CVE-2014-1731
HighSummary
The DOM implementation in Blink, used in Google Chrome before version 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, has an issue with improper renderer state checking upon a focus event. This can lead to denial of service or other unspecified impacts via vectors leveraging 'type confusion' for SELECT elements.
Risk Assessment
Remote attackers may exploit this vulnerability to disrupt application functionality or introduce unforeseen effects, potentially impacting service availability within the organization.
Recommendation
It is recommended to update Google Chrome to the latest version to mitigate this vulnerability and to monitor systems for potential attacks exploiting this flaw.
Other vulnerabilities in Blink DOM implementation in Google Chrome
See all- CVE-2015-1293High
The DOM implementation in Blink, used in Google Chrome before version 45.0.2454.85, allows remote attackers to bypass the Same Origin Policy via unspecified vectors.
- CVE-2015-1253High
In the DOM implementation in Blink, used in Google Chrome before version 43.0.2357.65, there is a vulnerability that allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code that appends a child to a SCRIPT element.
- CVE-2014-7930High
A use-after-free vulnerability in the DOM implementation in Blink, used in Google Chrome before version 40.0.2214.91, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers improper maintenance of TreeScope data.
- CVE-2014-3169High
A use-after-free vulnerability in the DOM implementation in Blink, used in Google Chrome before version 37.0.2062.94, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging script execution that occurs before notification of node removal.
Original NVD description (English source)
core/html/HTMLSelectElement.cpp in the DOM implementation in Blink, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, does not properly check renderer state upon a focus event, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage "type confusion" for SELECT elements.