CVE-2014-7907
HighSummary
Multiple use-after-free vulnerabilities in ScreenOrientationController.cpp in Blink, used in Google Chrome before version 39.0.2171.65, allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger improper handling of a detached frame, related to the (1) lock and (2) unlock methods.
Risk Assessment
These vulnerabilities may lead to denial of service, affecting application availability and potentially allowing attackers to gain control over the system in unspecified ways.
Recommendation
It is recommended to update Google Chrome to the latest version to mitigate these vulnerabilities and to monitor systems for unauthorized activities.
Other vulnerabilities in Blink, Google Chrome
See all- CVE-2016-5170High
In Blink, used in Google Chrome before version 53.0.2785.113, there is an issue with improperly considering getter side effects during array key conversion. This can lead to denial of service (use-after-free) or other unspecified impacts via crafted Indexed Database API calls.
- CVE-2016-5150High
In Blink, used in Google Chrome before version 53.0.2785.89 on Windows and OS X and before version 53.0.2785.92 on Linux, there is an issue with the Indexed Database (IndexedDB) API implementation that does not properly restrict key-path evaluation. This can lead to denial of service (use-after-free) or other unspecified impacts via crafted JavaScript code.
- CVE-2016-1675High
Blink, as used in Google Chrome before version 51.0.2704.63, allows remote attackers to bypass the Same Origin Policy by leveraging the mishandling of Document reattachment during destruction, related to FrameLoader.cpp and LocalFrame.cpp.
- CVE-2016-1661High
Blink in Google Chrome before version 50.0.2661.94 does not ensure that frames satisfy an additional check for the same renderer process, which can lead to denial of service (memory corruption) or other unspecified impacts via a crafted website.
- CVE-2015-1299High
A use-after-free vulnerability in the shared-timer implementation in Blink, as used in Google Chrome before version 45.0.2454.85, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging erroneous timer firing.
- CVE-2015-1221High
A use-after-free vulnerability in Blink, as used in Google Chrome before version 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging incorrect ordering of operations in the Web SQL Database thread relative to Blink's main thread.
- CVE-2014-3191High
A use-after-free vulnerability in Blink, used in Google Chrome before version 38.0.2125.101, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers a widget-position update improperly interacting with the render tree.
- CVE-2014-3178High
A use-after-free vulnerability in Blink, as used in Google Chrome before version 37.0.2062.120, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper handling of render-tree inconsistencies.
- CVE-2016-1633Critical
Use-after-free vulnerability in Blink, as used in Google Chrome before version 49.0.2623.75, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
Original NVD description (English source)
Multiple use-after-free vulnerabilities in modules/screen_orientation/ScreenOrientationController.cpp in Blink, as used in Google Chrome before 39.0.2171.65, allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger improper handling of a detached frame, related to the (1) lock and (2) unlock methods.