CVE-2014-1721

2014-04-0900:00:00

ubuntu.com

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

0.013

Percentile

85.9%

JSON

Google V8, as used in Google Chrome before 34.0.1847.116, does not properly
implement lazy deoptimization, which allows remote attackers to cause a
denial of service (memory corruption) or possibly have unspecified other
impact via crafted JavaScript code, as demonstrated by improper handling of
a heap allocation of a number outside the Small Integer (aka smi) range.

Notes

Author	Note
chrisccoulson	Issue was fixed prior to Oxide r501, the first version to be included in an Ubuntu release
mikesalvatore	The Ubuntu Security Team does not support libv8

OSVersionArchitecturePackageVersionFilename
ubuntu12.04noarchchromium-browser< 34.0.1847.116-0ubuntu~1.12.04.0~pkg884UNKNOWN
ubuntu12.10noarchchromium-browser< 34.0.1847.116-0ubuntu~1.12.10.0~pkg900UNKNOWN
ubuntu13.10noarchchromium-browser< 34.0.1847.116-0ubuntu~1.13.10.0~pkg991UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	12.04	noarch	chromium-browser	< 34.0.1847.116-0ubuntu~1.12.04.0~pkg884	UNKNOWN
ubuntu	12.10	noarch	chromium-browser	< 34.0.1847.116-0ubuntu~1.12.10.0~pkg900	UNKNOWN
ubuntu	13.10	noarch	chromium-browser	< 34.0.1847.116-0ubuntu~1.13.10.0~pkg991	UNKNOWN