CVE-2014-1748: Medium severity Google Chrome vulnerability
Published May 21, 2014
·Updated
The ScrollView::paint function in platform/scroll/ScrollView.cpp in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attackers to spoof the UI by extending scrollbar painting into the parent frame.
Affected Software
81 affected components
Google Chrome<=35.0.1916.113
Google Chrome=35.0.1916.0
Google Chrome=35.0.1916.1
Google Chrome=35.0.1916.2
Google Chrome=35.0.1916.3
Google Chrome=35.0.1916.4
Google Chrome=35.0.1916.5
Google Chrome=35.0.1916.6
Google Chrome=35.0.1916.7
Google Chrome=35.0.1916.8
Google Chrome=35.0.1916.9
Google Chrome=35.0.1916.10
Google Chrome=35.0.1916.11
Google Chrome=35.0.1916.13
Google Chrome=35.0.1916.14
Google Chrome=35.0.1916.15
Google Chrome=35.0.1916.17
Google Chrome=35.0.1916.18
Google Chrome=35.0.1916.19
Google Chrome=35.0.1916.20
Google Chrome=35.0.1916.21
Google Chrome=35.0.1916.22
Google Chrome=35.0.1916.23
Google Chrome=35.0.1916.27
Google Chrome=35.0.1916.31
Google Chrome=35.0.1916.32
Google Chrome=35.0.1916.33
Google Chrome=35.0.1916.34
Google Chrome=35.0.1916.35
Google Chrome=35.0.1916.36
Google Chrome=35.0.1916.37
Google Chrome=35.0.1916.38
Google Chrome=35.0.1916.39
Google Chrome=35.0.1916.40
Google Chrome=35.0.1916.41
Google Chrome=35.0.1916.42
Google Chrome=35.0.1916.43
Google Chrome=35.0.1916.44
Google Chrome=35.0.1916.45
Google Chrome=35.0.1916.46
Google Chrome=35.0.1916.47
Google Chrome=35.0.1916.48
Google Chrome=35.0.1916.49
Google Chrome=35.0.1916.51
Google Chrome=35.0.1916.52
Google Chrome=35.0.1916.54
Google Chrome=35.0.1916.56
Google Chrome=35.0.1916.57
Google Chrome=35.0.1916.59
Google Chrome=35.0.1916.61
Google Chrome=35.0.1916.68
Google Chrome=35.0.1916.69
Google Chrome=35.0.1916.71
Google Chrome=35.0.1916.72
Google Chrome=35.0.1916.74
Google Chrome=35.0.1916.77
Google Chrome=35.0.1916.80
Google Chrome=35.0.1916.82
Google Chrome=35.0.1916.84
Google Chrome=35.0.1916.85
Google Chrome=35.0.1916.86
Google Chrome=35.0.1916.88
Google Chrome=35.0.1916.90
Google Chrome=35.0.1916.92
Google Chrome=35.0.1916.93
Google Chrome=35.0.1916.95
Google Chrome=35.0.1916.96
Google Chrome=35.0.1916.98
Google Chrome=35.0.1916.99
Google Chrome=35.0.1916.101
Google Chrome=35.0.1916.103
Google Chrome=35.0.1916.104
Google Chrome=35.0.1916.105
Google Chrome=35.0.1916.106
Google Chrome=35.0.1916.107
Google Chrome=35.0.1916.108
Google Chrome=35.0.1916.109
Google Chrome=35.0.1916.110
Google Chrome=35.0.1916.111
Google Chrome=35.0.1916.112
debian/chromium-browser
Event History
May 21, 2014
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Data Sourced
via NVD·11:14 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2014-1748?
CVE-2014-1748 has been classified as a medium severity vulnerability.
2
How do I fix CVE-2014-1748?
To fix CVE-2014-1748, upgrade Google Chrome to version 35.0.1916.114 or later.
3
What type of vulnerability is CVE-2014-1748?
CVE-2014-1748 is a UI spoofing vulnerability present in the ScrollView::paint function.
4
Which versions of Google Chrome are affected by CVE-2014-1748?
CVE-2014-1748 affects Google Chrome versions prior to 35.0.1916.114.
5
What impact does CVE-2014-1748 have on users?
CVE-2014-1748 can allow remote attackers to spoof the UI by extending scrollbar painting into the parent frame, potentially misleading users.