Use-after-free vulnerability in the element wrapper in Google V8, as used in Google Chrome before 17.0.963.65, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

Changes in chromium :

  - Update to 19.0.1066

  - Fixed Chrome install/update resets Google search     preferences (Issue: 105390)

  - Don't trigger accelerated compositing on 3D CSS when     using swiftshader (Issue: 116401)

  - Fixed a GPU crash (Issue: 116096)

  - More fixes for Back button frequently hangs (Issue:
    93427)

  - Bastion now works (Issue: 116285)

  - Fixed Composited layer sorting irregularity with     accelerated canvas (Issue: 102943)

  - Fixed Composited layer sorting irregularity with     accelerated canvas (Issue: 102943)

  - Fixed Google Feedback causes render process to use too     much memory (Issue: 114489)

  - Fixed after upgrade, some pages are rendered as blank     (Issue: 109888)

  - Fixed Pasting text into a single-line text field     shouldn't keep literal newlines (Issue: 106551)

  - Security Fixes :

  - Critical CVE-2011-3047: Errant plug-in load and GPU     process memory corruption

  - Critical CVE-2011-3046: UXSS and bad history navigation.

  - Update to 19.0.1060

  - Fixed NTP signed in state is missing (Issue: 112676)

  - Fixed gmail seems to redraw itself (all white)     occasionally (Issue: 111263)

  - Focus 'OK' button on JavaScript dialogs (Issue: 111015)

  - Fixed Back button frequently hangs (Issue: 93427)

  - Increase the buffer size to fix muted playback rate     (Issue: 108239)

  - Fixed Empty span with line-height renders with non-zero     height (Issue: 109811)

  - Marked the Certum Trusted Network CA as an issuer of     extended-validation (EV) certificates.

  - Fixed importing of bookmarks, history, etc. from Firefox     10+.

  - Fixed issues - 114001, 110785, 114168, 114598, 111663,     113636, 112676

  - Fixed several crashes (Issues: 111376, 108688, 114391)

  - Fixed Firefox browser in Import Bookmarks and Settings     drop-down (Issue: 114476)

  - Sync: Sessions aren't associating pre-existing tabs     (Issue: 113319)

  - Fixed All 'Extensions' make an entry under the 'NTP     Apps' page (Issue: 113672)

  - Security Fixes (bnc#750407) :

  - High CVE-2011-3031: Use-after-free in v8 element     wrapper.

  - High CVE-2011-3032: Use-after-free in SVG value     handling.

  - High CVE-2011-3033: Buffer overflow in the Skia drawing     library.

  - High CVE-2011-3034: Use-after-free in SVG document     handling.

  - High CVE-2011-3035: Use-after-free in SVG use handling.

  - High CVE-2011-3036: Bad cast in line box handling.

  - High CVE-2011-3037: Bad casts in anonymous block     splitting.

  - High CVE-2011-3038: Use-after-free in multi-column     handling.

  - High CVE-2011-3039: Use-after-free in quote handling.

  - High CVE-2011-3040: Out-of-bounds read in text handling.

  - High CVE-2011-3041: Use-after-free in class attribute     handling.

  - High CVE-2011-3042: Use-after-free in table section     handling.

  - High CVE-2011-3043: Use-after-free in flexbox with     floats.

  - High CVE-2011-3044: Use-after-free with SVG animation     elements.

Changes in v8 :

  - Update to 3.9.13.0

  - Add code kind check before preparing for OSR. (issue     1900, 115073)

  - Pass zone explicitly to zone-allocation on x64 and ARM.
    (issue 1802)

  - Port string construct stub to x64. (issue 849)

  - Performance and stability improvements on all platforms.

A large number of security issues were discovered in the WebKit browser and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201203-19 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium. Please review       the CVE identifiers and release notes referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted web       site using Chromium, possibly resulting in the execution of arbitrary       code with the privileges of the process, a Denial of Service condition,       Universal Cross-Site Scripting, or installation of an extension without       user interaction.
    A remote attacker could also entice a user to install a specially       crafted extension that would interfere with browser-issued web requests.
  Workaround :

    There is no known workaround at this time.

Google Chrome Releases reports :

[105867] High CVE-2011-3031: Use-after-free in v8 element wrapper.
Credit to Chamal de Silva.

[108037] High CVE-2011-3032: Use-after-free in SVG value handling.
Credit to Arthur Gerkis.

[108406] [115471] High CVE-2011-3033: Buffer overflow in the Skia drawing library. Credit to Aki Helin of OUSPG.

[111748] High CVE-2011-3034: Use-after-free in SVG document handling.
Credit to Arthur Gerkis.

[112212] High CVE-2011-3035: Use-after-free in SVG use handling.
Credit to Arthur Gerkis.

[113258] High CVE-2011-3036: Bad cast in line box handling. Credit to miaubiz.

[113439] [114924] [115028] High CVE-2011-3037: Bad casts in anonymous block splitting. Credit to miaubiz.

[113497] High CVE-2011-3038: Use-after-free in multi-column handling.
Credit to miaubiz.

[113707] High CVE-2011-3039: Use-after-free in quote handling. Credit to miaubiz.

[114054] High CVE-2011-3040: Out-of-bounds read in text handling.
Credit to miaubiz.

[114068] High CVE-2011-3041: Use-after-free in class attribute handling. Credit to miaubiz.

[114219] High CVE-2011-3042: Use-after-free in table section handling.
Credit to miaubiz.

[115681] High CVE-2011-3043: Use-after-free in flexbox with floats.
Credit to miaubiz.

[116093] High CVE-2011-3044: Use-after-free with SVG animation elements. Credit to Arthur Gerkis.

Versions of Google Chrome earlier than 17.0.963.65 are potentially affected by the following vulnerabilities :

  - Use-after-free errors exist related to 'v8 element wrapper', SVG value handling, SVG document handling, SVG use handling, multi-column handling, quote handling, class attribute handling, table section handling, flexbox with floats and SVG animation elements. (CVE-2011-3031, CVE-2011-3032, CVE-2011-3034, CVE-2011-3035, CVE-2011-3038, CVE-2011-3039, CVE-2011-3041, CVE-2011-3042, CVE-2011-3043, CVE-2011-3044)

  - An error exists in the 'Skia' drawing library that can allow buffer overflows. (CVE-2011-3033)

  - Casting errors exist related to line box handling and anonymous block splitting. (CVE-2011-3036, CVE-2011-3037)

  - An out-of-bounds read error exists related to text handling. (CVE-2011-3040)

The version of Google Chrome installed on the remote host is earlier than 17.0.963.65 and is, therefore, affected by the following vulnerabilities:

  - Use-after-free errors exist related to 'v8 element     wrapper', SVG value handling, SVG document handling,     SVG use handling, multi-column handling, quote     handling, class attribute handling, table section     handling, flexbox with floats and SVG animation     elements. (CVE-2011-3031, CVE-2011-3032, CVE-2011-3034,     CVE-2011-3035, CVE-2011-3038, CVE-2011-3039,     CVE-2011-3041, CVE-2011-3042, CVE-2011-3043,     CVE-2011-3044)

  - An error exists in the 'Skia' drawing library that can     allow buffer overflows. (CVE-2011-3033)

  - Casting errors exist related to line box handling and     anonymous block splitting. (CVE-2011-3036,     CVE-2011-3037)

  - An out-of-bounds read error exists related to text     handling. (CVE-2011-3040)

ID	Name	Product	Family	Severity
74570	openSUSE Security Update : chromium / v8 (openSUSE-SU-2012:0374-1)	Nessus	SuSE Local Security Checks	critical
62707	Ubuntu 12.04 LTS : webkit vulnerabilities (USN-1617-1)	Nessus	Ubuntu Local Security Checks	critical
59611	GLSA-201203-19 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
58210	FreeBSD : chromium -- multiple vulnerabilities (99aef698-66ed-11e1-8288-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	high
800899	Google Chrome < 17.0.963.65 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
6341	Google Chrome < 17.0.963.65 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
58206	Google Chrome < 17.0.963.65 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2011-3031

high

Tenable Plugins

critical

critical

critical

high

high

high

high