Google Chrome vulnerabilities

CVE-2013-6665 [HIGH] CWE-119 CVE-2013-6665: Heap-based buffer overflow in the ResourceProvider::InitializeSoftware function in cc/resources/reso Heap-based buffer overflow in the ResourceProvider::InitializeSoftware function in cc/resources/resource_provider.cc in Google Chrome before 33.0.1750.146 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large texture size that triggers improper memory allocation in the software renderer.

CVE-2013-6667 [HIGH] CVE-2013-6667: Multiple unspecified vulnerabilities in Google Chrome before 33.0.1750.146 allow attackers to cause Multiple unspecified vulnerabilities in Google Chrome before 33.0.1750.146 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

CVE-2013-6666 [MEDIUM] CWE-264 CVE-2013-6666: The PepperFlashRendererHost::OnNavigate function in renderer/pepper/pepper_flash_renderer_host.cc in The PepperFlashRendererHost::OnNavigate function in renderer/pepper/pepper_flash_renderer_host.cc in Google Chrome before 33.0.1750.146 does not verify that all headers are Cross-Origin Resource Sharing (CORS) simple headers before proceeding with a PPB_Flash.Navigate operation, which might allow remote attackers to bypass intended CORS restrictions v

CVE-2013-6658 [HIGH] CWE-399 CVE-2013-6658: Multiple use-after-free vulnerabilities in the layout implementation in Blink, as used in Google Chr Multiple use-after-free vulnerabilities in the layout implementation in Blink, as used in Google Chrome before 33.0.1750.117, allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving (1) running JavaScript code during execution of the updateWidgetPositions function or (2) making a call into a pl

CVE-2013-6655 [HIGH] CWE-399 CVE-2013-6655: Use-after-free vulnerability in Blink, as used in Google Chrome before 33.0.1750.117, allows remote Use-after-free vulnerability in Blink, as used in Google Chrome before 33.0.1750.117, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to improper handling of overflowchanged DOM events during interaction between JavaScript and layout.

CVE-2013-6652 [HIGH] CWE-22 CVE-2013-6652: Directory traversal vulnerability in sandbox/win/src/named_pipe_dispatcher.cc in Google Chrome befor Directory traversal vulnerability in sandbox/win/src/named_pipe_dispatcher.cc in Google Chrome before 33.0.1750.117 on Windows allows attackers to bypass intended named-pipe policy restrictions in the sandbox via vectors related to (1) lack of checks for .. (dot dot) sequences or (2) lack of use of the \\?\ protection mechanism.

CVE-2013-6661 [HIGH] CVE-2013-6661: Multiple unspecified vulnerabilities in Google Chrome before 33.0.1750.117 allow attackers to bypass Multiple unspecified vulnerabilities in Google Chrome before 33.0.1750.117 allow attackers to bypass the sandbox protection mechanism after obtaining renderer access, or have other impact, via unknown vectors.

CVE-2013-6653 [HIGH] CWE-399 CVE-2013-6653: Use-after-free vulnerability in the web contents implementation in Google Chrome before 33.0.1750.11 Use-after-free vulnerability in the web contents implementation in Google Chrome before 33.0.1750.117 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving attempted conflicting access to the color chooser.

CVE-2013-6654 [HIGH] CWE-20 CVE-2013-6654: The SVGAnimateElement::calculateAnimatedValue function in core/svg/SVGAnimateElement.cpp in Blink, a The SVGAnimateElement::calculateAnimatedValue function in core/svg/SVGAnimateElement.cpp in Blink, as used in Google Chrome before 33.0.1750.117, does not properly handle unexpected data types, which allows remote attackers to cause a denial of service (incorrect cast) or possibly have unspecified other impact via unknown vectors.

CVE-2013-6656 [MEDIUM] CWE-200 CVE-2013-6656: The XSSAuditor::init function in core/html/parser/XSSAuditor.cpp in the XSS auditor in Blink, as use The XSSAuditor::init function in core/html/parser/XSSAuditor.cpp in the XSS auditor in Blink, as used in Google Chrome before 33.0.1750.117, processes POST requests by using the body of a redirecting page instead of the body of a redirect target, which allows remote attackers to obtain sensitive information via unspecified vectors.

CVE-2013-6659 [MEDIUM] CWE-310 CVE-2013-6659: The SSLClientSocketNSS::Core::OwnAuthCertHandler function in net/socket/ssl_client_socket_nss.cc in The SSLClientSocketNSS::Core::OwnAuthCertHandler function in net/socket/ssl_client_socket_nss.cc in Google Chrome before 33.0.1750.117 does not prevent changes to server X.509 certificates during renegotiations, which allows remote SSL servers to trigger use of a new certificate chain, inconsistent with the user's expectations, by initiating a TLS rene

CVE-2013-6660 [MEDIUM] CWE-264 CVE-2013-6660: The drag-and-drop implementation in Google Chrome before 33.0.1750.117 does not properly restrict th The drag-and-drop implementation in Google Chrome before 33.0.1750.117 does not properly restrict the information in WebDropData data structures, which allows remote attackers to discover full pathnames via a crafted web site.

CVE-2013-6657 [MEDIUM] CWE-264 CVE-2013-6657: core/html/parser/XSSAuditor.cpp in the XSS auditor in Blink, as used in Google Chrome before 33.0.17 core/html/parser/XSSAuditor.cpp in the XSS auditor in Blink, as used in Google Chrome before 33.0.1750.117, inserts the about:blank URL during certain blocking of FORM elements within HTTP requests, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via unspecified vectors.

CVE-2013-6166 [MEDIUM] CWE-352 CVE-2013-6166: Google Chrome before 29 sends HTTP Cookie headers without first validating that they have the requir Google Chrome before 29 sends HTTP Cookie headers without first validating that they have the required character-set restrictions, which allows remote attackers to conduct the equivalent of a persistent Logout CSRF attack via a crafted parameter that forces a web application to set a malformed cookie within an HTTP response.

CVE-2014-0497 [CRITICAL] CWE-191 CVE-2014-0497: Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0. Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors.

CVE-2014-1681 [CRITICAL] CVE-2014-1681: Multiple unspecified vulnerabilities in Google Chrome before 32.0.1700.102 have unknown impact and a Multiple unspecified vulnerabilities in Google Chrome before 32.0.1700.102 have unknown impact and attack vectors, related to 12 "security fixes [that were not] either contributed by external researchers or particularly interesting."

CVE-2013-6649 [HIGH] CWE-399 CVE-2013-6649: Use-after-free vulnerability in the RenderSVGImage::paint function in core/rendering/svg/RenderSVGIm Use-after-free vulnerability in the RenderSVGImage::paint function in core/rendering/svg/RenderSVGImage.cpp in Blink, as used in Google Chrome before 32.0.1700.102, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving a zero-size SVG image.

CVE-2013-6650 [HIGH] CWE-20 CVE-2013-6650: The StoreBuffer::ExemptPopularPages function in store-buffer.cc in Google V8 before 3.22.24.16, as u The StoreBuffer::ExemptPopularPages function in store-buffer.cc in Google V8 before 3.22.24.16, as used in Google Chrome before 32.0.1700.102, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via vectors that trigger incorrect handling of "popular pages."

CVE-2013-6643 [HIGH] CWE-287 CVE-2013-6643: The OneClickSigninBubbleView::WindowClosing function in browser/ui/views/sync/one_click_signin_bubbl The OneClickSigninBubbleView::WindowClosing function in browser/ui/views/sync/one_click_signin_bubble_view.cc in Google Chrome before 32.0.1700.76 on Windows and before 32.0.1700.77 on Mac OS X and Linux allows attackers to trigger a sync with an arbitrary Google account by leveraging improper handling of the closing of an untrusted signin confirm dialo

CVE-2013-6641 [HIGH] CWE-416 CVE-2013-6641: Use-after-free vulnerability in the FormAssociatedElement::formRemovedFromTree function in core/html Use-after-free vulnerability in the FormAssociatedElement::formRemovedFromTree function in core/html/FormAssociatedElement.cpp in Blink, as used in Google Chrome before 32.0.1700.76 on Windows and before 32.0.1700.77 on Mac OS X and Linux, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improp