Vulnerabilities in Chromium Browser
Summary
DSA-2724-1: chromium-browser - several. Affects chromium-browser versions < 28.0.1500.71-1~deb7u1. Fixed in 28.0.1500.71-1~deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Chromium is an open-source web browser project that serves as the foundation for various popular browsers, including Google Chrome. It provides users with a fast and secure browsing experience, offering features such as tabbed browsing, automatic updates, and support for extensions. However, several vulnerabilities have been discovered in the Chromium browser, which could potentially compromise user security and privacy.
Vulnerability Detail
The vulnerabilities in the Chromium browser include:
- CVE-2013-2853: The HTTPS implementation does not ensure that headers are terminated by \r\n\r\n, which could lead to security issues.
- CVE-2013-2867: Chrome does not properly prevent pop-under windows, allowing potentially malicious content to be displayed.
- CVE-2013-2868: The sync_helper.cc file proceeds with sync operations for NPAPI extensions without checking for a certain plugin permission setting, which could lead to unauthorized access.
- CVE-2013-2869: A crafted JPEG2000 image can cause a denial of service (out-of-bounds read) vulnerability.
- CVE-2013-2870: A use-after-free vulnerability in network sockets could be exploited by an attacker.
- CVE-2013-2871: A use-after-free vulnerability in input handling could lead to arbitrary code execution.
- CVE-2013-2873: A use-after-free vulnerability in resource loading could be exploited to execute arbitrary code.
- CVE-2013-2875: An out-of-bounds read vulnerability in SVG file handling could lead to information disclosure.
- CVE-2013-2876: Chromium does not properly enforce restrictions on the capture of screenshots by extensions, potentially exposing sensitive information.
- CVE-2013-2877: An out-of-bounds read vulnerability in XML file handling could lead to information disclosure.
- CVE-2013-2878: An out-of-bounds read vulnerability in text handling could lead to information disclosure.
- CVE-2013-2879: The circumstances for considering a renderer process as a trusted process for sign-in and sync operations were not properly checked, potentially leading to unauthorized access.
- CVE-2013-2880: Various issues were found in the Chromium 28 development, including those discovered through internal fuzzing, audits, and other studies.
How To Fix
Minimum fixed version
28.0.1500.71-1~deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade chromium-browserTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workarounds have been mentioned for these vulnerabilities.
Conclusion
Upgrading your chromium-browser packages to the latest version is crucial to address these vulnerabilities and ensure the security of your browsing experience. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for chromium-browser →
FAQ
Chromium is an open-source web browser project that serves as the foundation for various popular browsers, including Google Chrome. It provides users with a fast and secure browsing experience.
These vulnerabilities could potentially compromise user security and privacy, allowing for unauthorized access, information disclosure, denial of service, and arbitrary code execution.
To fix these vulnerabilities, it is recommended to upgrade your chromium-browser packages to the latest available version.
No specific workarounds have been mentioned for these vulnerabilities.
You can find more information about these vulnerabilities in the Debian Security Advisory DSA-2724-1.
Related vulnerabilities
Recent vulnerabilities recorded for chromium-browser.
