Google Chrome < 28.0.1500.71 Multiple Vulnerabilities

high Nessus Plugin ID 67232

Language:

Synopsis

The remote host contains a web browser that is affected by multiple vulnerabilities.

Description

The version of Google Chrome installed on the remote host is a version prior to 28.0.1500.71 and is, therefore, affected by multiple vulnerabilities :

 - A vulnerability exists that exposes HTTP in SSL to a man-in-the-middle attack. (CVE-2013-2853)

 - Block pop-unders in various scenarios. (CVE-2013-2867)

 - An error exists related to an incorrect sync of the NPAPI extension component. (CVE-2013-2868)

 - An unspecified flaw exists due to a lack of entropy in renderers. (CVE-2013-2872)

 - Use-after-free errors exist related to network sockets, input handling, and resource loading. (CVE-2013-2870, CVE-2013-2871, CVE-2013-2873)

 - A screen data leak error exists related to GL textures.
 (CVE-2013-2874)

 - An extension permission error exists related to interstitials. (CVE-2013-2876)

 - Multiple out-of-bounds errors exist related to JPEG2000, SVG, text handling and XML parsing. (CVE-2013-2869, CVE-2013-2875, CVE-2013-2877, CVE-2013-2878)

 - An unspecified error exists when setting up sign-in and sync. (CVE-2013-2879)

 - The vendor reports various, unspecified errors exist.
 (CVE-2013-2880)

Solution

Upgrade to Google Chrome 28.0.1500.71 or later.

See Also

http://www.nessus.org/u?f68d8c39

Plugin Details

Severity: High

ID: 67232

File Name: google_chrome_28_0_1500_71.nasl

Version: 1.20

Type: local

Agent: windows

Family: Windows

Published: 7/10/2013

Updated: 4/11/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus Agent

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 9.3

Temporal Score: 6.9

Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

Temporal Vector: E:U/RL:OF/RC:C

CVSS Score Source: CVE-2013-2870

Vulnerability Information

CPE: cpe:/a:google:chrome

Required KB Items: SMB/Google_Chrome/Installed

Exploit Ease: No known exploits are available

Patch Publication Date: 7/9/2013

Vulnerability Publication Date: 7/9/2013

Reference Information

CVE: CVE-2013-2853, CVE-2013-2867, CVE-2013-2868, CVE-2013-2869, CVE-2013-2870, CVE-2013-2871, CVE-2013-2872, CVE-2013-2873, CVE-2013-2874, CVE-2013-2875, CVE-2013-2876, CVE-2013-2877, CVE-2013-2878, CVE-2013-2879, CVE-2013-2880

BID: 61046, 61047, 61049, 61050, 61051, 61052, 61053, 61054, 61055, 61056, 61057, 61058, 61059, 61060, 61061