Multiple vulnerabilities in Techland Chrome



Published: 2012-01-07 | Updated: 2020-08-11
Risk Medium
Patch available YES
Number of vulnerabilities 3
CVE-ID CVE-2011-3921
CVE-2011-3922
CVE-2011-3919
CWE-ID CWE-416
CWE-121
CWE-122
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe 		Google Chrome
Client/Desktop applications / Web browsers

Vendor Google

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Use-after-free

EUVDB-ID: #VU44413

Risk: Medium

CVSSv3.1: 6.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-3921

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing vectors involving animation frames. A remote attackers can cause a denial of service or possibly have unspecified other impact.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update to version 16.0.912.75.

Vulnerable software versions

Google Chrome: 16.0.912.0 - 16.0.912.74

CPE2.3 External links

http://code.google.com/p/chromium/issues/detail?id=106672
http://googlechromereleases.blogspot.com/2012/01/stable-channel-update.html
http://secunia.com/advisories/47449
http://www.securityfocus.com/bid/51300
http://www.securitytracker.com/id?1026487
http://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13995


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Stack-based buffer overflow

EUVDB-ID: #VU44414

Risk: Medium

CVSSv3.1: 6.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-3922

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing vectors related to glyph handling. A remote unauthenticated attacker can trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update to version 16.0.912.75.

Vulnerable software versions

Google Chrome: 16.0.912.0 - 16.0.912.74

CPE2.3 External links

http://code.google.com/p/chromium/issues/detail?id=108006
http://googlechromereleases.blogspot.com/2012/01/stable-channel-update.html
http://secunia.com/advisories/47449
http://www.securityfocus.com/bid/51300
http://www.securitytracker.com/id?1026487
http://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14871


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Heap-based buffer overflow

EUVDB-ID: #VU44415

Risk: Medium

CVSSv3.1: 6.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-3919

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in Heap-based buffer overflow in libxml2, as used in Google Chrome before 16.0.912.75,. A remote attacker can use unknown vectors. to trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update to version 16.0.912.75.

Vulnerable software versions

Google Chrome: 16.0.912.0 - 16.0.912.74

CPE2.3 External links

http://code.google.com/p/chromium/issues/detail?id=107128
http://googlechromereleases.blogspot.com/2012/01/stable-channel-update.html
http://lists.apple.com/archives/security-announce/2012/May/msg00001.html
http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html
http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00002.html
http://rhn.redhat.com/errata/RHSA-2013-0217.html
http://secunia.com/advisories/47449
http://secunia.com/advisories/55568
http://support.apple.com/kb/HT5281
http://support.apple.com/kb/HT5503
http://www.debian.org/security/2012/dsa-2394
http://www.mandriva.com/security/advisories?name=MDVSA-2012:005
http://www.securityfocus.com/bid/51300
http://www.securitytracker.com/id?1026487
http://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14504


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###