CVE-2014-1733

2014-04-2600:00:00

ubuntu.com

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

0.012

Percentile

85.4%

JSON

The PointerCompare function in codegen.cc in Seccomp-BPF, as used in Google
Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on
Linux, does not properly merge blocks, which might allow remote attackers
to bypass intended sandbox restrictions by leveraging renderer access.

Notes

Author	Note
chrisccoulson	Bug affects seccomp sandbox, which is used for the GPU process in Chrome. Oxide doesn’t have a GPU process

OSVersionArchitecturePackageVersionFilename
ubuntu12.04noarchchromium-browser< 36.0.1985.125-0ubuntu1.12.04.0~pkg897UNKNOWN
ubuntu14.04noarchchromium-browser< 36.0.1985.125-0ubuntu1.14.04.0~pkg1029UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	12.04	noarch	chromium-browser	< 36.0.1985.125-0ubuntu1.12.04.0~pkg897	UNKNOWN
ubuntu	14.04	noarch	chromium-browser	< 36.0.1985.125-0ubuntu1.14.04.0~pkg1029	UNKNOWN