ID CVE-2013-0908
Summary Google Chrome before 25.0.1364.152 does not properly manage bindings of extension processes, which has unspecified impact and attack vectors.
References
Vulnerable Configurations
  • Google Chrome 25.0.1364.35
    cpe:2.3:a:google:chrome:25.0.1364.35
  • Google Chrome 25.0.1364.36
    cpe:2.3:a:google:chrome:25.0.1364.36
  • Google Chrome 25.0.1364.33
    cpe:2.3:a:google:chrome:25.0.1364.33
  • Google Chrome 25.0.1364.34
    cpe:2.3:a:google:chrome:25.0.1364.34
  • Google Chrome 25.0.1364.39
    cpe:2.3:a:google:chrome:25.0.1364.39
  • Google Chrome 25.0.1364.40
    cpe:2.3:a:google:chrome:25.0.1364.40
  • Google Chrome 25.0.1364.37
    cpe:2.3:a:google:chrome:25.0.1364.37
  • Google Chrome 25.0.1364.38
    cpe:2.3:a:google:chrome:25.0.1364.38
  • Google Chrome 25.0.1364.43
    cpe:2.3:a:google:chrome:25.0.1364.43
  • Google Chrome 25.0.1364.44
    cpe:2.3:a:google:chrome:25.0.1364.44
  • Google Chrome 25.0.1364.41
    cpe:2.3:a:google:chrome:25.0.1364.41
  • Google Chrome 25.0.1364.42
    cpe:2.3:a:google:chrome:25.0.1364.42
  • Google Chrome 25.0.1364.47
    cpe:2.3:a:google:chrome:25.0.1364.47
  • Google Chrome 25.0.1364.48
    cpe:2.3:a:google:chrome:25.0.1364.48
  • Google Chrome 25.0.1364.45
    cpe:2.3:a:google:chrome:25.0.1364.45
  • Google Chrome 25.0.1364.46
    cpe:2.3:a:google:chrome:25.0.1364.46
  • Google Chrome 25.0.1364.52
    cpe:2.3:a:google:chrome:25.0.1364.52
  • Google Chrome 25.0.1364.51
    cpe:2.3:a:google:chrome:25.0.1364.51
  • Google Chrome 25.0.1364.50
    cpe:2.3:a:google:chrome:25.0.1364.50
  • Google Chrome 25.0.1364.49
    cpe:2.3:a:google:chrome:25.0.1364.49
  • Google Chrome 25.0.1364.56
    cpe:2.3:a:google:chrome:25.0.1364.56
  • Google Chrome 25.0.1364.55
    cpe:2.3:a:google:chrome:25.0.1364.55
  • Google Chrome 25.0.1364.54
    cpe:2.3:a:google:chrome:25.0.1364.54
  • Google Chrome 25.0.1364.53
    cpe:2.3:a:google:chrome:25.0.1364.53
  • Google Chrome 25.0.1364.62
    cpe:2.3:a:google:chrome:25.0.1364.62
  • Google Chrome 25.0.1364.61
    cpe:2.3:a:google:chrome:25.0.1364.61
  • Google Chrome 25.0.1364.58
    cpe:2.3:a:google:chrome:25.0.1364.58
  • Google Chrome 25.0.1364.57
    cpe:2.3:a:google:chrome:25.0.1364.57
  • Google Chrome 25.0.1364.67
    cpe:2.3:a:google:chrome:25.0.1364.67
  • Google Chrome 25.0.1364.66
    cpe:2.3:a:google:chrome:25.0.1364.66
  • Google Chrome 25.0.1364.65
    cpe:2.3:a:google:chrome:25.0.1364.65
  • Google Chrome 25.0.1364.63
    cpe:2.3:a:google:chrome:25.0.1364.63
  • Google Chrome 25.0.1364.0
    cpe:2.3:a:google:chrome:25.0.1364.0
  • Google Chrome 25.0.1364.1
    cpe:2.3:a:google:chrome:25.0.1364.1
  • Google Chrome 25.0.1364.2
    cpe:2.3:a:google:chrome:25.0.1364.2
  • Google Chrome 25.0.1364.3
    cpe:2.3:a:google:chrome:25.0.1364.3
  • Google Chrome 25.0.1364.5
    cpe:2.3:a:google:chrome:25.0.1364.5
  • Google Chrome 25.0.1364.7
    cpe:2.3:a:google:chrome:25.0.1364.7
  • Google Chrome 25.0.1364.8
    cpe:2.3:a:google:chrome:25.0.1364.8
  • Google Chrome 25.0.1364.9
    cpe:2.3:a:google:chrome:25.0.1364.9
  • Google Chrome 25.0.1364.10
    cpe:2.3:a:google:chrome:25.0.1364.10
  • Google Chrome 25.0.1364.11
    cpe:2.3:a:google:chrome:25.0.1364.11
  • Google Chrome 25.0.1364.12
    cpe:2.3:a:google:chrome:25.0.1364.12
  • Google Chrome 25.0.1364.13
    cpe:2.3:a:google:chrome:25.0.1364.13
  • Google Chrome 25.0.1364.14
    cpe:2.3:a:google:chrome:25.0.1364.14
  • Google Chrome 25.0.1364.15
    cpe:2.3:a:google:chrome:25.0.1364.15
  • Google Chrome 25.0.1364.16
    cpe:2.3:a:google:chrome:25.0.1364.16
  • Google Chrome 25.0.1364.18
    cpe:2.3:a:google:chrome:25.0.1364.18
  • Google Chrome 25.0.1364.17
    cpe:2.3:a:google:chrome:25.0.1364.17
  • Google Chrome 25.0.1364.20
    cpe:2.3:a:google:chrome:25.0.1364.20
  • Google Chrome 25.0.1364.19
    cpe:2.3:a:google:chrome:25.0.1364.19
  • Google Chrome 25.0.1364.22
    cpe:2.3:a:google:chrome:25.0.1364.22
  • Google Chrome 25.0.1364.21
    cpe:2.3:a:google:chrome:25.0.1364.21
  • Google Chrome 25.0.1364.24
    cpe:2.3:a:google:chrome:25.0.1364.24
  • Google Chrome 25.0.1364.23
    cpe:2.3:a:google:chrome:25.0.1364.23
  • Google Chrome 25.0.1364.26
    cpe:2.3:a:google:chrome:25.0.1364.26
  • Google Chrome 25.0.1364.25
    cpe:2.3:a:google:chrome:25.0.1364.25
  • Google Chrome 25.0.1364.28
    cpe:2.3:a:google:chrome:25.0.1364.28
  • Google Chrome 25.0.1364.27
    cpe:2.3:a:google:chrome:25.0.1364.27
  • Google Chrome 25.0.1364.30
    cpe:2.3:a:google:chrome:25.0.1364.30
  • Google Chrome 25.0.1364.29
    cpe:2.3:a:google:chrome:25.0.1364.29
  • Google Chrome 25.0.1364.32
    cpe:2.3:a:google:chrome:25.0.1364.32
  • Google Chrome 25.0.1364.31
    cpe:2.3:a:google:chrome:25.0.1364.31
  • Google Chrome 25.0.1364.74
    cpe:2.3:a:google:chrome:25.0.1364.74
  • Google Chrome 25.0.1364.75
    cpe:2.3:a:google:chrome:25.0.1364.75
  • Google Chrome 25.0.1364.76
    cpe:2.3:a:google:chrome:25.0.1364.76
  • Google Chrome 25.0.1364.77
    cpe:2.3:a:google:chrome:25.0.1364.77
  • Google Chrome 25.0.1364.68
    cpe:2.3:a:google:chrome:25.0.1364.68
  • Google Chrome 25.0.1364.70
    cpe:2.3:a:google:chrome:25.0.1364.70
  • Google Chrome 25.0.1364.72
    cpe:2.3:a:google:chrome:25.0.1364.72
  • Google Chrome 25.0.1364.73
    cpe:2.3:a:google:chrome:25.0.1364.73
  • Google Chrome 25.0.1364.82
    cpe:2.3:a:google:chrome:25.0.1364.82
  • Google Chrome 25.0.1364.84
    cpe:2.3:a:google:chrome:25.0.1364.84
  • Google Chrome 25.0.1364.85
    cpe:2.3:a:google:chrome:25.0.1364.85
  • Google Chrome 25.0.1364.86
    cpe:2.3:a:google:chrome:25.0.1364.86
  • Google Chrome 25.0.1364.78
    cpe:2.3:a:google:chrome:25.0.1364.78
  • Google Chrome 25.0.1364.79
    cpe:2.3:a:google:chrome:25.0.1364.79
  • Google Chrome 25.0.1364.80
    cpe:2.3:a:google:chrome:25.0.1364.80
  • Google Chrome 25.0.1364.81
    cpe:2.3:a:google:chrome:25.0.1364.81
  • Google Chrome 25.0.1364.92
    cpe:2.3:a:google:chrome:25.0.1364.92
  • Google Chrome 25.0.1364.91
    cpe:2.3:a:google:chrome:25.0.1364.91
  • Google Chrome 25.0.1364.98
    cpe:2.3:a:google:chrome:25.0.1364.98
  • Google Chrome 25.0.1364.93
    cpe:2.3:a:google:chrome:25.0.1364.93
  • Google Chrome 25.0.1364.88
    cpe:2.3:a:google:chrome:25.0.1364.88
  • Google Chrome 25.0.1364.87
    cpe:2.3:a:google:chrome:25.0.1364.87
  • Google Chrome 25.0.1364.90
    cpe:2.3:a:google:chrome:25.0.1364.90
  • Google Chrome 25.0.1364.89
    cpe:2.3:a:google:chrome:25.0.1364.89
  • Google Chrome 25.0.1364.95
    cpe:2.3:a:google:chrome:25.0.1364.95
  • Google Chrome 25.0.1364.99
    cpe:2.3:a:google:chrome:25.0.1364.99
  • Google Chrome 25.0.1364.108
    cpe:2.3:a:google:chrome:25.0.1364.108
  • Google Chrome 25.0.1364.110
    cpe:2.3:a:google:chrome:25.0.1364.110
  • Google Chrome 25.0.1364.112
    cpe:2.3:a:google:chrome:25.0.1364.112
  • Google Chrome 25.0.1364.113
    cpe:2.3:a:google:chrome:25.0.1364.113
  • Google Chrome 25.0.1364.114
    cpe:2.3:a:google:chrome:25.0.1364.114
  • Google Chrome 25.0.1364.115
    cpe:2.3:a:google:chrome:25.0.1364.115
  • Google Chrome 25.0.1364.116
    cpe:2.3:a:google:chrome:25.0.1364.116
  • Google Chrome 25.0.1364.117
    cpe:2.3:a:google:chrome:25.0.1364.117
  • Google Chrome 25.0.1364.118
    cpe:2.3:a:google:chrome:25.0.1364.118
  • Google Chrome 25.0.1364.119
    cpe:2.3:a:google:chrome:25.0.1364.119
  • Google Chrome 25.0.1364.120
    cpe:2.3:a:google:chrome:25.0.1364.120
  • Google Chrome 25.0.1364.121
    cpe:2.3:a:google:chrome:25.0.1364.121
  • Google Chrome 25.0.1364.122
    cpe:2.3:a:google:chrome:25.0.1364.122
  • Google Chrome 25.0.1364.123
    cpe:2.3:a:google:chrome:25.0.1364.123
  • Google Chrome 25.0.1364.124
    cpe:2.3:a:google:chrome:25.0.1364.124
  • Google Chrome 25.0.1364.125
    cpe:2.3:a:google:chrome:25.0.1364.125
  • Google Chrome 25.0.1364.126
    cpe:2.3:a:google:chrome:25.0.1364.126
CVSS
Base: 7.5 (as of 13-10-2016 - 09:38)
Impact:
Exploitability:
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
nessus via4
  • NASL family FreeBSD Local Security Checks
    NASL id FREEBSD_PKG_40D5AB3785F211E2B52800262D5ED8EE.NASL
    description Google Chrome Releases reports : [176882] High CVE-2013-0902: Use-after-free in frame loader. Credit to Chamal de Silva. [176252] High CVE-2013-0903: Use-after-free in browser navigation handling. Credit to 'chromium.khalil'. [172926] [172331] High CVE-2013-0904: Memory corruption in Web Audio. Credit to Atte Kettunen of OUSPG. [168982] High CVE-2013-0905: Use-after-free with SVG animations. Credit to Atte Kettunen of OUSPG. [174895] High CVE-2013-0906: Memory corruption in Indexed DB. Credit to Google Chrome Security Team (Juri Aedla). [174150] Medium CVE-2013-0907: Race condition in media thread handling. Credit to Andrew Scherkus of the Chromium development community. [174059] Medium CVE-2013-0908: Incorrect handling of bindings for extension processes. [173906] Low CVE-2013-0909: Referer leakage with XSS Auditor. Credit to Egor Homakov. [172573] Medium CVE-2013-0910: Mediate renderer -> browser plug-in loads more strictly. Credit to Google Chrome Security Team (Chris Evans). [172264] High CVE-2013-0911: Possible path traversal in database handling. Credit to Google Chrome Security Team (Juri Aedla).
    last seen 2019-02-21
    modified 2013-06-21
    plugin id 65067
    published 2013-03-07
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=65067
    title FreeBSD : chromium -- multiple vulnerabilities (40d5ab37-85f2-11e2-b528-00262d5ed8ee)
  • NASL family Windows
    NASL id GOOGLE_CHROME_25_0_1364_152.NASL
    description The version of Google Chrome installed on the remote host is a version prior to 25.0.1364.152. It is, therefore, affected by the following vulnerabilities : - Use-after-free errors exist related to the frame loader, browser navigation handling and SVG animation. (CVE-2013-0902, CVE-2013-0903, CVE-2013-0905) - Memory corruption errors exist related to 'Web Audio' and 'Indexed DB'. (CVE-2013-0904, CVE-2013-0906) - A race condition exists related to media thread handling. (CVE-2013-0907) - An unspecified error exists related to extension process bindings. (CVE-2013-0908) - The 'XSS Auditor' could leak referrer information. (CVE-2013-0909) - An unspecified error exists related to loading strictness and 'Mediate renderer -> browser plug-in'. (CVE-2013-0910) - A path traversal error exists related to database handling. (CVE-2013-0911)
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 65029
    published 2013-03-05
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=65029
    title Google Chrome < 25.0.1364.152 Multiple Vulnerabilities
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201309-16.NASL
    description The remote host is affected by the vulnerability described in GLSA-201309-16 (Chromium, V8: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Chromium and V8. Please review the CVE identifiers and release notes referenced below for details. Impact : A context-dependent attacker could entice a user to open a specially crafted website or JavaScript program using Chromium or V8, possibly resulting in the execution of arbitrary code with the privileges of the process or a Denial of Service condition. Furthermore, a remote attacker may be able to bypass security restrictions or have other, unspecified, impact. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2018-07-12
    plugin id 70112
    published 2013-09-25
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=70112
    title GLSA-201309-16 : Chromium, V8: Multiple vulnerabilities
oval via4
accepted 2013-08-12T04:08:27.153-04:00
class vulnerability
contributors
  • name Shane Shaffer
    organization G2, Inc.
  • name Jonathan Baker
    organization The MITRE Corporation
  • name Maria Kedovskaya
    organization ALTX-SOFT
definition_extensions
comment Google Chrome is installed
oval oval:org.mitre.oval:def:11914
description Google Chrome before 25.0.1364.152 does not properly manage bindings of extension processes, which has unspecified impact and attack vectors.
family windows
id oval:org.mitre.oval:def:16369
status accepted
submitted 2013-03-06T11:06:10.582-05:00
title Google Chrome before 25.0.1364.152 does not properly manage bindings of extension processes
version 43
refmap via4
confirm
Last major update 13-10-2016 - 11:01
Published 05-03-2013 - 16:55
Last modified 18-09-2017 - 21:35
Back to Top