Use-after-free vulnerability in the FormAssociatedElement::formRemovedFromTree function in core/html/FormAssociatedElement.cpp in Blink, as used in Google Chrome before 33.0.1750.146, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving FORM elements, as demonstrated by use of the speech-recognition feature.

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2013-6653     Khalil Zhani discovered a use-after-free issue in     chromium's web contents color chooser.

  - CVE-2013-6654     TheShow3511 discovered an issue in SVG handling.

  - CVE-2013-6655     cloudfuzzer discovered a use-after-free issue in dom     event handling.

  - CVE-2013-6656     NeexEmil discovered an information leak in the XSS     auditor.

  - CVE-2013-6657     NeexEmil discovered a way to bypass the Same Origin     policy in the XSS auditor.

  - CVE-2013-6658     cloudfuzzer discovered multiple use-after-free issues     surrounding the updateWidgetPositions function.

  - CVE-2013-6659     Antoine Delignat-Lavaud and Karthikeyan Bhargavan     discovered that it was possible to trigger an unexpected     certificate chain during TLS renegotiation.

  - CVE-2013-6660     bishopjeffreys discovered an information leak in the     drag and drop implementation.

  - CVE-2013-6661     The Google Chrome team discovered and fixed multiple     issues in version 33.0.1750.117.

  - CVE-2013-6663     Atte Kettunen discovered a use-after-free issue in SVG     handling.

  - CVE-2013-6664     Khalil Zhani discovered a use-after-free issue in the     speech recognition feature.

  - CVE-2013-6665     cloudfuzzer discovered a buffer overflow issue in the     software renderer.

  - CVE-2013-6666     netfuzzer discovered a restriction bypass in the Pepper     Flash plugin.

  - CVE-2013-6667     The Google Chrome team discovered and fixed multiple     issues in version 33.0.1750.146.

  - CVE-2013-6668     Multiple vulnerabilities were fixed in version     3.24.35.10 of the V8 JavaScript library.

  - CVE-2014-1700     Chamal de Silva discovered a use-after-free issue in     speech synthesis.

  - CVE-2014-1701     aidanhs discovered a cross-site scripting issue in event     handling.

  - CVE-2014-1702     Colin Payne discovered a use-after-free issue in the web     database implementation.

  - CVE-2014-1703     VUPEN discovered a use-after-free issue in web sockets     that could lead to a sandbox escape.

  - CVE-2014-1704     Multiple vulnerabilities were fixed in version     3.23.17.18 of the V8 JavaScript library.

  - CVE-2014-1705     A memory corruption issue was discovered in the V8     JavaScript library.

  - CVE-2014-1713     A use-after-free issue was discovered in the     AttributeSetter function.

  - CVE-2014-1715     A directory traversal issue was found and fixed.

The version of Opera installed on the remote host is a version prior to version 20. It is, therefore, reportedly affected by multiple unspecified vulnerabilities.

The remote host is affected by the vulnerability described in GLSA-201403-01 (Chromium, V8: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and V8. Please       review the CVE identifiers and release notes referenced below for       details.
  Impact :

    A context-dependent attacker could entice a user to open a specially       crafted website or JavaScript program using Chromium or V8, possibly       resulting in the execution of arbitrary code with the privileges of the       process or a Denial of Service condition. Furthermore, a remote attacker       may be able to bypass security restrictions or have other unspecified       impact.
  Workaround :

    There is no known workaround at this time.

Google Chrome Releases reports :

19 vulnerabilities fixed in this release, including :

- [344492] High CVE-2013-6663: Use-after-free in svg images. Credit to Atte Kettunen of OUSPG.

- [326854] High CVE-2013-6664: Use-after-free in speech recognition.
Credit to Khalil Zhani.

- [337882] High CVE-2013-6665: Heap buffer overflow in software rendering. Credit to cloudfuzzer.

- [332023] Medium CVE-2013-6666: Chrome allows requests in flash header request. Credit to netfuzzerr.

- [348175] CVE-2013-6667: Various fixes from internal audits, fuzzing and other initiatives.

- [343964, 344186, 347909] CVE-2013-6668: Multiple vulnerabilities in V8 fixed in version 3.24.35.10.

The version of Google Chrome installed on the remote Mac OS X host is a version prior to 33.0.1750.146.  It is, therefore, affected by the following vulnerabilities :

  - Use-after-free errors exist related to handling     SVG images and speech recognition processing.
    (CVE-2013-6663, CVE-2013-6664)

  - An error exists related to software rendering that     could allow heap-based buffer overflows.
    (CVE-2013-6665)

  - An error exists related to Flash header requests.
    (CVE-2013-6666)

  - Various unspecified errors exist having unspecified     impacts. (CVE-2013-6667)

  - Unspecified errors exist related to the V8 JavaScript     engine that could have unspecified impacts.
    (CVE-2013-6668)

The version of Google Chrome installed on the remote host is a version prior to 33.0.1750.146.  It is, therefore, affected by the following vulnerabilities :

  - Use-after-free errors exist related to handling     SVG images and speech recognition processing.
    (CVE-2013-6663, CVE-2013-6664)

  - An error exists related to software rendering that     could allow heap-based buffer overflows.
    (CVE-2013-6665)

  - An error exists related to Flash header requests.
    (CVE-2013-6666)

  - Various unspecified errors exist having unspecified     impacts. (CVE-2013-6667)

  - Unspecified errors exist related to the V8 JavaScript     engine that could have unspecified impacts.
    (CVE-2013-6668)

ID	Name	Product	Family	Severity
73164	Debian DSA-2883-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	critical
72884	Opera < 20 Multiple Vulnerabilities	Nessus	Windows	high
72851	GLSA-201403-01 : Chromium, V8: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
72850	FreeBSD : chromium -- multiple vulnerabilities (b4023753-a4ba-11e3-bec2-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	high
72801	Google Chrome < 33.0.1750.146 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
72800	Google Chrome < 33.0.1750.146 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2013-6664

high

Tenable Plugins

critical

high

critical

high

high

high