CVE-2014-7941 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Google Chrome

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125 — Out-of-bounds Read6 documents6 sources

Severity

5.0MEDIUMNVD

EPSS

2.3%

top 15.39%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Google Chrome Chromium Opensuse +4 more

Timeline

PublishedJan 22

Latest updateMay 14

Description

The SelectionOwner::ProcessTarget function in ui/base/x/selection_owner.cc in the UI implementation in Google Chrome before 40.0.2214.91 uses an incorrect data type for a certain length value, which allows remote attackers to cause a denial of service (out-of-bounds read) via crafted X11 data.

CVSS vector

AV:N/AC:L/C:N/I:N/A:PExploitability: 10.0 | Impact: 2.9

Affected Packages5 packages

▶NVDgoogle/chrome40.0.2214.85

▶NVDchromium/chromium40.0.2214.110

▶NVDopensuse/opensuse13.1, 13.2+1

▶NVDredhat/enterprise_linux_desktop_supplementary6.0

▶NVDredhat/enterprise_linux_workstation_supplementary6.0

Also affects: Enterprise Linux 6.0, 6.6.z

🔴Vulnerability Details

GHSA

GHSA-6877-256j-g6q4: The SelectionOwner::ProcessTarget function in ui/base/x/selection_owner↗2022-05-14

▶

CVEList

CVE-2014-7941: The SelectionOwner::ProcessTarget function in ui/base/x/selection_owner↗2015-01-22

▶

OSV

CVE-2014-7941: The SelectionOwner::ProcessTarget function in ui/base/x/selection_owner↗2015-01-22

▶

📋Vendor Advisories

Red Hat

chromium-browser: out-of-bounds read in UI↗2015-01-21

▶

💬Community

Bugzilla

CVE-2014-7941 chromium-browser: out-of-bounds read in UI↗2015-01-23

▶