base/memory/shared_memory_win.cc in Google Chrome before 38.0.2125.101 on Windows does not properly implement read-only restrictions on shared memory, which allows attackers to bypass a sandbox protection mechanism via unspecified vectors.

- Update to Chromium 38.0.2125.101 This update includes     159 security fixes, including 113 relatively minor     fixes. Highlighted securtiy fixes are: CVE-2014-3188: A     combination of V8 and IPC bugs that can lead to remote     code execution outside of the sandbox CVE-2014-3189:
    Out-of-bounds read in PDFium CVE-2014-3190:
    Use-after-free in Events CVE-2014-3191: Use-after-free     in Rendering CVE-2014-3192: Use-after-free in DOM     CVE-2014-3193: Type confusion in Session Management     CVE-2014-3194: Use-after-free in Web Workers     CVE-2014-3195: Information Leak in V8 CVE-2014-3196:
    Permissions bypass in Windows Sandbox CVE-2014-3197:
    Information Leak in XSS Auditor CVE-2014-3198:
    Out-of-bounds read in PDFium CVE-2014-3199: Release     Assert in V8 bindings CVE-2014-3200: Various fixes from     internal audits, fuzzing and other initiatives

  - Drop the build of the Native Client. This is actually     not a build as that prebuild binaries are being shipped.
    Also Google no longer provides prebuild binaries for the     NativeClient for 32bit. Chromium as webbrowser is not     affected by this and it bring Chromium inline with the     regulations that prebuild binaries should not be     shipped.

  - toolchaing_linux tarball dropped

  - Spec-file cleaned for NaCl stuff

  - Added patch no-clang-on-packman.diff to prevent the     usage of clang on packman, which is not supported there

Google Chrome Releases reports :

159 security fixes in this release, including 113 found using MemorySanitizer :

- [416449] Critical CVE-2014-3188: A special thanks to Juri Aedla for a combination of V8 and IPC bugs that can lead to remote code execution outside of the sandbox.

- [398384] High CVE-2014-3189: Out-of-bounds read in PDFium. Credit to cloudfuzzer.

- [400476] High CVE-2014-3190: Use-after-free in Events. Credit to cloudfuzzer.

- [402407] High CVE-2014-3191: Use-after-free in Rendering. Credit to cloudfuzzer.

- [403276] High CVE-2014-3192: Use-after-free in DOM. Credit to cloudfuzzer.

- [399655] High CVE-2014-3193: Type confusion in Session Management.
Credit to miaubiz.

- [401115] High CVE-2014-3194: Use-after-free in Web Workers. Credit to Collin Payne.

- [403409] Medium CVE-2014-3195: Information Leak in V8. Credit to Juri Aedla.

- [338538] Medium CVE-2014-3196: Permissions bypass in Windows Sandbox. Credit to James Forshaw.

- [396544] Medium CVE-2014-3197: Information Leak in XSS Auditor.
Credit to Takeshi Terada.

- [415307] Medium CVE-2014-3198: Out-of-bounds read in PDFium. Credit to Atte Kettunen of OUSPG.

- [395411] Low CVE-2014-3199: Release Assert in V8 bindings. Credit to Collin Payne.

- [420899] CVE-2014-3200: Various fixes from internal audits, fuzzing and other initiatives (Chrome 38).

- Multiple vulnerabilities in V8 fixed at the tip of the 3.28 branch (currently 3.28.71.15).

The version of Google Chrome installed on the remote Mac OS X host is a version prior to 37.0.2062.94. It is, therefore, affected by the following vulnerabilities :

  - A flaw exists in V8 and IPC that can lead to remote code     execution. (CVE-2014-3188)

  - Out-of-bounds read errors exist in PDFium.
    (CVE-2014-3189, CVE-2014-3198)

  - Use-after-free errors exist in Events, Rendering, DOM,     and Web Workers. (CVE-2014-3190, CVE-2014-3191,     CVE-2014-3192, CVE-2014-3194)

  - A type confusion error exists in Session Management.
    (CVE-2014-3193)

  - Information leak vulnerabilities exist in the V8     JavaScript engine and the XSS Auditor.
    (CVE-2014-3195, CVE-2014-3197)

  - A security bypass vulnerability exists in the Windows     Sandbox. (CVE-2014-3196)

  - An error exists related to assertion of bindings in     the V8 JavaScript engine. (CVE-2014-3199)

  - Multiple unspecified vulnerabilities exist.
    (CVE-2014-3200)

The version of Google Chrome installed on the remote host is a version prior to 37.0.2062.94. It is, therefore, affected by the following vulnerabilities :

  - A flaw exists in V8 and IPC that can lead to remote code     execution. (CVE-2014-3188)

  - Out-of-bounds read errors exist in PDFium.
    (CVE-2014-3189, CVE-2014-3198)

  - Use-after-free errors exist in Events, Rendering, DOM,     and Web Workers. (CVE-2014-3190, CVE-2014-3191,     CVE-2014-3192, CVE-2014-3194)

  - A type confusion error exists in Session Management.
    (CVE-2014-3193)

  - Information leak vulnerabilities exist in the V8     JavaScript engine and the XSS Auditor.
    (CVE-2014-3195, CVE-2014-3197)

  - A security bypass vulnerability exists in the Windows     Sandbox. (CVE-2014-3196)

  - An error exists related to assertion of bindings in     the V8 JavaScript engine. (CVE-2014-3199)

  - Multiple unspecified vulnerabilities exist.
    (CVE-2014-3200)

  - Multiple vulnerabilities in V8 exist.

ID	Name	Product	Family	Severity
79267	openSUSE Security Update : chromium (openSUSE-SU-2014:1378-1)	Nessus	SuSE Local Security Checks	critical
78104	FreeBSD : chromium -- multiple vulnerabilities (d2bbcc01-4ec3-11e4-ab3f-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	critical
78081	Google Chrome < 38.0.2125.101 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
78080	Google Chrome < 38.0.2125.101 Multiple Vulnerabilities	Nessus	Windows	critical

Detections

Analytics

CVE-2014-3196

critical

Tenable Plugins

critical

critical

critical

critical