Directory traversal vulnerability in Google Chrome before 33.0.1750.152 on OS X and Linux and before 33.0.1750.154 on Windows has unspecified impact and attack vectors.

The remote host is affected by the vulnerability described in GLSA-201408-16 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could conduct a number of attacks which include: cross       site scripting attacks, bypassing of sandbox protection,  potential       execution of arbitrary code with the privileges of the process, or cause       a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Chromium was updated to the 33.0.1750.152 stable channel uodate :

  - Security fixes :

  - CVE-2014-1713: Use-after-free in Blink bindings

  - CVE-2014-1714: Windows clipboard vulnerability

  - CVE-2014-1705: Memory corruption in V8

  - CVE-2014-1715: Directory traversal issue

Previous stable channel update 33.0.1750.149 :

  - Security fixes :

  - CVE-2014-1700: Use-after-free in speech

  - CVE-2014-1701: UXSS in events

  - CVE-2014-1702: Use-after-free in web database

  - CVE-2014-1703: Potential sandbox escape due to a     use-after-free in web sockets

  - CVE-2014-1704: Multiple vulnerabilities in V8 fixed in     version 3.23.17.18

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2013-6653     Khalil Zhani discovered a use-after-free issue in     chromium's web contents color chooser.

  - CVE-2013-6654     TheShow3511 discovered an issue in SVG handling.

  - CVE-2013-6655     cloudfuzzer discovered a use-after-free issue in dom     event handling.

  - CVE-2013-6656     NeexEmil discovered an information leak in the XSS     auditor.

  - CVE-2013-6657     NeexEmil discovered a way to bypass the Same Origin     policy in the XSS auditor.

  - CVE-2013-6658     cloudfuzzer discovered multiple use-after-free issues     surrounding the updateWidgetPositions function.

  - CVE-2013-6659     Antoine Delignat-Lavaud and Karthikeyan Bhargavan     discovered that it was possible to trigger an unexpected     certificate chain during TLS renegotiation.

  - CVE-2013-6660     bishopjeffreys discovered an information leak in the     drag and drop implementation.

  - CVE-2013-6661     The Google Chrome team discovered and fixed multiple     issues in version 33.0.1750.117.

  - CVE-2013-6663     Atte Kettunen discovered a use-after-free issue in SVG     handling.

  - CVE-2013-6664     Khalil Zhani discovered a use-after-free issue in the     speech recognition feature.

  - CVE-2013-6665     cloudfuzzer discovered a buffer overflow issue in the     software renderer.

  - CVE-2013-6666     netfuzzer discovered a restriction bypass in the Pepper     Flash plugin.

  - CVE-2013-6667     The Google Chrome team discovered and fixed multiple     issues in version 33.0.1750.146.

  - CVE-2013-6668     Multiple vulnerabilities were fixed in version     3.24.35.10 of the V8 JavaScript library.

  - CVE-2014-1700     Chamal de Silva discovered a use-after-free issue in     speech synthesis.

  - CVE-2014-1701     aidanhs discovered a cross-site scripting issue in event     handling.

  - CVE-2014-1702     Colin Payne discovered a use-after-free issue in the web     database implementation.

  - CVE-2014-1703     VUPEN discovered a use-after-free issue in web sockets     that could lead to a sandbox escape.

  - CVE-2014-1704     Multiple vulnerabilities were fixed in version     3.23.17.18 of the V8 JavaScript library.

  - CVE-2014-1705     A memory corruption issue was discovered in the V8     JavaScript library.

  - CVE-2014-1713     A use-after-free issue was discovered in the     AttributeSetter function.

  - CVE-2014-1715     A directory traversal issue was found and fixed.

The version of Google Chrome installed on the remote Mac OS X host is a version prior to 33.0.1750.152. It is, therefore, affected by the following vulnerabilities :

  - A remote code-execution flaw exists due to a read/write     error with the a sandbox bypass, specifically the V8     JavaScript engine. This could allow an attacker to     execute code or cause a denial of service if the exploit     fails. (CVE-2014-1705)

  - A use-after-free flaw exists with the     'document.location' bindings. An attacker, using a     specially crafted web page, can dereference freed memory     and could execute arbitrary code. (CVE-2014-1713)

  - A flaw exists with the clipboard message filter. A     context-dependent attacker could bypass sandbox     restrictions. (CVE-2014-1714)

  - A restriction bypass flaw exists with the     'CreatePlatformFileUnsafe()' function in the     'base/platform_file_win.cc' where user input is not     properly sanitized. A context-dependent attacker could     open arbitrary directories bypassing sandbox     restrictions. (CVE-2014-1715)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote host is a version prior to 33.0.1750.154. It is, therefore, affected by the following vulnerabilities :

  - A remote code-execution flaw exists due to a read/write     error with the a sandbox bypass, specifically the V8     JavaScript engine. This could allow an attacker to     execute code or cause a denial of service if the exploit     fails. (CVE-2014-1705)

  - A use-after-free flaw exists with the     'document.location' bindings. An attacker, using a     specially crafted web page, can dereference freed memory     and could execute arbitrary code. (CVE-2014-1713)

  - A flaw exists with the clipboard message filter. A     context-dependent attacker could bypass sandbox     restrictions. (CVE-2014-1714)

  - A restriction bypass flaw exists with the     'CreatePlatformFileUnsafe()' function in the     'base/platform_file_win.cc' where user input is not     properly sanitized. A context-dependent attacker could     open arbitrary directories bypassing sandbox     restrictions. (CVE-2014-1715)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Google Chrome Releases reports :

New vulnerabilities after the Pwn2Own competition :

- [352369] Code execution outside sandbox. Credit to VUPEN.

- [352374] High CVE-2014-1713: Use-after-free in Blink bindings

- [352395] High CVE-2014-1714: Windows clipboard vulnerability

- [352420] Code execution outside sandbox. Credit to Anonymous.

- [351787] High CVE-2014-1705: Memory corruption in V8

- [352429] High CVE-2014-1715: Directory traversal issue

ID	Name	Product	Family	Type	Severity
77460	GLSA-201408-16 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	critical
75318	openSUSE Security Update : chromium (openSUSE-SU-2014:0501-1)	Nessus	SuSE Local Security Checks	Local	critical
73164	Debian DSA-2883-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	Local	critical
73083	Google Chrome < 33.0.1750.152 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	Local	high
73082	Google Chrome < 33.0.1750.154 Multiple Vulnerabilities	Nessus	Windows	Local	high
73049	FreeBSD : www/chromium -- multiple vulnerabilities (a70966a1-ac22-11e3-8d04-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	Local	high

Detections

Analytics

CVE-2014-1715

critical

Tenable Plugins

critical

critical

critical

high

high

high