Several vulnerabilities have been discovered in the Chromium web browser. CVE-2013-2853 The HTTPS implementation does not ensure that headers are terminated by \r\n\r\n (carriage return, newline, carriage return, newline). CVE-2013-2867 Chrome does not properly prevent pop-under windows. CVE-2013-2868 common/extensions/sync_helper.cc proceeds with sync operations for NPAPI extensions without checking for a certain plugin permission setting. CVE-2013-2869 Denial of service (out-of-bounds read) via a crafted JPEG2000 image. CVE-2013-2870 Use-after-free vulnerability in network sockets. CVE-2013-2871 Use-after-free vulnerability in input handling. CVE-2013-2873 Use-after-free vulnerability in resource loading. CVE-2013-2875 Out-of-bounds read in SVG file handling. CVE-2013-2876 Chromium does not properly enforce restrictions on the capture of screenshots by extensions, which could lead to information disclosure from previous page visits. CVE-2013-2877 Out-of-bounds read in XML file handling. CVE-2013-2878 Out-of-bounds read in text handling. CVE-2013-2879 The circumstances in which a renderer process can be considered a trusted process for sign-in and subsequent sync operations were not propertly checked. CVE-2013-2880 The Chromium 28 development team found various issues from internal fuzzing, audits, and other studies. For the stable distribution (wheezy), these problems have been fixed in version 28.0.1500.71-1~deb7u1. For the testing distribution (jessie), these problems will be fixed soon. For the unstable distribution (sid), these problems have been fixed in version 28.0.1500.71-1. We recommend that you upgrade your chromium-browser packages.
Several vulnerabilities have been discovered in the Chromium web browser.
The HTTPS implementation does not ensure that headers are terminated by \r\n\r\n (carriage return, newline, carriage return, newline).
Chrome does not properly prevent pop-under windows.
common/extensions/sync_helper.cc proceeds with sync operations for NPAPI extensions without checking for a certain plugin permission setting.
Denial of service (out-of-bounds read) via a crafted JPEG2000 image.
Use-after-free vulnerability in network sockets.
Use-after-free vulnerability in input handling.
Use-after-free vulnerability in resource loading.
Out-of-bounds read in SVG file handling.
Chromium does not properly enforce restrictions on the capture of screenshots by extensions, which could lead to information disclosure from previous page visits.
Out-of-bounds read in XML file handling.
Out-of-bounds read in text handling.
The circumstances in which a renderer process can be considered a trusted process for sign-in and subsequent sync operations were not propertly checked.
The Chromium 28 development team found various issues from internal fuzzing, audits, and other studies.
For the stable distribution (wheezy), these problems have been fixed in version 28.0.1500.71-1~deb7u1.
For the testing distribution (jessie), these problems will be fixed soon.
For the unstable distribution (sid), these problems have been fixed in version 28.0.1500.71-1.
We recommend that you upgrade your chromium-browser packages.
Vulmon