Use-after-free vulnerability in the DOM implementation in Google Chrome before 28.0.1500.95 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to improper tracking of which document owns an Attr object.

The remote host is affected by the vulnerability described in GLSA-201309-16 (Chromium, V8: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and V8. Please       review the CVE identifiers and release notes referenced below for       details.
  Impact :

    A context-dependent attacker could entice a user to open a specially       crafted website or JavaScript program using Chromium or V8, possibly       resulting in the execution of arbitrary code with the privileges of the       process or a Denial of Service condition. Furthermore, a remote attacker       may be able to bypass security restrictions or have other, unspecified,       impact.
  Workaround :

    There is no known workaround at this time.

Several vulnerabilities have been discovered in the Chromium web browser.

  - CVE-2013-2881     Karthik Bhargavan discovered a way to bypass the Same     Origin Policy in frame handling.

  - CVE-2013-2882     Cloudfuzzer discovered a type confusion issue in the V8     JavaScript library.

  - CVE-2013-2883     Cloudfuzzer discovered a use-after-free issue in     MutationObserver.

  - CVE-2013-2884     Ivan Fratric of the Google Security Team discovered a     use-after-free issue in the DOM implementation.

  - CVE-2013-2885     Ivan Fratric of the Google Security Team discovered a     use-after-free issue in input handling.

  - CVE-2013-2886     The chrome 28 development team found various issues from     internal fuzzing, audits, and other studies.

Google Chrome Releases reports :

Eleven vulnerabilities, including :

[257748] Medium CVE-2013-2881: Origin bypass in frame handling. Credit to Karthik Bhargavan.

[260106] High CVE-2013-2882: Type confusion in V8. Credit to Cloudfuzzer.

[260165] High CVE-2013-2883: Use-after-free in MutationObserver.
Credit to Cloudfuzzer.

[248950] High CVE-2013-2884: Use-after-free in DOM. Credit to Ivan Fratric of Google Security Team.

[249640] [257353] High CVE-2013-2885: Use-after-free in input handling. Credit to Ivan Fratric of Google Security Team.

[261701] High CVE-2013-2886: Various fixes from internal audits, fuzzing and other initiatives.

The version of Google Chrome installed on the remote host is a version prior to 28.0.1500.95.  It is, therefore, affected by multiple vulnerabilities :

  - A cross-origin restriction bypass error exists     related to HTML frames. (CVE-2013-2881)

  - A type-confusion error exists in the V8 JavaScript     engine. (CVE-2013-2882)

  - Use-after-free errors exist related to     MutationObserver, DOM and input handling.
    (CVE-2013-2883, CVE-2013-2884, CVE-2013-2885)

  - Unspecified errors exist with no further details.
    (CVE-2013-2886)

ID	Name	Product	Family	Severity
70112	GLSA-201309-16 : Chromium, V8: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
69227	Debian DSA-2732-1 : chromium-browser - several vulnerabilities	Nessus	Debian Local Security Checks	high
69214	FreeBSD : chromium -- multiple vulnerabilities (69098c5c-fc4b-11e2-8ad0-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	high
69139	Google Chrome < 28.0.1500.95 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2013-2884

critical

Tenable Plugins

critical

high

high

high