Google Chrome Releases reports :

[172243] High CVE-2013-0879: Memory corruption with web audio node.
Credit to Atte Kettunen of OUSPG.

[171951] High CVE-2013-0880: Use-after-free in database handling.
Credit to Chamal de Silva.

[167069] Medium CVE-2013-0881: Bad read in Matroska handling. Credit to Atte Kettunen of OUSPG.

[165432] High CVE-2013-0882: Bad memory access with excessive SVG parameters. Credit to Renata Hodovan.

[142169] Medium CVE-2013-0883: Bad read in Skia. Credit to Atte Kettunen of OUSPG.

[172984] Low CVE-2013-0884: Inappropriate load of NaCl. Credit to Google Chrome Security Team (Chris Evans).

[172369] Medium CVE-2013-0885: Too many API permissions granted to web store.

[171065] [170836] Low CVE-2013-0887: Developer tools process has too many permissions and places too much trust in the connected server.

[170666] Medium CVE-2013-0888: Out-of-bounds read in Skia. Credit to Google Chrome Security Team (Inferno).

[170569] Low CVE-2013-0889: Tighten user gesture check for dangerous file downloads.

[169973] [169966] High CVE-2013-0890: Memory safety issues across the IPC layer. Credit to Google Chrome Security Team (Chris Evans).

[169685] High CVE-2013-0891: Integer overflow in blob handling. Credit to Google Chrome Security Team (Juri Aedla).

[169295] [168710] [166493] [165836] [165747] [164958] [164946] Medium CVE-2013-0892: Lower severity issues across the IPC layer. Credit to Google Chrome Security Team (Chris Evans).

[168570] Medium CVE-2013-0893: Race condition in media handling.
Credit to Andrew Scherkus of the Chromium development community.

[168473] High CVE-2013-0894: Buffer overflow in vorbis decoding.
Credit to Google Chrome Security Team (Inferno).

[Linux / Mac] [167840] High CVE-2013-0895: Incorrect path handling in file copying. Credit to Google Chrome Security Team (Juri Aedla).

[166708] High CVE-2013-0896: Memory management issues in plug-in message handling. Credit to Google Chrome Security Team (Cris Neckar).

[165537] Low CVE-2013-0897: Off-by-one read in PDF. Credit to Mateusz Jurczyk, with contributions by Gynvael Coldwind, both from Google Security Team.

[164643] High CVE-2013-0898: Use-after-free in URL handling. Credit to Alexander Potapenko of the Chromium development community.

[160480] Low CVE-2013-0899: Integer overflow in Opus handling. Credit to Google Chrome Security Team (Juri Aedla).

[152442] Medium CVE-2013-0900: Race condition in ICU. Credit to Google Chrome Security Team (Inferno).

The remote host is affected by the vulnerability described in GLSA-201309-16 (Chromium, V8: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and V8. Please       review the CVE identifiers and release notes referenced below for       details.
  Impact :

    A context-dependent attacker could entice a user to open a specially       crafted website or JavaScript program using Chromium or V8, possibly       resulting in the execution of arbitrary code with the privileges of the       process or a Denial of Service condition. Furthermore, a remote attacker       may be able to bypass security restrictions or have other, unspecified,       impact.
  Workaround :

    There is no known workaround at this time.

chromium was updated to version 27.0.1425 having both stability and security fixes :

  - Bug and stability fixes :

  - Fixed crash after clicking through malware warning.
    (Issue: 173986)

  - Fixed broken command line to create extensions with     locale info (Issue: 176187)

  - Hosted apps in Chrome will always be opened from app     launcher. (Issue: 176267)

  - Added modal confirmation dialog to the enterprise     profile sign-in flow. (Issue: 171236)

  - Fixed a crash with autofill. (Issues: 175454, 176576)

  - Fixed issues with sign-in. (Issues: 175672, 175819,     175541, 176190)

  - Fixed spurious profile shortcuts created with a     system-level install. (Issue: 177047)

  - Fixed the background tab flashing with certain themes.
    (Issue: 175426)

  - Security Fixes: (bnc#804986)

  - High CVE-2013-0879: Memory corruption with web audio     node

  - High CVE-2013-0880: Use-after-free in database handling

  - Medium CVE-2013-0881: Bad read in Matroska handling

  - High CVE-2013-0882: Bad memory access with excessive SVG     parameters.

  - Medium CVE-2013-0883: Bad read in Skia.

  - Low CVE-2013-0884: Inappropriate load of NaCl.

  - Medium CVE-2013-0885: Too many API permissions granted     to web store

  - Medium CVE-2013-0886: Incorrect NaCl signal handling. 

  - Low CVE-2013-0887: Developer tools process has too many     permissions and places too much trust in the connected     server

  - Medium CVE-2013-0888: Out-of-bounds read in Skia

  - Low CVE-2013-0889: Tighten user gesture check for     dangerous file downloads.

  - High CVE-2013-0890: Memory safety issues across the IPC     layer.

  - High CVE-2013-0891: Integer overflow in blob handling.

  - Medium CVE-2013-0892: Lower severity issues across the     IPC layer

  - Medium CVE-2013-0893: Race condition in media handling.

  - High CVE-2013-0894: Buffer overflow in vorbis decoding.

  - High CVE-2013-0895: Incorrect path handling in file     copying.

  - High CVE-2013-0896: Memory management issues in plug-in     message handling

  - Low CVE-2013-0897: Off-by-one read in PDF

  - High CVE-2013-0898: Use-after-free in URL handling

  - Low CVE-2013-0899: Integer overflow in Opus handling

  - Medium CVE-2013-0900: Race condition in ICU

  - Make adjustment for autodetecting of the PepperFlash     library. The package with the PepperFlash hopefully will     be soon available through packman

  - Update to 26.0.1411

  - Bug and stability fixes

  - Update to 26.0.1403

  - Bug and stability fixes

  - Using system libxml2 requires system libxslt.

  - Using system MESA does not work in i586 for some reason.

  - Also use system MESA, factory version seems adecuate     now. 

  - Always use system libxml2.

  - Restrict the usage of system libraries instead of the     bundled ones to new products, too much hassle otherwise.

  - Also link kerberos and libgps directly, do not dlopen     them. 

  - Avoid using dlopen on system libraries, rpm or the     package Manager do not handle this at all. tested for a     few weeks and implemented with a macro so it can be     easily disabled if problems arise.

  - Use SOME system libraries instead of the bundled ones,     tested for several weeks and implemented with a macro     for easy enable/Disable in case of trouble.

  - Update to 26.0.1393

  - Bug and stability fixes

  - Security fixes 

  - Update to 26.0.1375

  - Bug and stability fixes

  - Update to 26.0.1371

  - Bug and stability fixes

  - Update to 26.0.1367

  - Bug and stability fixes

ID	Name	Product	Family	Published	Updated	Severity
64859	FreeBSD : chromium -- multiple vulnerabilities (dfd92cb2-7d48-11e2-ad48-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	2/24/2013	1/6/2021	high
70112	GLSA-201309-16 : Chromium, V8: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	9/25/2013	1/6/2021	critical
74920	openSUSE Security Update : chromium (openSUSE-SU-2013:0454-1)	Nessus	SuSE Local Security Checks	6/13/2014	1/19/2021	high

Detections

Analytics

Plugins Search

high

critical

high