Use-after-free vulnerability in the OnWindowRemovingFromRootWindow function in content/browser/web_contents/web_contents_view_aura.cc in Google Chrome before 32.0.1700.76 on Windows and before 32.0.1700.77 on Mac OS X and Linux allows user-assisted remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving certain print-preview and tab-switch actions that interact with a speech input element.

Chromium was updated to version 32.0.1700.102: Stable channel update :

  - Security Fixes :

  - CVE-2013-6649: Use-after-free in SVG images

  - CVE-2013-6650: Memory corruption in V8

  - and 12 other fixes

  - Other :

  - Mouse Pointer disappears after exiting full-screen mode

  - Drag and drop files into Chromium may not work properly

  - Quicktime Plugin crashes in Chromium

  - Chromium becomes unresponsive

  - Trackpad users may not be able to scroll horizontally

  - Scrolling does not work in combo box

  - Chromium does not work with all CSS minifiers such as     whitespace around a media query's `and` keyword

  - Update to Chromium 32.0.1700.77 Stable channel update :

  - Security fixes :

  - CVE-2013-6646: Use-after-free in web workers

  - CVE-2013-6641: Use-after-free related to forms

  - CVE-2013-6643: Unprompted sync with an attacker&rsquo;s     Google account

  - CVE-2013-6645: Use-after-free related to speech input     elements

  - CVE-2013-6644: Various fixes from internal audits,     fuzzing and other initiatives

  - Other :

  - Tab indicators for sound, webcam and casting 

  - Automatically blocking malware files 

  - Lots of under the hood changes for stability and     performance 

  - Remove patch chromium-fix-chromedriver-build.diff as     that chromedriver is fixed upstream

  - Updated ExcludeArch to exclude aarch64, ppc, ppc64 and     ppc64le. This is based on missing build requires     (valgrind, v8, etc)

The remote host is affected by the vulnerability described in GLSA-201403-01 (Chromium, V8: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and V8. Please       review the CVE identifiers and release notes referenced below for       details.
  Impact :

    A context-dependent attacker could entice a user to open a specially       crafted website or JavaScript program using Chromium or V8, possibly       resulting in the execution of arbitrary code with the privileges of the       process or a Denial of Service condition. Furthermore, a remote attacker       may be able to bypass security restrictions or have other unspecified       impact.
  Workaround :

    There is no known workaround at this time.

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2013-6641     Atte Kettunen discovered a use-after-free issue in     Blink/Webkit form elements.

  - CVE-2013-6643     Joao Lucas Melo Brasio discovered a Google account     information disclosure issue related to the one-click     sign-on feature.

  - CVE-2013-6644     The chrome development team discovered and fixed     multiple issues with potential security impact. 

  - CVE-2013-6645     Khalil Zhani discovered a use-after-free issue related     to speech input.

  - CVE-2013-6646     Colin Payne discovered a use-after-free issue in the web     workers implementation. 

  - CVE-2013-6649     Atte Kettunen discovered a use-after-free issue in the     Blink/Webkit SVG implementation.

  - CVE-2013-6650     Christian Holler discovered a memory corruption in the     v8 JavaScript library.

Google Chrome Releases reports :

11 security fixes in this release, including :

- [249502] High CVE-2013-6646: Use-after-free in web workers. Credit to Collin Payne.

- [326854] High CVE-2013-6641: Use-after-free related to forms. Credit to Atte Kettunen of OUSPG.

- [324969] High CVE-2013-6642: Address bar spoofing in Chrome for Android. Credit to lpilorz.

- [321940] High CVE-2013-6643: Unprompted sync with an attacker's Google account. Credit to Joao Lucas Melo Brasio.

- [318791] Medium CVE-2013-6645 Use-after-free related to speech input elements. Credit to Khalil Zhani.

- [333036] CVE-2013-6644: Various fixes from internal audits, fuzzing and other initiatives.

The version of Google Chrome installed on the remote Mac OS X host is a version prior to 32.0.1700.77.  It is, therefore, affected by the following vulnerabilities :

  - Use-after-free errors exist related to forms, web     workers and speech input elements. (CVE-2013-6641,     CVE-2013-6645, CVE-2013-6646)

  - An unspecified error exists related to Google accounts     and the sync process. (CVE-2013-6643)

  - Various unspecified errors exist having unspecified     impacts. (CVE-2013-6644)

  - An input validation error exists related to the     included WebKit component 'XSS Auditor' and the     handling of the 'srcdoc' attribute that could allow     cross-site scripting attacks.

The version of Google Chrome installed on the remote host is a version prior to 32.0.1700.76.  It is, therefore, affected by the following vulnerabilities :

  - Use-after-free errors exist related to forms, web     workers and speech input elements. (CVE-2013-6641,     CVE-2013-6645, CVE-2013-6646)

  - An unspecified error exists related to Google accounts     and the sync process. (CVE-2013-6643)

  - Various unspecified errors exist having unspecified     impacts. (CVE-2013-6644)

  - An input validation error exists related to the     included WebKit component 'XSS Auditor' and the     handling of the 'srcdoc' attribute that could allow     cross-site scripting attacks.

The remote host has Google Chrome browser installed. Versions of Google Chrome prior to 32.0.1700.76 are affected by the following vulnerabilities:

  - Use-after-free errors exist related to forms, web workers and speech input elements. (CVE-2013-6641, CVE-2013-6645, CVE-2013-6646)

  - An unspecified error exists related to Google accounts and the sync process. (CVE-2013-6643)

  - Various unspecified errors exist having unspecified impacts. (CVE-2013-6644)

ID	Name	Product	Family	Severity
75257	openSUSE Security Update : chromium (openSUSE-SU-2014:0243-1)	Nessus	SuSE Local Security Checks	high
72851	GLSA-201403-01 : Chromium, V8: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
72538	Debian DSA-2862-1 : chromium-browser - several vulnerabilities	Nessus	Debian Local Security Checks	high
71983	FreeBSD : chromium -- multiple vulnerabilities (5acf4638-7e2c-11e3-9fba-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	high
71969	Google Chrome < 32.0.1700.77 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
71968	Google Chrome < 32.0.1700.76 Multiple Vulnerabilities	Nessus	Windows	high
801615	Google Chrome < 32.0.1700.76 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high

Detections

Analytics

CVE-2013-6645

high

Tenable Plugins

high

critical

high

high

high

high

high