SB2012052402 - Multiple vulnerabilities in Chrome 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2012052402

SB2012052402 - Multiple vulnerabilities in Chrome

Published: May 24, 2012 Updated: February 13, 2023

Security Bulletin ID SB2012052402
Severity
High
Patch available
YES
Number of vulnerabilities 12
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 17% Medium 83%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 12 secuirty vulnerabilities.


1) Use-after-free (CVE-ID: CVE-2011-3105)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing vectors related to the :first-letter pseudo-element. A remote attackers can cause a denial of service or possibly have unspecified other impact.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


2) Buffer overflow (CVE-ID: CVE-2011-3106)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The WebSockets implementation in Google Chrome before 19.0.1084.52 does not properly handle use of SSL, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.


3) Input validation error (CVE-ID: CVE-2011-3107)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 19.0.1084.52 does not properly implement JavaScript bindings for plug-ins, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via unknown vectors.


4) Use-after-free (CVE-ID: CVE-2011-3108)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing vectors related to the browser cache. A remote attackers can execute arbitrary code.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


5) Buffer overflow (CVE-ID: CVE-2011-3110)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The PDF functionality in Google Chrome before 19.0.1084.52 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger out-of-bounds write operations.


6) Buffer overflow (CVE-ID: CVE-2011-3111)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

Google V8, as used in Google Chrome before 19.0.1084.52, allows remote attackers to cause a denial of service (invalid read operation) via unspecified vectors.


7) Use-after-free (CVE-ID: CVE-2011-3112)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing an invalid encrypted document. A remote attackers can cause a denial of service or possibly have unspecified other impact.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


8) Input validation error (CVE-ID: CVE-2011-3113)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The PDF functionality in Google Chrome before 19.0.1084.52 does not properly perform a cast of an unspecified variable during handling of color spaces, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted document.


9) Buffer overflow (CVE-ID: CVE-2011-3114)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Multiple buffer overflows in the PDF functionality in Google Chrome before 19.0.1084.52 allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger unknown function calls.


10) Buffer overflow (CVE-ID: CVE-2011-3115)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google V8, as used in Google Chrome before 19.0.1084.52, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger "type corruption."


11) Resource management error (CVE-ID: CVE-2011-3103)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google V8, as used in Google Chrome before 19.0.1084.52, does not properly perform garbage collection, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted JavaScript code.


12) Buffer overflow (CVE-ID: CVE-2011-3104)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

Skia, as used in Google Chrome before 19.0.1084.52, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


Remediation

Install update from vendor's website.

References