Google V8, as used in Google Chrome before 33.0.1750.152 on OS X and Linux and before 33.0.1750.154 on Windows, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.

The remote host is affected by the vulnerability described in GLSA-201408-16 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could conduct a number of attacks which include: cross       site scripting attacks, bypassing of sandbox protection,  potential       execution of arbitrary code with the privileges of the process, or cause       a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Chromium was updated to the 33.0.1750.152 stable channel uodate :

  - Security fixes :

  - CVE-2014-1713: Use-after-free in Blink bindings

  - CVE-2014-1714: Windows clipboard vulnerability

  - CVE-2014-1705: Memory corruption in V8

  - CVE-2014-1715: Directory traversal issue

Previous stable channel update 33.0.1750.149 :

  - Security fixes :

  - CVE-2014-1700: Use-after-free in speech

  - CVE-2014-1701: UXSS in events

  - CVE-2014-1702: Use-after-free in web database

  - CVE-2014-1703: Potential sandbox escape due to a     use-after-free in web sockets

  - CVE-2014-1704: Multiple vulnerabilities in V8 fixed in     version 3.23.17.18

Chrome OS version 33.0.1750.152 (Platform version: 5116.115.4/5116.115.5) was released with fixes for the following security vulnerabilities :

  - Memory corruption in V8 via the builtin ArrayBuffer property access, which can lead to remote code execution (CVE-2014-1705)
  - Command injection in Crosh via the try_touch_experiment function, which may allow a context-dependent attacker to run arbitrary commands (CVE-2014-1706)
  - Path traversal issue in CrosDisk due to insufficient user input sanitation when mounting a source (CVE-2014-1707)
  - Issue with file persistence at boot, relating to a flaw in dump_vpd_log (CVE-2014-1708)
  - Memory corruption flaw in the AsyncPixelTransfersCompletedQuery::End() function in the GPU command buffer, which a context-dependent attacker can leverage to run arbitrary code (CVE-2014-1710)
  - Out-of-bounds write in the GPU driver, which can be leveraged to execute arbitrary code (CVE-2014-1711)
  - Use-after-free error in Blink bindings used in the V8 engine, which can be leveraged to execute arbitrary code (CVE-2014-1713)

Google Chrome for Android version 33.0.1750.166 contains fixes for the following security issues, discovered during CanSecWest 2014:

  - Memory corruption in V8 (CVE-2014-1705)

  - Memory corruption in GPU command buffer (CVE-2014-1710)

  - Use-after-free in bindings (CVE-2014-1713)

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2013-6653     Khalil Zhani discovered a use-after-free issue in     chromium's web contents color chooser.

  - CVE-2013-6654     TheShow3511 discovered an issue in SVG handling.

  - CVE-2013-6655     cloudfuzzer discovered a use-after-free issue in dom     event handling.

  - CVE-2013-6656     NeexEmil discovered an information leak in the XSS     auditor.

  - CVE-2013-6657     NeexEmil discovered a way to bypass the Same Origin     policy in the XSS auditor.

  - CVE-2013-6658     cloudfuzzer discovered multiple use-after-free issues     surrounding the updateWidgetPositions function.

  - CVE-2013-6659     Antoine Delignat-Lavaud and Karthikeyan Bhargavan     discovered that it was possible to trigger an unexpected     certificate chain during TLS renegotiation.

  - CVE-2013-6660     bishopjeffreys discovered an information leak in the     drag and drop implementation.

  - CVE-2013-6661     The Google Chrome team discovered and fixed multiple     issues in version 33.0.1750.117.

  - CVE-2013-6663     Atte Kettunen discovered a use-after-free issue in SVG     handling.

  - CVE-2013-6664     Khalil Zhani discovered a use-after-free issue in the     speech recognition feature.

  - CVE-2013-6665     cloudfuzzer discovered a buffer overflow issue in the     software renderer.

  - CVE-2013-6666     netfuzzer discovered a restriction bypass in the Pepper     Flash plugin.

  - CVE-2013-6667     The Google Chrome team discovered and fixed multiple     issues in version 33.0.1750.146.

  - CVE-2013-6668     Multiple vulnerabilities were fixed in version     3.24.35.10 of the V8 JavaScript library.

  - CVE-2014-1700     Chamal de Silva discovered a use-after-free issue in     speech synthesis.

  - CVE-2014-1701     aidanhs discovered a cross-site scripting issue in event     handling.

  - CVE-2014-1702     Colin Payne discovered a use-after-free issue in the web     database implementation.

  - CVE-2014-1703     VUPEN discovered a use-after-free issue in web sockets     that could lead to a sandbox escape.

  - CVE-2014-1704     Multiple vulnerabilities were fixed in version     3.23.17.18 of the V8 JavaScript library.

  - CVE-2014-1705     A memory corruption issue was discovered in the V8     JavaScript library.

  - CVE-2014-1713     A use-after-free issue was discovered in the     AttributeSetter function.

  - CVE-2014-1715     A directory traversal issue was found and fixed.

The Google Chrome browser detected on the remote Linux system is older than version 33.0.1750.152 and is therefore vulnerable to the following issues:

  - Memory corruption vulnerability in Google V8 via ArrayBuffer property accesses. (CVE-2014-1705)

  - Use-after-free error related to document.location bindings, which may be leveraged to execute arbitrary code by a context-dependent attacker. (CVE-2014-1713)

  - A sandbox bypass via a flaw related to the clipboard message filter. (CVE-2014-1714)

  - A sandbox bypass via path traversal due to insufficient user input sanitation in the 'CreatePlatformFileUnsafe()' function within 'base/platform_file_win.cc' (CVE-2014-1715)

The Google Chrome browser detected on the remote Mac/OS X system is older than version 33.0.1750.152 and is therefore vulnerable to the following issues:

  - Memory corruption vulnerability in Google V8 via ArrayBuffer property accesses. (CVE-2014-1705)

  - Use-after-free error related to document.location bindings, which may be leveraged to execute arbitrary code by a context-dependent attacker. (CVE-2014-1713)

  - A sandbox bypass via a flaw related to the clipboard message filter. (CVE-2014-1714)

  - A sandbox bypass via path traversal due to insufficient user input sanitation in the 'CreatePlatformFileUnsafe()' function within 'base/platform_file_win.cc' (CVE-2014-1715)

The Google Chrome browser detected on the remote Windows system is older than version 33.0.1750.154, and is therefore vulnerable to the following issues:

  - Memory corruption vulnerability in Google V8 via ArrayBuffer property accesses. (CVE-2014-1705)

  - Use-after-free error related to document.location bindings, which may be leveraged to execute arbitrary code by a context-dependent attacker. (CVE-2014-1713)

  - A sandbox bypass via a flaw related to the clipboard message filter. (CVE-2014-1714)

  - A sandbox bypass via path traversal due to insufficient user input sanitation in the 'CreatePlatformFileUnsafe()' function within 'base/platform_file_win.cc' (CVE-2014-1715)

The version of Google Chrome installed on the remote Mac OS X host is a version prior to 33.0.1750.152. It is, therefore, affected by the following vulnerabilities :

  - A remote code-execution flaw exists due to a read/write     error with the a sandbox bypass, specifically the V8     JavaScript engine. This could allow an attacker to     execute code or cause a denial of service if the exploit     fails. (CVE-2014-1705)

  - A use-after-free flaw exists with the     'document.location' bindings. An attacker, using a     specially crafted web page, can dereference freed memory     and could execute arbitrary code. (CVE-2014-1713)

  - A flaw exists with the clipboard message filter. A     context-dependent attacker could bypass sandbox     restrictions. (CVE-2014-1714)

  - A restriction bypass flaw exists with the     'CreatePlatformFileUnsafe()' function in the     'base/platform_file_win.cc' where user input is not     properly sanitized. A context-dependent attacker could     open arbitrary directories bypassing sandbox     restrictions. (CVE-2014-1715)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote host is a version prior to 33.0.1750.154. It is, therefore, affected by the following vulnerabilities :

  - A remote code-execution flaw exists due to a read/write     error with the a sandbox bypass, specifically the V8     JavaScript engine. This could allow an attacker to     execute code or cause a denial of service if the exploit     fails. (CVE-2014-1705)

  - A use-after-free flaw exists with the     'document.location' bindings. An attacker, using a     specially crafted web page, can dereference freed memory     and could execute arbitrary code. (CVE-2014-1713)

  - A flaw exists with the clipboard message filter. A     context-dependent attacker could bypass sandbox     restrictions. (CVE-2014-1714)

  - A restriction bypass flaw exists with the     'CreatePlatformFileUnsafe()' function in the     'base/platform_file_win.cc' where user input is not     properly sanitized. A context-dependent attacker could     open arbitrary directories bypassing sandbox     restrictions. (CVE-2014-1715)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Versions of Google Chrome OS prior to 33.0.1750.152 are affected by the following vulnerabilities :

  - Memory corruption vulnerability in Google V8 via ArrayBuffer property accesses. (CVE-2014-1705)

  - Command injection vulnerability via a flaw in crosh that is triggered when calling try_touch_experiment. (CVE-2014-1706)

  - Unspecified path traversal vulnerability due to insufficient user-input sanitation when mounting a source (CVE-2014-1707)

  - Unspecified on-boot file persistence vulnerability (CVE-2014-1708)

  - An exploitable memory corruption in the 'AsyncPixelTransfersCompletedQuery::End()' function in 'gpu/command_buffer/service/query_manager.cc' (CVE-2014-1710)

  - Out-of-bounds write flaw in the GPU driver (CVE-2014-1711)

  - Use-after-free error related to document.location bindings, which may be leveraged to execute arbitrary code by a context-dependent attacker. (CVE-2014-1713)

Google Chrome Releases reports :

New vulnerabilities after the Pwn2Own competition :

- [352369] Code execution outside sandbox. Credit to VUPEN.

- [352374] High CVE-2014-1713: Use-after-free in Blink bindings

- [352395] High CVE-2014-1714: Windows clipboard vulnerability

- [352420] Code execution outside sandbox. Credit to Anonymous.

- [351787] High CVE-2014-1705: Memory corruption in V8

- [352429] High CVE-2014-1715: Directory traversal issue

ID	Name	Product	Family	Severity
77460	GLSA-201408-16 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
75318	openSUSE Security Update : chromium (openSUSE-SU-2014:0501-1)	Nessus	SuSE Local Security Checks	critical
8202	Google Chrome OS < 33.0.1750.152 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	high
8201	Google Chrome for Android < 33.0.1750.166 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	medium
73164	Debian DSA-2883-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	critical
8164	Google Chrome < 33.0.1750.152 (Linux) Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
8163	Google Chrome < 33.0.1750.152 (Mac) Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
8162	Google Chrome < 33.0.1750.154 (Win) Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
73083	Google Chrome < 33.0.1750.152 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
73082	Google Chrome < 33.0.1750.154 Multiple Vulnerabilities	Nessus	Windows	high
8161	Google Chrome OS < 33.0.1750.152 Multiple Security Vulnerabilities (deprecated)	Nessus Network Monitor	Web Clients	high
73049	FreeBSD : www/chromium -- multiple vulnerabilities (a70966a1-ac22-11e3-8d04-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2014-1705

critical

Tenable Plugins

critical

critical

high

medium

critical

high

high

high

high

high

high

high