CVSS: 10.0EPSS: 0%CPEs: 125EXPL: 0CVE-2014-1704 – v8: multiple vulnerabilities fixed in Google Chrome version 33.0.1750.149
https://notcve.org/view.php?id=CVE-2014-1704
Multiple unspecified vulnerabilities in Google V8 before 3.23.17.18, as used in Google Chrome before 33.0.1750.149, allow attackers to cause a denial of service or possibly have other impact via unknown vectors. Múltiples vulnerabilidades no especificadas en Google V8 anterior a 3.23.17.18, utilizado en Google Chrome anterior a 33.0.1750.149, permiten a atacantes remotos causar una denegación de servicio o posiblemente tener otro impacto a través de vectores desconocidos. • http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_11.html http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00008.html http://security.gentoo.org/glsa/glsa-201408-16.xml http://www.debian.org/security/2014/dsa-2883 http://www.securitytracker.com/id/1029914 https://code.google.com/p/chromium/issues/detail?id=328202 https://code.google.com/p/chromium/issues/detail?id=345715 https://code.google.com/p/chromium/issues/detail?id=349079 https://code •
CVSS: 7.5EPSS: 3%CPEs: 5EXPL: 0CVE-2014-1713 – Google Chrome Blink Use-After-Free Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2014-1713
Use-after-free vulnerability in the AttributeSetter function in bindings/templates/attributes.cpp in the bindings in Blink, as used in Google Chrome before 33.0.1750.152 on OS X and Linux and before 33.0.1750.154 on Windows, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving the document.location value. Vulnerabilidad de uso después de liberación en la función AttributeSetter en bindings/templates/attributes.cpp en los enlaces en Blink, utilizado en Google Chrome anterior a 33.0.1750.152 en OS X y Linux y anterior a 33.0.1750.154 en Windows, permite a atacantes remotos causar una denegación de servicio o posiblemente tener otro impacto no especificado a través de vectores involucrando el valor document.location. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Google Chrome. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Blink bindings. By manipulating a document's elements an attacker can force a dangling pointer to be reused after it has been freed. • http://archives.neohapsis.com/archives/bugtraq/2014-03/0144.html http://archives.neohapsis.com/archives/bugtraq/2014-04/0009.html http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html http://googlechromereleases.blogspot.com/2014/03/stable-channel-update-for-chrome-os_14.html http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_14.html http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00008.htm • CWE-416: Use After Free •
CVSS: 7.5EPSS: 1%CPEs: 5EXPL: 0CVE-2014-1714 – Google Chrome Clipboard Sandbox Escape Vulnerability
https://notcve.org/view.php?id=CVE-2014-1714
The ScopedClipboardWriter::WritePickledData function in ui/base/clipboard/scoped_clipboard_writer.cc in Google Chrome before 33.0.1750.152 on OS X and Linux and before 33.0.1750.154 on Windows does not verify a certain format value, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the clipboard. La función ScopedClipboardWriter::WritePickledData en ui/base/clipboard/scoped_clipboard_writer.cc en Google Chrome anterior a 33.0.1750.152 en OS X y Linux y anterior a 33.0.1750.154 en Windows no verifica cierto valor de formato, lo que permite a atacantes remotos causar una denegación de servicio o posiblemente tener otro impacto no especificado a través de vectores relacionados con el portapapeles. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Google Chrome. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the Microsoft Windows Clipboard. An attacker can leverage this vulnerability to execute code under the context of the broker process. • http://archives.neohapsis.com/archives/bugtraq/2014-03/0143.html http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_14.html http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00008.html http://security.gentoo.org/glsa/glsa-201408-16.xml https://code.google.com/p/chromium/issues/detail?id=352395 https://src.chromium.org/viewvc/chrome?revision=256974&view=revision • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2014-1715 – Google Chrome Directory Traversal Sandbox Escape Vulnerability
https://notcve.org/view.php?id=CVE-2014-1715
Directory traversal vulnerability in Google Chrome before 33.0.1750.152 on OS X and Linux and before 33.0.1750.154 on Windows has unspecified impact and attack vectors. Vulnerabilidad de salto de directorio en Google Chrome anterior a 33.0.1750.152 en OS X y Linux y anterior a 33.0.1750.154 en Windows tiene vectores de impacto y ataque no especificados. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Google Chrome. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of directories. The issue lies in the failure to fully check for directory traversal attempts. • http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_14.html http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00008.html http://security.gentoo.org/glsa/glsa-201408-16.xml http://www.debian.org/security/2014/dsa-2883 http://www.securityfocus.com/bid/66249 https://code.google.com/p/chromium/issues/detail?id=352429 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 1%CPEs: 107EXPL: 0CVE-2014-1700
https://notcve.org/view.php?id=CVE-2014-1700
Use-after-free vulnerability in modules/speech/SpeechSynthesis.cpp in Blink, as used in Google Chrome before 33.0.1750.149, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper handling of a certain utterance data structure. Vulnerabilidad de uso después de liberación en modules/speech/SpeechSynthesis.cpp en Blink, utilizado en Google Chrome anterior a 33.0.1750.149, permite a atacantes remotos causar una denegación de servicio o posiblemente tener otro impacto no especificado mediante el aprovechamiento de cierta estructura de datos de pronunciación. • http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_11.html http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00008.html http://security.gentoo.org/glsa/glsa-201408-16.xml http://www.debian.org/security/2014/dsa-2883 http://www.securitytracker.com/id/1029914 https://code.google.com/p/chromium/issues/detail?id=344881 https://src.chromium.org/viewvc/blink?revision=168171&view=revision • CWE-399: Resource Management Errors •