PT-2014-3164 · Google+1 · Google Chrome+1

Publicado 2014-03-03 · Atualizado 2017-01-07 · CVE-2013-6666

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 33.0.1750.146

Description The issue is related to the PepperFlashRendererHost::OnNavigate function, which does not properly verify that all headers are Cross-Origin Resource Sharing (CORS) simple headers before proceeding with a PPB Flash.Navigate operation. This could potentially allow remote attackers to bypass intended CORS restrictions via an inappropriate header.

Recommendations For versions prior to 33.0.1750.146, update to version 33.0.1750.146 or later to resolve the issue.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

ALT-PU-2014-1282

CVE-2013-6666

DSA-2883-1

MGASA-2014-0121

Produtos afetados

Alt Linux

Google Chrome

Referências · 34

• 🔥 https://github.com/Metnew/uxss-db/tree/master/chrome/CVE-2014-1701 · Exploit
• https://errata.altlinux.org/ALT-PU-2014-1282 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6666 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1700 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6663 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6667 · Nota de Segurança
• https://advisories.mageia.org/MGASA-2014-0121.html · Nota de Segurança
• https://bugs.mageia.org/show_bug.cgi?id=12945 · Nota
• http://securityfocus.com/bid/65930 · Nota
• https://packages.altlinux.org/ru/vuln/CVE-2013-6666 · Nota
• http://googlechromereleases.blogspot.com/2014/03/stable-channel-update.html · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6658 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1702 · Nota de Segurança
• https://osv.dev/vulnerability/MGASA-2014-0121 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1704 · Nota de Segurança