Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2013-2904

Date: August 21, 2013

Use-after-free vulnerability in the Document::finishedParsing function in core/dom/Document.cpp in Blink, as used in Google Chrome before 29.0.1547.57, allows remote attackers to cause a denial of service or possibly have unspecified other impact via an onload event that changes an IFRAME element so that its src attribute is no longer an XML document, leading to unintended garbage collection of this document.

Severity Score

Related Resources (8)

https://src.chromium.org/viewvc/blink?revision=154680&view=revision
https://nvd.nist.gov/vuln/detail/CVE-2013-2904
http://www.debian.org/security/2013/dsa-2741
http://crbug.com/260428
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18550
http://googlechromereleases.blogspot.com/2013/08/stable-channel-update.html
https://people.canonical.com/~ubuntu-security/cve/CVE-2013-2904
https://www.mend.io/vulnerability-database/CVE-2013-2904

Severity Score

Weakness Type (CWE)

Resource Management Errors

CWE-399

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): LOW
Integrity (I): LOW
Availability (A): LOW

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): LOW
Authentication (AU): NONE
Confidentiality (C): PARTIAL
Integrity (I): PARTIAL
Availability (A): PARTIAL
Additional information:

Do you need more information?

Contact Us