Vulnerability CVE-2014-1747 - CERT Civis.Net

Vulnerability Name:

CVE-2014-1747 (CCN-93257)

Assigned:

2014-05-20

Published:

2014-05-20

Updated:

2017-12-29

Summary:

Cross-site scripting (XSS) vulnerability in the DocumentLoader::maybeCreateArchive function in core/loader/DocumentLoader.cpp in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attackers to inject arbitrary web script or HTML via crafted MHTML content, aka "Universal XSS (UXSS)."

CVSS v3 Severity:

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

Vulnerability Type:

Vulnerability Consequences:

Cross-Site Scripting

References:

Source: MITRE
Type: CNA
CVE-2014-1747

Source: CONFIRM
Type: Vendor Advisory
http://googlechromereleases.blogspot.com/2014/05/stable-channel-update_20.html

Source: CCN
Type: Google Chrome Releases Web site
Stable Channel Update

Source: SUSE
Type: UNKNOWN
openSUSE-SU-2014:0783

Source: SECUNIA
Type: UNKNOWN
58920

Source: SECUNIA
Type: UNKNOWN
59155

Source: GENTOO
Type: UNKNOWN
GLSA-201408-16

Source: DEBIAN
Type: UNKNOWN
DSA-2939

Source: SECTRACK
Type: UNKNOWN
1030270

Source: CONFIRM
Type: Vendor Advisory
https://code.google.com/p/chromium/issues/detail?id=330663

Source: XF
Type: UNKNOWN
google-chrome-cve20141747-xss(93257)

Source: CONFIRM
Type: UNKNOWN
https://src.chromium.org/viewvc/blink?revision=169499&view=revision

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2014-1747

Vulnerable Configuration:

Configuration 1:

cpe:/a:google:chrome:35.0.1916.0:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.1:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.2:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.3:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.4:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.5:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.6:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.7:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.8:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.9:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.10:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.11:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.13:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.14:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.15:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.17:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.18:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.19:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.20:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.21:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.22:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.23:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.27:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.31:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.32:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.33:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.34:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.35:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.36:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.37:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.38:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.39:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.40:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.41:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.42:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.43:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.44:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.45:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.46:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.47:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.48:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.49:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.51:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.52:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.54:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.56:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.57:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.59:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.61:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.68:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.69:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.71:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.72:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.74:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.77:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.80:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.82:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.84:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.85:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.86:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.88:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.90:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.92:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.93:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.95:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.96:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.98:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.99:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.101:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.103:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.104:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.105:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.106:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.107:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.108:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.109:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.110:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.111:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:35.0.1916.112:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:*:*:*:*:*:*:*:* (Version <= 35.0.1916.113)

Configuration CCN 1:

cpe:/a:google:chrome:34.0.1847.131:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:20141747	V	CVE-2014-1747	2022-06-30
oval:org.opensuse.security:def:112065	P	chromedriver-55.0.2883.75-3.1 on GA media (Moderate)	2022-01-17
oval:org.opensuse.security:def:105614	P	chromedriver-55.0.2883.75-3.1 on GA media (Moderate)	2021-10-01
oval:org.mitre.oval:def:24402	P	DSA-2939-1 chromium-browser - security update	2014-07-21
oval:org.mitre.oval:def:24516	V	Vulnerability in Google Chrome before 35.0.1916.114 allows remote attackers to inject arbitrary web script or HTML via crafted MHTML content	2014-06-30
oval:com.ubuntu.precise:def:20141747000	V	CVE-2014-1747 on Ubuntu 12.04 LTS (precise) - medium.	2014-05-21
oval:com.ubuntu.trusty:def:20141747000	V	CVE-2014-1747 on Ubuntu 14.04 LTS (trusty) - medium.	2014-05-21