The extension subsystem in Google Chrome before 17.0.963.78 does not properly handle history navigation, which allows remote attackers to execute arbitrary code by leveraging a "Universal XSS (UXSS)" issue.

Changes in chromium :

  - Update to 19.0.1066

  - Fixed Chrome install/update resets Google search     preferences (Issue: 105390)

  - Don't trigger accelerated compositing on 3D CSS when     using swiftshader (Issue: 116401)

  - Fixed a GPU crash (Issue: 116096)

  - More fixes for Back button frequently hangs (Issue:
    93427)

  - Bastion now works (Issue: 116285)

  - Fixed Composited layer sorting irregularity with     accelerated canvas (Issue: 102943)

  - Fixed Composited layer sorting irregularity with     accelerated canvas (Issue: 102943)

  - Fixed Google Feedback causes render process to use too     much memory (Issue: 114489)

  - Fixed after upgrade, some pages are rendered as blank     (Issue: 109888)

  - Fixed Pasting text into a single-line text field     shouldn't keep literal newlines (Issue: 106551)

  - Security Fixes :

  - Critical CVE-2011-3047: Errant plug-in load and GPU     process memory corruption

  - Critical CVE-2011-3046: UXSS and bad history navigation.

  - Update to 19.0.1060

  - Fixed NTP signed in state is missing (Issue: 112676)

  - Fixed gmail seems to redraw itself (all white)     occasionally (Issue: 111263)

  - Focus 'OK' button on JavaScript dialogs (Issue: 111015)

  - Fixed Back button frequently hangs (Issue: 93427)

  - Increase the buffer size to fix muted playback rate     (Issue: 108239)

  - Fixed Empty span with line-height renders with non-zero     height (Issue: 109811)

  - Marked the Certum Trusted Network CA as an issuer of     extended-validation (EV) certificates.

  - Fixed importing of bookmarks, history, etc. from Firefox     10+.

  - Fixed issues - 114001, 110785, 114168, 114598, 111663,     113636, 112676

  - Fixed several crashes (Issues: 111376, 108688, 114391)

  - Fixed Firefox browser in Import Bookmarks and Settings     drop-down (Issue: 114476)

  - Sync: Sessions aren't associating pre-existing tabs     (Issue: 113319)

  - Fixed All 'Extensions' make an entry under the 'NTP     Apps' page (Issue: 113672)

  - Security Fixes (bnc#750407) :

  - High CVE-2011-3031: Use-after-free in v8 element     wrapper.

  - High CVE-2011-3032: Use-after-free in SVG value     handling.

  - High CVE-2011-3033: Buffer overflow in the Skia drawing     library.

  - High CVE-2011-3034: Use-after-free in SVG document     handling.

  - High CVE-2011-3035: Use-after-free in SVG use handling.

  - High CVE-2011-3036: Bad cast in line box handling.

  - High CVE-2011-3037: Bad casts in anonymous block     splitting.

  - High CVE-2011-3038: Use-after-free in multi-column     handling.

  - High CVE-2011-3039: Use-after-free in quote handling.

  - High CVE-2011-3040: Out-of-bounds read in text handling.

  - High CVE-2011-3041: Use-after-free in class attribute     handling.

  - High CVE-2011-3042: Use-after-free in table section     handling.

  - High CVE-2011-3043: Use-after-free in flexbox with     floats.

  - High CVE-2011-3044: Use-after-free with SVG animation     elements.

Changes in v8 :

  - Update to 3.9.13.0

  - Add code kind check before preparing for OSR. (issue     1900, 115073)

  - Pass zone explicitly to zone-allocation on x64 and ARM.
    (issue 1802)

  - Port string construct stub to x64. (issue 849)

  - Performance and stability improvements on all platforms.

A large number of security issues were discovered in the WebKit browser and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201203-19 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium. Please review       the CVE identifiers and release notes referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted web       site using Chromium, possibly resulting in the execution of arbitrary       code with the privileges of the process, a Denial of Service condition,       Universal Cross-Site Scripting, or installation of an extension without       user interaction.
    A remote attacker could also entice a user to install a specially       crafted extension that would interfere with browser-issued web requests.
  Workaround :

    There is no known workaround at this time.

The remote host has Safari installed. 

Versions of Safari earlier than 5.1.7 are reportedly affected by several issues :

  - Two unspecified errors that can allow malicious sites to perform cross-site scripting attacks. (CVE-2011-3046, CVE-2011-3056)

  - An unspecified memory corruption error exists that can allows malicious sites to crash the application or potentially execute arbitrary code. (CVE-2012-0672)

  - A state-tracking issue exists that can allow malicious sites to populate HTML form values of other sites with arbitrary data. (CVE-2012-0676)

The version of Safari installed on the remote host reportedly is affected by several issues :

  - Two unspecified errors exist that can allow malicious     sites to perform cross-site scripting attacks.
    (CVE-2011-3046, CVE-2011-3056)

  - An unspecified memory corruption error exists that can     allow malicious sites to crash the application or     potentially execute arbitrary code. (CVE-2012-0672)

  - A state-tracking issue exists that can allow malicious     sites to populate HTML form values of other sites with     arbitrary data. (CVE-2012-0676)

The version of Apple Safari installed on the remote Mac OS X host is earlier than 5.1.7.  It is, therefore, potentially affected by several issues :

   - Two unspecified errors exist that can allow malicious     sites to perform cross-site scripting attacks.
    (CVE-2011-3046, CVE-2011-3056)

  - An unspecified memory corruption error exists that can     allow malicious sites to crash the application or     potentially execute arbitrary code. (CVE-2012-0672)

  - A state-tracking issue exists that can allow malicious     sites to populate HTML form values of other sites with     arbitrary data. (CVE-2012-0676)

According to its banner, the remote Apple iOS device is missing a security update.  Versions of Apple iOS 3.0 through 5.1.0 are affected by vulnerabilities within the following components :

 - Safari
 - WebKit

Versions of Google Chrome earlier than 17.0.963.78 are potentially affected by the following vulnerabilities :

  - The application does not properly handle history navigation.

  - An unspecified universal cross-site scripting issue exists.

By exploiting these vulnerabilities in combination, an attacker could bypass  Chrome's sandbox and execute arbitrary code on the target machine as demonstrated in March 2012 at Google's Pwnium competition.

The version of Google Chrome installed on the remote host is earlier than 17.0.963.78 and is, therefore, affected by the following vulnerabilities:

  - The application does not properly handle history     navigation.

  - An unspecified universal cross-site scripting issue     exists.

By exploiting these vulnerabilities in combination, an attacker could bypass Chrome's sandbox and execute arbitrary code on the target machine as demonstrated in March 2012 at Google's Pwnium competition.

Google Chrome Releases reports :

[117226] [117230] Critical CVE-2011-3046: UXSS and bad history navigation. Credit to Sergey Glazunov.

The mobile device is running a version of iOS that is older than version 5.1.1.  Version 5.1.1 contains numerous security-related fixes for the following vulnerabilities :

  - Attackers can use a vulnerability in WebKit to perform     cross-site scripting attacks, possibly leaking data such     as cookies, user information, and passwords.
    (CVE-2011-3046, CVE-2011-3056)

  - A remote code execution vulnerability in WebKit could     allow a malicious site to run code on the host iOS     device giving the attacker access to critical data on     the phone.(CVE-2012-0672)

  - Vulnerabilities in Safari can allow malicious sites to     spoof the address in the address bar of the browser.
    This attack allows an attacker to redirect victims to a     malicious site without the user's ability to notice.
    (CVE-2012-0674)

ID	Name	Product	Family	Severity
74570	openSUSE Security Update : chromium / v8 (openSUSE-SU-2012:0374-1)	Nessus	SuSE Local Security Checks	critical
61458	Ubuntu 12.04 LTS : webkit vulnerabilities (USN-1524-1)	Nessus	Ubuntu Local Security Checks	critical
59611	GLSA-201203-19 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
800989	Safari < 5.1.7 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
6483	Safari < 5.1.7 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
59069	Safari < 5.1.7 Multiple Vulnerabilities	Nessus	Windows	high
59068	Mac OS X : Apple Safari < 5.1.7 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
6481	Apple iOS < 5.1.1 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	high
800922	Google Chrome < 17.0.963.78 Code Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
6348	Google Chrome < 17.0.963.78 Code Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
58328	Google Chrome < 17.0.963.78 Multiple Vulnerabilities	Nessus	Windows	high
58313	FreeBSD : chromium -- XSS vulnerability (1015e1fe-69ce-11e1-8288-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	critical
60027	Apple iOS < 5.1.1 Multiple Vulnerabilities	Nessus	Mobile Devices	critical

Detections

Analytics

CVE-2011-3046

high

Tenable Plugins

critical

critical

critical

high

high

high

high

high

high

high

high

critical

critical