PT-2014-1374 · Google+2 · Google Chrome+2

Published 2014-08-26 · Updated 2024-06-15 · CVE-2014-3172

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 37.0.2062.94

Description The issue exists due to the lack of URL validation in the Debugger extension API before an attach operation. This allows remote attackers to bypass access limitations by using an extension with a restricted URL, such as a chrome:// URL.

Recommendations For versions prior to 37.0.2062.94, update to version 37.0.2062.94 or later to resolve the issue. As a temporary workaround, consider restricting access to the debugger api.cc module to minimize the risk of exploitation. Avoid using restricted URLs, such as chrome:// URLs, in extensions until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

ALT-PU-2014-2044

BDU:2015-00236

CVE-2014-3172

DSA-3039-1

OPENSUSE-SU-2014_1151-1

OPENSUSE-SU-2024:10171-1

OPENSUSE-SU-2024:12948-1

Affected Products

Alt Linux

Google Chrome

Suse

References · 2385

• 🔥 https://github.com/tunz/js-vuln-db/blob/master/v8/CVE-2014-3176.md · Exploit
• http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00027.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3176 · Security Note
• https://bdu.fstec.ru/vul/2015-00236 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3177 · Security Note
• https://bdu.fstec.ru/vul/2015-00202 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10171-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3169 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3170 · Security Note
• http://security.gentoo.org/glsa/glsa-201408-16.xml · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3174 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:12948-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-00195 · Security Note
• https://ubuntu.com/security/CVE-2014-3172 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-3172 · Security Note