Google Chrome vulnerabilities

CVE-2014-1748 [MEDIUM] CVE-2014-1748: The ScrollView::paint function in platform/scroll/ScrollView.cpp in Blink, as used in Google Chrome The ScrollView::paint function in platform/scroll/ScrollView.cpp in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attackers to spoof the UI by extending scrollbar painting into the parent frame.

CVE-2014-3803 [MEDIUM] CWE-200 CVE-2014-3803: The SpeechInput feature in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attac The SpeechInput feature in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attackers to enable microphone access and obtain speech-recognition text without indication via an INPUT element with a -x-webkit-speech attribute.

CVE-2014-1747 [MEDIUM] CWE-79 CVE-2014-1747: Cross-site scripting (XSS) vulnerability in the DocumentLoader::maybeCreateArchive function in core/ Cross-site scripting (XSS) vulnerability in the DocumentLoader::maybeCreateArchive function in core/loader/DocumentLoader.cpp in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attackers to inject arbitrary web script or HTML via crafted MHTML content, aka "Universal XSS (UXSS)."

CVE-2014-1746 [MEDIUM] CWE-119 CVE-2014-1746: The InMemoryUrlProtocol::Read function in media/filters/in_memory_url_protocol.cc in Google Chrome b The InMemoryUrlProtocol::Read function in media/filters/in_memory_url_protocol.cc in Google Chrome before 35.0.1916.114 relies on an insufficiently large integer data type, which allows remote attackers to cause a denial of service (out-of-bounds read) via vectors that trigger use of a large buffer.

CVE-2014-1742 [HIGH] CWE-399 CVE-2014-1742: Use-after-free vulnerability in the FrameSelection::updateAppearance function in core/editing/FrameS Use-after-free vulnerability in the FrameSelection::updateAppearance function in core/editing/FrameSelection.cpp in Blink, as used in Google Chrome before 34.0.1847.137, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper RenderObject handling.

CVE-2014-1741 [HIGH] CWE-189 CVE-2014-1741: Multiple integer overflows in the replace-data functionality in the CharacterData interface implemen Multiple integer overflows in the replace-data functionality in the CharacterData interface implementation in core/dom/CharacterData.cpp in Blink, as used in Google Chrome before 34.0.1847.137, allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to ranges.

CVE-2014-1740 [HIGH] CWE-399 CVE-2014-1740: Multiple use-after-free vulnerabilities in net/websockets/websocket_job.cc in the WebSockets impleme Multiple use-after-free vulnerabilities in net/websockets/websocket_job.cc in the WebSockets implementation in Google Chrome before 34.0.1847.137 allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to WebSocketJob deletion.

CVE-2014-1736 [HIGH] CWE-190 CVE-2014-1736: Integer overflow in api.cc in Google V8, as used in Google Chrome before 34.0.1847.131 on Windows an Integer overflow in api.cc in Google V8, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large length value.

CVE-2014-1732 [HIGH] CWE-416 CVE-2014-1732: Use-after-free vulnerability in browser/ui/views/speech_recognition_bubble_views.cc in Google Chrome Use-after-free vulnerability in browser/ui/views/speech_recognition_bubble_views.cc in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux allows remote attackers to cause a denial of service or possibly have unspecified other impact via an INPUT element that triggers the presence of a Speech Recognition Bubble windo

CVE-2014-1734 [HIGH] CVE-2014-1734: Multiple unspecified vulnerabilities in Google Chrome before 34.0.1847.131 on Windows and OS X and b Multiple unspecified vulnerabilities in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

CVE-2014-1735 [HIGH] CVE-2014-1735: Multiple unspecified vulnerabilities in Google V8 before 3.24.35.33, as used in Google Chrome before Multiple unspecified vulnerabilities in Google V8 before 3.24.35.33, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

CVE-2014-1730 [HIGH] CWE-843 CVE-2014-1730: Google V8, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.13 Google V8, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, does not properly store internationalization metadata, which allows remote attackers to bypass intended access restrictions by leveraging "type confusion" and reading property values, related to i18n.js and runtime.cc.

CVE-2014-1733 [HIGH] CWE-20 CVE-2014-1733: The PointerCompare function in codegen.cc in Seccomp-BPF, as used in Google Chrome before 34.0.1847. The PointerCompare function in codegen.cc in Seccomp-BPF, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, does not properly merge blocks, which might allow remote attackers to bypass intended sandbox restrictions by leveraging renderer access.

CVE-2014-1731 [HIGH] CWE-843 CVE-2014-1731: core/html/HTMLSelectElement.cpp in the DOM implementation in Blink, as used in Google Chrome before core/html/HTMLSelectElement.cpp in the DOM implementation in Blink, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, does not properly check renderer state upon a focus event, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage "

CVE-2014-1719 [HIGH] CWE-399 CVE-2014-1719: Use-after-free vulnerability in the WebSharedWorkerStub::OnTerminateWorkerContext function in conten Use-after-free vulnerability in the WebSharedWorkerStub::OnTerminateWorkerContext function in content/worker/websharedworker_stub.cc in the Web Workers implementation in Google Chrome before 34.0.1847.116 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via vectors that trigger a Sha

CVE-2014-1722 [HIGH] CWE-399 CVE-2014-1722: Use-after-free vulnerability in the RenderBlock::addChildIgnoringAnonymousColumnBlocks function in c Use-after-free vulnerability in the RenderBlock::addChildIgnoringAnonymousColumnBlocks function in core/rendering/RenderBlock.cpp in Blink, as used in Google Chrome before 34.0.1847.116, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving addition of a child node.

CVE-2014-1728 [HIGH] CVE-2014-1728: Multiple unspecified vulnerabilities in Google Chrome before 34.0.1847.116 allow attackers to cause Multiple unspecified vulnerabilities in Google Chrome before 34.0.1847.116 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

CVE-2014-1721 [HIGH] CWE-189 CVE-2014-1721: Google V8, as used in Google Chrome before 34.0.1847.116, does not properly implement lazy deoptimiz Google V8, as used in Google Chrome before 34.0.1847.116, does not properly implement lazy deoptimization, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted JavaScript code, as demonstrated by improper handling of a heap allocation of a number outside the Small Integer (a

CVE-2014-1727 [HIGH] CWE-399 CVE-2014-1727: Use-after-free vulnerability in content/renderer/renderer_webcolorchooser_impl.h in Google Chrome be Use-after-free vulnerability in content/renderer/renderer_webcolorchooser_impl.h in Google Chrome before 34.0.1847.116 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to forms.

CVE-2014-1723 [HIGH] CWE-20 CVE-2014-1723: The UnescapeURLWithOffsetsImpl function in net/base/escape.cc in Google Chrome before 34.0.1847.116 The UnescapeURLWithOffsetsImpl function in net/base/escape.cc in Google Chrome before 34.0.1847.116 does not properly handle bidirectional Internationalized Resource Identifiers (IRIs), which makes it easier for remote attackers to spoof URLs via crafted use of right-to-left (RTL) Unicode text.