Google V8, as used in Google Chrome before 17.0.963.83, allows remote attackers to cause a denial of service via vectors that trigger an invalid read operation.

Security update for Chromium and V8 to 18.0.1025.142.

Following bugs are listed in the Chrome changelog :

  - [$500]     [109574<https://code.google.com/p/chromium/issues/detail     ?id=109574>] Medium CVE-2011-3058: Bad interaction     possibly leading to XSS in EUC-JP. Credit to Masato     Kinugawa.

  - [$500]     [112317<https://code.google.com/p/chromium/issues/detail     ?id=112317>] Medium CVE-2011-3059: Out-of-bounds read in     SVG text handling. Credit to Arthur Gerkis.

  - [$500]     [114056<https://code.google.com/p/chromium/issues/detail     ?id=114056>] Medium CVE-2011-3060: Out-of-bounds read in     text fragment handling. Credit to miaubiz.

  - [116398     <https://code.google.com/p/chromium/issues/detail?id=116     398>] Medium CVE-2011-3061: SPDY proxy certificate     checking error. Credit to Leonidas Kontothanassis of     Google.

  - [116524     <https://code.google.com/p/chromium/issues/detail?id=116     524>] High CVE-2011-3062: Off-by-one in OpenType     Sanitizer. Credit to Mateusz Jurczyk of the Google     Security Team.

  - [117417     <https://code.google.com/p/chromium/issues/detail?id=117     417>] Low CVE-2011-3063: Validate navigation requests     from the renderer more carefully. Credit to kuzzcc,     Sergey Glazunov, PinkiePie and scarybeasts (Google     Chrome Security Team).

  - [$1000]     [117471<https://code.google.com/p/chromium/issues/detail     ?id=117471>] High CVE-2011-3064: Use-after-free in SVG     clipping. Credit to Atte Kettunen of OUSPG.

  - [$1000]     [117588<https://code.google.com/p/chromium/issues/detail     ?id=117588>] High CVE-2011-3065: Memory corruption in     Skia. Credit to Omair.

  - [$500]     [117794<https://code.google.com/p/chromium/issues/detail     ?id=117794>] Medium CVE-2011-3057: Invalid read in v8.
    Credit to Christian Holler.

The bugs [112317<https://code.google.com/p/chromium/issues/detail?id=112317>], [114056 <https://code.google.com/p/chromium/issues/detail?id=114056>] and [ 117471 <https://code.google.com/p/chromium/issues/detail?id=117471>] were detected using AddressSanitizer<http://code.google.com/p/address-sanitizer/wiki/Addre ssSanitizer> .

We'd also like to thank miaubiz, Chamal de Silva, Atte Kettunen of OUSPG, Aki Helin of OUSPG and Arthur Gerkis for working with us during the development cycle and preventing security regressions from ever reaching the stable channel. $8000 of additional rewards were issued for this awesomeness

The remote host is affected by the vulnerability described in GLSA-201203-24 (Chromium, V8: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and V8. Please       review the CVE identifiers and release notes referenced below for       details.
  Impact :

    A context-dependent attacker could entice a user to open a specially       crafted website or JavaScript program using Chromium or V8, possibly       resulting in the execution of arbitrary code with the privileges of the       process, or a Denial of Service condition.
    The attacker could also entice a user to open a specially crafted web       site using Chromium, possibly resulting in cross-site scripting (XSS), or       an unspecified SPDY certificate checking error.
  Workaround :

    There is no known workaround at this time.

The remote host is affected by the vulnerability described in GLSA-201203-19 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium. Please review       the CVE identifiers and release notes referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted web       site using Chromium, possibly resulting in the execution of arbitrary       code with the privileges of the process, a Denial of Service condition,       Universal Cross-Site Scripting, or installation of an extension without       user interaction.
    A remote attacker could also entice a user to install a specially       crafted extension that would interfere with browser-issued web requests.
  Workaround :

    There is no known workaround at this time.

Versions of Google Chrome earlier than 18.0.1025.142 are potentially affected by the following vulnerabilities :

  - An error exists in the v8 JavaScript engine that can allow invalid reads. (CVE-2011-3057)

  - An unspecified error exists related to bad interaction and 'EUC-JP'.  This can lead to cross-site scripting attacks. (CVE-2011-3058)

  - Out-of-bounds read errors exist related to SVG text handling and text fragment handling. (CVE-2011-3059, CVE-2011-3060)

  - A certificate checking error exists related to the SPDY protocol. (CVE-2011-3061)

  - An off-by-one error exists in the 'OpenType Sanitizer'. (CVE-2011-3062)

  - Navigation requests from the renderer are not validated carefully enough. (CVE-2011-3063)

  - A use-after-free error exists related to SVG clipping. (CVE-2011-3064)

  - An unspecified memory corruption error exists related to 'Skia'. (CVE-2011-3065)

  - The bundled version of Adobe Flash Player contains errors related to ActiveX and the NetStream class.  These errors can allow memory corruption, denial of service via application crashes and possibly code execution. (CVE-2012-0772, CVE-2012-0773)

The version of Google Chrome installed on the remote host is earlier than 18.0.1025.142 and is, therefore, affected by the following vulnerabilities :

  - An error exists in the v8 JavaScript engine that can     allow invalid reads. (CVE-2011-3057)

  - An unspecified error exists related to bad interaction     and 'EUC-JP'. This can lead to cross-site scripting     attacks. (CVE-2011-3058)

  - Out-of-bounds read errors exist related to SVG text     handling and text fragment handling. (CVE-2011-3059,     CVE-2011-3060)

  - A certificate checking error exists related to the     SPDY protocol. (CVE-2011-3061)

  - An off-by-one error exists in the 'OpenType Sanitizer'.
    (CVE-2011-3062)

  - Navigation requests from the renderer are not validated     carefully enough.(CVE-2011-3063)

  - A use-after-free error exists related to SVG clipping.
    (CVE-2011-3064)

  - An unspecified memory corruption error exists related     to 'Skia'. (CVE-2011-3065)

  - The bundled version of Adobe Flash Player contains     errors related to ActiveX and the NetStream class.
    These errors can allow memory corruption, denial of     service via application crashes and possibly code     execution. (CVE-2012-0772, CVE-2012-0773)

Google Chrome Releases reports :

[109574] Medium CVE-2011-3058: Bad interaction possibly leading to XSS in EUC-JP. Credit to Masato Kinugawa.

[112317] Medium CVE-2011-3059: Out-of-bounds read in SVG text handling. Credit to Arthur Gerkis.

[114056] Medium CVE-2011-3060: Out-of-bounds read in text fragment handling. Credit to miaubiz.

[116398] Medium CVE-2011-3061: SPDY proxy certificate checking error.
Credit to Leonidas Kontothanassis of Google.

[116524] High CVE-2011-3062: Off-by-one in OpenType Sanitizer. Credit to Mateusz Jurczyk of the Google Security Team.

[117417] Low CVE-2011-3063: Validate navigation requests from the renderer more carefully. Credit to kuzzcc, Sergey Glazunov, PinkiePie and scarybeasts (Google Chrome Security Team).

[117471] High CVE-2011-3064: Use-after-free in SVG clipping. Credit to Atte Kettunen of OUSPG.

[117588] High CVE-2011-3065: Memory corruption in Skia. Credit to Omair.

[117794] Medium CVE-2011-3057: Invalid read in v8. Credit to Christian Holler.

Google Chrome Releases reports :

[113902] High CVE-2011-3050: Use-after-free with first-letter handling. Credit to miaubiz.

[116162] High CVE-2011-3045: libpng integer issue from upstream.
Credit to Glenn Randers-Pehrson of the libpng project.

[116461] High CVE-2011-3051: Use-after-free in CSS cross-fade handling. Credit to Arthur Gerkis.

[116637] High CVE-2011-3052: Memory corruption in WebGL canvas handling. Credit to Ben Vanik of Google.

[116746] High CVE-2011-3053: Use-after-free in block splitting. Credit to miaubiz.

[117418] Low CVE-2011-3054: Apply additional isolations to webui privileges. Credit to Sergey Glazunov.

[117736] Low CVE-2011-3055: Prompt in the browser native UI for unpacked extension installation. Credit to PinkiePie.

[117550] High CVE-2011-3056: Cross-origin violation with 'magic iframe'. Credit to Sergey Glazunov.

[117794] Medium CVE-2011-3057: Invalid read in v8. Credit to Christian Holler.

[108648] Low CVE-2011-3049: Extension web request API can interfere with system requests. Credit to Michael Gundlach. Fixed in an earlier release.

The version of Google Chrome installed on the remote host is earlier than 17.0.963.83 and is, therefore, affected by the following vulnerabilities :

  - An unspecified integer issue exists in libpng.
    (CVE-2011-3045)

  - An error exists related to the extension web request     API that could allow denial of service attacks.
    Note this issue was corrected in a previous, unspecified     release. (CVE-2011-3049)

  - Use-after-free errors exist related to 'first-letter'     handling, CSS cross-fade handling and block splitting.
    (CVE-2011-3050, CVE-2011-3051, CVE-2011-3053)

  - A memory corruption error exists related to WebGL     canvas handling. (CVE-2011-3052)

  - An error exists related to webui privilege isolation.
    (CVE-2011-3054)

  - Installation of unpacked extensions does not use the     application's native user interface for prompts.
    (CVE-2011-3055)

  - A cross-origin violation is possible with 'magic iframe'.
    (CVE-2011-3056)

  - The v8 JavaScript engine could allow invalid reads to     take place. (CVE-2011-3057)

ID	Name	Product	Family	Type	Severity
74592	openSUSE Security Update : chromium (openSUSE-SU-2012:0492-1)	Nessus	SuSE Local Security Checks	Local	high
59616	GLSA-201203-24 : Chromium, V8: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	high
59611	GLSA-201203-19 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	critical
6402	Google Chrome < 18.0.1025.142 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients		high
58536	Google Chrome < 18.0.1025.142 Multiple Vulnerabilities	Nessus	Windows	Local	high
58521	FreeBSD : chromium -- multiple vulnerabilities (b8f0a391-7910-11e1-8a43-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	Local	critical
58438	FreeBSD : chromium -- multiple vulnerabilities (330106da-7406-11e1-a1d7-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	Local	high
58434	Google Chrome < 17.0.963.83 Multiple Vulnerabilities	Nessus	Windows	Local	high

Detections

Analytics

CVE-2011-3057

medium

Tenable Plugins

high

high

critical

high

high

critical

high

high