Vulnerability identifier: #VU44216

Vulnerability risk: Medium

CVSSv3.1: 6.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-3037

CWE-ID: CWE-704

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Google Chrome
Client/Desktop applications / Web browsers

Vendor: Google

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 17.0.963.65 does not properly perform casts of unspecified variables during the splitting of anonymous blocks, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted document.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Google Chrome: 17.0.963.0 - 17.0.963.64

---

External links
http://code.google.com/p/chromium/issues/detail?id=113439
http://code.google.com/p/chromium/issues/detail?id=114924
http://code.google.com/p/chromium/issues/detail?id=115028
http://googlechromereleases.blogspot.com/2012/03/chrome-stable-update.html
http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html
http://lists.apple.com/archives/security-announce/2012/Sep/msg00001.html
http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html
http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00012.html
http://osvdb.org/79796
http://secunia.com/advisories/48265
http://secunia.com/advisories/48419
http://secunia.com/advisories/48527
http://security.gentoo.org/glsa/glsa-201203-19.xml
http://support.apple.com/kb/HT5400
http://support.apple.com/kb/HT5485
http://support.apple.com/kb/HT5503
http://www.securityfocus.com/bid/52271
http://www.securitytracker.com/id?1026759
http://exchange.xforce.ibmcloud.com/vulnerabilities/73648
http://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14397

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.