Google Chrome Releases reports :

A special reward for Andrey Labunets for his combination of CVE-2013-2879 and CVE-2013-2868 along with some (since fixed) server-side bugs.

[252216] Low CVE-2013-2867: Block pop-unders in various scenarios.

[252062] High CVE-2013-2879: Confusion setting up sign-in and sync.
Credit to Andrey Labunets.

[252034] Medium CVE-2013-2868: Incorrect sync of NPAPI extension component. Credit to Andrey Labunets.

[245153] Medium CVE-2013-2869: Out-of-bounds read in JPEG2000 handling. Credit to Felix Groebert of Google Security Team.

[244746] [242762] Critical CVE-2013-2870: Use-after-free with network sockets. Credit to Collin Payne.

[244260] Medium CVE-2013-2853: Man-in-the-middle attack against HTTP in SSL. Credit to Antoine Delignat-Lavaud and Karthikeyan Bhargavan from Prosecco at INRIA Paris.

[243991] [243818] High CVE-2013-2871: Use-after-free in input handling. Credit to miaubiz.

[Mac only] [242702] Low CVE-2013-2872: Possible lack of entropy in renderers. Credit to Eric Rescorla.

[241139] High CVE-2013-2873: Use-after-free in resource loading.
Credit to miaubiz.

[233848] Medium CVE-2013-2875: Out-of-bounds-read in SVG. Credit to miaubiz.

[229504] Medium CVE-2013-2876: Extensions permissions confusion with interstitials. Credit to Dev Akhawe.

[229019] Low CVE-2013-2877: Out-of-bounds read in XML parsing. Credit to Aki Helin of OUSPG.

[196636] None: Remove the 'viewsource' attribute on iframes. Credit to Collin Jackson.

[177197] Medium CVE-2013-2878: Out-of-bounds read in text handling.
Credit to Atte Kettunen of OUSPG.

Several vulnerabilities have been discovered in the Chromium web browser.

  - CVE-2013-2853     The HTTPS implementation does not ensure that headers     are terminated by \r\n\r\n (carriage return, newline,     carriage return, newline).

  - CVE-2013-2867     Chrome does not properly prevent pop-under windows.

  - CVE-2013-2868     common/extensions/sync_helper.cc proceeds with sync     operations for NPAPI extensions without checking for a     certain plugin permission setting.

  - CVE-2013-2869     Denial of service (out-of-bounds read) via a crafted     JPEG2000 image.

  - CVE-2013-2870     Use-after-free vulnerability in network sockets.

  - CVE-2013-2871     Use-after-free vulnerability in input handling.

  - CVE-2013-2873     Use-after-free vulnerability in resource loading.

  - CVE-2013-2875     Out-of-bounds read in SVG file handling.

  - CVE-2013-2876     Chromium does not properly enforce restrictions on the     capture of screenshots by extensions, which could lead     to information disclosure from previous page visits.

  - CVE-2013-2877     Out-of-bounds read in XML file handling.

  - CVE-2013-2878     Out-of-bounds read in text handling.

  - CVE-2013-2879     The circumstances in which a renderer process can be     considered a trusted process for sign-in and subsequent     sync operations were not propertly checked.

  - CVE-2013-2880     The Chromium 28 development team found various issues     from internal fuzzing, audits, and other studies.

The version of Google Chrome installed on the remote host is a version prior to 28.0.1500.71 and is, therefore, affected by multiple vulnerabilities :

  - A vulnerability exists that exposes HTTP in SSL to a     man-in-the-middle attack. (CVE-2013-2853)

  - Block pop-unders in various scenarios. (CVE-2013-2867)

  - An error exists related to an incorrect sync of the     NPAPI extension component. (CVE-2013-2868)

  - An unspecified flaw exists due to a lack of entropy in     renderers. (CVE-2013-2872)

  - Use-after-free errors exist related to network sockets,     input handling, and resource loading. (CVE-2013-2870,     CVE-2013-2871, CVE-2013-2873)

  - A screen data leak error exists related to GL textures.
    (CVE-2013-2874)

  - An extension permission error exists related to     interstitials.  (CVE-2013-2876)

  - Multiple out-of-bounds errors exist related to JPEG2000,     SVG, text handling and XML parsing.  (CVE-2013-2869,     CVE-2013-2875, CVE-2013-2877, CVE-2013-2878)

  - An unspecified error exists when setting up sign-in and     sync. (CVE-2013-2879)

  - The vendor reports various, unspecified errors exist.
    (CVE-2013-2880)

Versions prior to Google Chrome 28.0.1500.71 are potentially affected by the multiple vulnerabilities, the more serious of which are as follows:

  - Several remote code execution vulnerabilities exist due to use-after-free errors in multiple areas. A remote attacker can leverage this to execute arbitrary code in the context of the application. (CVE-2013-2870, CVE-2013-2871, CVE-2013-2873, CVE-2013-2879)

  - Memory corruption vulnerabilities exist which may be exploitable to induce arbitrary code execution. (CVE-2013-2869, CVE-2013-2878, CVE-2013-2875)

  - Information disclosure vulnerabilities exist that may be exploited by remote attackers to obtain information that can aid in further attacks. (CVE-2013-2853, CVE-2013-2874)

  - A security bypass vulnerability exists due to confusion in extensions permissions, which a remote attacker could exploit to bypass intended security restrictions to perform unauthorized actions. (CVE-2013-2876)

ID	Name	Product	Family	Published	Updated	Severity
67237	FreeBSD : chromium -- multiple vulnerabilities (3b80104f-e96c-11e2-8bac-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	7/11/2013	1/6/2021	high
68970	Debian DSA-2724-1 : chromium-browser - several vulnerabilities	Nessus	Debian Local Security Checks	7/19/2013	1/11/2021	high
67232	Google Chrome < 28.0.1500.71 Multiple Vulnerabilities	Nessus	Windows	7/10/2013	4/11/2022	high
801411	Google Chrome < 28.0.1500.71 Multiple Security Vulnerabilities	Log Correlation Engine	Web Clients	7/11/2013		high

Detections

Analytics

Plugins Search

high

high

high

high