PT-2013-3822 · Google · Google Chrome Frame

Publicado 2013-03-07 · Atualizado 2013-03-08 · CVE-2013-2493

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Google Chrome Frame plugin versions prior to 26.0.1410.28

Description The issue is related to the Hook Terminate function in the Google Chrome Frame plugin, which does not properly handle attach tab requests. This allows user-assisted remote attackers to cause a denial of service, resulting in an application crash. The attack can be performed via an blank value for the target attribute of an A element.

Recommendations For Google Chrome Frame plugin versions prior to 26.0.1410.28, update to version 26.0.1410.28 or later to resolve the issue.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2013-2493

Produtos afetados

Google Chrome Frame

Referências · 6

• http://src.chromium.org/viewvc/chrome/trunk/src/chrome_frame/protocol_sink_wrap.cc?r1=185956&r2=185955&pathrev=185956 · Nota
• https://code.google.com/p/chromium/issues/detail?id=178415 · Nota
• https://chromiumcodereview.appspot.com/12395021 · Aviso do Fabricante
• http://googlechromereleases.blogspot.com/2013/03/beta-channel-update.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-2493 · Nota de Segurança
• http://src.chromium.org/viewvc/chrome?view=rev&revision=185956 · Aviso do Fabricante