MEDIUM5.0
Уязвимости операционной системы Red Hat Enterprise Linux, позволяющие удаленному злоумышленнику нарушить конфиденциальность защищаемой информации
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:NReferences
Severity:
Closed issues (29)
MEDIUM5.3
Уязвимости операционной системы Red Hat Enterprise Linux, позволяющие удаленному злоумышленнику нарушить конфиденциальность защищаемой информации
CVSS 3.xMEDIUM 5.3
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NCVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:NReferences
MEDIUM5.0
Уязвимости операционной системы Red Hat Enterprise Linux, позволяющие удаленному злоумышленнику нарушить конфиденциальность защищаемой информации
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:NReferences
MEDIUM5.3
Множественные уязвимости пакета libjpeg-turbo-static-1.2.1 операционной системы Red Hat Enterprise Linux, позволяющие удаленному злоумышленнику нарушить конфиденциальность защищаемой информации
CVSS 3.xMEDIUM 5.3
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NCVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:NReferences
MEDIUM5.0
Уязвимость операционной системы Red Hat Enterprise Linux, позволяющая удаленному злоумышленнику нарушить конфиденциальность защищаемой информации
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:NReferences
MEDIUM5.0
Уязвимость операционной системы Red Hat Enterprise Linux, позволяющая удаленному злоумышленнику нарушить конфиденциальность защищаемой информации
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:NReferences
MEDIUM5.0
Уязвимость операционной системы Red Hat Enterprise Linux, позволяющая удаленному злоумышленнику нарушить конфиденциальность защищаемой информации
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:NReferences
MEDIUM5.0
Уязвимость операционной системы CentOS, позволяющая удаленному злоумышленнику нарушить конфиденциальность защищаемой информации
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:NReferences
MEDIUM5.0
Уязвимость операционной системы CentOS, позволяющая удаленному злоумышленнику нарушить конфиденциальность защищаемой информации
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:NReferences
MEDIUM5.0
Уязвимость операционной системы CentOS, позволяющая удаленному злоумышленнику нарушить конфиденциальность защищаемой информации
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:NReferences
MEDIUM5.0
Уязвимости операционной системы CentOS, позволяющие удаленному злоумышленнику нарушить конфиденциальность защищаемой информации
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:NReferences
MEDIUM5.0
Уязвимости операционной системы CentOS, позволяющие удаленному злоумышленнику нарушить конфиденциальность защищаемой информации
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:NReferences
MEDIUM5.0
Уязвимости операционной системы CentOS, позволяющие удаленному злоумышленнику нарушить конфиденциальность защищаемой информации
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:NReferences
MEDIUM5.0
Уязвимости операционной системы CentOS, позволяющие удаленному злоумышленнику нарушить конфиденциальность защищаемой информации
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:NReferences
MEDIUM4.3
Уязвимость расширения Kaspersky Protection браузера Google Chrome, позволяющая нарушителю удалить произвольные расширения chrome
CVSS 3.xMEDIUM 4.3
CVSS:3.x/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NCVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:P/A:NReferences
CRITICAL10.0
Multiple unspecified vulnerabilities in Google Chrome before 31.0.1650.48 allow attackers to execute arbitrary code or possibly have other impact via unknown vectors.
CVSS 2.0CRITICAL 10.0
CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:CReferences
- http://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00026.html
- http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00002.html
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00042.html
- http://www.debian.org/security/2013/dsa-2799
- https://code.google.com/p/chromium/issues/detail?id=258723
- https://code.google.com/p/chromium/issues/detail?id=263255
- https://code.google.com/p/chromium/issues/detail?id=264574
- https://code.google.com/p/chromium/issues/detail?id=271235
- https://code.google.com/p/chromium/issues/detail?id=282738
- https://code.google.com/p/chromium/issues/detail?id=285578
- https://code.google.com/p/chromium/issues/detail?id=286368
- https://code.google.com/p/chromium/issues/detail?id=296276
- https://code.google.com/p/chromium/issues/detail?id=296804
- https://code.google.com/p/chromium/issues/detail?id=297556
- https://code.google.com/p/chromium/issues/detail?id=299835
- https://code.google.com/p/chromium/issues/detail?id=299993
- https://code.google.com/p/chromium/issues/detail?id=302810
- https://code.google.com/p/chromium/issues/detail?id=303232
- https://code.google.com/p/chromium/issues/detail?id=304226
- https://code.google.com/p/chromium/issues/detail?id=306255
- https://code.google.com/p/chromium/issues/detail?id=314225
- https://code.google.com/p/chromium/issues/detail?id=315823
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19183
- http://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00026.html
- http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00002.html
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00042.html
- http://www.debian.org/security/2013/dsa-2799
- https://code.google.com/p/chromium/issues/detail?id=258723
- https://code.google.com/p/chromium/issues/detail?id=263255
- https://code.google.com/p/chromium/issues/detail?id=264574
- https://code.google.com/p/chromium/issues/detail?id=271235
- https://code.google.com/p/chromium/issues/detail?id=282738
- https://code.google.com/p/chromium/issues/detail?id=285578
- https://code.google.com/p/chromium/issues/detail?id=286368
- https://code.google.com/p/chromium/issues/detail?id=296276
- https://code.google.com/p/chromium/issues/detail?id=296804
- https://code.google.com/p/chromium/issues/detail?id=297556
- https://code.google.com/p/chromium/issues/detail?id=299835
- https://code.google.com/p/chromium/issues/detail?id=299993
- https://code.google.com/p/chromium/issues/detail?id=302810
- https://code.google.com/p/chromium/issues/detail?id=303232
- https://code.google.com/p/chromium/issues/detail?id=304226
- https://code.google.com/p/chromium/issues/detail?id=306255
- https://code.google.com/p/chromium/issues/detail?id=314225
- https://code.google.com/p/chromium/issues/detail?id=315823
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19183
HIGH7.5
Use-after-free vulnerability in Google Chrome before 31.0.1650.48 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the x-webkit-speech attribute in a text INPUT element.
CVSS 2.0HIGH 7.5
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:PReferences
- http://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00026.html
- http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00002.html
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00042.html
- http://www.debian.org/security/2013/dsa-2799
- https://code.google.com/p/chromium/issues/detail?id=268565
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19006
- http://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00026.html
- http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00002.html
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00042.html
- http://www.debian.org/security/2013/dsa-2799
- https://code.google.com/p/chromium/issues/detail?id=268565
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19006
MEDIUM6.8
Use-after-free vulnerability in the HTMLMediaElement::didMoveToNewDocument function in core/html/HTMLMediaElement.cpp in Blink, as used in Google Chrome before 31.0.1650.48, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving the movement of a media element between documents.
CVSS 2.0MEDIUM 6.8
CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:PReferences
- http://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00026.html
- http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00002.html
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00042.html
- http://www.debian.org/security/2013/dsa-2799
- https://code.google.com/p/chromium/issues/detail?id=272786
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18335
- https://src.chromium.org/viewvc/blink?revision=159031&view=revision
- http://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00026.html
- http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00002.html
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00042.html
- http://www.debian.org/security/2013/dsa-2799
- https://code.google.com/p/chromium/issues/detail?id=272786
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18335
- https://src.chromium.org/viewvc/blink?revision=159031&view=revision
MEDIUM4.3
The SVG implementation in Blink, as used in Google Chrome before 31.0.1650.48, allows remote attackers to cause a denial of service (out-of-bounds read) by leveraging the use of tree order, rather than transitive dependency order, for layout.
CVSS 2.0MEDIUM 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:PReferences
- http://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00026.html
- http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00002.html
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00042.html
- http://www.debian.org/security/2013/dsa-2799
- https://code.google.com/p/chromium/issues/detail?id=282925
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19311
- https://src.chromium.org/viewvc/blink?revision=158480&view=revision
- http://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00026.html
- http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00002.html
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00042.html
- http://www.debian.org/security/2013/dsa-2799
- https://code.google.com/p/chromium/issues/detail?id=282925
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19311
- https://src.chromium.org/viewvc/blink?revision=158480&view=revision
HIGH7.5
Use-after-free vulnerability in Google Chrome before 31.0.1650.48 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving the string values of id attributes.
CVSS 2.0HIGH 7.5
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:PReferences
- http://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00026.html
- http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00002.html
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00042.html
- http://www.debian.org/security/2013/dsa-2799
- https://code.google.com/p/chromium/issues/detail?id=290566
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19168
- http://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00026.html
- http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00002.html
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00042.html
- http://www.debian.org/security/2013/dsa-2799
- https://code.google.com/p/chromium/issues/detail?id=290566
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19168
MEDIUM6.8
Use-after-free vulnerability in core/dom/ContainerNode.cpp in Blink, as used in Google Chrome before 31.0.1650.48, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper handling of DOM range objects in circumstances that require child node removal after a (1) mutation or (2) blur event.
CVSS 2.0MEDIUM 6.8
CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:PReferences
- http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html
- http://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00026.html
- http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00002.html
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00042.html
- http://support.apple.com/kb/HT6162
- http://support.apple.com/kb/HT6163
- http://www.debian.org/security/2013/dsa-2799
- https://code.google.com/p/chromium/issues/detail?id=295010
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19257
- https://src.chromium.org/viewvc/blink?revision=160037&view=revision
- https://support.apple.com/kb/HT6537
- http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html
- http://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00026.html
- http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00002.html
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00042.html
- http://support.apple.com/kb/HT6162
- http://support.apple.com/kb/HT6163
- http://www.debian.org/security/2013/dsa-2799
- https://code.google.com/p/chromium/issues/detail?id=295010
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19257
- https://src.chromium.org/viewvc/blink?revision=160037&view=revision
- https://support.apple.com/kb/HT6537
MEDIUM4.3
The WebContentsImpl::AttachInterstitialPage function in content/browser/web_contents/web_contents_impl.cc in Google Chrome before 31.0.1650.48 does not cancel JavaScript dialogs upon generating an interstitial warning, which allows remote attackers to spoof the address bar via a crafted web site.
CVSS 2.0MEDIUM 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:NReferences
- http://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00026.html
- http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00002.html
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00042.html
- http://www.debian.org/security/2013/dsa-2799
- https://code.google.com/p/chromium/issues/detail?id=295695
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18401
- https://src.chromium.org/viewvc/chrome?revision=225026&view=revision
- http://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00026.html
- http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00002.html
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00042.html
- http://www.debian.org/security/2013/dsa-2799
- https://code.google.com/p/chromium/issues/detail?id=295695
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18401
- https://src.chromium.org/viewvc/chrome?revision=225026&view=revision
MEDIUM5.0
net/http/http_stream_parser.cc in Google Chrome before 31.0.1650.48 does not properly process HTTP Informational (aka 1xx) status codes, which allows remote web servers to cause a denial of service (out-of-bounds read) via a crafted response.
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:PReferences
- http://blog.skylined.nl/20161219001.html
- http://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00026.html
- http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00002.html
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00042.html
- http://packetstormsecurity.com/files/140209/Chrome-HTTP-1xx-Out-Of-Bounds-Read.html
- http://seclists.org/fulldisclosure/2016/Dec/65
- http://www.debian.org/security/2013/dsa-2799
- https://code.google.com/p/chromium/issues/detail?id=299892
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19113
- https://src.chromium.org/viewvc/chrome?revision=226539&view=revision
- https://www.exploit-db.com/exploits/40944/
- http://blog.skylined.nl/20161219001.html
- http://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00026.html
- http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00002.html
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00042.html
- http://packetstormsecurity.com/files/140209/Chrome-HTTP-1xx-Out-Of-Bounds-Read.html
- http://seclists.org/fulldisclosure/2016/Dec/65
- http://www.debian.org/security/2013/dsa-2799
- https://code.google.com/p/chromium/issues/detail?id=299892
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19113
- https://src.chromium.org/viewvc/chrome?revision=226539&view=revision
- https://www.exploit-db.com/exploits/40944/
MEDIUM4.3
net/socket/ssl_client_socket_nss.cc in the TLS implementation in Google Chrome before 31.0.1650.48 does not ensure that a server's X.509 certificate is the same during renegotiation as it was before renegotiation, which might allow remote web servers to interfere with trust relationships by renegotiating a session.
CVSS 2.0MEDIUM 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:NReferences
- http://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00026.html
- http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00002.html
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00042.html
- http://www.debian.org/security/2013/dsa-2799
- https://code.google.com/p/chromium/issues/detail?id=306959
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19108
- https://secure-resumption.com/
- https://src.chromium.org/viewvc/chrome?revision=229611&view=revision
- http://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00026.html
- http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00002.html
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00042.html
- http://www.debian.org/security/2013/dsa-2799
- https://code.google.com/p/chromium/issues/detail?id=306959
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19108
- https://secure-resumption.com/
- https://src.chromium.org/viewvc/chrome?revision=229611&view=revision
MEDIUM5.0
The get_sos function in jdmarker.c in (1) libjpeg 6b and (2) libjpeg-turbo through 1.3.0, as used in Google Chrome before 31.0.1650.48, Ghostscript, and other products, does not check for certain duplications of component data during the reading of segments that follow Start Of Scan (SOS) JPEG markers, which allows remote attackers to obtain sensitive information from uninitialized memory locations via a crafted JPEG image.
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:NReferences
- http://advisories.mageia.org/MGASA-2013-0333.html
- http://archives.neohapsis.com/archives/fulldisclosure/2013-11/0080.html
- http://bugs.ghostscript.com/show_bug.cgi?id=686980
- http://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
- http://lists.fedoraproject.org/pipermail/package-announce/2013-December/123437.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-December/124108.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-December/124257.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-January/125470.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00026.html
- http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00002.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00085.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00086.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00087.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00119.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00120.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00121.html
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00002.html
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00042.html
- http://marc.info/?l=bugtraq&m=140852886808946&w=2
- http://marc.info/?l=bugtraq&m=140852974709252&w=2
- http://rhn.redhat.com/errata/RHSA-2013-1803.html
- http://rhn.redhat.com/errata/RHSA-2013-1804.html
- http://secunia.com/advisories/56175
- http://secunia.com/advisories/58974
- http://secunia.com/advisories/59058
- http://security.gentoo.org/glsa/glsa-201406-32.xml
- http://support.apple.com/kb/HT6150
- http://support.apple.com/kb/HT6162
- http://support.apple.com/kb/HT6163
- http://www-01.ibm.com/support/docview.wss?uid=swg21672080
- http://www-01.ibm.com/support/docview.wss?uid=swg21676746
- http://www.debian.org/security/2013/dsa-2799
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:273
- http://www.mozilla.org/security/announce/2013/mfsa2013-116.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html
- http://www.securityfocus.com/bid/63676
- http://www.securitytracker.com/id/1029470
- http://www.securitytracker.com/id/1029476
- http://www.ubuntu.com/usn/USN-2052-1
- http://www.ubuntu.com/usn/USN-2053-1
- http://www.ubuntu.com/usn/USN-2060-1
- https://access.redhat.com/errata/RHSA-2014:0413
- https://access.redhat.com/errata/RHSA-2014:0414
- https://bugzilla.mozilla.org/show_bug.cgi?id=891693
- https://code.google.com/p/chromium/issues/detail?id=258723
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2013-6629
- https://security.gentoo.org/glsa/201606-03
- https://src.chromium.org/viewvc/chrome?revision=229729&view=revision
- https://www.ibm.com/support/docview.wss?uid=swg21675973
- http://advisories.mageia.org/MGASA-2013-0333.html
- http://archives.neohapsis.com/archives/fulldisclosure/2013-11/0080.html
- http://bugs.ghostscript.com/show_bug.cgi?id=686980
- http://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
- http://lists.fedoraproject.org/pipermail/package-announce/2013-December/123437.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-December/124108.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-December/124257.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-January/125470.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00026.html
- http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00002.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00085.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00086.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00087.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00119.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00120.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00121.html
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00002.html
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00042.html
- http://marc.info/?l=bugtraq&m=140852886808946&w=2
- http://marc.info/?l=bugtraq&m=140852974709252&w=2
- http://rhn.redhat.com/errata/RHSA-2013-1803.html
- http://rhn.redhat.com/errata/RHSA-2013-1804.html
- http://secunia.com/advisories/56175
- http://secunia.com/advisories/58974
- http://secunia.com/advisories/59058
- http://security.gentoo.org/glsa/glsa-201406-32.xml
- http://support.apple.com/kb/HT6150
- http://support.apple.com/kb/HT6162
- http://support.apple.com/kb/HT6163
- http://www-01.ibm.com/support/docview.wss?uid=swg21672080
- http://www-01.ibm.com/support/docview.wss?uid=swg21676746
- http://www.debian.org/security/2013/dsa-2799
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:273
- http://www.mozilla.org/security/announce/2013/mfsa2013-116.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html
- http://www.securityfocus.com/bid/63676
- http://www.securitytracker.com/id/1029470
- http://www.securitytracker.com/id/1029476
- http://www.ubuntu.com/usn/USN-2052-1
- http://www.ubuntu.com/usn/USN-2053-1
- http://www.ubuntu.com/usn/USN-2060-1
- https://access.redhat.com/errata/RHSA-2014:0413
- https://access.redhat.com/errata/RHSA-2014:0414
- https://bugzilla.mozilla.org/show_bug.cgi?id=891693
- https://code.google.com/p/chromium/issues/detail?id=258723
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2013-6629
- https://security.gentoo.org/glsa/201606-03
- https://src.chromium.org/viewvc/chrome?revision=229729&view=revision
- https://www.ibm.com/support/docview.wss?uid=swg21675973
MEDIUM5.0
The get_dht function in jdmarker.c in libjpeg-turbo through 1.3.0, as used in Google Chrome before 31.0.1650.48 and other products, does not set all elements of a certain Huffman value array during the reading of segments that follow Define Huffman Table (DHT) JPEG markers, which allows remote attackers to obtain sensitive information from uninitialized memory locations via a crafted JPEG image.
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:NReferences
- http://advisories.mageia.org/MGASA-2013-0333.html
- http://archives.neohapsis.com/archives/fulldisclosure/2013-11/0080.html
- http://git.chromium.org/gitweb/?p=chromium/deps/libjpeg_turbo.git%3Ba=commit%3Bh=32cab49bd4cb1ce069a435fd75f9439c34ddc6f8
- http://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-December/123437.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-December/124108.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-December/124257.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-January/125470.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00026.html
- http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00002.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00085.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00086.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00087.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00119.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00120.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00121.html
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00002.html
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00042.html
- http://rhn.redhat.com/errata/RHSA-2013-1803.html
- http://secunia.com/advisories/56175
- http://www.debian.org/security/2013/dsa-2799
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:273
- http://www.mozilla.org/security/announce/2013/mfsa2013-116.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.securitytracker.com/id/1029470
- http://www.securitytracker.com/id/1029476
- http://www.ubuntu.com/usn/USN-2052-1
- http://www.ubuntu.com/usn/USN-2053-1
- http://www.ubuntu.com/usn/USN-2060-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=891693
- https://code.google.com/p/chromium/issues/detail?id=299835
- https://security.gentoo.org/glsa/201606-03
- http://advisories.mageia.org/MGASA-2013-0333.html
- http://archives.neohapsis.com/archives/fulldisclosure/2013-11/0080.html
- http://git.chromium.org/gitweb/?p=chromium/deps/libjpeg_turbo.git%3Ba=commit%3Bh=32cab49bd4cb1ce069a435fd75f9439c34ddc6f8
- http://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-December/123437.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-December/124108.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-December/124257.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-January/125470.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00026.html
- http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00002.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00085.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00086.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00087.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00119.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00120.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00121.html
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00002.html
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00042.html
- http://rhn.redhat.com/errata/RHSA-2013-1803.html
- http://secunia.com/advisories/56175
- http://www.debian.org/security/2013/dsa-2799
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:273
- http://www.mozilla.org/security/announce/2013/mfsa2013-116.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.securitytracker.com/id/1029470
- http://www.securitytracker.com/id/1029476
- http://www.ubuntu.com/usn/USN-2052-1
- http://www.ubuntu.com/usn/USN-2053-1
- http://www.ubuntu.com/usn/USN-2060-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=891693
- https://code.google.com/p/chromium/issues/detail?id=299835
- https://security.gentoo.org/glsa/201606-03
HIGH7.5
Use-after-free vulnerability in the Channel::SendRTCPPacket function in voice_engine/channel.cc in libjingle in WebRTC, as used in Google Chrome before 31.0.1650.48 and other products, allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via vectors that trigger the absence of certain statistics initialization, leading to the skipping of a required DeRegisterExternalTransport call.
CVSS 2.0HIGH 7.5
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:PReferences
- http://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00026.html
- http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00002.html
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00042.html
- http://www.debian.org/security/2013/dsa-2799
- https://code.google.com/p/chromium/issues/detail?id=296804
- https://code.google.com/p/webrtc/source/detail?r=4827
- https://webrtc-codereview.appspot.com/2275008
- http://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00026.html
- http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00002.html
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00042.html
- http://www.debian.org/security/2013/dsa-2799
- https://code.google.com/p/chromium/issues/detail?id=296804
- https://code.google.com/p/webrtc/source/detail?r=4827
- https://webrtc-codereview.appspot.com/2275008
CRITICAL9.3
Integer overflow in Google Chrome before 31.0.1650.57 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, as demonstrated during a Mobile Pwn2Own competition at PacSec 2013.
CVSS 2.0CRITICAL 9.3
CVSS:2.0/AV:N/AC:M/Au:N/C:C/I:C/A:CReferences
- http://googlechromereleases.blogspot.com/2013/11/chrome-for-android-update.html
- http://googlechromereleases.blogspot.com/2013/11/stable-channel-update_14.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00026.html
- http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00002.html
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00042.html
- http://www.debian.org/security/2013/dsa-2799
- http://www.hppwn2own.com/chrome-nexus-4-samsung-galaxy-s4-falls/
- https://code.google.com/p/chromium/issues/detail?id=319117
- https://code.google.com/p/chromium/issues/detail?id=319125
- http://googlechromereleases.blogspot.com/2013/11/chrome-for-android-update.html
- http://googlechromereleases.blogspot.com/2013/11/stable-channel-update_14.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00026.html
- http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00002.html
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00042.html
- http://www.debian.org/security/2013/dsa-2799
- http://www.hppwn2own.com/chrome-nexus-4-samsung-galaxy-s4-falls/
- https://code.google.com/p/chromium/issues/detail?id=319117
- https://code.google.com/p/chromium/issues/detail?id=319125
MEDIUM4.3
Kaspersky Protection extension for web browser Google Chrome prior to 30.112.62.0 was vulnerable to unauthorized access to its features remotely that could lead to removing other installed extensions.
CVSS 2.0MEDIUM 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:NCVSS 3.xMEDIUM 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N