CVE-2014-3176

Google Chrome before 37.0.2062.94 does not properly handle the interaction of extensions, IPC, the sync API, and Google V8, which allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-3177.

Published Bychrome-cve-admin@google.com

Published DateAug 27, 2014, 01:55

Weakness Type (CWE):CWE-94

CVSS Metrics

Base Score

Vector String

AV:N/AC:L/Au:N/C:C/I:C/A:C

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

COMPLETE

Integrity (I)

COMPLETE

Availability (A)

COMPLETE

References

http://googlechromereleases.blogspot.com/2014/08/stable-channel-update_26.html
http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00027.html
http://secunia.com/advisories/60268
http://secunia.com/advisories/61482
http://security.gentoo.org/glsa/glsa-201408-16.xml
http://www.debian.org/security/2014/dsa-3039
http://www.securityfocus.com/bid/69404
http://www.securitytracker.com/id/1030767
https://crbug.com/386988
https://exchange.xforce.ibmcloud.com/vulnerabilities/95476

Weakness Type (CWE):CWE-94

CVSS Metrics

Base Score

Vector String

AV:N/AC:L/Au:N/C:C/I:C/A:C

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

COMPLETE

Integrity (I)

COMPLETE

Availability (A)

COMPLETE