Google Chrome Releases reports :

159 security fixes in this release, including 113 found using MemorySanitizer :

- [416449] Critical CVE-2014-3188: A special thanks to Juri Aedla for a combination of V8 and IPC bugs that can lead to remote code execution outside of the sandbox.

- [398384] High CVE-2014-3189: Out-of-bounds read in PDFium. Credit to cloudfuzzer.

- [400476] High CVE-2014-3190: Use-after-free in Events. Credit to cloudfuzzer.

- [402407] High CVE-2014-3191: Use-after-free in Rendering. Credit to cloudfuzzer.

- [403276] High CVE-2014-3192: Use-after-free in DOM. Credit to cloudfuzzer.

- [399655] High CVE-2014-3193: Type confusion in Session Management.
Credit to miaubiz.

- [401115] High CVE-2014-3194: Use-after-free in Web Workers. Credit to Collin Payne.

- [403409] Medium CVE-2014-3195: Information Leak in V8. Credit to Juri Aedla.

- [338538] Medium CVE-2014-3196: Permissions bypass in Windows Sandbox. Credit to James Forshaw.

- [396544] Medium CVE-2014-3197: Information Leak in XSS Auditor.
Credit to Takeshi Terada.

- [415307] Medium CVE-2014-3198: Out-of-bounds read in PDFium. Credit to Atte Kettunen of OUSPG.

- [395411] Low CVE-2014-3199: Release Assert in V8 bindings. Credit to Collin Payne.

- [420899] CVE-2014-3200: Various fixes from internal audits, fuzzing and other initiatives (Chrome 38).

- Multiple vulnerabilities in V8 fixed at the tip of the 3.28 branch (currently 3.28.71.15).

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2345-1 advisory.

    Multiple use-after-free issues were discovered in Blink. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit these to cause a denial of service via renderer     crash, or execute arbitrary code with the privileges of the sandboxed render process. (CVE-2014-3178,     CVE-2014-3190, CVE-2014-3191, CVE-2014-3192)

    Multiple security issues were discovered in Chromium. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial     of service via application crash or execute arbitrary code with the privileges of the user invoking the     program. (CVE-2014-3179, CVE-2014-3200)

    It was discovered that Chromium did not properly handle the interaction of IPC and V8. If a user were     tricked in to opening a specially crafted website, an attacker could potentially exploit this to execute     arbitrary code with the privileges of the user invoking the program. (CVE-2014-3188)

    A use-after-free was discovered in the web workers implementation in Chromium. If a user were tricked in     to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of     service via applicatin crash or execute arbitrary code with the privileges of the user invoking the     program. (CVE-2014-3194)

    It was discovered that V8 did not correctly handle Javascript heap allocations in some circumstances. If a     user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to     steal sensitive information. (CVE-2014-3195)

    It was discovered that Blink did not properly provide substitute data for pages blocked by the XSS     auditor. If a user were tricked in to opening a specially crafter website, an attacker could potentially     exploit this to steal sensitive information. (CVE-2014-3197)

    It was discovered that the wrap function for Event's in the V8 bindings in Blink produced an erroneous     result in some circumstances. If a user were tricked in to opening a specially crafted website, an     attacker could potentially exploit this to cause a denial of service by stopping a worker process that was     handling an Event object. (CVE-2014-3199)

    Multiple security issues were discovered in V8. If a user were tricked in to opening a specially crafted     website, an attacker could potentially exploit these to read uninitialized memory, cause a denial of     service via renderer crash or execute arbitrary code with the privileges of the sandboxed render process.
    (CVE-2014-7967)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- Update to Chromium 38.0.2125.101 This update includes     159 security fixes, including 113 relatively minor     fixes. Highlighted securtiy fixes are: CVE-2014-3188: A     combination of V8 and IPC bugs that can lead to remote     code execution outside of the sandbox CVE-2014-3189:
    Out-of-bounds read in PDFium CVE-2014-3190:
    Use-after-free in Events CVE-2014-3191: Use-after-free     in Rendering CVE-2014-3192: Use-after-free in DOM     CVE-2014-3193: Type confusion in Session Management     CVE-2014-3194: Use-after-free in Web Workers     CVE-2014-3195: Information Leak in V8 CVE-2014-3196:
    Permissions bypass in Windows Sandbox CVE-2014-3197:
    Information Leak in XSS Auditor CVE-2014-3198:
    Out-of-bounds read in PDFium CVE-2014-3199: Release     Assert in V8 bindings CVE-2014-3200: Various fixes from     internal audits, fuzzing and other initiatives

  - Drop the build of the Native Client. This is actually     not a build as that prebuild binaries are being shipped.
    Also Google no longer provides prebuild binaries for the     NativeClient for 32bit. Chromium as webbrowser is not     affected by this and it bring Chromium inline with the     regulations that prebuild binaries should not be     shipped.

  - toolchaing_linux tarball dropped

  - Spec-file cleaned for NaCl stuff

  - Added patch no-clang-on-packman.diff to prevent the     usage of clang on packman, which is not supported there

The version of Google Chrome installed on the remote host is a version prior to 37.0.2062.94. It is, therefore, affected by the following vulnerabilities :

  - A flaw exists in V8 and IPC that can lead to remote code     execution. (CVE-2014-3188)

  - Out-of-bounds read errors exist in PDFium.
    (CVE-2014-3189, CVE-2014-3198)

  - Use-after-free errors exist in Events, Rendering, DOM,     and Web Workers. (CVE-2014-3190, CVE-2014-3191,     CVE-2014-3192, CVE-2014-3194)

  - A type confusion error exists in Session Management.
    (CVE-2014-3193)

  - Information leak vulnerabilities exist in the V8     JavaScript engine and the XSS Auditor.
    (CVE-2014-3195, CVE-2014-3197)

  - A security bypass vulnerability exists in the Windows     Sandbox. (CVE-2014-3196)

  - An error exists related to assertion of bindings in     the V8 JavaScript engine. (CVE-2014-3199)

  - Multiple unspecified vulnerabilities exist.
    (CVE-2014-3200)

  - Multiple vulnerabilities in V8 exist.

The version of Google Chrome installed on the remote Mac OS X host is a version prior to 37.0.2062.94. It is, therefore, affected by the following vulnerabilities :

  - A flaw exists in V8 and IPC that can lead to remote code     execution. (CVE-2014-3188)

  - Out-of-bounds read errors exist in PDFium.
    (CVE-2014-3189, CVE-2014-3198)

  - Use-after-free errors exist in Events, Rendering, DOM,     and Web Workers. (CVE-2014-3190, CVE-2014-3191,     CVE-2014-3192, CVE-2014-3194)

  - A type confusion error exists in Session Management.
    (CVE-2014-3193)

  - Information leak vulnerabilities exist in the V8     JavaScript engine and the XSS Auditor.
    (CVE-2014-3195, CVE-2014-3197)

  - A security bypass vulnerability exists in the Windows     Sandbox. (CVE-2014-3196)

  - An error exists related to assertion of bindings in     the V8 JavaScript engine. (CVE-2014-3199)

  - Multiple unspecified vulnerabilities exist.
    (CVE-2014-3200)

The remote host is affected by the vulnerability described in GLSA-201412-13 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to execute arbitrary code with the       privileges of the process or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Updated chromium-browser packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Chromium is an open source web browser, powered by WebKit (Blink).

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash or, potentially, execute arbitrary code with the privileges of the user running Chromium. (CVE-2014-3188, CVE-2014-3189, CVE-2014-3190, CVE-2014-3191, CVE-2014-3192, CVE-2014-3193, CVE-2014-3194, CVE-2014-3199, CVE-2014-3200)

Several information leak flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to disclose potentially sensitive information.
(CVE-2014-3195, CVE-2014-3197, CVE-2014-3198)

All Chromium users should upgrade to these updated packages, which contain Chromium version 38.0.2125.101, which corrects these issues.
After installing the update, Chromium must be restarted for the changes to take effect.

ID	Name	Product	Family	Published	Updated	Severity
78104	FreeBSD : chromium -- multiple vulnerabilities (d2bbcc01-4ec3-11e4-ab3f-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	10/9/2014	1/6/2021	critical
78465	Ubuntu 14.04 LTS : Oxide vulnerabilities (USN-2345-1)	Nessus	Ubuntu Local Security Checks	10/15/2014	8/28/2024	high
79267	openSUSE Security Update : chromium (openSUSE-SU-2014:1378-1)	Nessus	SuSE Local Security Checks	11/17/2014	1/19/2021	critical
78080	Google Chrome < 38.0.2125.101 Multiple Vulnerabilities	Nessus	Windows	10/7/2014	4/11/2022	critical
78081	Google Chrome < 38.0.2125.101 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	10/7/2014	11/25/2019	critical
79966	GLSA-201412-13 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	12/15/2014	1/6/2021	critical
78415	RHEL 6 : chromium-browser (RHSA-2014:1626)	Nessus	Red Hat Local Security Checks	10/14/2014	1/14/2021	critical

Detections

Analytics

Plugins Search

critical

high

critical

critical

critical

critical

critical