CVE-2013-6643

Upstream information

CVE-2013-6643 at MITRE

Description

The OneClickSigninBubbleView::WindowClosing function in browser/ui/views/sync/one_click_signin_bubble_view.cc in Google Chrome before 32.0.1700.76 on Windows and before 32.0.1700.77 on Mac OS X and Linux allows attackers to trigger a sync with an arbitrary Google account by leveraging improper handling of the closing of an untrusted signin confirm dialog.

---

SUSE information

Overall state of this security issue: Does not affect SUSE products

This issue is currently rated as having important severity.

CVSS v2 Scores

	National Vulnerability Database
Base Score	7.5
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P
Access Vector	Network
Access Complexity	Low
Authentication	None
Confidentiality Impact	Partial
Integrity Impact	Partial
Availability Impact	Partial

SUSE Bugzilla entry: 861013 [RESOLVED / FIXED]

SUSE Security Advisories:

• openSUSE-SU-2014:0243-1, published Tue, 18 Feb 2014 10:04:12 +0100 (CET)

List of released packages

Product(s)	Fixed package version(s)	References
openSUSE 13.1	chromedriver >= 32.0.1700.102-17.2 chromedriver-debuginfo >= 32.0.1700.102-17.2 chromium >= 32.0.1700.102-17.2 chromium-debuginfo >= 32.0.1700.102-17.2 chromium-debugsource >= 32.0.1700.102-17.2 chromium-desktop-gnome >= 32.0.1700.102-17.2 chromium-desktop-kde >= 32.0.1700.102-17.2 chromium-ffmpegsumo >= 32.0.1700.102-17.2 chromium-ffmpegsumo-debuginfo >= 32.0.1700.102-17.2 chromium-suid-helper >= 32.0.1700.102-17.2 chromium-suid-helper-debuginfo >= 32.0.1700.102-17.2	Patchnames: openSUSE-2014-135
openSUSE Tumbleweed	chromedriver >= 55.0.2883.75-3.1 chromium >= 55.0.2883.75-3.1	Patchnames: openSUSE Tumbleweed GA chromedriver