CVE-2014-3195 — Google Chrome vulnerability

CWE-3997 documents7 sources
Severity
5.0MEDIUMNVD
EPSS
0.5%
top 34.35%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Google ChromeRedhat Enterprise Linux Desktop SupplementaryRedhat Enterprise Linux Server Supplementary+2 more
Timeline
PublishedOct 8
Latest updateMay 17

Description

Google V8, as used in Google Chrome before 38.0.2125.101, does not properly track JavaScript heap-memory allocations as allocations of uninitialized memory and does not properly concatenate arrays of double-precision floating-point numbers, which allows remote attackers to obtain sensitive information via crafted JavaScript code, related to the PagedSpace::AllocateRaw and NewSpace::AllocateRaw functions in heap/spaces-inl.h, the LargeObjectSpace::AllocateRaw function in heap/spaces.cc, and the R…

CVSS vector

AV:N/AC:L/C:P/I:N/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages3 packages

▶NVDgoogle/chrome38.0.2125.7

Also affects: Enterprise Linux 6.0, 6.6.z

🔴Vulnerability Details

3
GHSA
GHSA-qj6g-vf38-w7w7: Google V8, as used in Google Chrome before 38↗2022-05-17
▶
OSV
CVE-2014-3195: Google V8, as used in Google Chrome before 38↗2014-10-08
▶
CVEList
CVE-2014-3195: Google V8, as used in Google Chrome before 38↗2014-10-08
▶

📋Vendor Advisories

2
Ubuntu
Oxide vulnerabilities↗2014-10-14
▶
Red Hat
v8: information leak fixed in Google Chrome 38.0.2125.101↗2014-09-18
▶

💬Community

1
Bugzilla
CVE-2014-3195 v8: information leak fixed in Google Chrome 38.0.2125.101↗2014-10-09
▶
CVE-2014-3195 — Google Chrome vulnerability | cvebase