Google Chrome before 39.0.2171.65 on Android does not prevent navigation to a URL in cases where an intent for the URL lacks CATEGORY_BROWSABLE, which allows remote attackers to bypass intended access restrictions via a crafted web site.

chromium was updated to version 39.0.2171.65 to fix 13 security issues.

These security issues were fixed :

  - Use-after-free in pepper plugins (CVE-2014-7906).

  - Buffer overflow in OpenJPEG before r2911 in PDFium, as     used in Google Chromebefore 39.0.2171.65, al...
    (CVE-2014-7903).

  - Uninitialized memory read in Skia (CVE-2014-7909).

  - Unspecified security issues (CVE-2014-7910).

  - Integer overflow in media (CVE-2014-7908).

  - Integer overflow in the opj_t2_read_packet_data function     infxcodec/fx_libopenjpeg/libopenjpeg20/t2....
    (CVE-2014-7901).

  - Use-after-free in blink (CVE-2014-7907).

  - Address bar spoofing (CVE-2014-7899).

  - Buffer overflow in Skia (CVE-2014-7904).

  - Use-after-free vulnerability in the CPDF_Parser     (CVE-2014-7900).

  - Use-after-free vulnerability in PDFium allows DoS     (CVE-2014-7902).

  - Flaw allowing navigation to intents that do not have the     BROWSABLE category (CVE-2014-7905).

  - Double-free in Flash (CVE-2014-0574).

Google Chrome Releases reports :

42 security fixes in this release, including :

- [389734] High CVE-2014-7899: Address bar spoofing. Credit to Eli Grey.

- [406868] High CVE-2014-7900: Use-after-free in pdfium. Credit to Atte Kettunen from OUSPG.

- [413375] High CVE-2014-7901: Integer overflow in pdfium. Credit to cloudfuzzer.

- [414504] High CVE-2014-7902: Use-after-free in pdfium. Credit to cloudfuzzer.

- [414525] High CVE-2014-7903: Buffer overflow in pdfium. Credit to cloudfuzzer.

- [418161] High CVE-2014-7904: Buffer overflow in Skia. Credit to Atte Kettunen from OUSPG.

- [421817] High CVE-2014-7905: Flaw allowing navigation to intents that do not have the BROWSABLE category. Credit to WangTao(neobyte) of Baidu X-Team.

- [423030] High CVE-2014-7906: Use-after-free in pepper plugins.
Credit to Chen Zhang (demi6od) of the NSFOCUS Security Team.

- [423703] High CVE-2014-0574: Double-free in Flash. Credit to biloulehibou.

- [424453] High CVE-2014-7907: Use-after-free in blink. Credit to Chen Zhang (demi6od) of the NSFOCUS Security Team.

- [425980] High CVE-2014-7908: Integer overflow in media. Credit to Christoph Diehl.

- [391001] Medium CVE-2014-7909: Uninitialized memory read in Skia.
Credit to miaubiz.

- CVE-2014-7910: Various fixes from internal audits, fuzzing and other initiatives.

ID	Name	Product	Family	Severity
79997	openSUSE Security Update : chromium (openSUSE-SU-2014:1626-1)	Nessus	SuSE Local Security Checks	critical
79320	FreeBSD : chromium -- multiple vulnerabilities (d395e44f-6f4f-11e4-a444-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2014-7905

high

Tenable Plugins

critical

critical