SB2011080304 - Multiple vulnerabilities in Techland Chrome

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2011080304

SB2011080304 - Multiple vulnerabilities in Techland Chrome

Published: August 3, 2011 Updated: August 11, 2020

Security Bulletin ID SB2011080304
Severity
Medium
Patch available
YES
Number of vulnerabilities 27
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 96% Low 4%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 27 secuirty vulnerabilities.


1) Out-of-bounds write (CVE-ID: CVE-2011-2791)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The International Components for Unicode (ICU) functionality in Google Chrome before 13.0.782.107 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that trigger an out-of-bounds write.


2) Use-after-free (CVE-ID: CVE-2011-2792)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing vectors related to float removal. A remote attackers can cause a denial of service or possibly have unspecified other impact.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


3) Use-after-free (CVE-ID: CVE-2011-2793)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing vectors related to media selectors. A remote attackers can cause a denial of service or possibly have unspecified other impact.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


4) Out-of-bounds read (CVE-ID: CVE-2011-2794)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 13.0.782.107 does not properly perform text iteration, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


5) Input validation error (CVE-ID: CVE-2011-2795)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

Google Chrome before 13.0.782.107 does not prevent calls to functions in other frames, which allows remote attackers to bypass intended access restrictions via a crafted web site, related to a "cross-frame function leak."


6) Use-after-free (CVE-ID: CVE-2011-2796)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing unknown vectors. A remote attackers can cause a denial of service or possibly have unspecified other impact.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


7) Use-after-free (CVE-ID: CVE-2011-2797)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing vectors related to resource caching. A remote attackers can cause a denial of service or possibly have unspecified other impact.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


8) Input validation error (CVE-ID: CVE-2011-2798)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 13.0.782.107 does not properly restrict access to internal schemes, which allows remote attackers to have an unspecified impact via a crafted web site.


9) Use-after-free (CVE-ID: CVE-2011-2799)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing vectors related to HTML range handling. A remote attackers can cause a denial of service or possibly have unspecified other impact.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


10) Information disclosure (CVE-ID: CVE-2011-2800)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

Google Chrome before 13.0.782.107 allows remote attackers to obtain potentially sensitive information about client-side redirect targets via a crafted web site.


11) Use-after-free (CVE-ID: CVE-2011-2801)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing vectors related to the frame loader. A remote attackers can cause a denial of service or possibly have unspecified other impact.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


12) Out-of-bounds read (CVE-ID: CVE-2011-2803)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 13.0.782.107 does not properly handle Skia paths, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


13) Improper Neutralization of Special Elements in Output Used by a Downstream Component (CVE-ID: CVE-2011-2805)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 13.0.782.107 allows remote attackers to bypass the Same Origin Policy and conduct script injection attacks via unspecified vectors.


14) Use-after-free (CVE-ID: CVE-2011-2818)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing vectors related to display box rendering. A remote attackers can cause a denial of service or possibly have unspecified other impact.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


15) Input validation error (CVE-ID: CVE-2011-2819)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 13.0.782.107 allows remote attackers to bypass the Same Origin Policy via vectors related to handling of the base URI.


16) Input validation error (CVE-ID: CVE-2011-2358)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 13.0.782.107 does not ensure that extension installations are confirmed by a browser dialog, which makes it easier for remote attackers to modify the product's functionality via a Trojan horse extension.


17) Input validation error (CVE-ID: CVE-2011-2359)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 13.0.782.107 does not properly track line boxes during rendering, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."


18) Input validation error (CVE-ID: CVE-2011-2360)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

Google Chrome before 13.0.782.107 does not ensure that the user is prompted before download of a dangerous file, which makes it easier for remote attackers to bypass intended content restrictions via a crafted web site.


19) Improper Authentication (CVE-ID: CVE-2011-2361)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The Basic Authentication dialog implementation in Google Chrome before 13.0.782.107 does not properly handle strings, which might make it easier for remote attackers to capture credentials via a crafted web site.


20) Input validation error (CVE-ID: CVE-2011-2783)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 13.0.782.107 does not ensure that developer-mode NPAPI extension installations are confirmed by a browser dialog, which makes it easier for remote attackers to modify the product's functionality via a Trojan horse extension.


21) Information disclosure (CVE-ID: CVE-2011-2784)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

Google Chrome before 13.0.782.107 allows remote attackers to obtain sensitive information via a request for the GL program log, which reveals a local path in an unspecified log entry.


22) Input validation error (CVE-ID: CVE-2011-2785)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The extensions implementation in Google Chrome before 13.0.782.107 does not properly validate the URL for the home page, which allows remote attackers to have an unspecified impact via a crafted extension.


23) Input validation error (CVE-ID: CVE-2011-2786)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

Google Chrome before 13.0.782.107 does not ensure that the speech-input bubble is shown on the product's screen, which might make it easier for remote attackers to make audio recordings via a crafted web page containing an INPUT element.


24) Input validation error (CVE-ID: CVE-2011-2787)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

Google Chrome before 13.0.782.107 does not properly address re-entrancy issues associated with the GPU lock, which allows remote attackers to cause a denial of service (application crash) via unspecified vectors.


25) Buffer overflow (CVE-ID: CVE-2011-2788)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Buffer overflow in the inspector serialization functionality in Google Chrome before 13.0.782.107 allows user-assisted remote attackers to have an unspecified impact via unknown vectors.


26) Use-after-free (CVE-ID: CVE-2011-2789)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing vectors related to instantiation of the Pepper plug-in. A remote attackers can cause a denial of service or possibly have unspecified other impact.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


27) Use-after-free (CVE-ID: CVE-2011-2790)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing vectors involving floating styles. A remote attackers can cause a denial of service or possibly have unspecified other impact.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


Remediation

Install update from vendor's website.

References