Vulnerabilities > CVE-2013-2904 - Resource Management Errors vulnerability in multiple products
Attack vector
UNKNOWN Attack complexity
UNKNOWN Privileges required
UNKNOWN Confidentiality impact
UNKNOWN Integrity impact
UNKNOWN Availability impact
UNKNOWN Summary
Use-after-free vulnerability in the Document::finishedParsing function in core/dom/Document.cpp in Blink, as used in Google Chrome before 29.0.1547.57, allows remote attackers to cause a denial of service or possibly have unspecified other impact via an onload event that changes an IFRAME element so that its src attribute is no longer an XML document, leading to unintended garbage collection of this document.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Nessus
NASL family Windows NASL id GOOGLE_CHROME_29_0_1547_57.NASL description The version of Google Chrome installed on the remote host is a version prior to 29.0.1547.57. It is, therefore, affected by multiple vulnerabilities : - Various unspecified errors exist. No further details have been provided. (CVE-2013-2887) - An input validation error exists related to incomplete paths and file handling. (CVE-2013-2900) - An integer overflow error exists related to last seen 2020-06-01 modified 2020-06-02 plugin id 69423 published 2013-08-20 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/69423 title Google Chrome < 29.0.1547.57 Multiple Vulnerabilities code # # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(69423); script_version("1.18"); script_cvs_date("Date: 2019/11/27"); script_cve_id( "CVE-2013-2887", "CVE-2013-2900", "CVE-2013-2901", "CVE-2013-2902", "CVE-2013-2903", "CVE-2013-2904", "CVE-2013-2905", "CVE-2013-6166" ); script_bugtraq_id( 58857, 61885, 61886, 61887, 61888, 61889, 61890, 61891 ); script_name(english:"Google Chrome < 29.0.1547.57 Multiple Vulnerabilities"); script_summary(english:"Checks version number of Google Chrome"); script_set_attribute(attribute:"synopsis", value: "The remote host contains a web browser that is affected by multiple vulnerabilities."); script_set_attribute(attribute:"description", value: "The version of Google Chrome installed on the remote host is a version prior to 29.0.1547.57. It is, therefore, affected by multiple vulnerabilities : - Various unspecified errors exist. No further details have been provided. (CVE-2013-2887) - An input validation error exists related to incomplete paths and file handling. (CVE-2013-2900) - An integer overflow error exists related to 'ANGLE'. (CVE-2013-2901) - Use-after-free errors exist related to 'XSLT', the 'media' element and document parsing. (CVE-2013-2902, CVE-2013-2903, CVE-2013-2904) - An error exists related to shared memory files that could lead to the disclosure of sensitive information. (CVE-2013-2905) - An error exists related to HTTP Cookie headers and validation that could allow denial of service attacks. (CVE-2013-6166)"); # http://googlechromereleases.blogspot.com/2013/08/stable-channel-update.html script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?51dcd991"); script_set_attribute(attribute:"see_also", value:"https://seclists.org/oss-sec/2013/q4/121"); script_set_attribute(attribute:"solution", value: "Upgrade to Google Chrome 29.0.1547.57 or later."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2013-2904"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"vuln_publication_date", value:"2013/08/20"); script_set_attribute(attribute:"patch_publication_date", value:"2013/08/20"); script_set_attribute(attribute:"plugin_publication_date", value:"2013/08/20"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/a:google:chrome"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"Windows"); script_copyright(english:"This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("google_chrome_installed.nasl"); script_require_keys("SMB/Google_Chrome/Installed"); exit(0); } include("google_chrome_version.inc"); get_kb_item_or_exit("SMB/Google_Chrome/Installed"); installs = get_kb_list("SMB/Google_Chrome/*"); google_chrome_check_version(installs:installs, fix:'29.0.1547.57', severity:SECURITY_HOLE);
NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_AE651A4B0A4211E3BA5200262D5ED8EE.NASL description Google Chrome Releases reports : 25 security fixes in this release, including : - [181617] High CVE-2013-2900: Incomplete path sanitization in file handling. Credit to Krystian Bigaj. - [254159] Low CVE-2013-2905: Information leak via overly broad permissions on shared memory files. Credit to Christian Jaeger. - [257363] High CVE-2013-2901: Integer overflow in ANGLE. Credit to Alex Chapman. - [260105] High CVE-2013-2902: Use after free in XSLT. Credit to cloudfuzzer. - [260156] High CVE-2013-2903: Use after free in media element. Credit to cloudfuzzer. - [260428] High CVE-2013-2904: Use after free in document parsing. Credit to cloudfuzzer. - [274602] CVE-2013-2887: Various fixes from internal audits, fuzzing and other initiatives (Chrome 29). last seen 2020-06-01 modified 2020-06-02 plugin id 69437 published 2013-08-22 reporter This script is Copyright (C) 2013 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/69437 title FreeBSD : chromium -- multiple vulnerabilities (ae651a4b-0a42-11e3-ba52-00262d5ed8ee) code # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from the FreeBSD VuXML database : # # Copyright 2003-2013 Jacques Vidrine and contributors # # Redistribution and use in source (VuXML) and 'compiled' forms (SGML, # HTML, PDF, PostScript, RTF and so forth) with or without modification, # are permitted provided that the following conditions are met: # 1. Redistributions of source code (VuXML) must retain the above # copyright notice, this list of conditions and the following # disclaimer as the first lines of this file unmodified. # 2. Redistributions in compiled form (transformed to other DTDs, # published online in any format, converted to PDF, PostScript, # RTF and other formats) must reproduce the above copyright # notice, this list of conditions and the following disclaimer # in the documentation and/or other materials provided with the # distribution. # # THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, # THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR # PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS # BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, # OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT # OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR # BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, # WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE # OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION, # EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. # include("compat.inc"); if (description) { script_id(69437); script_version("$Revision: 1.4 $"); script_cvs_date("$Date: 2013/10/13 02:36:38 $"); script_cve_id("CVE-2013-2887", "CVE-2013-2900", "CVE-2013-2901", "CVE-2013-2902", "CVE-2013-2903", "CVE-2013-2904", "CVE-2013-2905"); script_name(english:"FreeBSD : chromium -- multiple vulnerabilities (ae651a4b-0a42-11e3-ba52-00262d5ed8ee)"); script_summary(english:"Checks for updated package in pkg_info output"); script_set_attribute( attribute:"synopsis", value:"The remote FreeBSD host is missing a security-related update." ); script_set_attribute( attribute:"description", value: "Google Chrome Releases reports : 25 security fixes in this release, including : - [181617] High CVE-2013-2900: Incomplete path sanitization in file handling. Credit to Krystian Bigaj. - [254159] Low CVE-2013-2905: Information leak via overly broad permissions on shared memory files. Credit to Christian Jaeger. - [257363] High CVE-2013-2901: Integer overflow in ANGLE. Credit to Alex Chapman. - [260105] High CVE-2013-2902: Use after free in XSLT. Credit to cloudfuzzer. - [260156] High CVE-2013-2903: Use after free in media element. Credit to cloudfuzzer. - [260428] High CVE-2013-2904: Use after free in document parsing. Credit to cloudfuzzer. - [274602] CVE-2013-2887: Various fixes from internal audits, fuzzing and other initiatives (Chrome 29)." ); script_set_attribute( attribute:"see_also", value:"http://googlechromereleases.blogspot.nl/" ); # http://www.freebsd.org/ports/portaudit/ae651a4b-0a42-11e3-ba52-00262d5ed8ee.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?04c99fa7" ); script_set_attribute(attribute:"solution", value:"Update the affected package."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:chromium"); script_set_attribute(attribute:"cpe", value:"cpe:/o:freebsd:freebsd"); script_set_attribute(attribute:"vuln_publication_date", value:"2013/08/20"); script_set_attribute(attribute:"patch_publication_date", value:"2013/08/21"); script_set_attribute(attribute:"plugin_publication_date", value:"2013/08/22"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2013 Tenable Network Security, Inc."); script_family(english:"FreeBSD Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/FreeBSD/release", "Host/FreeBSD/pkg_info"); exit(0); } include("audit.inc"); include("freebsd_package.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/FreeBSD/release")) audit(AUDIT_OS_NOT, "FreeBSD"); if (!get_kb_item("Host/FreeBSD/pkg_info")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if (pkg_test(save_report:TRUE, pkg:"chromium<29.0.1547.57")) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:pkg_report_get()); else security_hole(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");
NASL family Debian Local Security Checks NASL id DEBIAN_DSA-2741.NASL description Several vulnerabilities have been discovered in the Chromium web browser. - CVE-2013-2887 The chrome 29 development team found various issues from internal fuzzing, audits, and other studies. - CVE-2013-2900 Krystian Bigaj discovered a file handling path sanitization issue. - CVE-2013-2901 Alex Chapman discovered an integer overflow issue in ANGLE, the Almost Native Graphics Layer. - CVE-2013-2902 cloudfuzzer discovered a use-after-free issue in XSLT. - CVE-2013-2903 cloudfuzzer discovered a use-after-free issue in HTMLMediaElement. - CVE-2013-2904 cloudfuzzer discovered a use-after-free issue in XML document parsing. - CVE-2013-2905 Christian Jaeger discovered an information leak due to insufficient file permissions. last seen 2020-03-17 modified 2013-08-26 plugin id 69470 published 2013-08-26 reporter This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/69470 title Debian DSA-2741-1 : chromium-browser - several vulnerabilities code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Debian Security Advisory DSA-2741. The text # itself is copyright (C) Software in the Public Interest, Inc. # include("compat.inc"); if (description) { script_id(69470); script_version("1.17"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12"); script_cve_id("CVE-2013-2887", "CVE-2013-2900", "CVE-2013-2901", "CVE-2013-2902", "CVE-2013-2903", "CVE-2013-2904", "CVE-2013-2905"); script_bugtraq_id(61885, 61886, 61887, 61888, 61889, 61890, 61891); script_xref(name:"DSA", value:"2741"); script_name(english:"Debian DSA-2741-1 : chromium-browser - several vulnerabilities"); script_summary(english:"Checks dpkg output for the updated package"); script_set_attribute( attribute:"synopsis", value:"The remote Debian host is missing a security-related update." ); script_set_attribute( attribute:"description", value: "Several vulnerabilities have been discovered in the Chromium web browser. - CVE-2013-2887 The chrome 29 development team found various issues from internal fuzzing, audits, and other studies. - CVE-2013-2900 Krystian Bigaj discovered a file handling path sanitization issue. - CVE-2013-2901 Alex Chapman discovered an integer overflow issue in ANGLE, the Almost Native Graphics Layer. - CVE-2013-2902 cloudfuzzer discovered a use-after-free issue in XSLT. - CVE-2013-2903 cloudfuzzer discovered a use-after-free issue in HTMLMediaElement. - CVE-2013-2904 cloudfuzzer discovered a use-after-free issue in XML document parsing. - CVE-2013-2905 Christian Jaeger discovered an information leak due to insufficient file permissions." ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2013-2887" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2013-2900" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2013-2901" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2013-2902" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2013-2903" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2013-2904" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2013-2905" ); script_set_attribute( attribute:"see_also", value:"https://packages.debian.org/source/wheezy/chromium-browser" ); script_set_attribute( attribute:"see_also", value:"https://www.debian.org/security/2013/dsa-2741" ); script_set_attribute( attribute:"solution", value: "Upgrade the chromium-browser packages. For the stable distribution (wheezy), these problems have been fixed in version 29.0.1547.57-1~deb7u1." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:chromium-browser"); script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:7.0"); script_set_attribute(attribute:"vuln_publication_date", value:"2013/08/21"); script_set_attribute(attribute:"patch_publication_date", value:"2013/08/25"); script_set_attribute(attribute:"plugin_publication_date", value:"2013/08/26"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Debian Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l"); exit(0); } include("audit.inc"); include("debian_package.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian"); if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if (deb_check(release:"7.0", prefix:"chromium", reference:"29.0.1547.57-1~deb7u1")) flag++; if (deb_check(release:"7.0", prefix:"chromium-browser", reference:"29.0.1547.57-1~deb7u1")) flag++; if (deb_check(release:"7.0", prefix:"chromium-browser-dbg", reference:"29.0.1547.57-1~deb7u1")) flag++; if (deb_check(release:"7.0", prefix:"chromium-browser-inspector", reference:"29.0.1547.57-1~deb7u1")) flag++; if (deb_check(release:"7.0", prefix:"chromium-browser-l10n", reference:"29.0.1547.57-1~deb7u1")) flag++; if (deb_check(release:"7.0", prefix:"chromium-dbg", reference:"29.0.1547.57-1~deb7u1")) flag++; if (deb_check(release:"7.0", prefix:"chromium-inspector", reference:"29.0.1547.57-1~deb7u1")) flag++; if (deb_check(release:"7.0", prefix:"chromium-l10n", reference:"29.0.1547.57-1~deb7u1")) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get()); else security_hole(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");
NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-201309-16.NASL description The remote host is affected by the vulnerability described in GLSA-201309-16 (Chromium, V8: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Chromium and V8. Please review the CVE identifiers and release notes referenced below for details. Impact : A context-dependent attacker could entice a user to open a specially crafted website or JavaScript program using Chromium or V8, possibly resulting in the execution of arbitrary code with the privileges of the process or a Denial of Service condition. Furthermore, a remote attacker may be able to bypass security restrictions or have other, unspecified, impact. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 70112 published 2013-09-25 reporter This script is Copyright (C) 2013-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/70112 title GLSA-201309-16 : Chromium, V8: Multiple vulnerabilities code # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Gentoo Linux Security Advisory GLSA 201309-16. # # The advisory text is Copyright (C) 2001-2018 Gentoo Foundation, Inc. # and licensed under the Creative Commons - Attribution / Share Alike # license. See http://creativecommons.org/licenses/by-sa/3.0/ # include("compat.inc"); if (description) { script_id(70112); script_version("1.26"); script_cvs_date("Date: 2018/07/12 15:01:52"); script_cve_id("CVE-2012-5116", "CVE-2012-5117", "CVE-2012-5118", "CVE-2012-5120", "CVE-2012-5121", "CVE-2012-5122", "CVE-2012-5123", "CVE-2012-5124", "CVE-2012-5125", "CVE-2012-5126", "CVE-2012-5127", "CVE-2012-5128", "CVE-2012-5130", "CVE-2012-5132", "CVE-2012-5133", "CVE-2012-5135", "CVE-2012-5136", "CVE-2012-5137", "CVE-2012-5138", "CVE-2012-5139", "CVE-2012-5140", "CVE-2012-5141", "CVE-2012-5142", "CVE-2012-5143", "CVE-2012-5144", "CVE-2012-5145", "CVE-2012-5146", "CVE-2012-5147", "CVE-2012-5148", "CVE-2012-5149", "CVE-2012-5150", "CVE-2012-5151", "CVE-2012-5152", "CVE-2012-5153", "CVE-2012-5154", "CVE-2013-0828", "CVE-2013-0829", "CVE-2013-0830", "CVE-2013-0831", "CVE-2013-0832", "CVE-2013-0833", "CVE-2013-0834", "CVE-2013-0835", "CVE-2013-0836", "CVE-2013-0837", "CVE-2013-0838", "CVE-2013-0839", "CVE-2013-0840", "CVE-2013-0841", "CVE-2013-0842", "CVE-2013-0879", "CVE-2013-0880", "CVE-2013-0881", "CVE-2013-0882", "CVE-2013-0883", "CVE-2013-0884", "CVE-2013-0885", "CVE-2013-0887", "CVE-2013-0888", "CVE-2013-0889", "CVE-2013-0890", "CVE-2013-0891", "CVE-2013-0892", "CVE-2013-0893", "CVE-2013-0894", "CVE-2013-0895", "CVE-2013-0896", "CVE-2013-0897", "CVE-2013-0898", "CVE-2013-0899", "CVE-2013-0900", "CVE-2013-0902", "CVE-2013-0903", "CVE-2013-0904", "CVE-2013-0905", "CVE-2013-0906", "CVE-2013-0907", "CVE-2013-0908", "CVE-2013-0909", "CVE-2013-0910", "CVE-2013-0911", "CVE-2013-0912", "CVE-2013-0916", "CVE-2013-0917", "CVE-2013-0918", "CVE-2013-0919", "CVE-2013-0920", "CVE-2013-0921", "CVE-2013-0922", "CVE-2013-0923", "CVE-2013-0924", "CVE-2013-0925", "CVE-2013-0926", "CVE-2013-2836", "CVE-2013-2837", "CVE-2013-2838", "CVE-2013-2839", "CVE-2013-2840", "CVE-2013-2841", "CVE-2013-2842", "CVE-2013-2843", "CVE-2013-2844", "CVE-2013-2845", "CVE-2013-2846", "CVE-2013-2847", "CVE-2013-2848", "CVE-2013-2849", "CVE-2013-2853", "CVE-2013-2855", "CVE-2013-2856", "CVE-2013-2857", "CVE-2013-2858", "CVE-2013-2859", "CVE-2013-2860", "CVE-2013-2861", "CVE-2013-2862", "CVE-2013-2863", "CVE-2013-2865", "CVE-2013-2867", "CVE-2013-2868", "CVE-2013-2869", "CVE-2013-2870", "CVE-2013-2871", "CVE-2013-2874", "CVE-2013-2875", "CVE-2013-2876", "CVE-2013-2877", "CVE-2013-2878", "CVE-2013-2879", "CVE-2013-2880", "CVE-2013-2881", "CVE-2013-2882", "CVE-2013-2883", "CVE-2013-2884", "CVE-2013-2885", "CVE-2013-2886", "CVE-2013-2887", "CVE-2013-2900", "CVE-2013-2901", "CVE-2013-2902", "CVE-2013-2903", "CVE-2013-2904", "CVE-2013-2905"); script_bugtraq_id(56413, 56684, 56741, 56903, 58318, 58388, 58723, 58724, 58725, 58727, 58728, 58729, 58730, 58731, 58732, 58733, 58734, 59326, 59327, 59328, 59330, 59331, 59332, 59334, 59336, 59337, 59338, 59339, 59340, 59342, 59343, 59344, 59345, 59346, 59347, 59349, 59351, 59413, 59414, 59415, 59416, 59417, 59418, 59419, 59420, 59422, 59423, 59425, 59427, 59428, 59429, 59430, 59431, 59433, 59435, 59436, 59437, 59438, 59515, 59516, 59518, 59520, 59521, 59522, 59523, 59524, 59680, 59681, 59682, 59683, 60062, 60063, 60064, 60065, 60066, 60067, 60068, 60069, 60070, 60071, 60072, 60073, 60074, 60076, 60395, 60396, 60397, 60398, 60399, 60400, 60401, 60403, 60404, 60405, 61046, 61047, 61049, 61050, 61051, 61052, 61054, 61055, 61057, 61059, 61060, 61061, 61547, 61548, 61549, 61550, 61551, 61552, 61885, 61886, 61887, 61888, 61889, 61890, 61891); script_xref(name:"GLSA", value:"201309-16"); script_name(english:"GLSA-201309-16 : Chromium, V8: Multiple vulnerabilities"); script_summary(english:"Checks for updated package(s) in /var/db/pkg"); script_set_attribute( attribute:"synopsis", value: "The remote Gentoo host is missing one or more security-related patches." ); script_set_attribute( attribute:"description", value: "The remote host is affected by the vulnerability described in GLSA-201309-16 (Chromium, V8: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Chromium and V8. Please review the CVE identifiers and release notes referenced below for details. Impact : A context-dependent attacker could entice a user to open a specially crafted website or JavaScript program using Chromium or V8, possibly resulting in the execution of arbitrary code with the privileges of the process or a Denial of Service condition. Furthermore, a remote attacker may be able to bypass security restrictions or have other, unspecified, impact. Workaround : There is no known workaround at this time." ); # https://googlechromereleases.blogspot.com/2012/11/stable-channel-release-and-beta-channel.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?0b9b0b08" ); # https://googlechromereleases.blogspot.com/2012/11/stable-channel-update.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?2f59319e" ); # https://googlechromereleases.blogspot.com/2012/11/stable-channel-update_29.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?ee73f07e" ); script_set_attribute( attribute:"see_also", value:"https://security.gentoo.org/glsa/201309-16" ); script_set_attribute( attribute:"solution", value: "All Chromium users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose '>=www-client/chromium-29.0.1457.57' All V8 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose '>=dev-lang/v8-3.18.5.14'" ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploited_by_malware", value:"true"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:chromium"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:v8"); script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux"); script_set_attribute(attribute:"patch_publication_date", value:"2013/09/24"); script_set_attribute(attribute:"plugin_publication_date", value:"2013/09/25"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2013-2018 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Gentoo Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("qpkg.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo"); if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if (qpkg_check(package:"www-client/chromium", unaffected:make_list("ge 29.0.1457.57"), vulnerable:make_list("lt 29.0.1457.57"))) flag++; if (qpkg_check(package:"dev-lang/v8", unaffected:make_list("ge 3.18.5.14"), vulnerable:make_list("lt 3.18.5.14"))) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get()); else security_hole(0); exit(0); } else { tested = qpkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "Chromium / V8"); }
NASL family MacOS X Local Security Checks NASL id MACOSX_GOOGLE_CHROME_29_0_1547_57.NASL description The version of Google Chrome installed on the remote host is a version prior to 29.0.1547.57. It is, therefore, affected by multiple vulnerabilities : - Various unspecified errors exist. No further details have been provided. (CVE-2013-2887) - An input validation error exists related to incomplete paths and file handling. (CVE-2013-2900) - An integer overflow error exists related to last seen 2020-06-01 modified 2020-06-02 plugin id 70891 published 2013-11-13 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/70891 title Google Chrome < 29.0.1547.57 Multiple Vulnerabilities (Mac OS X) code # # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(70891); script_version("1.8"); script_cvs_date("Date: 2019/11/27"); script_cve_id( "CVE-2013-2887", "CVE-2013-2900", "CVE-2013-2901", "CVE-2013-2902", "CVE-2013-2903", "CVE-2013-2904", "CVE-2013-2905" ); script_bugtraq_id( 61885, 61886, 61887, 61888, 61889, 61890, 61891 ); script_name(english:"Google Chrome < 29.0.1547.57 Multiple Vulnerabilities (Mac OS X)"); script_summary(english:"Checks version number of Google Chrome"); script_set_attribute(attribute:"synopsis", value: "The remote Mac OS X host contains a web browser that is affected by multiple vulnerabilities."); script_set_attribute(attribute:"description", value: "The version of Google Chrome installed on the remote host is a version prior to 29.0.1547.57. It is, therefore, affected by multiple vulnerabilities : - Various unspecified errors exist. No further details have been provided. (CVE-2013-2887) - An input validation error exists related to incomplete paths and file handling. (CVE-2013-2900) - An integer overflow error exists related to 'ANGLE'. (CVE-2013-2901) - Use-after-free errors exist related to 'XSLT', the 'media' element and document parsing. (CVE-2013-2902, CVE-2013-2903, CVE-2013-2904) - An error exists related to shared memory files that could lead to the disclosure of sensitive information. (CVE-2013-2905)"); # http://googlechromereleases.blogspot.com/2013/08/stable-channel-update.html script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?51dcd991"); script_set_attribute(attribute:"solution", value: "Upgrade to Google Chrome 29.0.1547.57 or later."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2013-2904"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_set_attribute(attribute:"vuln_publication_date", value:"2013/08/20"); script_set_attribute(attribute:"patch_publication_date", value:"2013/08/20"); script_set_attribute(attribute:"plugin_publication_date", value:"2013/11/13"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/a:google:chrome"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"MacOS X Local Security Checks"); script_copyright(english:"This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("macosx_google_chrome_installed.nbin"); script_require_keys("MacOSX/Google Chrome/Installed"); exit(0); } include("google_chrome_version.inc"); get_kb_item_or_exit("MacOSX/Google Chrome/Installed"); google_chrome_check_version(fix:'29.0.1547.57', severity:SECURITY_HOLE);
Oval
accepted | 2013-09-30T04:01:16.613-04:00 | ||||
class | vulnerability | ||||
contributors |
| ||||
definition_extensions |
| ||||
description | Use-after-free vulnerability in the Document::finishedParsing function in core/dom/Document.cpp in Blink, as used in Google Chrome before 29.0.1547.57, allows remote attackers to cause a denial of service or possibly have unspecified other impact via an onload event that changes an IFRAME element so that its src attribute is no longer an XML document, leading to unintended garbage collection of this document. | ||||
family | windows | ||||
id | oval:org.mitre.oval:def:18550 | ||||
status | accepted | ||||
submitted | 2013-08-21T14:36:01.598-04:00 | ||||
title | Use-after-free vulnerability in the Document::finishedParsing function in core/dom/Document.cpp in Blink, as used in Google Chrome before 29.0.1547.57, allows remote attackers to cause a denial of service or possibly have unspecified other impact via an onload event that changes an IFRAME element so that its src attribute is no longer an XML document, leading to unintended garbage collection of this document. | ||||
version | 40 |
References
- https://src.chromium.org/viewvc/blink?revision=154680&view=revision
- http://googlechromereleases.blogspot.com/2013/08/stable-channel-update.html
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18550
- http://www.debian.org/security/2013/dsa-2741
- http://crbug.com/260428