FKIE_CVE-2014-1731

Vulnerability from fkie_nvd - Published: 2014-04-26 10:55 - Updated: 2026-06-17 00:05
Severity
Summary
core/html/HTMLSelectElement.cpp in the DOM implementation in Blink, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, does not properly check renderer state upon a focus event, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage "type confusion" for SELECT elements.
References
chrome-cve-admin@google.comhttp://archives.neohapsis.com/archives/bugtraq/2014-05/0128.html
chrome-cve-admin@google.comhttp://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html
chrome-cve-admin@google.comhttp://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html
chrome-cve-admin@google.comhttp://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html
chrome-cve-admin@google.comhttp://lists.opensuse.org/opensuse-updates/2014-05/msg00049.html
chrome-cve-admin@google.comhttp://lists.opensuse.org/opensuse-updates/2014-05/msg00050.html
chrome-cve-admin@google.comhttp://secunia.com/advisories/58301
chrome-cve-admin@google.comhttp://secunia.com/advisories/60372
chrome-cve-admin@google.comhttp://security.gentoo.org/glsa/glsa-201408-16.xml
chrome-cve-admin@google.comhttp://support.apple.com/kb/HT6254
chrome-cve-admin@google.comhttp://www.debian.org/security/2014/dsa-2920
chrome-cve-admin@google.comhttp://www.securityfocus.com/bid/67572
chrome-cve-admin@google.comhttps://code.google.com/p/chromium/issues/detail?id=349903
chrome-cve-admin@google.comhttps://src.chromium.org/viewvc/blink?revision=171216&view=revision
chrome-cve-admin@google.comhttps://support.apple.com/kb/HT6537
af854a3a-2127-422b-91ae-364da2661108http://archives.neohapsis.com/archives/bugtraq/2014-05/0128.html
af854a3a-2127-422b-91ae-364da2661108http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html
af854a3a-2127-422b-91ae-364da2661108http://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html
af854a3a-2127-422b-91ae-364da2661108http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-updates/2014-05/msg00049.html
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-updates/2014-05/msg00050.html
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/58301
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/60372
af854a3a-2127-422b-91ae-364da2661108http://security.gentoo.org/glsa/glsa-201408-16.xml
af854a3a-2127-422b-91ae-364da2661108http://support.apple.com/kb/HT6254
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2014/dsa-2920
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/67572
af854a3a-2127-422b-91ae-364da2661108https://code.google.com/p/chromium/issues/detail?id=349903
af854a3a-2127-422b-91ae-364da2661108https://src.chromium.org/viewvc/blink?revision=171216&view=revision
af854a3a-2127-422b-91ae-364da2661108https://support.apple.com/kb/HT6537
Impacted products
Vendor Product Version
google chrome *
apple mac_os_x -
microsoft windows -
google chrome *
linux linux_kernel -
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "chrome-cve-admin@google.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "59F9F3BD-65CD-462B-A3CD-D970F48AABAB",
              "versionEndExcluding": "34.0.1847.131",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "4781BF1E-8A4E-4AFF-9540-23D523EE30DD",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "682715EE-1BA1-4A6B-AEB6-B99257B38A45",
              "versionEndExcluding": "34.0.1847.132",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "core/html/HTMLSelectElement.cpp in the DOM implementation in Blink, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, does not properly check renderer state upon a focus event, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage \"type confusion\" for SELECT elements."
    },
    {
      "lang": "es",
      "value": "core/html/HTMLSelectElement.cpp en la implementaci\u00f3n DOM en Blink, utilizado en Google Chrome anterior a 34.0.1847.131 en Windows y OS X y anterior a 34.0.1847.132 en Linux, no comprueba debidamente el estado renderer en un evento focus, lo que permite a atacantes remotos causar una denegaci\u00f3n de servicio o posiblemente tener otro impacto no especificado a trav\u00e9s de vectores que aprovechan \"confusi\u00f3n de tipo\" para elementos SELECT."
    }
  ],
  "id": "CVE-2014-1731",
  "lastModified": "2026-06-17T00:05:27.423",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2014-04-26T10:55:05.480",
  "references": [
    {
      "source": "chrome-cve-admin@google.com",
      "url": "http://archives.neohapsis.com/archives/bugtraq/2014-05/0128.html"
    },
    {
      "source": "chrome-cve-admin@google.com",
      "url": "http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html"
    },
    {
      "source": "chrome-cve-admin@google.com",
      "url": "http://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html"
    },
    {
      "source": "chrome-cve-admin@google.com",
      "url": "http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html"
    },
    {
      "source": "chrome-cve-admin@google.com",
      "url": "http://lists.opensuse.org/opensuse-updates/2014-05/msg00049.html"
    },
    {
      "source": "chrome-cve-admin@google.com",
      "url": "http://lists.opensuse.org/opensuse-updates/2014-05/msg00050.html"
    },
    {
      "source": "chrome-cve-admin@google.com",
      "url": "http://secunia.com/advisories/58301"
    },
    {
      "source": "chrome-cve-admin@google.com",
      "url": "http://secunia.com/advisories/60372"
    },
    {
      "source": "chrome-cve-admin@google.com",
      "url": "http://security.gentoo.org/glsa/glsa-201408-16.xml"
    },
    {
      "source": "chrome-cve-admin@google.com",
      "url": "http://support.apple.com/kb/HT6254"
    },
    {
      "source": "chrome-cve-admin@google.com",
      "url": "http://www.debian.org/security/2014/dsa-2920"
    },
    {
      "source": "chrome-cve-admin@google.com",
      "url": "http://www.securityfocus.com/bid/67572"
    },
    {
      "source": "chrome-cve-admin@google.com",
      "url": "https://code.google.com/p/chromium/issues/detail?id=349903"
    },
    {
      "source": "chrome-cve-admin@google.com",
      "url": "https://src.chromium.org/viewvc/blink?revision=171216\u0026view=revision"
    },
    {
      "source": "chrome-cve-admin@google.com",
      "url": "https://support.apple.com/kb/HT6537"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://archives.neohapsis.com/archives/bugtraq/2014-05/0128.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-updates/2014-05/msg00049.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-updates/2014-05/msg00050.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/58301"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/60372"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://security.gentoo.org/glsa/glsa-201408-16.xml"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://support.apple.com/kb/HT6254"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2014/dsa-2920"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/67572"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://code.google.com/p/chromium/issues/detail?id=349903"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://src.chromium.org/viewvc/blink?revision=171216\u0026view=revision"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://support.apple.com/kb/HT6537"
    }
  ],
  "sourceIdentifier": "chrome-cve-admin@google.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-843"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.