Debian DSA-2811-1 : chromium-browser - several vulnerabilities
high Nessus Plugin ID 71254
Language:
New! Vulnerability Priority Rating (VPR)
Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it is different from CVSS.
VPR Score: 5.9
Synopsis
The remote Debian host is missing a security-related update.Description
Several vulnerabilities have been discovered in the chromium web browser.- CVE-2013-6634 Andrey Labunets discovered that the wrong URL was used during validation in the one-click sign on helper.
- CVE-2013-6635 cloudfuzzer discovered use-after-free issues in the InsertHTML and Indent DOM editing commands.
- CVE-2013-6636 Bas Venis discovered an address bar spoofing issue.
- CVE-2013-6637 The chrome 31 development team discovered and fixed multiple issues with potential security impact.
- CVE-2013-6638 Jakob Kummerow of the Chromium project discovered a buffer overflow in the v8 JavaScript library.
- CVE-2013-6639 Jakob Kummerow of the Chromium project discovered an out-of-bounds write in the v8 JavaScript library.
- CVE-2013-6640 Jakob Kummerow of the Chromium project discovered an out-of-bounds read in the v8 JavaScript library.
Solution
Upgrade the chromium-browser packages.For the stable distribution (wheezy), these problems have been fixed in version 31.0.1650.63-1~deb7u1.
See Also
https://security-tracker.debian.org/tracker/CVE-2013-6634
https://security-tracker.debian.org/tracker/CVE-2013-6635
https://security-tracker.debian.org/tracker/CVE-2013-6636
https://security-tracker.debian.org/tracker/CVE-2013-6637
https://security-tracker.debian.org/tracker/CVE-2013-6638
https://security-tracker.debian.org/tracker/CVE-2013-6639
https://security-tracker.debian.org/tracker/CVE-2013-6640
Plugin Details
Severity: High
ID: 71254
File Name: debian_DSA-2811.nasl
Version: 1.15
Type: local
Agent: unix
Family: Debian Local Security Checks
Published: 12/9/2013
Updated: 1/11/2021
Dependencies: ssh_get_info.nasl
Risk Information
Risk Factor: High
VPR Score: 5.9
CVSS v2.0
Base Score: 7.5
Temporal Score: 5.5
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Temporal Vector: E:U/RL:OF/RC:C
Vulnerability Information
CPE: p-cpe:/a:debian:debian_linux:chromium-browser, cpe:/o:debian:debian_linux:7.0
Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l
Exploit Ease: No known exploits are available
Patch Publication Date: 12/7/2013
Reference Information
CVE: CVE-2013-6634, CVE-2013-6635, CVE-2013-6636, CVE-2013-6637, CVE-2013-6638, CVE-2013-6639, CVE-2013-6640
BID: 64078
DSA: 2811