What’s Vulnerable › Vulnerabilities
CVE-2013-6649
- Severity: high (CVSS 7.5 v2.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.5% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2014-01-28 · updated 2026-06-17
- Weakness: CWE-399
Description
Use-after-free vulnerability in the RenderSVGImage::paint function in core/rendering/svg/RenderSVGImage.cpp in Blink, as used in Google Chrome before 32.0.1700.102, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving a zero-size SVG image.
Affected products
- Debian Linux: 7.0, 8.0
- Google Chrome: through 32.0.1700.101; 32.0.1700.0, 32.0.1700.2, 32.0.1700.3, 32.0.1700.4, 32.0.1700.5, 32.0.1700.6 (+62)
- Opensuse: 12.3, 13.1
References
- http://crbug.com/330420
- http://googlechromereleases.blogspot.com/2014/01/stable-channel-update_27.html
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00008.html
- http://www.debian.org/security/2014/dsa-2862
- https://src.chromium.org/viewvc/blink?revision=164536&view=revision
- http://crbug.com/330420
- http://googlechromereleases.blogspot.com/2014/01/stable-channel-update_27.html
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00008.html
- http://www.debian.org/security/2014/dsa-2862
- https://src.chromium.org/viewvc/blink?revision=164536&view=revision
Get alerted when CVE-2013-6649 or the next vulnerability affects your stack