CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
AI Score
Confidence
High
EPSS
Percentile
88.2%
modules/webaudio/BiquadDSPKernel.cpp in the Web Audio API implementation in Blink, as used in Google Chrome before 37.0.2062.94, does not properly consider concurrent threads during attempts to update biquad filter coefficients, which allows remote attackers to cause a denial of service (read of uninitialized memory) via crafted API calls.
Vendor | Product | Version | CPE |
---|---|---|---|
chrome | * | cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* | |
chrome | 37.0.2062.0 | cpe:2.3:a:google:chrome:37.0.2062.0:*:*:*:*:*:*:* | |
chrome | 37.0.2062.1 | cpe:2.3:a:google:chrome:37.0.2062.1:*:*:*:*:*:*:* | |
chrome | 37.0.2062.2 | cpe:2.3:a:google:chrome:37.0.2062.2:*:*:*:*:*:*:* | |
chrome | 37.0.2062.3 | cpe:2.3:a:google:chrome:37.0.2062.3:*:*:*:*:*:*:* | |
chrome | 37.0.2062.4 | cpe:2.3:a:google:chrome:37.0.2062.4:*:*:*:*:*:*:* | |
chrome | 37.0.2062.5 | cpe:2.3:a:google:chrome:37.0.2062.5:*:*:*:*:*:*:* | |
chrome | 37.0.2062.6 | cpe:2.3:a:google:chrome:37.0.2062.6:*:*:*:*:*:*:* | |
chrome | 37.0.2062.7 | cpe:2.3:a:google:chrome:37.0.2062.7:*:*:*:*:*:*:* | |
chrome | 37.0.2062.8 | cpe:2.3:a:google:chrome:37.0.2062.8:*:*:*:*:*:*:* |
googlechromereleases.blogspot.com/2014/08/stable-channel-update_26.html
lists.opensuse.org/opensuse-security-announce/2014-09/msg00027.html
secunia.com/advisories/60268
secunia.com/advisories/60424
secunia.com/advisories/61482
security.gentoo.org/glsa/glsa-201408-16.xml
www.debian.org/security/2014/dsa-3039
www.securityfocus.com/bid/69407
www.securitytracker.com/id/1030767
crbug.com/389219
exchange.xforce.ibmcloud.com/vulnerabilities/95474
src.chromium.org/viewvc/blink?revision=177250&view=revision