Google Chrome < 28.0.1500.71 Multiple Vulnerabilities
high Nessus Plugin ID 67232
Language:
New! Plugin Severity Now Using CVSS v3
The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Synopsis
The remote host contains a web browser that is affected by multiple vulnerabilities.Description
The version of Google Chrome installed on the remote host is a version prior to 28.0.1500.71 and is, therefore, affected by multiple vulnerabilities :- A vulnerability exists that exposes HTTP in SSL to a man-in-the-middle attack. (CVE-2013-2853)
- Block pop-unders in various scenarios. (CVE-2013-2867)
- An error exists related to an incorrect sync of the NPAPI extension component. (CVE-2013-2868)
- An unspecified flaw exists due to a lack of entropy in renderers. (CVE-2013-2872)
- Use-after-free errors exist related to network sockets, input handling, and resource loading. (CVE-2013-2870, CVE-2013-2871, CVE-2013-2873)
- A screen data leak error exists related to GL textures.
(CVE-2013-2874)
- An extension permission error exists related to interstitials. (CVE-2013-2876)
- Multiple out-of-bounds errors exist related to JPEG2000, SVG, text handling and XML parsing. (CVE-2013-2869, CVE-2013-2875, CVE-2013-2877, CVE-2013-2878)
- An unspecified error exists when setting up sign-in and sync. (CVE-2013-2879)
- The vendor reports various, unspecified errors exist.
(CVE-2013-2880)
Solution
Upgrade to Google Chrome 28.0.1500.71 or later.See Also
Plugin Details
Severity: High
ID: 67232
File Name: google_chrome_28_0_1500_71.nasl
Version: 1.19
Type: local
Agent: windows
Family: Windows
Published: 7/10/2013
Updated: 11/27/2019
Dependencies: google_chrome_installed.nasl
Risk Information
CVSS Score Source: CVE-2013-2870
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 9.3
Temporal Score: 6.9
Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Temporal Vector: E:U/RL:OF/RC:C
Vulnerability Information
CPE: cpe:/a:google:chrome
Required KB Items: SMB/Google_Chrome/Installed
Exploit Ease: No known exploits are available
Patch Publication Date: 7/9/2013
Vulnerability Publication Date: 7/9/2013
Reference Information
CVE: CVE-2013-2853, CVE-2013-2867, CVE-2013-2868, CVE-2013-2869, CVE-2013-2870, CVE-2013-2871, CVE-2013-2872, CVE-2013-2873, CVE-2013-2874, CVE-2013-2875, CVE-2013-2876, CVE-2013-2877, CVE-2013-2878, CVE-2013-2879, CVE-2013-2880
BID: 61046, 61047, 61049, 61050, 61051, 61052, 61053, 61054, 61055, 61056, 61057, 61058, 61059, 61060, 61061