Debian DSA-2905-1 : chromium-browser - security update

high Nessus Plugin ID 73581

Language:

Synopsis

The remote Debian host is missing a security-related update.

Description

Several vulnerabilities were discovered in the chromium web browser.

- CVE-2014-1716 A cross-site scripting issue was discovered in the v8 JavaScript library.

- CVE-2014-1717 An out-of-bounds read issue was discovered in the v8 JavaScript library.

- CVE-2014-1718 Aaron Staple discovered an integer overflow issue in chromium's software compositor.

- CVE-2014-1719 Colin Payne discovered a use-after-free issue in the web workers implementation.

- CVE-2014-1720 cloudfuzzer discovered a use-after-free issue in the Blink/Webkit document object model implementation.

- CVE-2014-1721 Christian Holler discovered a memory corruption issue in the v8 JavaScript library.

- CVE-2014-1722 miaubiz discovered a use-after-free issue in block rendering.

- CVE-2014-1723 George McBay discovered a url spoofing issue.

- CVE-2014-1724 Atte Kettunen discovered a use-after-free issue in freebsoft's libspeechd library.

Because of this issue, the text-to-speech feature is now disabled by default ('--enable-speech-dispatcher' at the command-line can re-enable it).

- CVE-2014-1725 An out-of-bounds read was discovered in the base64 implementation.

- CVE-2014-1726 Jann Horn discovered a way to bypass the same origin policy.

- CVE-2014-1727 Khalil Zhani discovered a use-after-free issue in the web color chooser implementation.

- CVE-2014-1728 The Google Chrome development team discovered and fixed multiple issues with potential security impact.

- CVE-2014-1729 The Google Chrome development team discovered and fixed multiple issues in version 3.24.35.22 of the v8 JavaScript library.

Solution

Upgrade the chromium-browser packages.

For the stable distribution (wheezy), these problems have been fixed in version 34.0.1847.116-1~deb7u1.

Plugin Details

Severity: High

ID: 73581

File Name: debian_DSA-2905.nasl

Version: 1.9

Type: local

Agent: unix

Family: Debian Local Security Checks

Published: 4/17/2014

Updated: 1/11/2021

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: High

Score: 8.9

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:chromium-browser, cpe:/o:debian:debian_linux:7.0

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Ease: No known exploits are available

Patch Publication Date: 4/15/2014

Reference Information

CVE: CVE-2014-1716, CVE-2014-1717, CVE-2014-1718, CVE-2014-1719, CVE-2014-1720, CVE-2014-1721, CVE-2014-1722, CVE-2014-1723, CVE-2014-1724, CVE-2014-1725, CVE-2014-1726, CVE-2014-1727, CVE-2014-1728, CVE-2014-1729

BID: 66704

DSA: 2905

Detections

Analytics