Integer underflow in the LCodeGen::PrepareKeyedOperand function in arm/lithium-codegen-arm.cc in Google V8 before 3.25.28.16, as used in Google Chrome before 35.0.1916.114, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a negative key value.
2014-05-21T11:14:09.990
2025-04-12T10:46:40.837
Deferred
CVSSv2: 7.5 (HIGH)
AV:N/AC:L/Au:N/C:P/I:P/A:P
10.0
6.4
| Type | Vendor | Product | Version/Range | Vulnerable? |
|---|---|---|---|---|
| Operating System | fedoraproject | fedora | 20 | Yes |
| Operating System | fedoraproject | fedora | 21 | Yes |
| Operating System | fedoraproject | fedora | 22 | Yes |
| Application | v8 | ≤ 3.25.28 | Yes | |
| Application | v8 | 3.25.0 | Yes | |
| Application | v8 | 3.25.1 | Yes | |
| Application | v8 | 3.25.2 | Yes | |
| Application | v8 | 3.25.3 | Yes | |
| Application | v8 | 3.25.4 | Yes | |
| Application | v8 | 3.25.5 | Yes | |
| Application | v8 | 3.25.6 | Yes | |
| Application | v8 | 3.25.7 | Yes | |
| Application | v8 | 3.25.8 | Yes | |
| Application | v8 | 3.25.9 | Yes | |
| Application | v8 | 3.25.10 | Yes | |
| Application | v8 | 3.25.11 | Yes | |
| Application | v8 | 3.25.12 | Yes | |
| Application | v8 | 3.25.13 | Yes | |
| Application | v8 | 3.25.14 | Yes | |
| Application | v8 | 3.25.15 | Yes | |
| Application | v8 | 3.25.16 | Yes | |
| Application | v8 | 3.25.17 | Yes | |
| Application | v8 | 3.25.18 | Yes | |
| Application | v8 | 3.25.19 | Yes | |
| Application | v8 | 3.25.20 | Yes | |
| Application | v8 | 3.25.21 | Yes | |
| Application | v8 | 3.25.22 | Yes | |
| Application | v8 | 3.25.23 | Yes | |
| Application | v8 | 3.25.24 | Yes | |
| Application | v8 | 3.25.25 | Yes | |
| Application | v8 | 3.25.26 | Yes | |
| Application | v8 | 3.25.27 | Yes | |
| Application | chrome | ≤ 35.0.1916.113 | Yes | |
| Application | chrome | 35.0.1916.0 | Yes | |
| Application | chrome | 35.0.1916.1 | Yes | |
| Application | chrome | 35.0.1916.2 | Yes | |
| Application | chrome | 35.0.1916.3 | Yes | |
| Application | chrome | 35.0.1916.4 | Yes | |
| Application | chrome | 35.0.1916.5 | Yes | |
| Application | chrome | 35.0.1916.6 | Yes | |
| Application | chrome | 35.0.1916.7 | Yes | |
| Application | chrome | 35.0.1916.8 | Yes | |
| Application | chrome | 35.0.1916.9 | Yes | |
| Application | chrome | 35.0.1916.10 | Yes | |
| Application | chrome | 35.0.1916.11 | Yes | |
| Application | chrome | 35.0.1916.13 | Yes | |
| Application | chrome | 35.0.1916.14 | Yes | |
| Application | chrome | 35.0.1916.15 | Yes | |
| Application | chrome | 35.0.1916.17 | Yes | |
| Application | chrome | 35.0.1916.18 | Yes | |
| Application | chrome | 35.0.1916.19 | Yes | |
| Application | chrome | 35.0.1916.20 | Yes | |
| Application | chrome | 35.0.1916.21 | Yes | |
| Application | chrome | 35.0.1916.22 | Yes | |
| Application | chrome | 35.0.1916.23 | Yes | |
| Application | chrome | 35.0.1916.27 | Yes | |
| Application | chrome | 35.0.1916.31 | Yes | |
| Application | chrome | 35.0.1916.32 | Yes | |
| Application | chrome | 35.0.1916.33 | Yes | |
| Application | chrome | 35.0.1916.34 | Yes | |
| Application | chrome | 35.0.1916.35 | Yes | |
| Application | chrome | 35.0.1916.36 | Yes | |
| Application | chrome | 35.0.1916.37 | Yes | |
| Application | chrome | 35.0.1916.38 | Yes | |
| Application | chrome | 35.0.1916.39 | Yes | |
| Application | chrome | 35.0.1916.40 | Yes | |
| Application | chrome | 35.0.1916.41 | Yes | |
| Application | chrome | 35.0.1916.42 | Yes | |
| Application | chrome | 35.0.1916.43 | Yes | |
| Application | chrome | 35.0.1916.44 | Yes | |
| Application | chrome | 35.0.1916.45 | Yes | |
| Application | chrome | 35.0.1916.46 | Yes | |
| Application | chrome | 35.0.1916.47 | Yes | |
| Application | chrome | 35.0.1916.48 | Yes | |
| Application | chrome | 35.0.1916.49 | Yes | |
| Application | chrome | 35.0.1916.51 | Yes | |
| Application | chrome | 35.0.1916.52 | Yes | |
| Application | chrome | 35.0.1916.54 | Yes | |
| Application | chrome | 35.0.1916.56 | Yes | |
| Application | chrome | 35.0.1916.57 | Yes | |
| Application | chrome | 35.0.1916.59 | Yes | |
| Application | chrome | 35.0.1916.61 | Yes | |
| Application | chrome | 35.0.1916.68 | Yes | |
| Application | chrome | 35.0.1916.69 | Yes | |
| Application | chrome | 35.0.1916.71 | Yes | |
| Application | chrome | 35.0.1916.72 | Yes | |
| Application | chrome | 35.0.1916.74 | Yes | |
| Application | chrome | 35.0.1916.77 | Yes | |
| Application | chrome | 35.0.1916.80 | Yes | |
| Application | chrome | 35.0.1916.82 | Yes | |
| Application | chrome | 35.0.1916.84 | Yes | |
| Application | chrome | 35.0.1916.85 | Yes | |
| Application | chrome | 35.0.1916.86 | Yes | |
| Application | chrome | 35.0.1916.88 | Yes | |
| Application | chrome | 35.0.1916.90 | Yes | |
| Application | chrome | 35.0.1916.92 | Yes | |
| Application | chrome | 35.0.1916.93 | Yes | |
| Application | chrome | 35.0.1916.95 | Yes | |
| Application | chrome | 35.0.1916.96 | Yes | |
| Application | chrome | 35.0.1916.98 | Yes | |
| Application | chrome | 35.0.1916.99 | Yes | |
| Application | chrome | 35.0.1916.101 | Yes | |
| Application | chrome | 35.0.1916.103 | Yes | |
| Application | chrome | 35.0.1916.104 | Yes | |
| Application | chrome | 35.0.1916.105 | Yes | |
| Application | chrome | 35.0.1916.106 | Yes | |
| Application | chrome | 35.0.1916.107 | Yes | |
| Application | chrome | 35.0.1916.108 | Yes | |
| Application | chrome | 35.0.1916.109 | Yes | |
| Application | chrome | 35.0.1916.110 | Yes | |
| Application | chrome | 35.0.1916.111 | Yes | |
| Application | chrome | 35.0.1916.112 | Yes |