Vulnetix
Try Vulnetix Request Demo
Google Security Advisories · February 2014 — Google Security Advisories
16 advisories 16 CVEs 1 EXPLOITED

GCVE / Google Cloud / Chrome / Android / Project Zero / OSS for 2014-02. Mirrored into Vulnetix VDB.

Every advisory below is enriched with the Vulnetix VDB exploit-intelligence chip (hover a CVE ID in the interactive page to see CVSS, EPSS, KEV status, and PoC maturity). 1 is already weaponised in the wild.

Back to archive Open Console

What would you fix first?

The advisories below are ordered by the Vulnetix risk prioritization strategy: exploitation evidence first, scores second. On the interactive page you can switch to three other lenses.

How Vulnetix ranks risk Get a free API key

Advisories

CVE-2014-0497

GoogleExploitedCISA KEV listedHIGH2014-02-05

Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors.

CVEs:CVE-2014-0497

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
enterprise_linux_desktop affected redhat — —
enterprise_linux_eus affected redhat — —
enterprise_linux_server affected redhat — —
enterprise_linux_server_aus affected redhat — —
enterprise_linux_workstation affected redhat — —
flash_player affected adobe — —
linux_enterprise_desktop affected suse — —
opensuse affected opensuse — —
Upstream advisory

CVE-2013-6166

GoogleActive exploitation (sightings)HIGH2014-02-15

Google Chrome before 29 sends HTTP Cookie headers without first validating that they have the required character-set restrictions, which allows remote attackers to conduct the equivalent of a persistent Logout CSRF attack via a crafted parameter that f...

CVEs:CVE-2013-6166

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
Upstream advisory

MGASA-2014-0107

Open SourceEPSS <= 49%CRITICAL2014-02-27

Updated chromium-browser-stable packages address multiple vulnerabilities

Affected products

ProductStatusVendorPackageEcosystem
chromium-browser-stable affected Mageia:3 chromium-browser-stable —
chromium-browser-stable affected Mageia:4 chromium-browser-stable —
Upstream advisory

CVE-2013-6658

GoogleEPSS <= 49%CRITICAL2014-02-21

Multiple use-after-free vulnerabilities in the layout implementation in Blink, as used in Google Chrome before 33.0.1750.117, allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving (1) runnin...

CVEs:CVE-2013-6658

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
Upstream advisory

DSA-2862-1

Open SourceEPSS <= 49%2014-02-16

chromium-browser - several

Affected products

ProductStatusVendorPackageEcosystem
chromium-browser affected Debian:7 chromium-browser —
Upstream advisory

MGASA-2014-0037

Open SourceEPSS <= 49%CRITICAL2014-02-08

Updated chromium-browser-stable package fixes multiple vulnerabilities

Affected products

ProductStatusVendorPackageEcosystem
chromium-browser-stable affected Mageia:3 chromium-browser-stable —
chromium-browser-stable affected Mageia:4 chromium-browser-stable —
Upstream advisory

CVE-2013-6661

GoogleEPSS <= 49%HIGH2014-02-21

Multiple unspecified vulnerabilities in Google Chrome before 33.0.1750.117 allow attackers to bypass the sandbox protection mechanism after obtaining renderer access, or have other impact, via unknown vectors.

CVEs:CVE-2013-6661

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
Upstream advisory

CVE-2013-4736

Open SourceEPSS <= 49%CRITICAL2014-02-10

Multiple integer overflows in the JPEG engine drivers in the MSM camera driver for the Linux kernel 2.6.x and 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allow attackers to cause a denial ...

CVEs:CVE-2013-4736

Affected products

ProductStatusVendorPackageEcosystem
android-msm affected codeaurora — —
Upstream advisory

CVE-2013-6654

GoogleEPSS <= 49%HIGH2014-02-21

The SVGAnimateElement::calculateAnimatedValue function in core/svg/SVGAnimateElement.cpp in Blink, as used in Google Chrome before 33.0.1750.117, does not properly handle unexpected data types, which allows remote attackers to cause a denial of service...

CVEs:CVE-2013-6654

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
Upstream advisory

CVE-2013-6653

GoogleEPSS <= 49%CRITICAL2014-02-21

Use-after-free vulnerability in the web contents implementation in Google Chrome before 33.0.1750.117 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving attempted conflicting access to t...

CVEs:CVE-2013-6653

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
Upstream advisory

CVE-2013-6655

GoogleEPSS <= 49%CRITICAL2014-02-21

Use-after-free vulnerability in Blink, as used in Google Chrome before 33.0.1750.117, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to improper handling of overflowchanged DOM events ...

CVEs:CVE-2013-6655

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
Upstream advisory

CVE-2013-6652

GoogleEPSS <= 49%HIGH2014-02-21

Directory traversal vulnerability in sandbox/win/src/named_pipe_dispatcher.cc in Google Chrome before 33.0.1750.117 on Windows allows attackers to bypass intended named-pipe policy restrictions in the sandbox via vectors related to (1) lack of checks f...

CVEs:CVE-2013-6652

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
Upstream advisory

CVE-2013-6657

GoogleEPSS <= 49%CRITICAL2014-02-21

core/html/parser/XSSAuditor.cpp in the XSS auditor in Blink, as used in Google Chrome before 33.0.1750.117, inserts the about:blank URL during certain blocking of FORM elements within HTTP requests, which allows remote attackers to bypass the Same Orig...

CVEs:CVE-2013-6657

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
Upstream advisory

CVE-2013-6656

GoogleEPSS <= 49%CRITICAL2014-02-21

The XSSAuditor::init function in core/html/parser/XSSAuditor.cpp in the XSS auditor in Blink, as used in Google Chrome before 33.0.1750.117, processes POST requests by using the body of a redirecting page instead of the body of a redirect target, which...

CVEs:CVE-2013-6656

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
Upstream advisory

CVE-2013-6660

GoogleEPSS <= 49%MEDIUM2014-02-21

The drag-and-drop implementation in Google Chrome before 33.0.1750.117 does not properly restrict the information in WebDropData data structures, which allows remote attackers to discover full pathnames via a crafted web site.

CVEs:CVE-2013-6660

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
Upstream advisory

CVE-2013-6659

GoogleEPSS <= 49%HIGH2014-02-21

The SSLClientSocketNSS::Core::OwnAuthCertHandler function in net/socket/ssl_client_socket_nss.cc in Google Chrome before 33.0.1750.117 does not prevent changes to server X.509 certificates during renegotiations, which allows remote SSL servers to trigg...

CVEs:CVE-2013-6659

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
Upstream advisory

Need live exploit intelligence?

Every CVE above is indexed in the Vulnetix VDB with KEV, EPSS, and PoC maturity. The interactive page surfaces that on hover.

All months Open Console