CVE-2013-2853

Publication date 10 July 2013

Last updated 24 July 2024

Ubuntu priority

The HTTPS implementation in Google Chrome before 28.0.1500.71 does not ensure that headers are terminated by \r\n\r\n (carriage return, newline, carriage return, newline), which allows man-in-the-middle attackers to have an unspecified impact via vectors that trigger header truncation.

Status

Show unmaintained releases

No maintained releases are affected by this CVE.

Package	Ubuntu Release	Status
chromium-browser	13.04 raring	Fixed 28.0.1500.71-0ubuntu1.13.04.1
	12.10 quantal	Fixed 28.0.1500.71-0ubuntu1.12.10.1
	12.04 LTS precise	Fixed 28.0.1500.71-0ubuntu1.12.04.1
	10.04 LTS lucid	Ignored end of life

How can I get the fixes?
What do statuses mean?

References

MITRE
NVD
Launchpad
Debian

Other references

https://code.google.com/p/chromium/issues/detail?id=244260
http://googlechromereleases.blogspot.com/2013/07/stable-channel-update.html
http://git.chromium.org/gitweb/?p=chromium/chromium.git;a=commit;h=f4f9f4948de5a59462e13ad712d7d9117238aeea
http://git.chromium.org/gitweb/?p=chromium/chromium.git;a=commit;h=44b400c80726ee5d205a27730a0c846be656a071
https://www.cve.org/CVERecord?id=CVE-2013-2853