DSA-2862-1 chromium-browser -- several vulnerabilities

Debian Security Advisory

DSA-2862-1 chromium-browser -- several vulnerabilities

Date Reported:

16 Feb 2014

Affected Packages:

chromium-browser

Vulnerable:

Yes

Security database references:

In Mitre's CVE dictionary: CVE-2013-6641, CVE-2013-6643, CVE-2013-6644, CVE-2013-6645, CVE-2013-6646, CVE-2013-6649, CVE-2013-6650.

More information:

Several vulnerabilities have been discovered in the chromium web browser.

• CVE-2013-6641

  Atte Kettunen discovered a use-after-free issue in Blink/Webkit form elements.

• CVE-2013-6643

  Joao Lucas Melo Brasio discovered a Google account information disclosure issue related to the one-click sign-on feature.

• CVE-2013-6644

  The chrome development team discovered and fixed multiple issues with potential security impact.

• CVE-2013-6645

  Khalil Zhani discovered a use-after-free issue related to speech input.

• CVE-2013-6646

  Colin Payne discovered a use-after-free issue in the web workers implementation.

• CVE-2013-6649

  Atte Kettunen discovered a use-after-free issue in the Blink/Webkit SVG implementation.

• CVE-2013-6650

  Christian Holler discovered a memory corruption in the v8 javascript library.

For the stable distribution (wheezy), these problems have been fixed in version 32.0.1700.123-1~deb7u1.

For the testing distribution (jessie), these problems will be fixed soon.

For the unstable distribution (sid), these problems have been fixed in version 32.0.1700.123-1.

We recommend that you upgrade your chromium-browser packages.