Summary: | <www-client/chromium-33.0.1750.146: multiple vulnerabilities (CVE-2013-{6663,6664,6665,6666,6667,6668}) | ||
---|---|---|---|
Product: | Gentoo Security | Reporter: | Mike Gilbert <floppym> |
Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
Status: | RESOLVED FIXED | ||
Severity: | major | CC: | ago, chromium |
Priority: | Normal | ||
Version: | unspecified | ||
Hardware: | All | ||
OS: | Linux | ||
URL: | http://googlechromereleases.blogspot.com/2014/03/stable-channel-update.html | ||
Whiteboard: | A2 [glsa] | ||
Package list: | Runtime testing required: | --- |
Description
Mike Gilbert
2014-03-04 02:21:31 UTC
Please stabilize on amd64 and x86. =www-client/chromium-33.0.1750.146 amd64/x86 stable Maintainer(s), Thank you for work! Added to Existing GLSA draft. This issue was resolved and addressed in GLSA 201403-01 at http://security.gentoo.org/glsa/glsa-201403-01.xml by GLSA coordinator Mikle Kolyada (Zlogene). CVE-2013-6668 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-6668): Multiple unspecified vulnerabilities in Google V8 before 3.24.35.10, as used in Google Chrome before 33.0.1750.146, allow attackers to cause a denial of service or possibly have other impact via unknown vectors. CVE-2013-6667 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-6667): Multiple unspecified vulnerabilities in Google Chrome before 33.0.1750.146 allow attackers to cause a denial of service or possibly have other impact via unknown vectors. CVE-2013-6666 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-6666): The PepperFlashRendererHost::OnNavigate function in renderer/pepper/pepper_flash_renderer_host.cc in Google Chrome before 33.0.1750.146 does not verify that all headers are Cross-Origin Resource Sharing (CORS) simple headers before proceeding with a PPB_Flash.Navigate operation, which might allow remote attackers to bypass intended CORS restrictions via an inappropriate header. CVE-2013-6665 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-6665): Heap-based buffer overflow in the ResourceProvider::InitializeSoftware function in cc/resources/resource_provider.cc in Google Chrome before 33.0.1750.146 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large texture size that triggers improper memory allocation in the software renderer. CVE-2013-6664 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-6664): Use-after-free vulnerability in the FormAssociatedElement::formRemovedFromTree function in core/html/FormAssociatedElement.cpp in Blink, as used in Google Chrome before 33.0.1750.146, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving FORM elements, as demonstrated by use of the speech-recognition feature. CVE-2013-6663 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-6663): Use-after-free vulnerability in the SVGImage::setContainerSize function in core/svg/graphics/SVGImage.cpp in the SVG implementation in Blink, as used in Google Chrome before 33.0.1750.146, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the resizing of a view. |