Buffer overflow in the clipboard implementation in Google Chrome before 35.0.1916.153 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger unexpected bitmap data, related to content/renderer/renderer_clipboard_client.cc and content/renderer/webclipboard_impl.cc.

The remote host is affected by the vulnerability described in GLSA-201408-16 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could conduct a number of attacks which include: cross       site scripting attacks, bypassing of sandbox protection,  potential       execution of arbitrary code with the privileges of the process, or cause       a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Chromium was updated to version 36.0.1985.125. New Functionality :

  - Rich Notifications Improvements

  - An Updated Incognito / Guest NTP design

  - The addition of a Browser crash recovery bubble

  - Chrome App Launcher for Linux

  - Lots of under the hood changes for stability and     performance Security Fixes (bnc#887952,bnc#887955) :

  - CVE-2014-3160: Same-Origin-Policy bypass in SVG

  - CVE-2014-3162: Various fixes from internal audits,     fuzzing and other initiatives and 24 more fixes for     which no description was given. Packaging changes :

  - Switch to newer method to retrieve toolchain packages.
    Dropping the three naclsdk_*tgz files. Everything is now     included in the toolchain_linux_x86.tar.bz2 tarball

  - Add Courgette.tar.xz as that the build process now     requires some files from Courgette in order to build     succesfully. This does not mean that Courgette is     build/delivered.

Includes also an update to Chromium 35.0.1916.153 Security fixes (bnc#882264,bnc#882264,bnc#882265,bnc#882263) :

  - CVE-2014-3154: Use-after-free in filesystem api

  - CVE-2014-3155: Out-of-bounds read in SPDY

  - CVE-2014-3156: Buffer overflow in clipboard

  - CVE-2014-3157: Heap overflow in media

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2014-3154     Collin Payne discovered a use-after-free issue in the     filesystem API.

  - CVE-2014-3155     James March, Daniel Sommermann, and Alan Frindell     discovered several out-of-bounds read issues in the SPDY     protocol implementation.

  - CVE-2014-3156     Atte Kettunen discovered a buffer overflow issue in     bitmap handling in the clipboard implementation.

  - CVE-2014-3157     A heap-based buffer overflow issue was discovered in     chromium's ffmpeg media filter.

In addition, this version corrects a regression in the previous update. Support for older i386 processors had been dropped. This functionality is now restored.

Google Chrome Releases reports :

4 security fixes in this release, including :

- [369525] High CVE-2014-3154: Use-after-free in filesystem api.
Credit to Collin Payne.

- [369539] High CVE-2014-3155: Out-if-bounds read in SPDY. Credit to James March, Daniel Sommermann and Alan Frindell of Facebook.

- [369621] Medium CVE-2014-3156: Buffer overflow in clipboard. Credit to Atte Kettunen of OUSPG.

- [368980] CVE-2014-3157: Heap overflow in media.

The version of Google Chrome installed on the remote Mac OS X host is a version prior to 35.0.1916.153. It is, therefore, affected by the following vulnerabilities :

  - Use-after-free errors exist in the file system API.
    (CVE-2014-3154)

  - An out-of-bounds read error exists related to SPDY.
    (CVE-2014-3155)

  - A buffer overflow error exits related to the clipboard.
    (CVE-2014-3156)

  - A heap overflow error exists related to media handling.
    (CVE-2014-3157)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote host is a version prior to 35.0.1916.153. It is, therefore, affected by the following vulnerabilities :

  - Use-after-free errors exist in the file system API.
    (CVE-2014-3154)

  - An out-of-bounds read error exists related to SPDY.
    (CVE-2014-3155)

  - A buffer overflow error exits related to the clipboard.
    (CVE-2014-3156)

  - A heap overflow error exists related to media handling.
    (CVE-2014-3157)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
77460	GLSA-201408-16 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	critical
77127	openSUSE Security Update : chromium (openSUSE-SU-2014:0982-1)	Nessus	SuSE Local Security Checks	Local	high
76057	Debian DSA-2959-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	Local	high
74479	FreeBSD : chromium -- multiple vulnerabilities (0b0fb9b0-f0fb-11e3-9bcd-000c6e25e3e9)	Nessus	FreeBSD Local Security Checks	Local	high
74435	Google Chrome < 35.0.1916.153 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	Local	high
74434	Google Chrome < 35.0.1916.153 Multiple Vulnerabilities	Nessus	Windows	Local	high

Detections

Analytics

CVE-2014-3156

critical

Tenable Plugins

critical

high

high

high

high

high