SB2012033001 - Gentoo update for Chromium, V8

Description

This security bulletin contains information about 9 secuirty vulnerabilities.

1) Out-of-bounds read (CVE-ID: CVE-2011-3057)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

Google V8, as used in Google Chrome before 17.0.963.83, allows remote attackers to cause a denial of service via vectors that trigger an invalid read operation.

2) Universal cross-site scripting (CVE-ID: CVE-2011-3058)

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in EUC-JP encoding. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

3) Out-of-bounds read (CVE-ID: CVE-2011-3059)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 18.0.1025.142 does not properly handle SVG text elements, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.

4) Out-of-bounds read (CVE-ID: CVE-2011-3060)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 18.0.1025.142 does not properly handle text fragments, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.

5) Improper Certificate Validation (CVE-ID: CVE-2011-3061)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 18.0.1025.142 does not properly check X.509 certificates before use of a SPDY proxy, which might allow man-in-the-middle attackers to spoof servers or obtain sensitive information via a crafted certificate.

6) Incorrect calculation (CVE-ID: CVE-2011-3062)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Off-by-one error in the OpenType Sanitizer in Google Chrome before 18.0.1025.142 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted OpenType file.

7) Input validation error (CVE-ID: CVE-2011-3063)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

Google Chrome before 18.0.1025.142 does not properly validate the renderer's navigation requests, which has unspecified impact and remote attack vectors.

8) Use-after-free (CVE-ID: CVE-2011-3064)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing vectors related to SVG clipping. A remote attackers can cause a denial of service or possibly have unspecified other impact.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

9) Integer overflow (CVE-ID: CVE-2011-3065)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Skia, as used in Google Chrome before 18.0.1025.142, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.

Remediation

Install update from vendor's website.

References

• https://security.gentoo.org/
• https://security.gentoo.org/glsa/201203-24