVE-2014-1300, CVE-2014-1301,     CVE-2014-1302, CVE-2014-1303, CVE-2014-1304,     CVE-2014-1305, CVE-2014-1307, CVE-2014-1308,     CVE-2014-1309, CVE-2014-1310, CVE-2014-1311,     CVE-2014-1312, CVE-2014-1313, CVE-2014-1713)

  - An error exists related to IPC messages and 'WebProcess'     that could allow an attacker to read arbitrary files.
    (CVE-2014-1297)

According to its banner, the remote Apple TV 2nd generation or later device is prior to 6.1. It is, therefore, reportedly affected by multiple vulnerabilities, the most serious issues of which could result in arbitrary code execution.

The mobile device is running a version of iOS that is prior to version 7.1. It is, therefore, affected by vulnerabilities in the following components :

  - Backup
  - Certificate Trust Policy
  - Configuration Profiles
  - CoreCapture
  - Crash Reporting
  - dyld
  - FaceTime
  - ImageIO
  - IOKit HID Event
  - iTunes Store
  - Kernel
  - Office Viewer
  - Photos Backend
  - Profiles
  - Safari
  - Settings - Accounts
  - Springboard
  - SpringBoard Lock Screen
  - TelephonyUI Framework
  - USB Host
  - Video Driver
  - WebKit

The remote host is affected by the vulnerability described in GLSA-201403-01 (Chromium, V8: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and V8. Please       review the CVE identifiers and release notes referenced below for       details.
  Impact :

    A context-dependent attacker could entice a user to open a specially       crafted website or JavaScript program using Chromium or V8, possibly       resulting in the execution of arbitrary code with the privileges of the       process or a Denial of Service condition. Furthermore, a remote attacker       may be able to bypass security restrictions or have other unspecified       impact.
  Workaround :

    There is no known workaround at this time.

The remote host has Google Chrome browser installed. Versions of Google Chrome prior to 31.0.1650.48 are affected by multiple vulnerabilities, some of which are highlighted below:

  - Use-after-free vulnerabilities related to speech input elements, media elements, DOM ranges, "id" attribute strings, and within the libjingle library, which can be triggered by a context-dependent attacker to potentially execute arbitrary code (CVE-2013-6621, CVE-2013-6622, CVE-2013-6624, CVE-2013-6625, CVE-2013-6631)

  - Out-of-bounds reading in HTTP parsing, SVG, and various jpeg libraries can be triggered via a specially crafted web page to cause a crash or potentially disclose memory contents. (CVE-CVE-2013-6623, CVE-2013-6627, CVE-2013-6629, CVE-2013-6630)

  - Address spoofing is possible via a flaw when displaying an interstitial webpage (CVE-2013-6626)

  - Certificates are not checked during TLS renegotiation, which may allow an attacker to present an invalid certification and have it accepted. (CVE-2013-6628)

Furthermore, an updated version of Flash Player (version 11.9.900.152) has been included in this release.

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2013-2931     The chrome 31 development team found various issues from     internal fuzzing, audits, and other studies.

  - CVE-2013-6621     Khalil Zhani discovered a use-after-free issue in speech     input handling.

  - CVE-2013-6622     'cloudfuzzer' discovered a use-after-free issue in     HTMLMediaElement.

  - CVE-2013-6623     'miaubiz' discovered an out-of-bounds read in the     Blink/Webkit SVG implementation.

  - CVE-2013-6624     Jon Butler discovered a use-after-free issue in id     attribute strings.

  - CVE-2013-6625     'cloudfuzzer' discovered a use-after-free issue in the     Blink/Webkit DOM implementation.

  - CVE-2013-6626     Chamal de Silva discovered an address bar spoofing     issue.

  - CVE-2013-6627     'skylined' discovered an out-of-bounds read in the HTTP     stream parser.

  - CVE-2013-6628     Antoine Delignat-Lavaud and Karthikeyan Bhargavan of     INRIA Paris discovered that a different (unverified)     certificate could be used after successful TLS     renegotiation with a valid certificate.

  - CVE-2013-6629     Michal Zalewski discovered an uninitialized memory read     in the libjpeg and libjpeg-turbo libraries.

  - CVE-2013-6630     Michal Zalewski discovered another uninitialized memory     read in the libjpeg and libjpeg-turbo libraries.

  - CVE-2013-6631     Patrik Hoglund discovered a use-free issue in the     libjingle library.

  - CVE-2013-6632     Pinkie Pie discovered multiple memory corruption issues.

The version of Google Chrome installed on the remote Mac OS X host is a version prior to 31.0.1650.48.  It is, therefore, affected by multiple vulnerabilities :

  - Various, unspecified errors exist. (CVE-2013-2931)

  - Use-after-free errors exist related to speech input     elements, media elements, 'id' attribute strings, DOM     ranges, and libjingle. (CVE-2013-6621, CVE-2013-6622,     CVE-2013-6624, CVE-2013-6625, CVE-2013-6631)

  - Out-of-bounds read errors exist in SVG and HTTP     parsing. (CVE-2013-6623, CVE-2013-6627)

  - An address bar URI-spoofing vulnerability exists that is     related to interstitial warnings. (CVE-2013-6626)

  - A certificate validation security bypass issue exists     during TLS renegotiation. (CVE-2013-6628)

  - A memory corruption error exists in the libjpeg and     libjpeg-turbo libraries when memory is uninitialized     when decoding images with missing SOS data.
    (CVE-2013-6629)

  - A memory corruption error exists in the 'jdmarker.c'     source file in the libjpeg-turbo library when processing     Huffman tables. (CVE-2013-6630)

The version of Google Chrome installed on the remote host is a version prior to 31.0.1650.48.  It is, therefore, affected by multiple vulnerabilities :

  - Various, unspecified errors exist. (CVE-2013-2931)

  - Use-after-free errors exist related to speech input     elements, media elements, 'id' attribute strings, DOM     ranges, and libjingle. (CVE-2013-6621, CVE-2013-6622,     CVE-2013-6624, CVE-2013-6625, CVE-2013-6631)

  - Out-of-bounds read errors exist in SVG and HTTP     parsing. (CVE-2013-6623, CVE-2013-6627)

  - An address bar URI-spoofing vulnerability exists that     is related to interstitial warnings. (CVE-2013-6626)

  - A certificate validation security bypass issue exists     during TLS renegotiation. (CVE-2013-6628)

  - A memory corruption error exists in the libjpeg and     libjpeg-turbo libraries when memory is uninitialized     when decoding images with missing SOS data.
    (CVE-2013-6629)

  - A memory corruption error exists in the 'jdmarker.c'     source file in the libjpeg-turbo library when processing     Huffman tables. (CVE-2013-6630)

Google Chrome Releases reports :

25 security fixes in this release, including :

- [268565] Medium CVE-2013-6621: Use after free related to speech input elements. Credit to Khalil Zhani.

- [272786] High CVE-2013-6622: Use after free related to media elements. Credit to cloudfuzzer.

- [282925] High CVE-2013-6623: Out of bounds read in SVG. Credit to miaubiz.

- [290566] High CVE-2013-6624: Use after free related to 'id' attribute strings. Credit to Jon Butler.

- [295010] High CVE-2013-6625: Use after free in DOM ranges. Credit to cloudfuzzer.

- [295695] Low CVE-2013-6626: Address bar spoofing related to interstitial warnings. Credit to Chamal de Silva.

- [299892] High CVE-2013-6627: Out of bounds read in HTTP parsing.
Credit to skylined.

- [306959] Medium CVE-2013-6628: Issue with certificates not being checked during TLS renegotiation. Credit to Antoine Delignat-Lavaud and Karthikeyan Bhargavan from Prosecco of INRIA Paris.

- [315823] Medium-Critical CVE-2013-2931: Various fixes from internal audits, fuzzing and other initiatives.

- [258723] Medium CVE-2013-6629: Read of uninitialized memory in libjpeg and libjpeg-turbo. Credit to Michal Zalewski of Google.

- [299835] Medium CVE-2013-6630: Read of uninitialized memory in libjpeg-turbo. Credit to Michal Zalewski of Google.

- [296804] High CVE-2013-6631: Use after free in libjingle. Credit to Patrik Hoglund of the Chromium project.

ID	Name	Product	Family	Severity
78598	Apple iTunes < 12.0.1 Multiple Vulnerabilities (uncredentialed check)	Nessus	Peer-To-Peer File Sharing	critical
78597	Apple iTunes < 12.0.1 Multiple Vulnerabilities (credentialed check)	Nessus	Windows	critical
8561	iTunes < 12.0.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	critical
75366	openSUSE Security Update : chromium (openSUSE-SU-2014:0065-1)	Nessus	SuSE Local Security Checks	critical
75225	openSUSE Security Update : chromium (openSUSE-SU-2013:1861-1)	Nessus	SuSE Local Security Checks	critical
75213	openSUSE Security Update : chromium (openSUSE-SU-2013:1777-1)	Nessus	SuSE Local Security Checks	critical
75212	openSUSE Security Update : chromium (openSUSE-SU-2013:1776-1)	Nessus	SuSE Local Security Checks	critical
8250	Apple TV < 6.1 Multiple Vulnerabilities	Nessus Network Monitor	Internet Services	high
8209	Safari < 6.1.3 / 7.0.3 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
73304	Mac OS X : Apple Safari < 6.1.3 / 7.0.3 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
72962	Apple TV < 6.1 Multiple Vulnerabilities	Nessus	Misc.	high
72907	Apple iOS < 7.1 Multiple Vulnerabilities	Nessus	Mobile Devices	high
72851	GLSA-201403-01 : Chromium, V8: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
801611	Google Chrome < 31.0.1650.48 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
70986	Debian DSA-2799-1 : chromium-browser - several vulnerabilities	Nessus	Debian Local Security Checks	critical
70917	Google Chrome < 31.0.1650.48 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
70916	Google Chrome < 31.0.1650.48 Multiple Vulnerabilities	Nessus	Windows	critical
70865	FreeBSD : chromium -- multiple vulnerabilities (3bfc7016-4bcc-11e3-b0cf-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2013-6625

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

high

high

critical

high

high

critical

high

critical

critical

critical

critical