Use-after-free vulnerability in the HTMLMediaElement::didMoveToNewDocument function in core/html/HTMLMediaElement.cpp in Blink, as used in Google Chrome before 29.0.1547.57, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving moving a (1) AUDIO or (2) VIDEO element between documents.
Name | Vendor | Start Version | End Version |
---|---|---|---|
Chrome | 29.0.1547.0 | 29.0.1547.0 | |
Chrome | 29.0.1547.39 | 29.0.1547.39 | |
Chrome | 29.0.1547.52 | 29.0.1547.52 | |
Chrome | 29.0.1547.15 | 29.0.1547.15 | |
Chrome | 29.0.1547.40 | 29.0.1547.40 | |
Chrome | 29.0.1547.49 | 29.0.1547.49 | |
Chrome | 29.0.1547.2 | 29.0.1547.2 | |
Chrome | 29.0.1547.7 | 29.0.1547.7 | |
Chrome | 29.0.1547.11 | 29.0.1547.11 | |
Chrome | 29.0.1547.3 | 29.0.1547.3 | |
Chrome | 29.0.1547.34 | 29.0.1547.34 | |
Chrome | * | 29.0.1547.56 | |
Chrome | 29.0.1547.16 | 29.0.1547.16 | |
Chrome | 29.0.1547.33 | 29.0.1547.33 | |
Chrome | 29.0.1547.46 | 29.0.1547.46 | |
Chrome | 29.0.1547.42 | 29.0.1547.42 | |
Chrome | 29.0.1547.54 | 29.0.1547.54 | |
Chrome | 29.0.1547.50 | 29.0.1547.50 | |
Chrome | 29.0.1547.18 | 29.0.1547.18 | |
Chrome | 29.0.1547.21 | 29.0.1547.21 | |
Chrome | 29.0.1547.29 | 29.0.1547.29 | |
Chrome | 29.0.1547.14 | 29.0.1547.14 | |
Chrome | 29.0.1547.17 | 29.0.1547.17 | |
Chrome | 29.0.1547.10 | 29.0.1547.10 | |
Chrome | 29.0.1547.27 | 29.0.1547.27 | |
Chrome | 29.0.1547.28 | 29.0.1547.28 | |
Chrome | 29.0.1547.31 | 29.0.1547.31 | |
Chrome | 29.0.1547.48 | 29.0.1547.48 | |
Chrome | 29.0.1547.36 | 29.0.1547.36 | |
Chrome | 29.0.1547.35 | 29.0.1547.35 | |
Chrome | 29.0.1547.51 | 29.0.1547.51 | |
Chrome | 29.0.1547.9 | 29.0.1547.9 | |
Chrome | 29.0.1547.20 | 29.0.1547.20 | |
Chrome | 29.0.1547.30 | 29.0.1547.30 | |
Chrome | 29.0.1547.13 | 29.0.1547.13 | |
Chrome | 29.0.1547.45 | 29.0.1547.45 | |
Chrome | 29.0.1547.55 | 29.0.1547.55 | |
Chrome | 29.0.1547.8 | 29.0.1547.8 | |
Chrome | 29.0.1547.1 | 29.0.1547.1 | |
Chrome | 29.0.1547.23 | 29.0.1547.23 | |
Chrome | 29.0.1547.32 | 29.0.1547.32 | |
Chrome | 29.0.1547.37 | 29.0.1547.37 | |
Chrome | 29.0.1547.19 | 29.0.1547.19 | |
Chrome | 29.0.1547.41 | 29.0.1547.41 | |
Chrome | 29.0.1547.53 | 29.0.1547.53 | |
Chrome | 29.0.1547.22 | 29.0.1547.22 | |
Chrome | 29.0.1547.4 | 29.0.1547.4 | |
Chrome | 29.0.1547.47 | 29.0.1547.47 | |
Chrome | 29.0.1547.38 | 29.0.1547.38 | |
Chrome | 29.0.1547.5 | 29.0.1547.5 | |
Chrome | 29.0.1547.12 | 29.0.1547.12 |