Google Chrome before 22.0.1229.92 does not monitor for crashes of Pepper plug-ins, which has unspecified impact and remote attack vectors.

The remote host is affected by the vulnerability described in GLSA-201210-07 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium. Please review       the CVE identifiers and release notes referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted web       site using Chromium, possibly resulting in the execution of arbitrary       code with the privileges of the process, arbitrary file write, a Denial       of Service condition, Cross-Site Scripting in SSL interstitial and       various Universal Cross-Site Scripting attacks.
  Workaround :

    There is no known workaround at this time.

The version of Google Chrome installed on the remote host is earlier than 22.0.1229.92 and is, therefore, affected by the following vulnerabilities :

  - An unspecified error exists related to Skia text     rendering can cause the application to crash.
    (CVE-2012-2900)

  - A race condition exists related to audio device     handling. (CVE-2012-5108)

  - Out-of-bounds read errors exist related to 'ICU'     regular expressions and the compositor.
    (CVE-2012-5109, CVE-2012-5110)

  - The 'Pepper' plugins are missing crash monitoring.
    (CVE-2012-5111)

Successful exploitation of any of these issues could lead to an application crash or even allow arbitrary code execution, subject to the user's privileges.

Google Chrome Releases reports :

[138208] High CVE-2012-2900: Crash in Skia text rendering. Credit to Atte Kettunen of OUSPG.

[147499] Critical CVE-2012-5108: Race condition in audio device handling. Credit to Atte Kettunen of OUSPG.

[148692] Medium CVE-2012-5109: OOB read in ICU regex. Credit to Arthur Gerkis.

[151449] Medium CVE-2012-5110: Out-of-bounds read in compositor.
Credit to Google Chrome Security Team (Inferno).

[151895] Low CVE-2012-5111: Plug-in crash monitoring was missing for Pepper plug-ins. Credit to Google Chrome Security Team (Chris Evans).

ID	Name	Product	Family	Severity
62652	GLSA-201210-07 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
62518	Google Chrome < 22.0.1229.92 Multiple Vulnerabilities	Nessus	Windows	high
62457	FreeBSD : chromium -- multiple vulnerabilities (e6161b65-1187-11e2-afe3-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2012-5111

critical

Tenable Plugins

critical

high

high