Integer overflow in api.cc in Google V8, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large length value.

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2014-1730     A type confusion issue was discovered in the v8     JavaScript library.

  - CVE-2014-1731     John Butler discovered a type confusion issue in the     WebKit/Blink document object model implementation.

  - CVE-2014-1732     Khalil Zhani discovered a use-after-free issue in the     speech recognition feature.

  - CVE-2014-1733     Jed Davis discovered a way to bypass the seccomp-bpf     sandbox.

  - CVE-2014-1734     The Google Chrome development team discovered and fixed     multiple issues with potential security impact.

  - CVE-2014-1735     The Google Chrome development team discovered and fixed     multiple issues in version 3.24.35.33 of the v8     JavaScript library.

  - CVE-2014-1736     SkyLined discovered an integer overlflow issue in the v8     JavaScript library.

Google Chrome Releases reports (belatedly) :

9 security fixes in this release, including :

- [354967] High CVE-2014-1730: Type confusion in V8. Credit to Anonymous.

- [349903] High CVE-2014-1731: Type confusion in DOM. Credit to John Butler.

- [359802] High CVE-2014-1736: Integer overflow in V8. Credit to SkyLined working with HP's Zero Day Initiative.

- [352851] Medium CVE-2014-1732: Use-after-free in Speech Recognition.
Credit to Khalil Zhani.

- [351103] Medium CVE-2014-1733: Compiler bug in Seccomp-BPF. Credit to Jed Davis.

- [367314] CVE-2014-1734: Various fixes from internal audits, fuzzing and other initiatives.

- [359130, 359525, 360429] CVE-2014-1735: Multiple vulnerabilities in V8 fixed in version 3.24.35.33.

The version of Google Chrome installed on the remote Mac OS X host is a version prior to 34.0.1847.131. It is, therefore, affected by the following vulnerabilities :

  - A buffer overflow error exists related to the included     version of Flash Player. (CVE-2014-0515)

  - Type confusion errors exist related to the V8     JavaScript engine and DOM handling. (CVE-2014-1730,     CVE-2014-1731)

  - A use-after-free error exists related to speech     recognition processing. (CVE-2014-1732)

  - An error exists related to compiling in 'Seccomp-BPF'.
    (CVE-2014-1733)

  - Various, unspecified errors exist. (CVE-2014-1734)

  - Various, unspecified errors exist related to the V8     JavaScript engine. (CVE-2014-1735)

  - An integer overflow error exists related to the V8     JavaScript engine. (CVE-2014-1736)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote host is a version prior to 34.0.1847.131. It is, therefore, affected by the following vulnerabilities :

  - A buffer overflow error exists related to the included     version of Flash Player. (CVE-2014-0515)

  - Type confusion errors exist related to the V8     JavaScript engine and DOM handling. (CVE-2014-1730,     CVE-2014-1731)

  - A use-after-free error exists related to speech     recognition processing. (CVE-2014-1732)

  - An error exists related to compiling in 'Seccomp-BPF'.
    (CVE-2014-1733)

  - Various, unspecified errors exist. (CVE-2014-1734)

  - Various, unspecified errors exist related to the V8     JavaScript engine. (CVE-2014-1735)

  - An integer overflow error exists related to the V8     JavaScript engine. (CVE-2014-1736)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
73856	Debian DSA-2920-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	high
73793	FreeBSD : chromium -- multiple vulnerabilities (7cf25a0c-d031-11e3-947b-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	high
73711	Google Chrome < 34.0.1847.131 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
73710	Google Chrome < 34.0.1847.131 Multiple Vulnerabilities	Nessus	Windows	critical

Detections

Analytics

CVE-2014-1736

high

Tenable Plugins

high

high

critical

critical