What is the CVSS score of CVE-2014-3192?

CVE-2014-3192 has a CVSS 2.0 base score of 7.5 (High). CVSS vector: AV:N/AC:L/Au:N/C:P/I:P/A:P. EPSS exploitation probability: 1.7%.

Enterprise Linux Desktop Supplementary CVE-2014-3192

HIGH

Use After Free (CWE-416)

2014-10-08 chrome-cve-admin@google.com

Memory Corruption Google Denial Of Service Use After Free Enterprise Linux Desktop Supplementary Enterprise Linux Server Supplementary Enterprise Linux Server Supplementary Eus Enterprise Linux Workstation Supplementary Itunes Safari Iphone Os Tvos Chrome

7.5

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/Au:N/C:P/I:P/A:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:L/Au:N/C:P/I:P/A:P

Attack Vector

Network

Attack Complexity

Low

Confidentiality

Integrity

Availability

Lifecycle Timeline

CVE Published

Oct 08, 2014 - 10:55 cve.org

HIGH 7.5

DescriptionCVE.org

Use-after-free vulnerability in the ProcessingInstruction::setXSLStyleSheet function in core/dom/ProcessingInstruction.cpp in the DOM implementation in Blink, as used in Google Chrome before 38.0.2125.101, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

AnalysisAI

Use-after-free vulnerability in the ProcessingInstruction::setXSLStyleSheet function in core/dom/ProcessingInstruction.cpp in the DOM implementation in Blink, as used in Google Chrome before. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Use After Free (CWE-416), which allows attackers to access freed memory to execute arbitrary code or crash the application. Use-after-free vulnerability in the ProcessingInstruction::setXSLStyleSheet function in core/dom/ProcessingInstruction.cpp in the DOM implementation in Blink, as used in Google Chrome before 38.0.2125.101, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors. Affected products include: Redhat Enterprise Linux Desktop Supplementary, Redhat Enterprise Linux Server Supplementary, Redhat Enterprise Linux Server Supplementary Eus, Redhat Enterprise Linux Workstation Supplementary, Apple Itunes. Version information: before 38.0.2125.101.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Use smart pointers or garbage-collected languages. Set pointers to NULL after freeing. Enable memory sanitizers.