CVE-2013-6627
net/http/http_stream_parser.cc in Google Chrome before 31.0.1650.48 does not properly process...
net/http/http_stream_parser.cc in Google Chrome before 31.0.1650.48 does not properly process HTTP Informational (aka 1xx) status codes, which allows remote web servers to cause a denial of service (out-of-bounds read) via a crafted response.
Exploit likelihood
What each source reports
NVD Score used
net/http/http_stream_parser.cc in Google Chrome before 31.0.1650.48 does not properly process HTTP Informational (aka 1xx) status codes, which allows remote web servers to cause a denial of service (out-of-bounds read) via a crafted response.
- Record
CVE-2013-6627- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
net/http/http_stream_parser.cc in Google Chrome before 31.0.1650.48 does not properly process HTTP Informational (aka 1xx) status codes, which allows remote web servers to cause a denial of service (out-of-bounds read) via a crafted response.
- Record
CVE-2013-6627- Updated
- 2026-11-02
EUVDEUVD-2013-6429 No score
net/http/http_stream_parser.cc in Google Chrome before 31.0.1650.48 does not properly process HTTP Informational (aka 1xx) status codes, which allows remote web servers to cause a denial of service (out-of-bounds read) via a crafted response.
- Record
EUVD-2013-6429- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mhhh-874c-f34g No score
net/http/http_stream_parser.cc in Google Chrome before 31.0.1650.48 does not properly process...
net/http/http_stream_parser.cc in Google Chrome before 31.0.1650.48 does not properly process HTTP Informational (aka 1xx) status codes, which allows remote web servers to cause a denial of service (out-of-bounds read) via a crafted response.
- Record
GHSA-mhhh-874c-f34g- Weakness
- CWE-119
- Updated
- 2026-11-02
OSVMGASA-2013-0324 No score
Updated chromium-browser-stable packages fix multiple vulnerabilities
Updated chromium-browser-stable packages fix security vulnerabilities:
Various fixes from internal audits, fuzzing and other initiatives (CVE-2013-2931).
Use after free related to speech input elements (CVE-2013-6621).
Use after free related to media elements (CVE-2013-6622).
Out of bounds read in SVG (CVE-2013-6623).
Use after free related to 'id' attribute strings (CVE-2013-6624).
Use after free in DOM ranges (CVE-2013-6625).
Address bar spoofing related to interstitial warnings (CVE-2013-6626).
Out of bounds read in HTTP parsing (CVE-2013-6627).
Issue with certificates not being checked during TLS renegotiation (CVE-2013-6628).
libjpeg 6b and libjpeg-turbo will use uninitialized memory when decoding images with missing SOS data for the luminance component (Y) in presence of valid chroma data (Cr, Cb) (CVE-2013-6629).
libjpeg-turbo will use uninitialized memory when handling Huffman tables (CVE-2013-6630).
Use after free in libjingle (CVE-2013-6631).
- Record
MGASA-2013-0324- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10171-1 No score
chromedriver-55.0.2883.75-3.1 on GA media
These are all security issues fixed in the chromedriver-55.0.2883.75-3.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10171-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12948-1 No score
ungoogled-chromium-113.0.5672.92-1.1 on GA media
These are all security issues fixed in the ungoogled-chromium-113.0.5672.92-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12948-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
chromium-browserDebian:7 From an advisory covering 14 CVEs |
before 31.0.1650.57-1~deb7u1, plus listed versions 26.0.1410.43-127.0.1453.110-127.0.1453.110-1~deb7u127.0.1453.110-227.0.1453.93-1 Show 17 moreShow less27.0.1453.93-1~deb7u128.0.1500.71-128.0.1500.71-1~deb7u128.0.1500.71-228.0.1500.95-128.0.1500.95-1~deb7u128.0.1500.95-228.0.1500.95-329.0.1547.57-129.0.1547.57-1~deb7u129.0.1547.57-229.0.1547.57-329.0.1547.57-3+exp130.0.1599.101-130.0.1599.101-1~deb7u130.0.1599.101-230.0.1599.101-3 |
31.0.1650.57-1~deb7u1 |
chromium-browser-stableMageia:2 From an advisory covering 12 CVEs |
before 31.0.1650.48-1.mga2 | 31.0.1650.48-1.mga2 |
chromium-browser-stableMageia:3 From an advisory covering 12 CVEs |
before 31.0.1650.48-1.mga3 | 31.0.1650.48-1.mga3 |
chromium-browser-stableMageia:3 From an advisory covering 12 CVEs |
before 31.0.1650.48-1.mga3.tainted | 31.0.1650.48-1.mga3.tainted |
chromiumopenSUSE:Tumbleweed From an advisory covering 719 CVEs |
before 55.0.2883.75-3.1 | 55.0.2883.75-3.1 |
chromiumopenSUSE:Tumbleweed From an advisory covering 2310 CVEs |
before 113.0.5672.92-1.1 | 113.0.5672.92-1.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Google Chrome < 31.0.1650.48 - HTTP 1xx base::StringTokenizerT<...>::QuickGetNext Out-of-Bounds Read | 2016-12-19 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-6627 is a medium vulnerability (CVSS 5.0) in Google Chrome, published November 13, 2013. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 5.34%, the 92nd percentile. No source names a fixed version.
References
packetstormsecurity.com/files/140209/Chrome-HTTP-1xx-Out-Of-Bounds-Read.html
src.chromium.org/viewvc/chrome?revision=226539&view=revision
exploit-db.com/exploits/40944
lists.opensuse.org/opensuse-updates/2014-01/msg00042.html
code.google.com/p/chromium/issues/detail?id=299892
seclists.org/fulldisclosure/2016/Dec/65
Show 194 moreShow less
googlechromereleases.blogspot.com/2013/11/stable-channel-update.html
blog.skylined.nl/20161219001.html
debian.org/security/2013/dsa-2799
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19113
nvd.nist.gov/vuln/detail/CVE-2013-6627
github.com/advisories/GHSA-mhhh-874c-f34g
advisories.mageia.org/MGASA-2013-0324.html
permalink.gmane.org/gmane.comp.security.full-disclosure/90919
bugs.mageia.org/show_bug.cgi?id=11657
suse.com/security/cve/CVE-2011-3015
Left out here: 2,150 references. The JSON record has them.