Bugzilla – Bug 850430
VUL-0: CVE-2013-2931: chromium-browser: Google Chrome before 31.0.1650.48 multiple vulnerabilities
Last modified: 2016-04-27 19:58:58 UTC
tracking bug for the following vulnerabilites: CVE-2013-6621 Use-after-free vulnerability allows remote attackers to cause a denial of service CVE-2013-6622 Use-after-free vulnerability in the HTMLMediaElement::didMoveToNewDocument function in core/html/HTMLMediaElement.cpp in Blink allows remote attackers to cause a denial of service CVE-2013-6623 SVG implementation in Blink, allows remote attackers to cause a denial of service CVE-2013-6624 Use-after-free vulnerability allows remote attackers to cause a denial of service CVE-2013-6625 Use-after-free vulnerability in core/dom/ContainerNode.cpp in Blink, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper handling of DOM range objects. CVE-2013-6626 WebContentsImpl::AttachInterstitialPage function in content/browser/web_contents/web_contents_impl.cc idoes not cancel JavaScript dialogs upon generating an interstitial warning, which allows remote attackers to spoof the address bar via a crafted web site. CVE-2013-6627 net/http/http_stream_parser.cc does not properly process HTTP Informational (aka 1xx) status codes, which allows remote web servers to cause a denial of service (out-of-bounds read) via a crafted response. CVE-2013-6628 net/socket/ssl_client_socket_nss.cc in the TLS implementation does not ensure that a server's X.509 certificate is the same during renegotiation as it was before renegotiation, which might allow remote web servers to interfere with trust relationships by renegotiating a session. CVE-2013-2931 Multiple unspecified vulnerabilities in Google Chrome before 31.0.1650.48 allow attackers to execute arbitrary code or possibly have other impact via unknown vectors. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-6621 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-6622 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-6623 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-6624 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-6625 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-6626 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-6627 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-6628 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-6631
The SWAMPID for this issue is 55102. This issue was rated as important. Please submit fixed packages until 2013-11-21. When done, please reassign the bug to security-team@suse.de. Patchinfo will be handled by security team.
Issue is canceled already. assign to opensuse maintainer
bugbot adjusting priority
this week some new chromium vulnerabilities were disclosured: CVE-2013-6629 (get_sos function in jdmarker.c in libjpeg 6b and libjpeg-turbo leak sensitive data): http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-6629 CVE-2013-6630 (get_dht function in jdmarker.c in libjpeg-turbo leak sensitive information) http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-6630 CVE-2013-6632 (Integer overflow allows remote attackers to execute arbitrary code) http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-6632 CVE-2013-6802 (sandobox restrictions bypass by leveraging access to a renderer process) http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-6802
openSUSE-SU-2013:1776-1: An update that fixes 17 vulnerabilities is now available. Category: security (important) Bug References: 849715,850430 CVE References: CVE-2013-2925,CVE-2013-2926,CVE-2013-2927,CVE-2013-2928,CVE-2013-2931,CVE-2013-6621,CVE-2013-6622,CVE-2013-6623,CVE-2013-6624,CVE-2013-6625,CVE-2013-6626,CVE-2013-6627,CVE-2013-6628,CVE-2013-6629,CVE-2013-6630,CVE-2013-6631,CVE-2013-6632 Sources used: openSUSE 12.3 (src): chromium-31.0.1650.57-1.17.1
openSUSE-SU-2013:1777-1: An update that fixes 13 vulnerabilities is now available. Category: security (important) Bug References: 850430 CVE References: CVE-2013-2931,CVE-2013-6621,CVE-2013-6622,CVE-2013-6623,CVE-2013-6624,CVE-2013-6625,CVE-2013-6626,CVE-2013-6627,CVE-2013-6628,CVE-2013-6629,CVE-2013-6630,CVE-2013-6631,CVE-2013-6632 Sources used: openSUSE 12.2 (src): chromium-31.0.1650.57-1.54.1
done