Detections
Analytics
Google Chrome < 34.0.1847.116 Multiple Vulnerabilities
critical Nessus Plugin ID 73419
Language:
Synopsis
The remote host contains a web browser that is affected by multiple vulnerabilities.Description
The version of Google Chrome installed on the remote host is a version prior to 34.0.1847.116. It is, therefore, affected by the following vulnerabilities :- A use-after-free error exists in the included Flash version that could lead to arbitrary code execution.
(CVE-2014-0506)
- A buffer overflow error exists in the included Flash version that could lead to arbitrary code execution.
(CVE-2014-0507)
- An unspecified error exists in the included Flash version that could allow a security bypass leading to information disclosure. (CVE-2014-0508)
- An unspecified error exists in the included Flash version that could allow cross-site scripting attacks.
(CVE-2014-0509)
- An unspecified flaw exists related to IPC message injection that allows an unauthenticated, remote attacker to bypass sandbox restrictions. (CVE-2014-1709)
- An input validation error exists that could allow universal cross-site scripting (UXSS) attacks.
(CVE-2014-1716)
- An unspecified out-of-bounds access error exists related to the V8 JavaScript engine. (CVE-2014-1717)
- An integer overflow error exists related to the compositor. (CVE-2014-1718)
- Use-after-free errors exist related to web workers, DOM processing, rendering, speech handling and forms handling. (CVE-2014-1719, CVE-2014-1720, CVE-2014-1722, CVE-2014-1724, CVE-2014-1727)
- An unspecified memory corruption error exists related to the V8 JavaScript engine. (CVE-2014-1721)
- An URL confusion error exists related to handling RTL characters. (CVE-2014-1723)
- An out-of-bounds read error exists related to handling 'window property' processing. (CVE-2014-1725)
- An unspecified error exists that could allow local cross-origin bypasses. (CVE-2014-1726)
- Various, unspecified memory handling errors exist.
(CVE-2014-1728)
- Various, unspecified errors exist related to the V8 JavaScript engine. (CVE-2014-1729)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to Google Chrome 34.0.1847.116 or later.See Also
Plugin Details
Severity: Critical
ID: 73419
File Name: google_chrome_34_0_1847_116.nasl
Version: 1.16
Type: local
Agent: windows
Family: Windows
Published: 4/8/2014
Updated: 4/7/2022
Configuration: Enable thorough checks
Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: High
Score: 8.9
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 7.4
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2014-0506
Vulnerability Information
CPE: cpe:/a:google:chrome
Required KB Items: SMB/Google_Chrome/Installed
Exploit Ease: No known exploits are available
Patch Publication Date: 4/8/2014
Vulnerability Publication Date: 4/8/2014
Reference Information
CVE: CVE-2014-0506, CVE-2014-0507, CVE-2014-0508, CVE-2014-0509, CVE-2014-1709, CVE-2014-1716, CVE-2014-1717, CVE-2014-1718, CVE-2014-1719, CVE-2014-1720, CVE-2014-1721, CVE-2014-1722, CVE-2014-1723, CVE-2014-1724, CVE-2014-1725, CVE-2014-1726, CVE-2014-1727, CVE-2014-1728, CVE-2014-1729
BID: 66704