Multiple unspecified vulnerabilities in Google V8 before 3.24.35.10, as used in Google Chrome before 33.0.1750.146, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

Updated nodejs package fixes security vulnerabilities :

A memory corruption vulnerability, which results in a denial-of-service, was identified in the versions of V8 that ship with Node.js 0.8 and 0.10. In certain circumstances, a particularly deep recursive workload that may trigger a GC and receive an interrupt may overflow the stack and result in a segmentation fault. For instance, if your work load involves successive JSON.parse calls and the parsed objects are significantly deep, you may experience the process aborting while parsing (CVE-2014-5256).

Multiple unspecified vulnerabilities in Google V8 before 3.24.35.10, as used in Node.js before 0.10.31, allow attackers to cause a denial of service or possibly have other impact via unknown vectors (CVE-2013-6668).

The nodejs package has been updated to version 0.10.33 to fix these issues as well as several other bugs.

This update provides the latest stable version of Node.js and corresponding backports to the v8 package.

This update resolves CVE-2013-6668, which has only a minor impact since Node.js is not typically used to execute untrusted JavaScript.
For more information on the fixed vulnerability, please see the CVE bugs listed below.

Changes in this update include :

  - v8: fix a crash introduced by previous release (Fedor     Indutny)

    - crypto: use domains for any callback-taking method       (Chris Dickinson)

    - http: do not send `0rnrn` in TE HEAD responses (Fedor       Indutny)

    - querystring: fix unescape override (Tristan Berger)

    - url: Add support for RFC 3490 separators (Mathias       Bynens)

    - v8: backport CVE-2013-6668

    - cluster: disconnect should not be synchronous (Sam       Roberts)

    - fs: fix fs.readFileSync fd leak when get RangeError       (Jackson Tian)

    - stream: fix Readable.wrap objectMode falsy values       (James Halliday)

    - timers: fix timers with non-integer delay hanging.
      (Julien Gilli)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2013-6653     Khalil Zhani discovered a use-after-free issue in     chromium's web contents color chooser.

  - CVE-2013-6654     TheShow3511 discovered an issue in SVG handling.

  - CVE-2013-6655     cloudfuzzer discovered a use-after-free issue in dom     event handling.

  - CVE-2013-6656     NeexEmil discovered an information leak in the XSS     auditor.

  - CVE-2013-6657     NeexEmil discovered a way to bypass the Same Origin     policy in the XSS auditor.

  - CVE-2013-6658     cloudfuzzer discovered multiple use-after-free issues     surrounding the updateWidgetPositions function.

  - CVE-2013-6659     Antoine Delignat-Lavaud and Karthikeyan Bhargavan     discovered that it was possible to trigger an unexpected     certificate chain during TLS renegotiation.

  - CVE-2013-6660     bishopjeffreys discovered an information leak in the     drag and drop implementation.

  - CVE-2013-6661     The Google Chrome team discovered and fixed multiple     issues in version 33.0.1750.117.

  - CVE-2013-6663     Atte Kettunen discovered a use-after-free issue in SVG     handling.

  - CVE-2013-6664     Khalil Zhani discovered a use-after-free issue in the     speech recognition feature.

  - CVE-2013-6665     cloudfuzzer discovered a buffer overflow issue in the     software renderer.

  - CVE-2013-6666     netfuzzer discovered a restriction bypass in the Pepper     Flash plugin.

  - CVE-2013-6667     The Google Chrome team discovered and fixed multiple     issues in version 33.0.1750.146.

  - CVE-2013-6668     Multiple vulnerabilities were fixed in version     3.24.35.10 of the V8 JavaScript library.

  - CVE-2014-1700     Chamal de Silva discovered a use-after-free issue in     speech synthesis.

  - CVE-2014-1701     aidanhs discovered a cross-site scripting issue in event     handling.

  - CVE-2014-1702     Colin Payne discovered a use-after-free issue in the web     database implementation.

  - CVE-2014-1703     VUPEN discovered a use-after-free issue in web sockets     that could lead to a sandbox escape.

  - CVE-2014-1704     Multiple vulnerabilities were fixed in version     3.23.17.18 of the V8 JavaScript library.

  - CVE-2014-1705     A memory corruption issue was discovered in the V8     JavaScript library.

  - CVE-2014-1713     A use-after-free issue was discovered in the     AttributeSetter function.

  - CVE-2014-1715     A directory traversal issue was found and fixed.

The version of Opera installed on the remote host is a version prior to version 20. It is, therefore, reportedly affected by multiple unspecified vulnerabilities.

The remote host is affected by the vulnerability described in GLSA-201403-01 (Chromium, V8: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and V8. Please       review the CVE identifiers and release notes referenced below for       details.
  Impact :

    A context-dependent attacker could entice a user to open a specially       crafted website or JavaScript program using Chromium or V8, possibly       resulting in the execution of arbitrary code with the privileges of the       process or a Denial of Service condition. Furthermore, a remote attacker       may be able to bypass security restrictions or have other unspecified       impact.
  Workaround :

    There is no known workaround at this time.

Google Chrome Releases reports :

19 vulnerabilities fixed in this release, including :

- [344492] High CVE-2013-6663: Use-after-free in svg images. Credit to Atte Kettunen of OUSPG.

- [326854] High CVE-2013-6664: Use-after-free in speech recognition.
Credit to Khalil Zhani.

- [337882] High CVE-2013-6665: Heap buffer overflow in software rendering. Credit to cloudfuzzer.

- [332023] Medium CVE-2013-6666: Chrome allows requests in flash header request. Credit to netfuzzerr.

- [348175] CVE-2013-6667: Various fixes from internal audits, fuzzing and other initiatives.

- [343964, 344186, 347909] CVE-2013-6668: Multiple vulnerabilities in V8 fixed in version 3.24.35.10.

The version of Google Chrome installed on the remote Mac OS X host is a version prior to 33.0.1750.146.  It is, therefore, affected by the following vulnerabilities :

  - Use-after-free errors exist related to handling     SVG images and speech recognition processing.
    (CVE-2013-6663, CVE-2013-6664)

  - An error exists related to software rendering that     could allow heap-based buffer overflows.
    (CVE-2013-6665)

  - An error exists related to Flash header requests.
    (CVE-2013-6666)

  - Various unspecified errors exist having unspecified     impacts. (CVE-2013-6667)

  - Unspecified errors exist related to the V8 JavaScript     engine that could have unspecified impacts.
    (CVE-2013-6668)

The version of Google Chrome installed on the remote host is a version prior to 33.0.1750.146.  It is, therefore, affected by the following vulnerabilities :

  - Use-after-free errors exist related to handling     SVG images and speech recognition processing.
    (CVE-2013-6663, CVE-2013-6664)

  - An error exists related to software rendering that     could allow heap-based buffer overflows.
    (CVE-2013-6665)

  - An error exists related to Flash header requests.
    (CVE-2013-6666)

  - Various unspecified errors exist having unspecified     impacts. (CVE-2013-6667)

  - Unspecified errors exist related to the V8 JavaScript     engine that could have unspecified impacts.
    (CVE-2013-6668)

ID	Name	Product	Family	Severity
82395	Mandriva Linux Security Advisory : nodejs (MDVSA-2015:142)	Nessus	Mandriva Local Security Checks	high
77931	Fedora 21 : nodejs-0.10.32-1.fc21 / v8-3.14.5.10-14.fc21 (2014-11132)	Nessus	Fedora Local Security Checks	high
77929	Fedora 20 : nodejs-0.10.32-1.fc20 / v8-3.14.5.10-14.fc20 (2014-11065)	Nessus	Fedora Local Security Checks	high
77927	Fedora 19 : nodejs-0.10.32-1.fc19 / v8-3.14.5.10-14.fc19 (2014-10975)	Nessus	Fedora Local Security Checks	high
73164	Debian DSA-2883-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	critical
72884	Opera < 20 Multiple Vulnerabilities	Nessus	Windows	high
72851	GLSA-201403-01 : Chromium, V8: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
72850	FreeBSD : chromium -- multiple vulnerabilities (b4023753-a4ba-11e3-bec2-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	high
72801	Google Chrome < 33.0.1750.146 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
72800	Google Chrome < 33.0.1750.146 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2013-6668

high

Tenable Plugins

high

high

high

high

critical

high

critical

high

high

high