Vulnerabilities > CVE-2013-6638 - Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Google Chrome and V8

047910
CVSS 0.0 - NONE
Attack vector
UNKNOWN
Attack complexity
UNKNOWN
Privileges required
UNKNOWN
Confidentiality impact
UNKNOWN
Integrity impact
UNKNOWN
Availability impact
UNKNOWN
google
CWE-119
nessus
NVD
Published: 2013-12-07
Updated: 2024-11-21

Summary

Multiple buffer overflows in runtime.cc in Google V8 before 3.22.24.7, as used in Google Chrome before 31.0.1650.63, allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a large typed array, related to the (1) Runtime_TypedArrayInitialize and (2) Runtime_TypedArrayInitializeFromArrayLike functions.

Vulnerable Configurations

Part Description Count
Application
Google
3287

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
  • Client-side Injection-induced Buffer Overflow
    This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
  • Filter Failure through Buffer Overflow
    In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
  • MIME Conversion
    An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.

Nessus

  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2013-1001.NASL
    description - Update to Chromium 31.0.1650.63 Stable channel update : - Security fixes : - CVE-2013-6634: Session fixation in sync related to 302 redirects - CVE-2013-6635: Use-after-free in editing - CVE-2013-6636: Address bar spoofing related to modal dialogs - CVE-2013-6637: Various fixes from internal audits, fuzzing and other initiatives. - CVE-2013-6638: Buffer overflow in v8 - CVE-2013-6639: Out of bounds write in v8. - CVE-2013-6640: Out of bounds read in v8 - and 12 other security fixes. - Remove the build flags to build according to the Chrome ffmpeg branding and the proprietary codecs. (bnc#847971)
    last seen2020-06-05
    modified2014-06-13
    plugin id74861
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/74861
    titleopenSUSE Security Update : chromium (openSUSE-SU-2013:1933-1)
    code
    #%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from openSUSE Security Update openSUSE-2013-1001.
#
# The text description of this plugin is (C) SUSE LLC.
#

include("compat.inc");

if (description)
{
  script_id(74861);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");

  script_cve_id("CVE-2013-6634", "CVE-2013-6635", "CVE-2013-6636", "CVE-2013-6637", "CVE-2013-6638", "CVE-2013-6639", "CVE-2013-6640");

  script_name(english:"openSUSE Security Update : chromium (openSUSE-SU-2013:1933-1)");
  script_summary(english:"Check for the openSUSE-2013-1001 patch");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote openSUSE host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"  - Update to Chromium 31.0.1650.63 Stable channel update :

  - Security fixes :

  - CVE-2013-6634: Session fixation in sync related to 302
    redirects

  - CVE-2013-6635: Use-after-free in editing

  - CVE-2013-6636: Address bar spoofing related to modal
    dialogs

  - CVE-2013-6637: Various fixes from internal audits,
    fuzzing and other initiatives.

  - CVE-2013-6638: Buffer overflow in v8

  - CVE-2013-6639: Out of bounds write in v8.

  - CVE-2013-6640: Out of bounds read in v8

  - and 12 other security fixes.

  - Remove the build flags to build according to the Chrome
    ffmpeg branding and the proprietary codecs. (bnc#847971)"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.novell.com/show_bug.cgi?id=847971"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.novell.com/show_bug.cgi?id=854472"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.novell.com/show_bug.cgi?id=854473"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://lists.opensuse.org/opensuse-updates/2013-12/msg00096.html"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected chromium packages."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:chromedriver");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:chromedriver-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:chromium");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:chromium-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:chromium-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:chromium-desktop-gnome");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:chromium-desktop-kde");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:chromium-ffmpegsumo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:chromium-ffmpegsumo-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:chromium-suid-helper");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:chromium-suid-helper-debuginfo");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:12.2");

  script_set_attribute(attribute:"patch_publication_date", value:"2013/12/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2014/06/13");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
if (release !~ "^(SUSE12\.2)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "12.2", release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

ourarch = get_kb_item("Host/cpu");
if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);

flag = 0;

if ( rpm_check(release:"SUSE12.2", reference:"chromedriver-31.0.1650.63-1.58.1") ) flag++;
if ( rpm_check(release:"SUSE12.2", reference:"chromedriver-debuginfo-31.0.1650.63-1.58.1") ) flag++;
if ( rpm_check(release:"SUSE12.2", reference:"chromium-31.0.1650.63-1.58.1") ) flag++;
if ( rpm_check(release:"SUSE12.2", reference:"chromium-debuginfo-31.0.1650.63-1.58.1") ) flag++;
if ( rpm_check(release:"SUSE12.2", reference:"chromium-debugsource-31.0.1650.63-1.58.1") ) flag++;
if ( rpm_check(release:"SUSE12.2", reference:"chromium-desktop-gnome-31.0.1650.63-1.58.1") ) flag++;
if ( rpm_check(release:"SUSE12.2", reference:"chromium-desktop-kde-31.0.1650.63-1.58.1") ) flag++;
if ( rpm_check(release:"SUSE12.2", reference:"chromium-ffmpegsumo-31.0.1650.63-1.58.1") ) flag++;
if ( rpm_check(release:"SUSE12.2", reference:"chromium-ffmpegsumo-debuginfo-31.0.1650.63-1.58.1") ) flag++;
if ( rpm_check(release:"SUSE12.2", reference:"chromium-suid-helper-31.0.1650.63-1.58.1") ) flag++;
if ( rpm_check(release:"SUSE12.2", reference:"chromium-suid-helper-debuginfo-31.0.1650.63-1.58.1") ) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "chromedriver / chromedriver-debuginfo / chromium / etc");
}
  • NASL familyWindows
    NASL idGOOGLE_CHROME_31_0_1650_63.NASL
    descriptionThe version of Google Chrome installed on the remote host is a version prior to 31.0.1650.63. It is, therefore, affected by the following vulnerabilities : - An error exists related to session fixation, the sync process and HTTP 302 redirects. (CVE-2013-6634) - A use-after-free error exists related to the editing process. (CVE-2013-6635) - An error exists related to modal dialogs that could allow address spoofing. (CVE-2013-6636) - Various unspecified errors exist having unspecified impacts. (CVE-2013-6637) - An out-of-bounds read error, an out-of-bounds write error and a buffer overflow error exist in the v8 JavaScript engine. (CVE-2013-6638, CVE-2013-6639, CVE-2013-6640)
    last seen2020-06-01
    modified2020-06-02
    plugin id71227
    published2013-12-05
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/71227
    titleGoogle Chrome < 31.0.1650.63 Multiple Vulnerabilities
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2014-57.NASL
    description - Update spec-file to fit the changes in V8 (addition of internal ICU) - Building against system ICU - Regenerate Makefiles before using them - Update to 3.22.24.8 - Security fixes (bnc#854473) : - CVE-2013-6638: Buffer overflow in v8 - CVE-2013-6639: Out of bounds write in v8 - CVE-2013-6640: Out of bounds read in v8
    last seen2020-06-05
    modified2014-06-13
    plugin id75393
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/75393
    titleopenSUSE Security Update : v8 (openSUSE-SU-2014:0092-1)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2013-1026.NASL
    description - Update spec-file to fit the changes in V8 (addition of internal ICU) - Building against system ICU - Regenerate Makefiles before using them - Update to 3.22.24.8 - Security fixes (bcn#854473) : - CVE-2013-6638: Buffer overflow in v8 - CVE-2013-6639: Out of bounds write in v8 - CVE-2013-6640: Out of bounds read in v8
    last seen2020-06-05
    modified2014-06-13
    plugin id74870
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/74870
    titleopenSUSE Security Update : v8 (openSUSE-SU-2013:1962-1)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_793560405DA411E3829E00262D5ED8EE.NASL
    descriptionGoogle Chrome Releases reports : 15 security fixes in this release, including : - [307159] Medium CVE-2013-6634: Session fixation in sync related to 302 redirects. Credit to Andrey Labunets. - [314469] High CVE-2013-6635: Use-after-free in editing. Credit to cloudfuzzer. - [322959] Medium CVE-2013-6636: Address bar spoofing related to modal dialogs. Credit to Bas Venis. - [325501] CVE-2013-6637: Various fixes from internal audits, fuzzing and other initiatives. - [319722] Medium CVE-2013-6638: Buffer overflow in v8. This issue was fixed in v8 version 3.22.24.7. Credit to Jakob Kummerow of the Chromium project. - [319835] High CVE-2013-6639: Out of bounds write in v8. This issue was fixed in v8 version 3.22.24.7. Credit to Jakob Kummerow of the Chromium project. - [319860] Medium CVE-2013-6640: Out of bounds read in v8. This issue was fixed in v8 version 3.22.24.7. Credit to Jakob Kummerow of the Chromium project.
    last seen2020-06-01
    modified2020-06-02
    plugin id71238
    published2013-12-06
    reporterThis script is Copyright (C) 2013-2014 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/71238
    titleFreeBSD : chromium -- multiple vulnerabilities (79356040-5da4-11e3-829e-00262d5ed8ee)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2013-1000.NASL
    description - Update to Chromium 31.0.1650.63 Stable channel update : - Security fixes : - CVE-2013-6634: Session fixation in sync related to 302 redirects - CVE-2013-6635: Use-after-free in editing - CVE-2013-6636: Address bar spoofing related to modal dialogs - CVE-2013-6637: Various fixes from internal audits, fuzzing and other initiatives. - CVE-2013-6638: Buffer overflow in v8 - CVE-2013-6639: Out of bounds write in v8. - CVE-2013-6640: Out of bounds read in v8 - and 12 other security fixes. - Remove the build flags to build according to the Chrome ffmpeg branding and the proprietary codecs. (bnc#847971)
    last seen2020-06-05
    modified2014-06-13
    plugin id74860
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/74860
    titleopenSUSE Security Update : chromium (openSUSE-SU-2013:1927-1)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-2811.NASL
    descriptionSeveral vulnerabilities have been discovered in the chromium web browser. - CVE-2013-6634 Andrey Labunets discovered that the wrong URL was used during validation in the one-click sign on helper. - CVE-2013-6635 cloudfuzzer discovered use-after-free issues in the InsertHTML and Indent DOM editing commands. - CVE-2013-6636 Bas Venis discovered an address bar spoofing issue. - CVE-2013-6637 The chrome 31 development team discovered and fixed multiple issues with potential security impact. - CVE-2013-6638 Jakob Kummerow of the Chromium project discovered a buffer overflow in the v8 JavaScript library. - CVE-2013-6639 Jakob Kummerow of the Chromium project discovered an out-of-bounds write in the v8 JavaScript library. - CVE-2013-6640 Jakob Kummerow of the Chromium project discovered an out-of-bounds read in the v8 JavaScript library.
    last seen2020-03-17
    modified2013-12-09
    plugin id71254
    published2013-12-09
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/71254
    titleDebian DSA-2811-1 : chromium-browser - several vulnerabilities
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2014-37.NASL
    description - Update to Chromium 31.0.1650.63 Stable channel update : - Security fixes : - CVE-2013-6634: Session fixation in sync related to 302 redirects - CVE-2013-6635: Use-after-free in editing - CVE-2013-6636: Address bar spoofing related to modal dialogs - CVE-2013-6637: Various fixes from internal audits, fuzzing and other initiatives. - CVE-2013-6638: Buffer overflow in v8 - CVE-2013-6639: Out of bounds write in v8. - CVE-2013-6640: Out of bounds read in v8 - and 12 other security fixes. - Remove the build flags to build according to the Chrome ffmpeg branding and the proprietary codecs. (bnc#847971) - Update to Chromium 31.0.1650.57 Stable channel update : - Security Fixes : - CVE-2013-6632: Multiple memory corruption issues. - Update to Chromium 31.0.1650.48 Stable Channel update : - Security fixes : - CVE-2013-6621: Use after free related to speech input elements.. - CVE-2013-6622: Use after free related to media elements. - CVE-2013-6623: Out of bounds read in SVG. - CVE-2013-6624: Use after free related to &ldquo;id&rdquo; attribute strings. - CVE-2013-6625: Use after free in DOM ranges. - CVE-2013-6626: Address bar spoofing related to interstitial warnings. - CVE-2013-6627: Out of bounds read in HTTP parsing. - CVE-2013-6628: Issue with certificates not being checked during TLS renegotiation. - CVE-2013-2931: Various fixes from internal audits, fuzzing and other initiatives. - CVE-2013-6629: Read of uninitialized memory in libjpeg and libjpeg-turbo. - CVE-2013-6630: Read of uninitialized memory in libjpeg-turbo. - CVE-2013-6631: Use after free in libjingle. - Added patch chromium-fix-chromedriver-build.diff to fix the chromedriver build - Enable ARM build for Chromium. - Added patches chromium-arm-webrtc-fix.patch, chromium-fix-arm-icu.patch and chromium-fix-arm-sysroot.patch to resolve ARM specific build issues - Update to Chromium 30.0.1599.114 Stable Channel update: fix build for 32bit systems - Drop patch chromium-fix-chromedriver-build.diff. This is now fixed upstream - For openSUSE versions lower than 13.1, build against the in-tree libicu - Update to Chromium 30.0.1599.101 - Security Fixes : + CVE-2013-2925: Use after free in XHR + CVE-2013-2926: Use after free in editing + CVE-2013-2927: Use after free in forms. + CVE-2013-2928: Various fixes from internal audits, fuzzing and other initiatives. - Update to Chromium 30.0.1599.66 - Easier searching by image - A number of new apps/extension APIs - Lots of under the hood changes for stability and performance - Security fixes : + CVE-2013-2906: Races in Web Audio + CVE-2013-2907: Out of bounds read in Window.prototype object + CVE-2013-2908: Address bar spoofing related to the &ldquo;204 No Content&rdquo; status code + CVE-2013-2909: Use after free in inline-block rendering + CVE-2013-2910: Use-after-free in Web Audio + CVE-2013-2911: Use-after-free in XSLT + CVE-2013-2912: Use-after-free in PPAPI + CVE-2013-2913: Use-after-free in XML document parsing + CVE-2013-2914: Use after free in the Windows color chooser dialog + CVE-2013-2915: Address bar spoofing via a malformed scheme + CVE-2013-2916: Address bar spoofing related to the &ldquo;204 No Content&rdquo; status code + CVE-2013-2917: Out of bounds read in Web Audio + CVE-2013-2918: Use-after-free in DOM + CVE-2013-2919: Memory corruption in V8 + CVE-2013-2920: Out of bounds read in URL parsing + CVE-2013-2921: Use-after-free in resource loader + CVE-2013-2922: Use-after-free in template element + CVE-2013-2923: Various fixes from internal audits, fuzzing and other initiatives + CVE-2013-2924: Use-after-free in ICU. Upstream bug
    last seen2020-06-05
    modified2014-06-13
    plugin id75366
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/75366
    titleopenSUSE Security Update : chromium (openSUSE-SU-2014:0065-1)
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_GOOGLE_CHROME_31_0_1650_63.NASL
    descriptionThe version of Google Chrome installed on the remote Mac OS X host is a version prior to 31.0.1650.63. It is, therefore, affected by the following vulnerabilities : - An error exists related to session fixation, the sync process and HTTP 302 redirects. (CVE-2013-6634) - A use-after-free error exists related to the editing process. (CVE-2013-6635) - An error exists related to modal dialogs that could allow address spoofing. (CVE-2013-6636) - Various unspecified errors exist having unspecified impacts. (CVE-2013-6637) - An out-of-bounds read error, an out-of-bounds write error and a buffer overflow error exist in the v8 JavaScript engine. (CVE-2013-6638, CVE-2013-6639, CVE-2013-6640)
    last seen2020-06-01
    modified2020-06-02
    plugin id71228
    published2013-12-05
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/71228
    titleGoogle Chrome < 31.0.1650.63 Multiple Vulnerabilities (Mac OS X)
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201403-01.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201403-01 (Chromium, V8: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Chromium and V8. Please review the CVE identifiers and release notes referenced below for details. Impact : A context-dependent attacker could entice a user to open a specially crafted website or JavaScript program using Chromium or V8, possibly resulting in the execution of arbitrary code with the privileges of the process or a Denial of Service condition. Furthermore, a remote attacker may be able to bypass security restrictions or have other unspecified impact. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id72851
    published2014-03-06
    reporterThis script is Copyright (C) 2014-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/72851
    titleGLSA-201403-01 : Chromium, V8: Multiple vulnerabilities
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2013-1025.NASL
    description - Update spec-file to fit the changes in V8 (addition of internal ICU) - Building against system ICU - Regenerate Makefiles before using them - Update to 3.22.24.8 - Security fixes (bnc#854473) : - CVE-2013-6638: Buffer overflow in v8 - CVE-2013-6639: Out of bounds write in v8 - CVE-2013-6640: Out of bounds read in v8
    last seen2020-06-05
    modified2014-06-13
    plugin id74869
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/74869
    titleopenSUSE Security Update : v8 (openSUSE-SU-2013:1960-1)

References