Use-after-free vulnerability in the frame-loader implementation in Google Chrome before 25.0.1364.152 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

The remote host is affected by the vulnerability described in GLSA-201309-16 (Chromium, V8: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and V8. Please       review the CVE identifiers and release notes referenced below for       details.
  Impact :

    A context-dependent attacker could entice a user to open a specially       crafted website or JavaScript program using Chromium or V8, possibly       resulting in the execution of arbitrary code with the privileges of the       process or a Denial of Service condition. Furthermore, a remote attacker       may be able to bypass security restrictions or have other, unspecified,       impact.
  Workaround :

    There is no known workaround at this time.

Google Chrome Releases reports :

[176882] High CVE-2013-0902: Use-after-free in frame loader. Credit to Chamal de Silva.

[176252] High CVE-2013-0903: Use-after-free in browser navigation handling. Credit to 'chromium.khalil'.

[172926] [172331] High CVE-2013-0904: Memory corruption in Web Audio.
Credit to Atte Kettunen of OUSPG.

[168982] High CVE-2013-0905: Use-after-free with SVG animations.
Credit to Atte Kettunen of OUSPG.

[174895] High CVE-2013-0906: Memory corruption in Indexed DB. Credit to Google Chrome Security Team (Juri Aedla).

[174150] Medium CVE-2013-0907: Race condition in media thread handling. Credit to Andrew Scherkus of the Chromium development community.

[174059] Medium CVE-2013-0908: Incorrect handling of bindings for extension processes.

[173906] Low CVE-2013-0909: Referer leakage with XSS Auditor. Credit to Egor Homakov.

[172573] Medium CVE-2013-0910: Mediate renderer -> browser plug-in loads more strictly. Credit to Google Chrome Security Team (Chris Evans).

[172264] High CVE-2013-0911: Possible path traversal in database handling. Credit to Google Chrome Security Team (Juri Aedla).

Versions of Google Chrome earlier than 25.0.1364.152 are potentially affected by the following vulnerabilities :

  - Use-after-free errors exist related to the frame loader, browser navigation handling and SVG animation. (CVE-2013-0902, CVE-2013-0903, CVE-2013-0905)

  - Memory corruption errors exist related to 'Web Audio' and 'Indexed DB'. (CVE-2013-0904, CVE-2013-0906)

  - A race condition exists related to media thread handling. (CVE-2013-0907)

  - An unspecified error exists related to extension process bindings. (CVE-2013-0908)

  - The 'XSS Auditor' could leak referrer information. (CVE-2013-0909)

  - An unspecified error exists related to loading strictness and 'Mediate renderer -&gt; browser plug-in'. (CVE-2013-0910)

  - A path traversal error exists related to database handling. (CVE-2013-0911)

Versions of Google Chrome earlier than 25.0.1364.152 are potentially affected by the following vulnerabilities :

  - Use-after-free errors exist related to the frame loader, browser navigation handling and SVG animation. (CVE-2013-0902, CVE-2013-0903, CVE-2013-0905)

  - Memory corruption errors exist related to 'Web Audio' and 'Indexed DB'. (CVE-2013-0904, CVE-2013-0906)

  - A race condition exists related to media thread handling. (CVE-2013-0907)

  - An unspecified error exists related to extension process bindings. (CVE-2013-0908)

  - The 'XSS Auditor' could leak referrer information. (CVE-2013-0909)

  - An unspecified error exists related to loading strictness and 'Mediate renderer -> browser plug-in'. (CVE-2013-0910)

  - A path traversal error exists related to database handling. (CVE-2013-0911)

The version of Google Chrome installed on the remote host is a version prior to 25.0.1364.152. It is, therefore, affected by the following vulnerabilities :

  - Use-after-free errors exist related to the frame     loader, browser navigation handling and SVG     animation. (CVE-2013-0902, CVE-2013-0903, CVE-2013-0905)

  - Memory corruption errors exist related to 'Web Audio'     and 'Indexed DB'. (CVE-2013-0904, CVE-2013-0906)

  - A race condition exists related to media thread     handling. (CVE-2013-0907)

  - An unspecified error exists related to extension     process bindings. (CVE-2013-0908)

  - The 'XSS Auditor' could leak referrer information.
    (CVE-2013-0909)

  - An unspecified error exists related to loading     strictness and 'Mediate renderer -> browser plug-in'.
    (CVE-2013-0910)

  - A path traversal error exists related to database     handling. (CVE-2013-0911)

ID	Name	Product	Family	Severity
70112	GLSA-201309-16 : Chromium, V8: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
65067	FreeBSD : chromium -- multiple vulnerabilities (40d5ab37-85f2-11e2-b528-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	high
800923	Google Chrome < 25.0.1364.152 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
6706	Google Chrome < 25.0.1364.152 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
65029	Google Chrome < 25.0.1364.152 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2013-0902

critical

Tenable Plugins

critical

high

high

high

high