Use-after-free vulnerability in the AttributeSetter function in bindings/templates/attributes.cpp in the bindings in Blink, as used in Google Chrome before 33.0.1750.152 on OS X and Linux and before 33.0.1750.154 on Windows, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving the document.location value.

The version of Apple iTunes on the remote host is prior to version 12.0.1. It is, therefore, affected by multiple vulnerabilities related to the included version of WebKit. The errors could lead to application crashes or arbitrary code execution.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apple iTunes installed on the remote Windows host is prior to 12.0.1. It is, therefore, affected by multiple vulnerabilities due to the included version of WebKit. The errors could lead to application crashes or arbitrary code execution.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Versions of iTunes earlier than 12.0.1 are missing updates that patch memory corruption vulnerabilities within WebKit, as well as a patch that fixes a man-in-the-middle vulnerability that affects encrypted connections to the iTunes Store via iTunes. The most severe of these vulnerabilites can result in arbitrary remote code execution or unexpected application termination.

The remote host is affected by the vulnerability described in GLSA-201408-16 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could conduct a number of attacks which include: cross       site scripting attacks, bypassing of sandbox protection,  potential       execution of arbitrary code with the privileges of the process, or cause       a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Chromium was updated to the 33.0.1750.152 stable channel uodate :

  - Security fixes :

  - CVE-2014-1713: Use-after-free in Blink bindings

  - CVE-2014-1714: Windows clipboard vulnerability

  - CVE-2014-1705: Memory corruption in V8

  - CVE-2014-1715: Directory traversal issue

Previous stable channel update 33.0.1750.149 :

  - Security fixes :

  - CVE-2014-1700: Use-after-free in speech

  - CVE-2014-1701: UXSS in events

  - CVE-2014-1702: Use-after-free in web database

  - CVE-2014-1703: Potential sandbox escape due to a     use-after-free in web sockets

  - CVE-2014-1704: Multiple vulnerabilities in V8 fixed in     version 3.23.17.18

According to its banner, the remote Apple iOS device is missing a security update.  Versions of Apple iOS 7.x prior to 7.1.1 are exposed to the following vulnerabilities :

  - Information disclosure of user cookies in CFNetwork HTTPProtocol

  - Information disclosure of kernel pointers in IOKit Kernel

  - Potential man-in-the-middle attack via Secure Transport

  - Memory corruptions in Webkit

The following have since been patched in version 6.1.1:

  - Set-Cookie HTTP headers are processed even if the connection closed before the header was complete. An attacker could leverage this to strip security settings and obtain the HTTP cookie. (CVE-2014-1296)
  - Information disclosure due to the IOKit object storing kernel pointers, which could be used by a local attacker to defeat kernel address space layout randomization. (CVE-2014-1320)
  - A 'triple handshake' vulnerability could be leveraged by an attacker on the local network to perform a man-in-the-middle attack. (CVE-2014-1295)
  - Multiple memory corruption issues in the underlying WebKit library. (CVE-2013-2871, CVE-2014-1298, CVE-2014-1299, CVE-2014-1300, CVE-2014-1302, CVE-2014-1303, CVE-2014-1304, CVE-2014-1305, CVE-2014-1307, CVE-2014-1308, CVE-2014-1309, CVE-2014-1310, CVE-2014-1311, CVE-2014-1312, CVE-2014-1313, CVE-2014-1713)

Chrome OS version 33.0.1750.152 (Platform version: 5116.115.4/5116.115.5) was released with fixes for the following security vulnerabilities :

  - Memory corruption in V8 via the builtin ArrayBuffer property access, which can lead to remote code execution (CVE-2014-1705)
  - Command injection in Crosh via the try_touch_experiment function, which may allow a context-dependent attacker to run arbitrary commands (CVE-2014-1706)
  - Path traversal issue in CrosDisk due to insufficient user input sanitation when mounting a source (CVE-2014-1707)
  - Issue with file persistence at boot, relating to a flaw in dump_vpd_log (CVE-2014-1708)
  - Memory corruption flaw in the AsyncPixelTransfersCompletedQuery::End() function in the GPU command buffer, which a context-dependent attacker can leverage to run arbitrary code (CVE-2014-1710)
  - Out-of-bounds write in the GPU driver, which can be leveraged to execute arbitrary code (CVE-2014-1711)
  - Use-after-free error in Blink bindings used in the V8 engine, which can be leveraged to execute arbitrary code (CVE-2014-1713)

Google Chrome for Android version 33.0.1750.166 contains fixes for the following security issues, discovered during CanSecWest 2014:

  - Memory corruption in V8 (CVE-2014-1705)

  - Memory corruption in GPU command buffer (CVE-2014-1710)

  - Use-after-free in bindings (CVE-2014-1713)

The remote host has Safari installed that is older than 6.1.3 or 7.0.3, and is thus unpatched for the following WebKit vulnerabilities :

 - Unspecified errors exist that could allow memory corruption, application crashes and possibly arbitrary code execution. (CVE-2013-2871, CVE-2013-2926, CVE-2013-2928, CVE-2013-6625, CVE-2014-1289, CVE-2014-1290, CVE-2014-1291, CVE-2014-1292, CVE-2014-1293, CVE-2014-1294, CVE-2014-1298, CVE-2014-1299, CVE-2014-1300, CVE-2014-1301, CVE-2014-1302, CVE-2014-1303, CVE-2014-1304, CVE-2014-1305, CVE-2014-1307, CVE-2014-1308, CVE-2014-1309, CVE-2014-1310, CVE-2014-1311, CVE-2014-1312, CVE-2014-1313, CVE-2014-1713)
 - An error exists related to IPC messages and 'WebProcess' that could allow an attacker to read arbitrary files. (CVE-2014-1297)

The version of Apple Safari installed on the remote Mac OS X host is a version prior to 6.1.3 or 7.0.3. It is, therefore, potentially affected by the following vulnerabilities related to the included WebKit components :

  - Unspecified errors exist that could allow memory     corruption, application crashes and possibly arbitrary     code execution. (CVE-2013-2871, CVE-2013-2926,     CVE-2013-2928, CVE-2013-6625, CVE-2014-1289,     CVE-2014-1290, CVE-2014-1291, CVE-2014-1292,     CVE-2014-1293, CVE-2014-1294, CVE-2014-1298,     CVE-2014-1299, CVE-2014-1300, CVE-2014-1301,     CVE-2014-1302, CVE-2014-1303, CVE-2014-1304,     CVE-2014-1305, CVE-2014-1307, CVE-2014-1308,     CVE-2014-1309, CVE-2014-1310, CVE-2014-1311,     CVE-2014-1312, CVE-2014-1313, CVE-2014-1713)

  - An error exists related to IPC messages and 'WebProcess'     that could allow an attacker to read arbitrary files.
    (CVE-2014-1297)

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2013-6653     Khalil Zhani discovered a use-after-free issue in     chromium's web contents color chooser.

  - CVE-2013-6654     TheShow3511 discovered an issue in SVG handling.

  - CVE-2013-6655     cloudfuzzer discovered a use-after-free issue in dom     event handling.

  - CVE-2013-6656     NeexEmil discovered an information leak in the XSS     auditor.

  - CVE-2013-6657     NeexEmil discovered a way to bypass the Same Origin     policy in the XSS auditor.

  - CVE-2013-6658     cloudfuzzer discovered multiple use-after-free issues     surrounding the updateWidgetPositions function.

  - CVE-2013-6659     Antoine Delignat-Lavaud and Karthikeyan Bhargavan     discovered that it was possible to trigger an unexpected     certificate chain during TLS renegotiation.

  - CVE-2013-6660     bishopjeffreys discovered an information leak in the     drag and drop implementation.

  - CVE-2013-6661     The Google Chrome team discovered and fixed multiple     issues in version 33.0.1750.117.

  - CVE-2013-6663     Atte Kettunen discovered a use-after-free issue in SVG     handling.

  - CVE-2013-6664     Khalil Zhani discovered a use-after-free issue in the     speech recognition feature.

  - CVE-2013-6665     cloudfuzzer discovered a buffer overflow issue in the     software renderer.

  - CVE-2013-6666     netfuzzer discovered a restriction bypass in the Pepper     Flash plugin.

  - CVE-2013-6667     The Google Chrome team discovered and fixed multiple     issues in version 33.0.1750.146.

  - CVE-2013-6668     Multiple vulnerabilities were fixed in version     3.24.35.10 of the V8 JavaScript library.

  - CVE-2014-1700     Chamal de Silva discovered a use-after-free issue in     speech synthesis.

  - CVE-2014-1701     aidanhs discovered a cross-site scripting issue in event     handling.

  - CVE-2014-1702     Colin Payne discovered a use-after-free issue in the web     database implementation.

  - CVE-2014-1703     VUPEN discovered a use-after-free issue in web sockets     that could lead to a sandbox escape.

  - CVE-2014-1704     Multiple vulnerabilities were fixed in version     3.23.17.18 of the V8 JavaScript library.

  - CVE-2014-1705     A memory corruption issue was discovered in the V8     JavaScript library.

  - CVE-2014-1713     A use-after-free issue was discovered in the     AttributeSetter function.

  - CVE-2014-1715     A directory traversal issue was found and fixed.

The mobile device is running a version of iOS that is prior to version 7.1.1. It is, therefore, affected by vulnerabilities in the following components :

  - CFNetwork HTTPProtocol
  - IOKit Kernel
  - Secure Transport
  - WebKit

The version of Google Chrome installed on the remote Mac OS X host is a version prior to 33.0.1750.152. It is, therefore, affected by the following vulnerabilities :

  - A remote code-execution flaw exists due to a read/write     error with the a sandbox bypass, specifically the V8     JavaScript engine. This could allow an attacker to     execute code or cause a denial of service if the exploit     fails. (CVE-2014-1705)

  - A use-after-free flaw exists with the     'document.location' bindings. An attacker, using a     specially crafted web page, can dereference freed memory     and could execute arbitrary code. (CVE-2014-1713)

  - A flaw exists with the clipboard message filter. A     context-dependent attacker could bypass sandbox     restrictions. (CVE-2014-1714)

  - A restriction bypass flaw exists with the     'CreatePlatformFileUnsafe()' function in the     'base/platform_file_win.cc' where user input is not     properly sanitized. A context-dependent attacker could     open arbitrary directories bypassing sandbox     restrictions. (CVE-2014-1715)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote host is a version prior to 33.0.1750.154. It is, therefore, affected by the following vulnerabilities :

  - A remote code-execution flaw exists due to a read/write     error with the a sandbox bypass, specifically the V8     JavaScript engine. This could allow an attacker to     execute code or cause a denial of service if the exploit     fails. (CVE-2014-1705)

  - A use-after-free flaw exists with the     'document.location' bindings. An attacker, using a     specially crafted web page, can dereference freed memory     and could execute arbitrary code. (CVE-2014-1713)

  - A flaw exists with the clipboard message filter. A     context-dependent attacker could bypass sandbox     restrictions. (CVE-2014-1714)

  - A restriction bypass flaw exists with the     'CreatePlatformFileUnsafe()' function in the     'base/platform_file_win.cc' where user input is not     properly sanitized. A context-dependent attacker could     open arbitrary directories bypassing sandbox     restrictions. (CVE-2014-1715)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Versions of Google Chrome OS prior to 33.0.1750.152 are affected by the following vulnerabilities :

  - Memory corruption vulnerability in Google V8 via ArrayBuffer property accesses. (CVE-2014-1705)

  - Command injection vulnerability via a flaw in crosh that is triggered when calling try_touch_experiment. (CVE-2014-1706)

  - Unspecified path traversal vulnerability due to insufficient user-input sanitation when mounting a source (CVE-2014-1707)

  - Unspecified on-boot file persistence vulnerability (CVE-2014-1708)

  - An exploitable memory corruption in the 'AsyncPixelTransfersCompletedQuery::End()' function in 'gpu/command_buffer/service/query_manager.cc' (CVE-2014-1710)

  - Out-of-bounds write flaw in the GPU driver (CVE-2014-1711)

  - Use-after-free error related to document.location bindings, which may be leveraged to execute arbitrary code by a context-dependent attacker. (CVE-2014-1713)

Google Chrome Releases reports :

New vulnerabilities after the Pwn2Own competition :

- [352369] Code execution outside sandbox. Credit to VUPEN.

- [352374] High CVE-2014-1713: Use-after-free in Blink bindings

- [352395] High CVE-2014-1714: Windows clipboard vulnerability

- [352420] Code execution outside sandbox. Credit to Anonymous.

- [351787] High CVE-2014-1705: Memory corruption in V8

- [352429] High CVE-2014-1715: Directory traversal issue

ID	Name	Product	Family	Severity
78598	Apple iTunes < 12.0.1 Multiple Vulnerabilities (uncredentialed check)	Nessus	Peer-To-Peer File Sharing	critical
78597	Apple iTunes < 12.0.1 Multiple Vulnerabilities (credentialed check)	Nessus	Windows	critical
8561	iTunes < 12.0.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	critical
77460	GLSA-201408-16 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
75318	openSUSE Security Update : chromium (openSUSE-SU-2014:0501-1)	Nessus	SuSE Local Security Checks	critical
8275	Apple iOS 7.x < 7.1.1 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	medium
8274	Apple TV < 6.1.1 Multiple Vulnerabilities	Nessus Network Monitor	Internet Services	medium
8202	Google Chrome OS < 33.0.1750.152 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	high
8201	Google Chrome for Android < 33.0.1750.166 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	medium
8209	Safari < 6.1.3 / 7.0.3 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
73304	Mac OS X : Apple Safari < 6.1.3 / 7.0.3 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
73164	Debian DSA-2883-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	critical
73647	Apple iOS < 7.1.1 Multiple Vulnerabilities	Nessus	Mobile Devices	critical
73083	Google Chrome < 33.0.1750.152 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
73082	Google Chrome < 33.0.1750.154 Multiple Vulnerabilities	Nessus	Windows	high
8161	Google Chrome OS < 33.0.1750.152 Multiple Security Vulnerabilities (deprecated)	Nessus Network Monitor	Web Clients	high
73049	FreeBSD : www/chromium -- multiple vulnerabilities (a70966a1-ac22-11e3-8d04-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2014-1713

high

Tenable Plugins

critical

critical

critical

critical

critical

medium

medium

high

medium

high

critical

critical

critical

high

high

high

high