Use-after-free vulnerability in Blink, as used in Google Chrome before 33.0.1750.117, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to improper handling of overflowchanged DOM events during interaction between JavaScript and layout.

Chromium was updated to 33.0.1750.117 Stable channel update :

  - Security Fixes :

  - CVE-2013-6653: Use-after-free related to web contents

  - CVE-2013-6654: Bad cast in SVG

  - CVE-2013-6655: Use-after-free in layout

  - CVE-2013-6656: Information leak in XSS auditor

  - CVE-2013-6657: Information leak in XSS auditor

  - CVE-2013-6658: Use-after-free in layout

  - CVE-2013-6659: Issue with certificates validation in TLS     handshake

  - CVE-2013-6660: Information leak in drag and drop

  - CVE-2013-6661: Various fixes from internal audits,     fuzzing and other initiatives. Of these, seven are fixes     for issues that could have allowed for sandbox escapes     from compromised renderers.

  - Other :

  - Google Chrome Frame has been retired

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2013-6653     Khalil Zhani discovered a use-after-free issue in     chromium's web contents color chooser.

  - CVE-2013-6654     TheShow3511 discovered an issue in SVG handling.

  - CVE-2013-6655     cloudfuzzer discovered a use-after-free issue in dom     event handling.

  - CVE-2013-6656     NeexEmil discovered an information leak in the XSS     auditor.

  - CVE-2013-6657     NeexEmil discovered a way to bypass the Same Origin     policy in the XSS auditor.

  - CVE-2013-6658     cloudfuzzer discovered multiple use-after-free issues     surrounding the updateWidgetPositions function.

  - CVE-2013-6659     Antoine Delignat-Lavaud and Karthikeyan Bhargavan     discovered that it was possible to trigger an unexpected     certificate chain during TLS renegotiation.

  - CVE-2013-6660     bishopjeffreys discovered an information leak in the     drag and drop implementation.

  - CVE-2013-6661     The Google Chrome team discovered and fixed multiple     issues in version 33.0.1750.117.

  - CVE-2013-6663     Atte Kettunen discovered a use-after-free issue in SVG     handling.

  - CVE-2013-6664     Khalil Zhani discovered a use-after-free issue in the     speech recognition feature.

  - CVE-2013-6665     cloudfuzzer discovered a buffer overflow issue in the     software renderer.

  - CVE-2013-6666     netfuzzer discovered a restriction bypass in the Pepper     Flash plugin.

  - CVE-2013-6667     The Google Chrome team discovered and fixed multiple     issues in version 33.0.1750.146.

  - CVE-2013-6668     Multiple vulnerabilities were fixed in version     3.24.35.10 of the V8 JavaScript library.

  - CVE-2014-1700     Chamal de Silva discovered a use-after-free issue in     speech synthesis.

  - CVE-2014-1701     aidanhs discovered a cross-site scripting issue in event     handling.

  - CVE-2014-1702     Colin Payne discovered a use-after-free issue in the web     database implementation.

  - CVE-2014-1703     VUPEN discovered a use-after-free issue in web sockets     that could lead to a sandbox escape.

  - CVE-2014-1704     Multiple vulnerabilities were fixed in version     3.23.17.18 of the V8 JavaScript library.

  - CVE-2014-1705     A memory corruption issue was discovered in the V8     JavaScript library.

  - CVE-2014-1713     A use-after-free issue was discovered in the     AttributeSetter function.

  - CVE-2014-1715     A directory traversal issue was found and fixed.

The remote host is affected by the vulnerability described in GLSA-201403-01 (Chromium, V8: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and V8. Please       review the CVE identifiers and release notes referenced below for       details.
  Impact :

    A context-dependent attacker could entice a user to open a specially       crafted website or JavaScript program using Chromium or V8, possibly       resulting in the execution of arbitrary code with the privileges of the       process or a Denial of Service condition. Furthermore, a remote attacker       may be able to bypass security restrictions or have other unspecified       impact.
  Workaround :

    There is no known workaround at this time.

Google Chrome Releases reports :

28 security fixes in this release, including :

- [334897] High CVE-2013-6652: Issue with relative paths in Windows sandbox named pipe policy. Credit to tyranid.

- [331790] High CVE-2013-6653: Use-after-free related to web contents.
Credit to Khalil Zhani.

- [333176] High CVE-2013-6654: Bad cast in SVG. Credit to TheShow3511.

- [293534] High CVE-2013-6655: Use-after-free in layout. Credit to cloudfuzzer.

- [331725] High CVE-2013-6656: Information leak in XSS auditor. Credit to NeexEmil.

- [331060] Medium CVE-2013-6657: Information leak in XSS auditor.
Credit to NeexEmil.

- [322891] Medium CVE-2013-6658: Use-after-free in layout. Credit to cloudfuzzer.

- [306959] Medium CVE-2013-6659: Issue with certificates validation in TLS handshake. Credit to Antoine Delignat-Lavaud and Karthikeyan Bhargavan from Prosecco, Inria Paris.

- [332579] Low CVE-2013-6660: Information leak in drag and drop.
Credit to bishopjeffreys.

- [344876] Low-High CVE-2013-6661: Various fixes from internal audits, fuzzing and other initiatives. Of these, seven are fixes for issues that could have allowed for sandbox escapes from compromised renderers.

The version of Google Chrome installed on the remote Mac OS X host is a version prior to 33.0.1750.117.  It is, therefore, affected by the following vulnerabilities :

  - Use-after-free errors exist related to handling     web components and layout. (CVE-2013-6653,     CVE-2013-6655, CVE-2013-6658)

  - A casting error exists related to SVG processing.
    (CVE-2013-6654)

  - Errors exist related to the XSS auditor that could lead     to disclosure of information. (CVE-2013-6656,     CVE-2013-6657)

  - An error exists related to certificate validation and     TLS handshake processing. (CVE-2013-6659)

  - An error exists related to drag and drop handling that     could lead to disclosure of information. (CVE-2013-6660)

  - Various unspecified errors exist having unspecified     impacts. (CVE-2013-6661)

The version of Google Chrome installed on the remote host is a version prior to 33.0.1750.117.  It is, therefore, affected by the following vulnerabilities :

  - An error exists related to relative path in Windows     sandbox named pipe policy. (CVE-2013-6652)

  - Use-after-free errors exist related to handling     web components and layout. (CVE-2013-6653,     CVE-2013-6655, CVE-2013-6658)

  - A casting error exists related to SVG processing.
    (CVE-2013-6654)

  - Errors exist related to the XSS auditor that could lead     to disclosure of information. (CVE-2013-6656,     CVE-2013-6657)

  - An error exists related to certificate validation and     TLS handshake processing. (CVE-2013-6659)

  - An error exists related to drag and drop handling that     could lead to disclosure of information. (CVE-2013-6660)

  - Various unspecified errors exist having unspecified     impacts. (CVE-2013-6661)

ID	Name	Product	Family	Severity
75275	openSUSE Security Update : chromium (openSUSE-SU-2014:0327-1)	Nessus	SuSE Local Security Checks	high
73164	Debian DSA-2883-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	critical
72851	GLSA-201403-01 : Chromium, V8: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
72676	FreeBSD : chromium -- multiple vulnerabilities (9dd47fa3-9d53-11e3-b20f-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	high
72617	Google Chrome < 33.0.1750.117 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
72616	Google Chrome < 33.0.1750.117 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2013-6655

critical

Tenable Plugins

high

critical

critical

high

high

high