Use-after-free vulnerability in modules/speech/SpeechSynthesis.cpp in Blink, as used in Google Chrome before 33.0.1750.149, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper handling of a certain utterance data structure.

The remote host is affected by the vulnerability described in GLSA-201408-16 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could conduct a number of attacks which include: cross       site scripting attacks, bypassing of sandbox protection,  potential       execution of arbitrary code with the privileges of the process, or cause       a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Chromium was updated to the 33.0.1750.152 stable channel uodate :

  - Security fixes :

  - CVE-2014-1713: Use-after-free in Blink bindings

  - CVE-2014-1714: Windows clipboard vulnerability

  - CVE-2014-1705: Memory corruption in V8

  - CVE-2014-1715: Directory traversal issue

Previous stable channel update 33.0.1750.149 :

  - Security fixes :

  - CVE-2014-1700: Use-after-free in speech

  - CVE-2014-1701: UXSS in events

  - CVE-2014-1702: Use-after-free in web database

  - CVE-2014-1703: Potential sandbox escape due to a     use-after-free in web sockets

  - CVE-2014-1704: Multiple vulnerabilities in V8 fixed in     version 3.23.17.18

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2013-6653     Khalil Zhani discovered a use-after-free issue in     chromium's web contents color chooser.

  - CVE-2013-6654     TheShow3511 discovered an issue in SVG handling.

  - CVE-2013-6655     cloudfuzzer discovered a use-after-free issue in dom     event handling.

  - CVE-2013-6656     NeexEmil discovered an information leak in the XSS     auditor.

  - CVE-2013-6657     NeexEmil discovered a way to bypass the Same Origin     policy in the XSS auditor.

  - CVE-2013-6658     cloudfuzzer discovered multiple use-after-free issues     surrounding the updateWidgetPositions function.

  - CVE-2013-6659     Antoine Delignat-Lavaud and Karthikeyan Bhargavan     discovered that it was possible to trigger an unexpected     certificate chain during TLS renegotiation.

  - CVE-2013-6660     bishopjeffreys discovered an information leak in the     drag and drop implementation.

  - CVE-2013-6661     The Google Chrome team discovered and fixed multiple     issues in version 33.0.1750.117.

  - CVE-2013-6663     Atte Kettunen discovered a use-after-free issue in SVG     handling.

  - CVE-2013-6664     Khalil Zhani discovered a use-after-free issue in the     speech recognition feature.

  - CVE-2013-6665     cloudfuzzer discovered a buffer overflow issue in the     software renderer.

  - CVE-2013-6666     netfuzzer discovered a restriction bypass in the Pepper     Flash plugin.

  - CVE-2013-6667     The Google Chrome team discovered and fixed multiple     issues in version 33.0.1750.146.

  - CVE-2013-6668     Multiple vulnerabilities were fixed in version     3.24.35.10 of the V8 JavaScript library.

  - CVE-2014-1700     Chamal de Silva discovered a use-after-free issue in     speech synthesis.

  - CVE-2014-1701     aidanhs discovered a cross-site scripting issue in event     handling.

  - CVE-2014-1702     Colin Payne discovered a use-after-free issue in the web     database implementation.

  - CVE-2014-1703     VUPEN discovered a use-after-free issue in web sockets     that could lead to a sandbox escape.

  - CVE-2014-1704     Multiple vulnerabilities were fixed in version     3.23.17.18 of the V8 JavaScript library.

  - CVE-2014-1705     A memory corruption issue was discovered in the V8     JavaScript library.

  - CVE-2014-1713     A use-after-free issue was discovered in the     AttributeSetter function.

  - CVE-2014-1715     A directory traversal issue was found and fixed.

The Google Chrome browser detected on the remote system is older than version 33.0.1750.149, and is therefore vulnerable to the following issues:

  - Use-after-free in 'speech' and 'web database', which may be leveraged by an attacker for remote code execution (CVE-2014-1700, CVE-2014-1702)

  - Universal cross-site-scripting attack due to insufficient user input validation in 'events' handling. (CVE-2014-1701)

  - Use-after-free error in 'web sockets' that can allow sandbox protection bypass (CVE-2014-1703)

  - Multiple unspecified errors in the V8 Javascript engine (CVE-2014-1704)

  - An update to the latest version of Flash player, 12.0.0.7.

Google Chrome Releases reports :

7 vulnerabilities fixed in this release, including :

- [344881] High CVE-2014-1700: Use-after-free in speech. Credit to Chamal de Silva.

- [342618] High CVE-2014-1701: UXSS in events. Credit to aidanhs.

- [333058] High CVE-2014-1702: Use-after-free in web database. Credit to Collin Payne.

- [338354] High CVE-2014-1703: Potential sandbox escape due to a use-after-free in web sockets.

- [328202, 349079, 345715] CVE-2014-1704: Multiple vulnerabilities in V8 fixed in version 3.23.17.18.

The version of Google Chrome installed on the remote Mac OS X host is a version prior to 33.0.1750.149.  It is, therefore, affected by the following vulnerabilities :

  - Use-after-free errors exist related to 'speech' and     'web database' processing. (CVE-2014-1700,     CVE-2014-1702)

  - An input validation error exists related to 'events'     handling that could allow universal cross-site     scripting (UXSS) attacks. (CVE-2014-1701)

  - A use-after-free error exists related to 'web sockets'     that could allow sandbox protection bypass.
    (CVE-2014-1703)

  - Multiple unspecified errors exist related to the V8     JavaScript engine. (CVE-2014-1704)

The version of Google Chrome installed on the remote host is a version prior to 33.0.1750.149.  It is, therefore, affected by the following vulnerabilities :

  - Use-after-free errors exist related to 'speech' and     'web database' processing. (CVE-2014-1700,     CVE-2014-1702)

  - An input validation error exists related to 'events'     handling that could allow universal cross-site     scripting (UXSS) attacks. (CVE-2014-1701)

  - A use-after-free error exists related to 'web sockets'     that could allow sandbox protection bypass.
    (CVE-2014-1703)

  - Multiple unspecified errors exist related to the V8     JavaScript engine. (CVE-2014-1704)

ID	Name	Product	Family	Severity
77460	GLSA-201408-16 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
75318	openSUSE Security Update : chromium (openSUSE-SU-2014:0501-1)	Nessus	SuSE Local Security Checks	critical
73164	Debian DSA-2883-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	critical
8158	Google Chrome < 33.0.1750.149 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
72955	FreeBSD : www/chromium --multiple vulnerabilities (24cefa4b-a940-11e3-91f2-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	critical
72940	Google Chrome < 33.0.1750.149 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
72939	Google Chrome < 33.0.1750.149 Multiple Vulnerabilities	Nessus	Windows	critical

Detections

Analytics

CVE-2014-1700

high

Tenable Plugins

critical

critical

critical

high

critical

critical

critical