Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, does not properly implement web audio nodes, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.

chromium was updated to version 27.0.1425 having both stability and security fixes :

  - Bug and stability fixes :

  - Fixed crash after clicking through malware warning.
    (Issue: 173986)

  - Fixed broken command line to create extensions with     locale info (Issue: 176187)

  - Hosted apps in Chrome will always be opened from app     launcher. (Issue: 176267)

  - Added modal confirmation dialog to the enterprise     profile sign-in flow. (Issue: 171236)

  - Fixed a crash with autofill. (Issues: 175454, 176576)

  - Fixed issues with sign-in. (Issues: 175672, 175819,     175541, 176190)

  - Fixed spurious profile shortcuts created with a     system-level install. (Issue: 177047)

  - Fixed the background tab flashing with certain themes.
    (Issue: 175426)

  - Security Fixes: (bnc#804986)

  - High CVE-2013-0879: Memory corruption with web audio     node

  - High CVE-2013-0880: Use-after-free in database handling

  - Medium CVE-2013-0881: Bad read in Matroska handling

  - High CVE-2013-0882: Bad memory access with excessive SVG     parameters.

  - Medium CVE-2013-0883: Bad read in Skia.

  - Low CVE-2013-0884: Inappropriate load of NaCl.

  - Medium CVE-2013-0885: Too many API permissions granted     to web store

  - Medium CVE-2013-0886: Incorrect NaCl signal handling. 

  - Low CVE-2013-0887: Developer tools process has too many     permissions and places too much trust in the connected     server

  - Medium CVE-2013-0888: Out-of-bounds read in Skia

  - Low CVE-2013-0889: Tighten user gesture check for     dangerous file downloads.

  - High CVE-2013-0890: Memory safety issues across the IPC     layer.

  - High CVE-2013-0891: Integer overflow in blob handling.

  - Medium CVE-2013-0892: Lower severity issues across the     IPC layer

  - Medium CVE-2013-0893: Race condition in media handling.

  - High CVE-2013-0894: Buffer overflow in vorbis decoding.

  - High CVE-2013-0895: Incorrect path handling in file     copying.

  - High CVE-2013-0896: Memory management issues in plug-in     message handling

  - Low CVE-2013-0897: Off-by-one read in PDF

  - High CVE-2013-0898: Use-after-free in URL handling

  - Low CVE-2013-0899: Integer overflow in Opus handling

  - Medium CVE-2013-0900: Race condition in ICU

  - Make adjustment for autodetecting of the PepperFlash     library. The package with the PepperFlash hopefully will     be soon available through packman

  - Update to 26.0.1411

  - Bug and stability fixes

  - Update to 26.0.1403

  - Bug and stability fixes

  - Using system libxml2 requires system libxslt.

  - Using system MESA does not work in i586 for some reason.

  - Also use system MESA, factory version seems adecuate     now. 

  - Always use system libxml2.

  - Restrict the usage of system libraries instead of the     bundled ones to new products, too much hassle otherwise.

  - Also link kerberos and libgps directly, do not dlopen     them. 

  - Avoid using dlopen on system libraries, rpm or the     package Manager do not handle this at all. tested for a     few weeks and implemented with a macro so it can be     easily disabled if problems arise.

  - Use SOME system libraries instead of the bundled ones,     tested for several weeks and implemented with a macro     for easy enable/Disable in case of trouble.

  - Update to 26.0.1393

  - Bug and stability fixes

  - Security fixes 

  - Update to 26.0.1375

  - Bug and stability fixes

  - Update to 26.0.1371

  - Bug and stability fixes

  - Update to 26.0.1367

  - Bug and stability fixes

According to its banner, the remote Apple TV 2nd generation or later device is prior to 6.0.  It is, therefore, reportedly affected by multiple vulnerabilities, the most serious issues of which could result in arbitrary code execution.

The remote host is affected by the vulnerability described in GLSA-201309-16 (Chromium, V8: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and V8. Please       review the CVE identifiers and release notes referenced below for       details.
  Impact :

    A context-dependent attacker could entice a user to open a specially       crafted website or JavaScript program using Chromium or V8, possibly       resulting in the execution of arbitrary code with the privileges of the       process or a Denial of Service condition. Furthermore, a remote attacker       may be able to bypass security restrictions or have other, unspecified,       impact.
  Workaround :

    There is no known workaround at this time.

The mobile device is running a version of iOS that is older than version 7.  This version contains security-related fixes for the following components :

  - Certificate Trust Policy
  - CoreGraphics
  - CoreMedia
  - Data Protection
  - Data Security
  - dyld
  - File Systems
  - ImageIO
  - IOKit
  - IOKitUser
  - IOSerialFamily
  - IPSec
  - Kernel
  - Kext Management
  - libxml
  - libxslt
  - Passcode Lock
  - Personal Hotspot
  - Push Notifications
  - Safari
  - Sandbox
  - Social
  - Springboard
  - Telephony
  - Twitter
  - WebKit

The remote host has Safari installed. Versions of Safari earlier than 6.0.5 are reportedly affected by the following vulnerabilities :

  - Multiple cross-site scripting vulnerabilities (CVE-2013-1012, CVE-2013-1013)
 - Multiple memory-corruption vulnerabilities exist that can be triggered by a specially crafted webpage. A remote attacker can exploit these issues to execute arbitrary code in in context of the user. (CVE-2013-0879, CVE-2013-0991, CVE-2013-0992, CVE-2013-0993, CVE-2013-0994, CVE-2013-0995, CVE-2013-0996, CVE-2013-0997, CVE-2013-0998, CVE-2013-0999, CVE-2013-1000, CVE-2013-1001, CVE-2013-1002, CVE-2013-1003, CVE-2013-1004, CVE-2013-1005, CVE-2013-1006, CVE-2013-1007, CVE-2013-1008, CVE-2013-1009, CVE-2013-1010, CVE-2013-1011, CVE-2013-1023)

The version of Apple Safari installed on the remote Mac OS X 10.7 or 10.8 host is earlier than 6.0.5. It is, therefore, potentially affected by several issues :

  - Multiple memory corruption vulnerabilities exist in     WebKit that could lead to unexpected program termination     or arbitrary code execution. (CVE-2013-0879 /     CVE-2013-0991 / CVE-2013-0992 / CVE-2013-0993 /     CVE-2013-0994 / CVE-2013-0995 / CVE-2013-0996 /     CVE-2013-0997 / CVE-2013-0998 / CVE-2013-0999 /     CVE-2013-1000 / CVE-2013-1001 / CVE-2013-1002 /     CVE-2013-1003 / CVE-2013-1004 / CVE-2013-1005 /     CVE-2013-1006 / CVE-2013-1007 / CVE-2013-1008 /     CVE-2013-1009 / CVE-2013-1010 / CVE-2013-1011 /     CVE-2013-1023)

  - A cross-site scripting issue exists in WebKit's handling     of iframes. (CVE-2013-1012)

  - A cross-site scripting issue exists in WebKit's handling     of copied and pasted data in HTML documents.
    (CVE-2013-0926)

  - In rewriting URLs to prevent cross-site scripting     attacks, XSS Auditor could be abused, leading to     malicious alteration of the behavior of a form     submission. (CVE-2013-1013)

Versions of iTunes earlier than 11.0.3 are reportedly affected by several vulnerabilities:

  - An error exists related to certificate validation that could allow disclosure of sensitive information and could allow the application to trust data from untrusted sources. (CVE-2013-1014)

  - The included version of WebKit contains several errors that could lead to memory corruption and possibly arbitrary code execution. The vendor notes one possible attack vector is a man-in-the-middle attack while the application browses the 'iTunes Store'. (CVE-2012-2824, CVE-2012-2857, CVE-2012-3748, CVE-2012-5112, CVE-2013-0879, CVE-2013-0912, CVE-2013-0948, CVE-2013-0949, CVE-2013-0950, CVE-2013-0951, CVE-2013-0952, CVE-2013-0953, CVE-2013-0954, CVE-2013-0955, CVE-2013-0956, CVE-2013-0958, CVE-2013-0959, CVE-2013-0960, CVE-2013-0961, CVE-2013-0991, CVE-2013-0992, CVE-2013-0993, CVE-2013-0994, CVE-2013-0995, CVE-2013-0996, CVE-2013-0997, CVE-2013-0998, CVE-2013-0999, CVE-2013-1000, CVE-2013-1001, CVE-2013-1002, CVE-2013-1003, CVE-2013-1004, CVE-2013-1005, CVE-2013-1006, CVE-2013-1007, CVE-2013-1008, CVE-2013-1010, CVE-2013-1011) 

The version of Apple iTunes on the remote host is prior to version 11.0.3. It is, therefore, affected by multiple vulnerabilities :

  - An error exists related to certificate validation. A     man-in-the-middle attacker can exploit this to spoof     HTTPS servers, which allows the disclosure of sensitive     information or the application to trust data from     untrusted sources. Note that this issue affects the     application regardless of the operating system.
    (CVE-2013-1014)

  - The version of WebKit included in iTunes contains     several errors that can lead to memory corruption and     arbitrary code execution. The vendor states that one     possible vector is a man-in-the-middle attack while the     application browses the 'iTunes Store'. Please note that     these vulnerabilities only affect the application when     it is running on a Windows host.
    (CVE-2012-2824, CVE-2012-2857, CVE-2012-3748,     CVE-2012-5112, CVE-2013-0879, CVE-2013-0912,     CVE-2013-0948, CVE-2013-0949, CVE-2013-0950,     CVE-2013-0951, CVE-2013-0952, CVE-2013-0953,     CVE-2013-0954, CVE-2013-0955, CVE-2013-0956,     CVE-2013-0958, CVE-2013-0959, CVE-2013-0960,     CVE-2013-0961, CVE-2013-0991, CVE-2013-0992,     CVE-2013-0993, CVE-2013-0994, CVE-2013-0995,     CVE-2013-0996, CVE-2013-0997, CVE-2013-0998,     CVE-2013-0999, CVE-2013-1000, CVE-2013-1001,     CVE-2013-1002, CVE-2013-1003, CVE-2013-1004,     CVE-2013-1005, CVE-2013-1006, CVE-2013-1007,     CVE-2013-1008, CVE-2013-1010, CVE-2013-1011)

The version of Apple iTunes installed on the remote Windows host is older than 11.0.3.  It therefore is potentially affected by several issues :

  - An error exists related to certificate validation     that could allow disclosure of sensitive information     and could allow the application to trust data from     untrusted sources. (CVE-2013-1014)

  - The included version of WebKit contains several errors     that could lead to memory corruption and possibly     arbitrary code execution. The vendor notes one possible     attack vector is a man-in-the-middle attack while the     application browses the 'iTunes Store'.
    (CVE-2012-2824, CVE-2012-2857, CVE-2012-3748,     CVE-2012-5112, CVE-2013-0879, CVE-2013-0912,     CVE-2013-0948, CVE-2013-0949, CVE-2013-0950,     CVE-2013-0951, CVE-2013-0952, CVE-2013-0953,     CVE-2013-0954, CVE-2013-0955, CVE-2013-0956,     CVE-2013-0958, CVE-2013-0959, CVE-2013-0960,     CVE-2013-0961, CVE-2013-0991, CVE-2013-0992,     CVE-2013-0993, CVE-2013-0994, CVE-2013-0995,     CVE-2013-0996, CVE-2013-0997, CVE-2013-0998,     CVE-2013-0999, CVE-2013-1000, CVE-2013-1001,     CVE-2013-1002, CVE-2013-1003, CVE-2013-1004,     CVE-2013-1005, CVE-2013-1006, CVE-2013-1007,     CVE-2013-1008, CVE-2013-1010, CVE-2013-1011)

Google Chrome Releases reports :

[172243] High CVE-2013-0879: Memory corruption with web audio node.
Credit to Atte Kettunen of OUSPG.

[171951] High CVE-2013-0880: Use-after-free in database handling.
Credit to Chamal de Silva.

[167069] Medium CVE-2013-0881: Bad read in Matroska handling. Credit to Atte Kettunen of OUSPG.

[165432] High CVE-2013-0882: Bad memory access with excessive SVG parameters. Credit to Renata Hodovan.

[142169] Medium CVE-2013-0883: Bad read in Skia. Credit to Atte Kettunen of OUSPG.

[172984] Low CVE-2013-0884: Inappropriate load of NaCl. Credit to Google Chrome Security Team (Chris Evans).

[172369] Medium CVE-2013-0885: Too many API permissions granted to web store.

[171065] [170836] Low CVE-2013-0887: Developer tools process has too many permissions and places too much trust in the connected server.

[170666] Medium CVE-2013-0888: Out-of-bounds read in Skia. Credit to Google Chrome Security Team (Inferno).

[170569] Low CVE-2013-0889: Tighten user gesture check for dangerous file downloads.

[169973] [169966] High CVE-2013-0890: Memory safety issues across the IPC layer. Credit to Google Chrome Security Team (Chris Evans).

[169685] High CVE-2013-0891: Integer overflow in blob handling. Credit to Google Chrome Security Team (Juri Aedla).

[169295] [168710] [166493] [165836] [165747] [164958] [164946] Medium CVE-2013-0892: Lower severity issues across the IPC layer. Credit to Google Chrome Security Team (Chris Evans).

[168570] Medium CVE-2013-0893: Race condition in media handling.
Credit to Andrew Scherkus of the Chromium development community.

[168473] High CVE-2013-0894: Buffer overflow in vorbis decoding.
Credit to Google Chrome Security Team (Inferno).

[Linux / Mac] [167840] High CVE-2013-0895: Incorrect path handling in file copying. Credit to Google Chrome Security Team (Juri Aedla).

[166708] High CVE-2013-0896: Memory management issues in plug-in message handling. Credit to Google Chrome Security Team (Cris Neckar).

[165537] Low CVE-2013-0897: Off-by-one read in PDF. Credit to Mateusz Jurczyk, with contributions by Gynvael Coldwind, both from Google Security Team.

[164643] High CVE-2013-0898: Use-after-free in URL handling. Credit to Alexander Potapenko of the Chromium development community.

[160480] Low CVE-2013-0899: Integer overflow in Opus handling. Credit to Google Chrome Security Team (Juri Aedla).

[152442] Medium CVE-2013-0900: Race condition in ICU. Credit to Google Chrome Security Team (Inferno).

Versions of Google Chrome earlier than 25.0.1364.97 are potentially affected by the following vulnerabilities :

  - An unspecified memory corruption error exists related to 'web audio node'. (CVE-2013-0879)

  - Use-after-free errors exist related to database and URL handling. (CVE-2013-0880, CVE-2013-0898)

  - Improper memory read errors exist related to Matroska, excessive SVG parameters, and Skia. (CVE-2013-0881, CVE-2013-0882, CVE-2013-0883, CVE-2013-0888)

  - An error exists related to improper loading of 'NaCl'. (CVE-2013-0884)

  - The 'web store' is granted too many API permissions. (CVE-2013-0885)

  - The developer tools process is granted too many permissions and trusts remote servers incorrectly. (CVE-2013-0887)

  - User gestures are not properly checked with respect to dangerous file downloads. (CVE-2013-0889)

  - An unspecified memory safety issue exists in the IPC layer. (CVE-2013-0890)

  - Integer overflow errors exist related to blob and 'Opus' handling. (CVE-2013-0891, CVE-2013-0899)

  - Numerous, unspecified, lower-severity issues exist related to the IPC layer. (CVE-2013-0892)

  - Race conditions exist related to media handling and ICU. (CVE-2013-0893, CVE-2013-0900)

  - A buffer overflow exists related to vorbis decoding. (CVE-2013-0894)

  - Memory management errors exist related to plugin message handling. (CVE-2013-0896)

  - An off-by-one read error exists related to PDF handling. (CVE-2013-0897)

Note that the vendor states that WebKit's MathML implementation has been disabled in this release.  This is due to several unspecified, high severity security issues.  Successful exploitation of some of these issues could lead to an application crash or even allow arbitrary code execution, subject to the user's privileges.

The version of Google Chrome installed on the remote host is a version prior to 25.0.1364.97. It is, therefore, affected by the following vulnerabilities :

  - An unspecified memory corruption error exists related     to 'web audio node'. (CVE-2013-0879)

  - Use-after-free errors exist related to database and     URL handling. (CVE-2013-0880, CVE-2013-0898)

  - Improper memory read errors exist related to Matroska,     excessive SVG parameters, and Skia. (CVE-2013-0881,     CVE-2013-0882, CVE-2013-0883, CVE-2013-0888)

  - An error exists related to improper loading of 'NaCl'.
    (CVE-2013-0884)

  - The 'web store' is granted too many API permissions.
    (CVE-2013-0885)

  - The developer tools process is granted too many     permissions and trusts remote servers incorrectly.
    (CVE-2013-0887)

  - User gestures are not properly checked with respect to     dangerous file downloads. (CVE-2013-0889)

  - An unspecified memory safety issue exists in the IPC     layer. (CVE-2013-0890)

  - Integer overflow errors exist related to blob and     'Opus' handling. (CVE-2013-0891, CVE-2013-0899)

  - Numerous, unspecified, lower-severity issues exist     related to the IPC layer. (CVE-2013-0892)

  - Race conditions exist related to media handling and     ICU. (CVE-2013-0893, CVE-2013-0900)

  - A buffer overflow exists related to vorbis decoding.
    (CVE-2013-0894)

  - Memory management errors exist related to plugin     message handling. (CVE-2013-0896)

  - An off-by-one read error exists related to PDF     handling. (CVE-2013-0897)

Note that the vendor states that WebKit's MathML implementation has been disabled in this release.  This is due to several unspecified, high severity security issues.  Successful exploitation of some of these issues could lead to an application crash or even allow arbitrary code execution, subject to the user's privileges.

According to its banner, the remote Apple iOS device is missing a security update.  Versions of Apple iOS older than 7.0 are affected by vulnerabilities within the following components :

 - Certificate Trust Policy
 - CoreGraphics
 - CoreMedia
 - Data Protection
 - Data Security
 - File Systems
 - IOKit
 - IOKitUser
 - IOSerialFamily
 - IPSec
 - ImageIO
 - Kernel
 - Kext Management
 - Passcode Lock
 - Personal Hotspot
 - Push Notifications
 - Safari
 - Sandbox
 - Social
 - Springboard
 - Telephony
 - Twitter
 - WebKit
 - dyld
 - libxml
 - libxslt

ID	Name	Product	Family	Type	Severity
74920	openSUSE Security Update : chromium (openSUSE-SU-2013:0454-1)	Nessus	SuSE Local Security Checks	Local	high
70257	Apple TV < 6.0 Multiple Vulnerabilities	Nessus	Misc.	Remote	high
70112	GLSA-201309-16 : Chromium, V8: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	critical
69984	Apple iOS < 7 Multiple Vulnerabilities	Nessus	Mobile Devices	Local	high
6856	Safari < 6.0.5 Multiple Security Vulnerabilities	Nessus Network Monitor	Web Clients		medium
66810	Mac OS X : Apple Safari < 6.0.5 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	Local	high
6831	iTunes < 11.0.3 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients		high
66499	Apple iTunes < 11.0.3 Multiple Vulnerabilities (uncredentialed check)	Nessus	Peer-To-Peer File Sharing	Remote	critical
66498	Apple iTunes < 11.0.3 Multiple Vulnerabilities (credentialed check)	Nessus	Windows	Local	critical
64859	FreeBSD : chromium -- multiple vulnerabilities (dfd92cb2-7d48-11e2-ad48-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	Local	high
6694	Google Chrome < 25.0.1364.97 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients		high
64813	Google Chrome < 25.0.1364.97 Multiple Vulnerabilities	Nessus	Windows	Local	high
8013	Apple iOS < 7.0 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices		critical

Detections

Analytics

CVE-2013-0879

critical

Tenable Plugins

high

high

critical

high

medium

high

high

critical

critical

high

high

high

critical