Use-after-free vulnerability in the RenderSVGImage::paint function in core/rendering/svg/RenderSVGImage.cpp in Blink, as used in Google Chrome before 32.0.1700.102, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving a zero-size SVG image.

Chromium was updated to version 32.0.1700.102: Stable channel update :

  - Security Fixes :

  - CVE-2013-6649: Use-after-free in SVG images

  - CVE-2013-6650: Memory corruption in V8

  - and 12 other fixes

  - Other :

  - Mouse Pointer disappears after exiting full-screen mode

  - Drag and drop files into Chromium may not work properly

  - Quicktime Plugin crashes in Chromium

  - Chromium becomes unresponsive

  - Trackpad users may not be able to scroll horizontally

  - Scrolling does not work in combo box

  - Chromium does not work with all CSS minifiers such as     whitespace around a media query's `and` keyword

  - Update to Chromium 32.0.1700.77 Stable channel update :

  - Security fixes :

  - CVE-2013-6646: Use-after-free in web workers

  - CVE-2013-6641: Use-after-free related to forms

  - CVE-2013-6643: Unprompted sync with an attacker&rsquo;s     Google account

  - CVE-2013-6645: Use-after-free related to speech input     elements

  - CVE-2013-6644: Various fixes from internal audits,     fuzzing and other initiatives

  - Other :

  - Tab indicators for sound, webcam and casting 

  - Automatically blocking malware files 

  - Lots of under the hood changes for stability and     performance 

  - Remove patch chromium-fix-chromedriver-build.diff as     that chromedriver is fixed upstream

  - Updated ExcludeArch to exclude aarch64, ppc, ppc64 and     ppc64le. This is based on missing build requires     (valgrind, v8, etc)

The remote host is affected by the vulnerability described in GLSA-201403-01 (Chromium, V8: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and V8. Please       review the CVE identifiers and release notes referenced below for       details.
  Impact :

    A context-dependent attacker could entice a user to open a specially       crafted website or JavaScript program using Chromium or V8, possibly       resulting in the execution of arbitrary code with the privileges of the       process or a Denial of Service condition. Furthermore, a remote attacker       may be able to bypass security restrictions or have other unspecified       impact.
  Workaround :

    There is no known workaround at this time.

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2013-6641     Atte Kettunen discovered a use-after-free issue in     Blink/Webkit form elements.

  - CVE-2013-6643     Joao Lucas Melo Brasio discovered a Google account     information disclosure issue related to the one-click     sign-on feature.

  - CVE-2013-6644     The chrome development team discovered and fixed     multiple issues with potential security impact. 

  - CVE-2013-6645     Khalil Zhani discovered a use-after-free issue related     to speech input.

  - CVE-2013-6646     Colin Payne discovered a use-after-free issue in the web     workers implementation. 

  - CVE-2013-6649     Atte Kettunen discovered a use-after-free issue in the     Blink/Webkit SVG implementation.

  - CVE-2013-6650     Christian Holler discovered a memory corruption in the     v8 JavaScript library.

The remote host has Google Chrome browser installed. Versions of Google Chrome prior to 32.0.1700.102 are affected by the following vulnerabilities:

  - A use-after-free error exists related to processing SVG images. (CVE-2013-6649)

 - An unspecified error exists related to the V8 JavaScript engine could allow memory corruption. (CVE-2013-6650)

 - An unspecified security issue exists. (CVE-2014-1681)

The version of Google Chrome installed on the remote Mac OS X host is a version prior to 32.0.1700.102.  It is, therefore, affected by the following vulnerabilities :

  - A use-after-free error exists related to processing     SVG images. (CVE-2013-6649)

  - An unspecified error exists related to the V8 JavaScript     engine could allow memory corruption. (CVE-2013-6650)

The version of Google Chrome installed on the remote host is a version prior to 32.0.1700.102.  It is, therefore, affected by the following vulnerabilities :

  - A use-after-free error exists related to processing     SVG images. (CVE-2013-6649)

  - An unspecified error exists related to the V8 JavaScript     engine could allow memory corruption. (CVE-2013-6650)

  - An unspecified security issue exists. (CVE-2014-1681)

Google Chrome Releases reports :

14 security fixes in this release, including :

- [330420] High CVE-2013-6649: Use-after-free in SVG images. Credit to Atte Kettunen of OUSPG.

- [331444] High CVE-2013-6650: Memory corruption in V8. This issue was fixed in v8 version 3.22.24.16. Credit to Christian Holler.

ID	Name	Product	Family	Severity
75257	openSUSE Security Update : chromium (openSUSE-SU-2014:0243-1)	Nessus	SuSE Local Security Checks	high
72851	GLSA-201403-01 : Chromium, V8: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
72538	Debian DSA-2862-1 : chromium-browser - several vulnerabilities	Nessus	Debian Local Security Checks	high
8102	Google Chrome < 32.0.1700.102 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
72168	Google Chrome < 32.0.1700.102 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
72167	Google Chrome < 32.0.1700.102 Multiple Vulnerabilities	Nessus	Windows	critical
72157	FreeBSD : chromium -- multiple vulnerabilities (f9810c43-87a5-11e3-9214-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	high
801616	Google Chrome < 32.0.1700.102 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high

Detections

Analytics

CVE-2013-6649

high

Tenable Plugins

high

critical

high

high

high

critical

high

high