The remote host is affected by the vulnerability described in GLSA-201309-16 (Chromium, V8: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and V8. Please       review the CVE identifiers and release notes referenced below for       details.
  Impact :

    A context-dependent attacker could entice a user to open a specially       crafted website or JavaScript program using Chromium or V8, possibly       resulting in the execution of arbitrary code with the privileges of the       process or a Denial of Service condition. Furthermore, a remote attacker       may be able to bypass security restrictions or have other, unspecified,       impact.
  Workaround :

    There is no known workaround at this time.

Google Chrome Releases reports :

[235638] High CVE-2013-2837: Use-after-free in SVG. Credit to Slawomir Blazek.

[235311] Medium CVE-2013-2838: Out-of-bounds read in v8. Credit to Christian Holler.

[230176] High CVE-2013-2839: Bad cast in clipboard handling. Credit to Jon of MWR InfoSecurity.

[230117] High CVE-2013-2840: Use-after-free in media loader. Credit to Nils of MWR InfoSecurity.

[227350] High CVE-2013-2841: Use-after-free in Pepper resource handling. Credit to Chamal de Silva.

[226696] High CVE-2013-2842: Use-after-free in widget handling. Credit to Cyril Cattiaux.

[222000] High CVE-2013-2843: Use-after-free in speech handling. Credit to Khalil Zhani.

[196393] High CVE-2013-2844: Use-after-free in style resolution.
Credit to Sachin Shinde (@cons0ul).

[188092] [179522] [222136] [188092] High CVE-2013-2845: Memory safety issues in Web Audio. Credit to Atte Kettunen of OUSPG.

[177620] High CVE-2013-2846: Use-after-free in media loader. Credit to Chamal de Silva.

[176692] High CVE-2013-2847: Use-after-free race condition with workers. Credit to Collin Payne.

[176137] Medium CVE-2013-2848: Possible data extraction with XSS Auditor. Credit to Egor Homakov.

[171392] Low CVE-2013-2849: Possible XSS with drag+drop or copy+paste.
Credit to Mario Heiderich.

[241595] High CVE-2013-2836: Various fixes from internal audits, fuzzing and other initiatives.

The version of Apple Safari installed on the remote Mac OS X 10.7 or 10.8 host is earlier than 6.1. It is, therefore, potentially affected by several issues :

  - A bounds-checking issue exists related to handling XML     files. (CVE-2013-1036)

  - Multiple memory corruption vulnerabilities exist in     WebKit that could lead to unexpected program termination     or arbitrary code execution. (CVE-2013-1037,     CVE-2013-1038, CVE-2013-1039, CVE-2013-1040,     CVE-2013-1041, CVE-2013-1042, CVE-2013-1043,     CVE-2013-1044, CVE-2013-1045, CVE-2013-1046,     CVE-2013-1047, CVE-2013-2842, CVE-2013-5125,     CVE-2013-5126, CVE-2013-5127, CVE-2013-5128)

  - An error exists related to URL handling that could lead     to information disclosure. (CVE-2013-2848)

  - A cross-site scripting issue exists in WebKit's handling     of URLs and drag-and-drop operations. (CVE-2013-5129,     CVE-2013-5131)

  - Using 'Web Inspector' could negate 'Private Browsing'     protections leading to information disclosure.
    (CVE-2013-5130)

  - An error exists related to the 'Reopen All Windows     from Last Session' feature that could allow a local     attacker to obtain plaintext user ID and password     information from the 'LastSession.plist' file.
    (CVE-2013-7127)

The version of Google Chrome installed on the remote host is a version prior to 27.0.1453.93 and is, therefore, affected by the following vulnerabilities :

  - Use-after-free errors exist in SVG, media loader,     Pepper resource handling, widget handling, speech     handling, style resolution, media loader, and related to     race condition with workers.  (CVE-2013-2837,     CVE-2013-2840, CVE-2013-2841, CVE-2013-2842,     CVE-2013-2843, CVE-2013-2844, CVE-2013-2846,     CVE-2013-2847)

  - An out-of-bounds read error exists in v8.
    (CVE-2013-2838)

  - A memory corruption vulnerability exists related to     a bad casting in clipboard handling.  (CVE-2013-2839)

  - A memory safety issue exists related to Web Audio.
    (CVE-2013-2845)

  - An information disclosure vulnerability exists related     to XSS Auditor.  (CVE-2013-2848)

  - A cross-site scripting vulnerability exists related to     drag and drop or copy and paste.  (CVE-2013-2849)

Several vulnerabilities have been discovered in the Chromium web browser. Multiple use-after-free, out-of-bounds read, memory safety, and cross-site scripting issues were discovered and corrected.

  - CVE-2013-2837     Use-after-free vulnerability in the SVG implementation     allows remote attackers to cause a denial of service or     possibly have unspecified other impact via unknown     vectors.

  - CVE-2013-2838     Google V8, as used in Chromium before 27.0.1453.93,     allows remote attackers to cause a denial of service     (out-of-bounds read) via unspecified vectors.

  - CVE-2013-2839     Chromium before 27.0.1453.93 does not properly perform a     cast of an unspecified variable during handling of     clipboard data, which allows remote attackers to cause a     denial of service or possibly have other impact via     unknown vectors.

  - CVE-2013-2840     Use-after-free vulnerability in the media loader in     Chromium before 27.0.1453.93 allows remote attackers to     cause a denial of service or possibly have unspecified     other impact via unknown vectors, a different     vulnerability than CVE-2013-2846.

  - CVE-2013-2841     Use-after-free vulnerability in Chromium before     27.0.1453.93 allows remote attackers to cause a denial     of service or possibly have unspecified other impact via     vectors related to the handling of Pepper resources.

  - CVE-2013-2842     Use-after-free vulnerability in Chromium before     27.0.1453.93 allows remote attackers to cause a denial     of service or possibly have unspecified other impact via     vectors related to the handling of widgets.

  - CVE-2013-2843     Use-after-free vulnerability in Chromium before     27.0.1453.93 allows remote attackers to cause a denial     of service or possibly have unspecified other impact via     vectors related to the handling of speech data.

  - CVE-2013-2844     Use-after-free vulnerability in the Cascading Style     Sheets (CSS) implementation in Chromium before     27.0.1453.93 allows remote attackers to cause a denial     of service or possibly have unspecified other impact via     vectors related to style resolution.

  - CVE-2013-2845     The Web Audio implementation in Chromium before     27.0.1453.93 allows remote attackers to cause a denial     of service (memory corruption) or possibly have     unspecified other impact via unknown vectors.

  - CVE-2013-2846     Use-after-free vulnerability in the media loader in     Chromium before 27.0.1453.93 allows remote attackers to     cause a denial of service or possibly have unspecified     other impact via unknown vectors, a different     vulnerability than CVE-2013-2840.

  - CVE-2013-2847     Race condition in the workers implementation in Chromium     before 27.0.1453.93 allows remote attackers to cause a     denial of service (use-after-free and application crash)     or possibly have unspecified other impact via unknown     vectors.

  - CVE-2013-2848     The XSS Auditor in Chromium before 27.0.1453.93 might     allow remote attackers to obtain sensitive information     via unspecified vectors.

  - CVE-2013-2849     Multiple cross-site scripting (XSS) vulnerabilities in     Chromium before 27.0.1453.93 allow user-assisted remote     attackers to inject arbitrary web script or HTML via     vectors involving a (1) drag-and-drop or (2)     copy-and-paste operation.

The mobile device is running a version of iOS that is older than version 7.  This version contains security-related fixes for the following components :

  - Certificate Trust Policy
  - CoreGraphics
  - CoreMedia
  - Data Protection
  - Data Security
  - dyld
  - File Systems
  - ImageIO
  - IOKit
  - IOKitUser
  - IOSerialFamily
  - IPSec
  - Kernel
  - Kext Management
  - libxml
  - libxslt
  - Passcode Lock
  - Personal Hotspot
  - Push Notifications
  - Safari
  - Sandbox
  - Social
  - Springboard
  - Telephony
  - Twitter
  - WebKit

The remote host has Safari installed. Versions of Safari earlier than 6.1 are reportedly affected by the following vulnerabilities :

  - A bounds-checking issue exists related to handling XML files. (CVE-2013-1036)
 - Multiple memory corruption vulnerabilities exist in WebKit that could lead to unexpected program termination or arbitrary code execution. (CVE-2013-1037, CVE-2013-1038, CVE-2013-1039, CVE-2013-1040, CVE-2013-1041, CVE-2013-1042, CVE-2013-1043, CVE-2013-1044, CVE-2013-1045, CVE-2013-1046, CVE-2013-1047, CVE-2013-2842, CVE-2013-5125, CVE-2013-5126, CVE-2013-5127, CVE-2013-5128)
 - An error exists related to URL handling that could lead to information disclosure. (CVE-2013-2848)
 - A cross-site scripting issue exists in WebKit's handling of URLs and drag-and-drop operations. (CVE-2013-5129, CVE-2013-5131)
 - Using 'Web Inspector' could negate 'Private Browsing' protections leading to information disclosure. (CVE-2013-5130)

According to its banner, the remote Apple iOS device is missing a security update.  Versions of Apple iOS older than 7.0 are affected by vulnerabilities within the following components :

 - Certificate Trust Policy
 - CoreGraphics
 - CoreMedia
 - Data Protection
 - Data Security
 - File Systems
 - IOKit
 - IOKitUser
 - IOSerialFamily
 - IPSec
 - ImageIO
 - Kernel
 - Kext Management
 - Passcode Lock
 - Personal Hotspot
 - Push Notifications
 - Safari
 - Sandbox
 - Social
 - Springboard
 - Telephony
 - Twitter
 - WebKit
 - dyld
 - libxml
 - libxslt

Versions of Google Chrome prior to 27.0.1453.93 are affected by the following vulnerabilities :

  - Use-after-free errors exist in SVG, media loader, Pepper resource handling, widget handling, speech handling, style resolution, media loader, and related to race condition with workers.  (CVE-2013-2837, CVE-2013-2840, CVE-2013-2841, CVE-2013-2842, CVE-2013-2843, CVE-2013-2844, CVE-2013-2846, CVE-2013-2847)

  - An out-of-bounds read error exists in v8. (CVE-2013-2838)

  - A memory corruption vulnerability exists related to a bad casting in clipboard handling.  (CVE-2013-2839)

  - A memory safety issue exists related to Web Audio. (CVE-2013-2845)

  - An information disclosure vulnerability exists related to XSS Auditor.  (CVE-2013-2848)

  - A cross-site scripting vulnerability exists related to drag and drop or copy and paste. (CVE-2013-2849)

ID	Name	Product	Family	Published	Updated	Severity
70112	GLSA-201309-16 : Chromium, V8: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	9/25/2013	1/6/2021	critical
66549	FreeBSD : chromium -- multiple vulnerabilities (358133b5-c2b9-11e2-a738-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	5/23/2013	1/6/2021	high
70563	Mac OS X : Apple Safari < 6.1 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	10/23/2013	11/27/2019	high
66556	Google Chrome < 27.0.1453.93 Multiple Vulnerabilities	Nessus	Windows	5/23/2013	4/11/2022	high
66676	Debian DSA-2695-1 : chromium-browser - several issues	Nessus	Debian Local Security Checks	5/30/2013	1/11/2021	high
69984	Apple iOS < 7 Multiple Vulnerabilities	Nessus	Mobile Devices	9/19/2013	9/4/2024	high
8048	Safari < 6.1 Multiple Security Vulnerabilities	Nessus Network Monitor	Web Clients	11/11/2013	3/6/2019	medium
8013	Apple iOS < 7.0 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	9/20/2011	3/6/2019	critical
800944	Google Chrome < 27.0.1453.93 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	5/23/2013		high
800797	Google Chrome < 27.0.1453.93 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	5/23/2013		high

Detections

Analytics

Plugins Search

critical

high

high

high

high

high

medium

critical

high

high