CVE-2014-3190
chromium: multiple security fixes in Chrome 38.0.2125.101
Severity Score
7.5
*CVSS v2
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Use-after-free vulnerability in the Event::currentTarget function in core/events/Event.cpp in Blink, as used in Google Chrome before 38.0.2125.101, allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted JavaScript code that accesses the path property of an Event object.
Vulnerabilidad de uso después de liberación en la función Event::currentTarget en core/events/Event.cpp en Blink, utilizado en Google Chrome anterior a 38.0.2125.101, permite a atacantes remotos causar una denegación de servicio (caída de la aplicación) o posiblemente tener otro impacto no especificado a través de código JavaScript manipulado que accede a la propiedad de ruta de un objeto Event.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2014-05-03 CVE Reserved
- 2014-10-08 CVE Published
- 2023-11-08 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-416: Use After Free
CAPEC
References (7)
| URL | Tag | Source |
|---|---|---|
| http://googlechromereleases.blogspot.com/2014/10/stable-channel-update.html | X_refsource_confirm | |
| http://www.securityfocus.com/bid/70273 | Vdb Entry | |
| https://crbug.com/400476 | X_refsource_confirm | |
| https://src.chromium.org/viewvc/blink?revision=181234&view=revision | X_refsource_confirm |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://rhn.redhat.com/errata/RHSA-2014-1626.html | 2023-11-07 | |
| https://access.redhat.com/security/cve/CVE-2014-3190 | 2014-10-14 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1151381 | 2014-10-14 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Google Search vendor "Google" | Chrome Search vendor "Google" for product "Chrome" | <= 38.0.2125.7 Search vendor "Google" for product "Chrome" and version " <= 38.0.2125.7" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Enterprise Linux Desktop Supplementary Search vendor "Redhat" for product "Enterprise Linux Desktop Supplementary" | 6.0 Search vendor "Redhat" for product "Enterprise Linux Desktop Supplementary" and version "6.0" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Enterprise Linux Server Supplementary Search vendor "Redhat" for product "Enterprise Linux Server Supplementary" | 6.0 Search vendor "Redhat" for product "Enterprise Linux Server Supplementary" and version "6.0" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Enterprise Linux Server Supplementary Eus Search vendor "Redhat" for product "Enterprise Linux Server Supplementary Eus" | 6.6.z Search vendor "Redhat" for product "Enterprise Linux Server Supplementary Eus" and version "6.6.z" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Enterprise Linux Workstation Supplementary Search vendor "Redhat" for product "Enterprise Linux Workstation Supplementary" | 6.0 Search vendor "Redhat" for product "Enterprise Linux Workstation Supplementary" and version "6.0" | - |
Affected
| ||||||