FKIE_CVE-2014-1730

Vulnerability from fkie_nvd - Published: 2014-04-26 10:55 - Updated: 2025-04-12 10:46
Severity ?
Summary
Google V8, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, does not properly store internationalization metadata, which allows remote attackers to bypass intended access restrictions by leveraging "type confusion" and reading property values, related to i18n.js and runtime.cc.
References
chrome-cve-admin@google.comhttp://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html
chrome-cve-admin@google.comhttp://lists.opensuse.org/opensuse-updates/2014-05/msg00049.html
chrome-cve-admin@google.comhttp://lists.opensuse.org/opensuse-updates/2014-05/msg00050.html
chrome-cve-admin@google.comhttp://secunia.com/advisories/58301
chrome-cve-admin@google.comhttp://secunia.com/advisories/60372
chrome-cve-admin@google.comhttp://security.gentoo.org/glsa/glsa-201408-16.xml
chrome-cve-admin@google.comhttp://www.debian.org/security/2014/dsa-2920
chrome-cve-admin@google.comhttps://code.google.com/p/chromium/issues/detail?id=354967
chrome-cve-admin@google.comhttps://code.google.com/p/v8/source/detail?r=20375
chrome-cve-admin@google.comhttps://code.google.com/p/v8/source/detail?r=20377
chrome-cve-admin@google.comhttps://code.google.com/p/v8/source/detail?r=20388
chrome-cve-admin@google.comhttps://code.google.com/p/v8/source/detail?r=20593
chrome-cve-admin@google.comhttps://code.google.com/p/v8/source/detail?r=20595
af854a3a-2127-422b-91ae-364da2661108http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-updates/2014-05/msg00049.html
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-updates/2014-05/msg00050.html
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/58301
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/60372
af854a3a-2127-422b-91ae-364da2661108http://security.gentoo.org/glsa/glsa-201408-16.xml
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2014/dsa-2920
af854a3a-2127-422b-91ae-364da2661108https://code.google.com/p/chromium/issues/detail?id=354967
af854a3a-2127-422b-91ae-364da2661108https://code.google.com/p/v8/source/detail?r=20375
af854a3a-2127-422b-91ae-364da2661108https://code.google.com/p/v8/source/detail?r=20377
af854a3a-2127-422b-91ae-364da2661108https://code.google.com/p/v8/source/detail?r=20388
af854a3a-2127-422b-91ae-364da2661108https://code.google.com/p/v8/source/detail?r=20593
af854a3a-2127-422b-91ae-364da2661108https://code.google.com/p/v8/source/detail?r=20595
Impacted products
Vendor Product Version
google chrome *
apple mac_os_x -
microsoft windows -
google chrome *
linux linux_kernel -
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "59F9F3BD-65CD-462B-A3CD-D970F48AABAB",
              "versionEndExcluding": "34.0.1847.131",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "4781BF1E-8A4E-4AFF-9540-23D523EE30DD",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "682715EE-1BA1-4A6B-AEB6-B99257B38A45",
              "versionEndExcluding": "34.0.1847.132",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Google V8, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, does not properly store internationalization metadata, which allows remote attackers to bypass intended access restrictions by leveraging \"type confusion\" and reading property values, related to i18n.js and runtime.cc."
    },
    {
      "lang": "es",
      "value": "Google V8, utilizado en Google Chrome anterior a 34.0.1847.131 en Windows y OS X y anterior a 34.0.1847.132 en Linux, no almacena debidamente metadatos de internacionalizaci\u00f3n, lo que permite a atacantes remotos evadir restricciones de acceso mediante el aprovechamiento de \"confusi\u00f3n de tipo\" y la lectura de valores de propiedad, relacionado con i18n.js y runtime.cc."
    }
  ],
  "id": "CVE-2014-1730",
  "lastModified": "2025-04-12T10:46:40.837",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 7.8,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2014-04-26T10:55:05.433",
  "references": [
    {
      "source": "chrome-cve-admin@google.com",
      "url": "http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html"
    },
    {
      "source": "chrome-cve-admin@google.com",
      "url": "http://lists.opensuse.org/opensuse-updates/2014-05/msg00049.html"
    },
    {
      "source": "chrome-cve-admin@google.com",
      "url": "http://lists.opensuse.org/opensuse-updates/2014-05/msg00050.html"
    },
    {
      "source": "chrome-cve-admin@google.com",
      "url": "http://secunia.com/advisories/58301"
    },
    {
      "source": "chrome-cve-admin@google.com",
      "url": "http://secunia.com/advisories/60372"
    },
    {
      "source": "chrome-cve-admin@google.com",
      "url": "http://security.gentoo.org/glsa/glsa-201408-16.xml"
    },
    {
      "source": "chrome-cve-admin@google.com",
      "url": "http://www.debian.org/security/2014/dsa-2920"
    },
    {
      "source": "chrome-cve-admin@google.com",
      "url": "https://code.google.com/p/chromium/issues/detail?id=354967"
    },
    {
      "source": "chrome-cve-admin@google.com",
      "url": "https://code.google.com/p/v8/source/detail?r=20375"
    },
    {
      "source": "chrome-cve-admin@google.com",
      "url": "https://code.google.com/p/v8/source/detail?r=20377"
    },
    {
      "source": "chrome-cve-admin@google.com",
      "url": "https://code.google.com/p/v8/source/detail?r=20388"
    },
    {
      "source": "chrome-cve-admin@google.com",
      "url": "https://code.google.com/p/v8/source/detail?r=20593"
    },
    {
      "source": "chrome-cve-admin@google.com",
      "url": "https://code.google.com/p/v8/source/detail?r=20595"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-updates/2014-05/msg00049.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-updates/2014-05/msg00050.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/58301"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/60372"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://security.gentoo.org/glsa/glsa-201408-16.xml"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2014/dsa-2920"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://code.google.com/p/chromium/issues/detail?id=354967"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://code.google.com/p/v8/source/detail?r=20375"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://code.google.com/p/v8/source/detail?r=20377"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://code.google.com/p/v8/source/detail?r=20388"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://code.google.com/p/v8/source/detail?r=20593"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://code.google.com/p/v8/source/detail?r=20595"
    }
  ],
  "sourceIdentifier": "chrome-cve-admin@google.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-843"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.