Multiple vulnerabilities in Techland Chrome

1) Use-after-free

EUVDB-ID: #VU44978

Risk: Medium

CVSSv3.1: 6.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-1808

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing vectors related to incorrect integer calculations during float handling. A remote attackers can cause a denial of service or possibly have unspecified other impact.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update to version 12.0.742.91.

Vulnerable software versions

Google Chrome: 12.0.742.0 - 12.0.742.82

CPE2.3

External links

http://code.google.com/p/chromium/issues/detail?id=73962
http://code.google.com/p/chromium/issues/detail?id=79746
http://googlechromereleases.blogspot.com/2011/06/chrome-stable-release.html
http://osvdb.org/72778
http://secunia.com/advisories/44829
http://www.securityfocus.com/bid/48129
http://exchange.xforce.ibmcloud.com/vulnerabilities/67891
http://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14659

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Use-after-free

EUVDB-ID: #VU44979

Risk: Medium

CVSSv3.1: 6.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-1809

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing unknown vectors. A remote attackers can cause a denial of service or possibly have unspecified other impact.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update to version 12.0.742.91.

Vulnerable software versions

Google Chrome: 12.0.742.0 - 12.0.742.82

CPE2.3

External links

http://code.google.com/p/chromium/issues/detail?id=75496
http://googlechromereleases.blogspot.com/2011/06/chrome-stable-release.html
http://osvdb.org/72779
http://secunia.com/advisories/44829
http://www.securityfocus.com/bid/48129
http://exchange.xforce.ibmcloud.com/vulnerabilities/67892
http://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14692

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Information disclosure

EUVDB-ID: #VU44980

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-1810

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The Cascading Style Sheets (CSS) implementation in Google Chrome before 12.0.742.91 does not properly restrict access to the visit history, which allows remote attackers to obtain sensitive information via unspecified vectors.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 12.0.742.0 - 12.0.742.82

CPE2.3

External links

http://code.google.com/p/chromium/issues/detail?id=75643
http://googlechromereleases.blogspot.com/2011/06/chrome-stable-release.html
http://osvdb.org/72780
http://secunia.com/advisories/44829
http://www.securityfocus.com/bid/48129
http://exchange.xforce.ibmcloud.com/vulnerabilities/67893
http://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14433

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Input validation error

EUVDB-ID: #VU44981

Risk: Medium

CVSSv3.1: 6.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-1812

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 12.0.742.91 allows remote attackers to bypass intended access restrictions via vectors related to extensions.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 12.0.742.0 - 12.0.742.82

CPE2.3

External links

http://code.google.com/p/chromium/issues/detail?id=77026
http://googlechromereleases.blogspot.com/2011/06/chrome-stable-release.html
http://osvdb.org/72782
http://secunia.com/advisories/44829
http://www.securityfocus.com/bid/48129
http://exchange.xforce.ibmcloud.com/vulnerabilities/67895
http://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14546

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Input validation error

EUVDB-ID: #VU44982

Risk: Medium

CVSSv3.1: 6.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-1813

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 12.0.742.91 does not properly implement the framework for extensions, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 12.0.742.0 - 12.0.742.82

CPE2.3

External links

http://code.google.com/p/chromium/issues/detail?id=78516
http://googlechromereleases.blogspot.com/2011/06/chrome-stable-release.html
http://osvdb.org/72783
http://secunia.com/advisories/44829
http://www.securityfocus.com/bid/48129
http://exchange.xforce.ibmcloud.com/vulnerabilities/67896
http://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14481

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Access of Uninitialized Pointer

EUVDB-ID: #VU44983

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-1814

CWE-ID: CWE-824 - Access of Uninitialized Pointer

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to #BASIC_IMPACT#.

Google Chrome before 12.0.742.91 attempts to read data from an uninitialized pointer, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 12.0.742.0 - 12.0.742.82

CPE2.3

External links

http://code.google.com/p/chromium/issues/detail?id=79362
http://googlechromereleases.blogspot.com/2011/06/chrome-stable-release.html
http://osvdb.org/72784
http://secunia.com/advisories/44829
http://www.securityfocus.com/bid/48129
http://exchange.xforce.ibmcloud.com/vulnerabilities/67897
http://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14565

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Cross-site scripting

EUVDB-ID: #VU44984

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-1815

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to manipulate data.

Google Chrome before 12.0.742.91 allows remote attackers to inject script into a tab page via vectors related to extensions.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 12.0.742.0 - 12.0.742.82

CPE2.3

External links

http://code.google.com/p/chromium/issues/detail?id=79862
http://googlechromereleases.blogspot.com/2011/06/chrome-stable-release.html
http://osvdb.org/72785
http://secunia.com/advisories/44829
http://www.securityfocus.com/bid/48129
http://exchange.xforce.ibmcloud.com/vulnerabilities/67898
http://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14728

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Use-after-free

EUVDB-ID: #VU44985

Risk: Medium

CVSSv3.1: 6.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-1816

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing unknown vectors. A remote attackers can cause a denial of service or possibly have unspecified other impact.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update to version 12.0.742.91.

Vulnerable software versions

Google Chrome: 12.0.742.0 - 12.0.742.82

CPE2.3

External links

http://code.google.com/p/chromium/issues/detail?id=80358
http://googlechromereleases.blogspot.com/2011/06/chrome-stable-release.html
http://osvdb.org/72786
http://secunia.com/advisories/44829
http://www.securityfocus.com/bid/48129
http://exchange.xforce.ibmcloud.com/vulnerabilities/67899
http://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13575

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Buffer overflow

EUVDB-ID: #VU44986

Risk: Medium

CVSSv3.1: 6.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-1817

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 12.0.742.91 does not properly implement history deletion, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 12.0.742.0 - 12.0.742.82

CPE2.3

External links

http://code.google.com/p/chromium/issues/detail?id=81916
http://googlechromereleases.blogspot.com/2011/06/chrome-stable-release.html
http://osvdb.org/72787
http://secunia.com/advisories/44829
http://www.securityfocus.com/bid/48129
http://exchange.xforce.ibmcloud.com/vulnerabilities/67900
http://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14128

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Use-after-free

EUVDB-ID: #VU44987

Risk: Medium

CVSSv3.1: 6.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-1818

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing unknown vectors. A remote attackers can cause a denial of service or possibly have unspecified other impact.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update to version 12.0.742.91.

Vulnerable software versions

Google Chrome: 12.0.742.0 - 12.0.742.82

CPE2.3

External links

http://code.google.com/p/chromium/issues/detail?id=81949
http://googlechromereleases.blogspot.com/2011/06/chrome-stable-release.html
http://osvdb.org/72788
http://secunia.com/advisories/44829
http://www.securityfocus.com/bid/48129
http://exchange.xforce.ibmcloud.com/vulnerabilities/67901
http://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14757

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Cross-site scripting

EUVDB-ID: #VU44988

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-1819

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to manipulate data.

Google Chrome before 12.0.742.91 allows remote attackers to perform unspecified injection into a chrome:// page via vectors related to extensions.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 12.0.742.0 - 12.0.742.82

CPE2.3

External links

http://code.google.com/p/chromium/issues/detail?id=83010
http://googlechromereleases.blogspot.com/2011/06/chrome-stable-release.html
http://osvdb.org/72789
http://secunia.com/advisories/44829
http://www.securityfocus.com/bid/48129
http://exchange.xforce.ibmcloud.com/vulnerabilities/67902
http://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14616

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Input validation error

EUVDB-ID: #VU44989

Risk: Medium

CVSSv3.1: 6.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-2332

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google V8, as used in Google Chrome before 12.0.742.91, allows remote attackers to bypass the Same Origin Policy via unspecified vectors.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 12.0.742.0 - 12.0.742.82

CPE2.3

External links

http://code.google.com/p/chromium/issues/detail?id=83275
http://googlechromereleases.blogspot.com/2011/06/chrome-stable-release.html
http://osvdb.org/72790
http://secunia.com/advisories/44829
http://www.securityfocus.com/bid/48129
http://exchange.xforce.ibmcloud.com/vulnerabilities/67903
http://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14242

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Cross-site scripting

EUVDB-ID: #VU44990

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-2342

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The DOM implementation in Google Chrome before 12.0.742.91 allows remote attackers to bypass the Same Origin Policy via unspecified vectors.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 12.0.742.0 - 12.0.742.82

CPE2.3

External links

http://code.google.com/p/chromium/issues/detail?id=83743
http://googlechromereleases.blogspot.com/2011/06/chrome-stable-release.html
http://osvdb.org/72791
http://secunia.com/advisories/44829
http://www.securityfocus.com/bid/48129
http://exchange.xforce.ibmcloud.com/vulnerabilities/67904
http://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14663

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Risk	Medium
Patch available	YES
Number of vulnerabilities	13
CVE-ID	CVE-2011-1808 CVE-2011-1809 CVE-2011-1810 CVE-2011-1812 CVE-2011-1813 CVE-2011-1814 CVE-2011-1815 CVE-2011-1816 CVE-2011-1817 CVE-2011-1818 CVE-2011-1819 CVE-2011-2332 CVE-2011-2342
CWE-ID	CWE-416 CWE-200 CWE-20 CWE-824 CWE-79 CWE-119
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	Google Chrome Client/Desktop applications / Web browsers
Vendor	Google