Debian DSA-2811-1 : chromium-browser - several vulnerabilities
high Nessus Plugin ID 71254
Language:
New! Plugin Severity Now Using CVSS v3
The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Synopsis
The remote Debian host is missing a security-related update.Description
Several vulnerabilities have been discovered in the chromium web browser.- CVE-2013-6634 Andrey Labunets discovered that the wrong URL was used during validation in the one-click sign on helper.
- CVE-2013-6635 cloudfuzzer discovered use-after-free issues in the InsertHTML and Indent DOM editing commands.
- CVE-2013-6636 Bas Venis discovered an address bar spoofing issue.
- CVE-2013-6637 The chrome 31 development team discovered and fixed multiple issues with potential security impact.
- CVE-2013-6638 Jakob Kummerow of the Chromium project discovered a buffer overflow in the v8 JavaScript library.
- CVE-2013-6639 Jakob Kummerow of the Chromium project discovered an out-of-bounds write in the v8 JavaScript library.
- CVE-2013-6640 Jakob Kummerow of the Chromium project discovered an out-of-bounds read in the v8 JavaScript library.
Solution
Upgrade the chromium-browser packages.For the stable distribution (wheezy), these problems have been fixed in version 31.0.1650.63-1~deb7u1.
See Also
https://security-tracker.debian.org/tracker/CVE-2013-6634
https://security-tracker.debian.org/tracker/CVE-2013-6635
https://security-tracker.debian.org/tracker/CVE-2013-6636
https://security-tracker.debian.org/tracker/CVE-2013-6637
https://security-tracker.debian.org/tracker/CVE-2013-6638
https://security-tracker.debian.org/tracker/CVE-2013-6639
https://security-tracker.debian.org/tracker/CVE-2013-6640
Plugin Details
Severity: High
ID: 71254
File Name: debian_DSA-2811.nasl
Version: 1.15
Type: local
Agent: unix
Family: Debian Local Security Checks
Published: 12/9/2013
Updated: 1/11/2021
Dependencies: ssh_get_info.nasl
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.5
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Temporal Vector: E:U/RL:OF/RC:C
Vulnerability Information
CPE: p-cpe:/a:debian:debian_linux:chromium-browser, cpe:/o:debian:debian_linux:7.0
Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l
Exploit Ease: No known exploits are available
Patch Publication Date: 12/7/2013
Reference Information
CVE: CVE-2013-6634, CVE-2013-6635, CVE-2013-6636, CVE-2013-6637, CVE-2013-6638, CVE-2013-6639, CVE-2013-6640
BID: 64078
DSA: 2811