PT-2014-5128 · Google+4 · Chrome Os+6

Publicado

2014-10-07

·

Atualizado

2024-06-15

·

CVE-2014-3188

CVSS v2.0

10

Alta

VetorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 38.0.2125.101 Chrome OS versions prior to 38.0.2125.101 Opera versions prior to 25.0.1614.50
Description The issue arises from the improper handling of the interaction between IPC and Google V8, allowing remote attackers to execute arbitrary code via vectors involving JSON data. This is related to the improper parsing of an escaped index by ParseJsonObject in json-parser.h.
Recommendations For Google Chrome versions prior to 38.0.2125.101, update to version 38.0.2125.101 or later. For Chrome OS versions prior to 38.0.2125.101, update to version 38.0.2125.101 or later. For Opera versions prior to 25.0.1614.50, update to version 25.0.1614.50 or later.

Correção

RCE

Code Injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

ALT-PU-2014-2280
CVE-2014-3188
MGASA-2014-0428
OPENSUSE-SU-2024:10171-1
OPENSUSE-SU-2024:12948-1
RHSA-2014:1626
RHSA-2014_1626
USN-2345-1

Produtos afetados

Alt Linux
Chrome Os
Google Chrome
Google V8
Opera
Red Hat
Ubuntu