The StoreBuffer::ExemptPopularPages function in store-buffer.cc in Google V8 before 3.22.24.16, as used in Google Chrome before 32.0.1700.102, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via vectors that trigger incorrect handling of "popular pages."

Chromium was updated to version 32.0.1700.102: Stable channel update :

  - Security Fixes :

  - CVE-2013-6649: Use-after-free in SVG images

  - CVE-2013-6650: Memory corruption in V8

  - and 12 other fixes

  - Other :

  - Mouse Pointer disappears after exiting full-screen mode

  - Drag and drop files into Chromium may not work properly

  - Quicktime Plugin crashes in Chromium

  - Chromium becomes unresponsive

  - Trackpad users may not be able to scroll horizontally

  - Scrolling does not work in combo box

  - Chromium does not work with all CSS minifiers such as     whitespace around a media query's `and` keyword

  - Update to Chromium 32.0.1700.77 Stable channel update :

  - Security fixes :

  - CVE-2013-6646: Use-after-free in web workers

  - CVE-2013-6641: Use-after-free related to forms

  - CVE-2013-6643: Unprompted sync with an attacker&rsquo;s     Google account

  - CVE-2013-6645: Use-after-free related to speech input     elements

  - CVE-2013-6644: Various fixes from internal audits,     fuzzing and other initiatives

  - Other :

  - Tab indicators for sound, webcam and casting 

  - Automatically blocking malware files 

  - Lots of under the hood changes for stability and     performance 

  - Remove patch chromium-fix-chromedriver-build.diff as     that chromedriver is fixed upstream

  - Updated ExcludeArch to exclude aarch64, ppc, ppc64 and     ppc64le. This is based on missing build requires     (valgrind, v8, etc)

Common Vulnerabilities and Exposures assigned an identifier CVE-2013-6650 to the following vulnerability :

Name: CVE-2013-6650

URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6650

The StoreBuffer::ExemptPopularPages function in store-buffer.cc in Google V8 before 3.22.24.16, as used in Google Chrome before 32.0.1700.102, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via vectors that trigger incorrect handling of 'popular pages.'

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201403-01 (Chromium, V8: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and V8. Please       review the CVE identifiers and release notes referenced below for       details.
  Impact :

    A context-dependent attacker could entice a user to open a specially       crafted website or JavaScript program using Chromium or V8, possibly       resulting in the execution of arbitrary code with the privileges of the       process or a Denial of Service condition. Furthermore, a remote attacker       may be able to bypass security restrictions or have other unspecified       impact.
  Workaround :

    There is no known workaround at this time.

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2013-6641     Atte Kettunen discovered a use-after-free issue in     Blink/Webkit form elements.

  - CVE-2013-6643     Joao Lucas Melo Brasio discovered a Google account     information disclosure issue related to the one-click     sign-on feature.

  - CVE-2013-6644     The chrome development team discovered and fixed     multiple issues with potential security impact. 

  - CVE-2013-6645     Khalil Zhani discovered a use-after-free issue related     to speech input.

  - CVE-2013-6646     Colin Payne discovered a use-after-free issue in the web     workers implementation. 

  - CVE-2013-6649     Atte Kettunen discovered a use-after-free issue in the     Blink/Webkit SVG implementation.

  - CVE-2013-6650     Christian Holler discovered a memory corruption in the     v8 JavaScript library.

The version of Google Chrome installed on the remote Mac OS X host is a version prior to 32.0.1700.102.  It is, therefore, affected by the following vulnerabilities :

  - A use-after-free error exists related to processing     SVG images. (CVE-2013-6649)

  - An unspecified error exists related to the V8 JavaScript     engine could allow memory corruption. (CVE-2013-6650)

The version of Google Chrome installed on the remote host is a version prior to 32.0.1700.102.  It is, therefore, affected by the following vulnerabilities :

  - A use-after-free error exists related to processing     SVG images. (CVE-2013-6649)

  - An unspecified error exists related to the V8 JavaScript     engine could allow memory corruption. (CVE-2013-6650)

  - An unspecified security issue exists. (CVE-2014-1681)

Google Chrome Releases reports :

14 security fixes in this release, including :

- [330420] High CVE-2013-6649: Use-after-free in SVG images. Credit to Atte Kettunen of OUSPG.

- [331444] High CVE-2013-6650: Memory corruption in V8. This issue was fixed in v8 version 3.22.24.16. Credit to Christian Holler.

The remote host has Google Chrome browser installed. Versions of Google Chrome prior to 32.0.1700.102 are affected by the following vulnerabilities:

  - A use-after-free error exists related to processing SVG images. (CVE-2013-6649)

 - An unspecified error exists related to the V8 JavaScript engine could allow memory corruption. (CVE-2013-6650)

 - An unspecified security issue exists. (CVE-2014-1681)

ID	Name	Product	Family	Severity
75257	openSUSE Security Update : chromium (openSUSE-SU-2014:0243-1)	Nessus	SuSE Local Security Checks	high
72890	Fedora 19 : v8-3.14.5.10-6.fc19 (2014-3253)	Nessus	Fedora Local Security Checks	high
72889	Fedora 20 : v8-3.14.5.10-6.fc20 (2014-3222)	Nessus	Fedora Local Security Checks	high
72851	GLSA-201403-01 : Chromium, V8: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
72538	Debian DSA-2862-1 : chromium-browser - several vulnerabilities	Nessus	Debian Local Security Checks	high
72168	Google Chrome < 32.0.1700.102 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
72167	Google Chrome < 32.0.1700.102 Multiple Vulnerabilities	Nessus	Windows	critical
72157	FreeBSD : chromium -- multiple vulnerabilities (f9810c43-87a5-11e3-9214-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	high
801616	Google Chrome < 32.0.1700.102 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high

Detections

Analytics

CVE-2013-6650

high

Tenable Plugins

high

high

high

critical

high

high

critical

high

high