Use-after-free vulnerability in the SVG implementation in WebKit, as used in Google Chrome before 22.0.1229.94, allows remote attackers to execute arbitrary code via unspecified vectors.

Versions of iTunes earlier than 11.0.3 are reportedly affected by several vulnerabilities:

  - An error exists related to certificate validation that could allow disclosure of sensitive information and could allow the application to trust data from untrusted sources. (CVE-2013-1014)

  - The included version of WebKit contains several errors that could lead to memory corruption and possibly arbitrary code execution. The vendor notes one possible attack vector is a man-in-the-middle attack while the application browses the 'iTunes Store'. (CVE-2012-2824, CVE-2012-2857, CVE-2012-3748, CVE-2012-5112, CVE-2013-0879, CVE-2013-0912, CVE-2013-0948, CVE-2013-0949, CVE-2013-0950, CVE-2013-0951, CVE-2013-0952, CVE-2013-0953, CVE-2013-0954, CVE-2013-0955, CVE-2013-0956, CVE-2013-0958, CVE-2013-0959, CVE-2013-0960, CVE-2013-0961, CVE-2013-0991, CVE-2013-0992, CVE-2013-0993, CVE-2013-0994, CVE-2013-0995, CVE-2013-0996, CVE-2013-0997, CVE-2013-0998, CVE-2013-0999, CVE-2013-1000, CVE-2013-1001, CVE-2013-1002, CVE-2013-1003, CVE-2013-1004, CVE-2013-1005, CVE-2013-1006, CVE-2013-1007, CVE-2013-1008, CVE-2013-1010, CVE-2013-1011) 

The version of Apple iTunes on the remote host is prior to version 11.0.3. It is, therefore, affected by multiple vulnerabilities :

  - An error exists related to certificate validation. A     man-in-the-middle attacker can exploit this to spoof     HTTPS servers, which allows the disclosure of sensitive     information or the application to trust data from     untrusted sources. Note that this issue affects the     application regardless of the operating system.
    (CVE-2013-1014)

  - The version of WebKit included in iTunes contains     several errors that can lead to memory corruption and     arbitrary code execution. The vendor states that one     possible vector is a man-in-the-middle attack while the     application browses the 'iTunes Store'. Please note that     these vulnerabilities only affect the application when     it is running on a Windows host.
    (CVE-2012-2824, CVE-2012-2857, CVE-2012-3748,     CVE-2012-5112, CVE-2013-0879, CVE-2013-0912,     CVE-2013-0948, CVE-2013-0949, CVE-2013-0950,     CVE-2013-0951, CVE-2013-0952, CVE-2013-0953,     CVE-2013-0954, CVE-2013-0955, CVE-2013-0956,     CVE-2013-0958, CVE-2013-0959, CVE-2013-0960,     CVE-2013-0961, CVE-2013-0991, CVE-2013-0992,     CVE-2013-0993, CVE-2013-0994, CVE-2013-0995,     CVE-2013-0996, CVE-2013-0997, CVE-2013-0998,     CVE-2013-0999, CVE-2013-1000, CVE-2013-1001,     CVE-2013-1002, CVE-2013-1003, CVE-2013-1004,     CVE-2013-1005, CVE-2013-1006, CVE-2013-1007,     CVE-2013-1008, CVE-2013-1010, CVE-2013-1011)

The version of Apple iTunes installed on the remote Windows host is older than 11.0.3.  It therefore is potentially affected by several issues :

  - An error exists related to certificate validation     that could allow disclosure of sensitive information     and could allow the application to trust data from     untrusted sources. (CVE-2013-1014)

  - The included version of WebKit contains several errors     that could lead to memory corruption and possibly     arbitrary code execution. The vendor notes one possible     attack vector is a man-in-the-middle attack while the     application browses the 'iTunes Store'.
    (CVE-2012-2824, CVE-2012-2857, CVE-2012-3748,     CVE-2012-5112, CVE-2013-0879, CVE-2013-0912,     CVE-2013-0948, CVE-2013-0949, CVE-2013-0950,     CVE-2013-0951, CVE-2013-0952, CVE-2013-0953,     CVE-2013-0954, CVE-2013-0955, CVE-2013-0956,     CVE-2013-0958, CVE-2013-0959, CVE-2013-0960,     CVE-2013-0961, CVE-2013-0991, CVE-2013-0992,     CVE-2013-0993, CVE-2013-0994, CVE-2013-0995,     CVE-2013-0996, CVE-2013-0997, CVE-2013-0998,     CVE-2013-0999, CVE-2013-1000, CVE-2013-1001,     CVE-2013-1002, CVE-2013-1003, CVE-2013-1004,     CVE-2013-1005, CVE-2013-1006, CVE-2013-1007,     CVE-2013-1008, CVE-2013-1010, CVE-2013-1011)

The remote Mac OS X host has Safari installed. 

Versions of Safari earlier than 6.0.2 are reportedly affected by several issues :

  - A time-of-check-to-time-of-use issue in the handling of JavaScript array in WebKit could lead to arbitrary, remote code execution. (CVE-2012-3748)

  - A use-after-free issue in the handling of SVG images in WebKit code could lead to arbitrary, remote code execution. (CVE-2012-5112)

The remote host has Safari installed. Versions of Safari earlier than 6.0.2 are reportedly affected by several issues :

  - A time-of-check-to-time-of-use issue in the handling of JavaScript array in WebKit could lead to arbitrary, remote code execution. (CVE-2012-3748)
 - A use-after-free issue in the handling of SVG images in WebKit code could lead to arbitrary, remote code execution. (CVE-2012-5112)

According to its banner, the remote Apple iOS device is missing a security update.  It is, therefore, affected by the following vulnerabilities :

 - Kernel extension API responses containing an 'OSBundleMachOHeaders' key may include kernel addresses which can aid in further attacks. (CVE-2012-3749)
 - The lock screen can provide 'Passbook' data to an attacker having physical device access but not a passcode. (CVE-2012-3750)
 - A 'time-of-check-to-time-of-use' issue in the handling of JavaScript array data within WebKit could lead to arbitrary, remote code execution. (CVE-2012-3748)
 - A use-after-free issue in the handling of SVG images in WebKit could lead to arbitrary, remote code execution. (CVE-2012-5112)

The mobile device is running a version of iOS that is older than version 6.0.1. This version contains security-related fixes for the following issues :

  - Kernel extension API responses containing     an 'OSBundleMachOHeaders' key may include kernel     addresses, which can aid in further attacks.
    (CVE-2012-3749)

  - The lock screen can provide 'Passbook' data to an     attacker having physical device access but not a     passcode. (CVE-2012-3750)

  - A time-of-check-to-time-of-use issue in the handling     of JavaScript array in WebKit could lead to arbitrary,     remote code execution. (CVE-2012-3748)

  - A use-after-free issue in the handling of SVG images     in WebKit code could lead to arbitrary, remote code     execution. (CVE-2012-5112)

The version of Apple Safari installed on the remote Mac OS X host is earlier than 6.0.2. It is, therefore, potentially affected by several issues :

  - A time-of-check-to-time-of-use issue in the handling     of JavaScript array in WebKit could lead to arbitrary,     remote code execution. (CVE-2012-3748)

  - A use-after-free issue in the handling of SVG images     in WebKit code could lead to arbitrary, remote code     execution. (CVE-2012-5112)

The remote host is affected by the vulnerability described in GLSA-201210-07 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium. Please review       the CVE identifiers and release notes referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted web       site using Chromium, possibly resulting in the execution of arbitrary       code with the privileges of the process, arbitrary file write, a Denial       of Service condition, Cross-Site Scripting in SSL interstitial and       various Universal Cross-Site Scripting attacks.
  Workaround :

    There is no known workaround at this time.

Versions of Google Chrome earlier than 22.0.1229.94 are potentially affected by the following vulnerabilities :

  - A use-after-free error exists related to SVG handling that can be used to exploit the renderer process.(Issue #154983) 

  - An unspecified error exists related to IPC handling that can allow an attacker to escape the application  sandbox. (Issue #154987)

Successful exploitation of any of these issues could lead to an application crash or even allow arbitrary code execution, subject to the user's privileges.

The version of Google Chrome installed on the remote host is earlier than 22.0.1229.94 and is, therefore, affected by the following vulnerabilities :

  - A use-after-free error exists related to SVG handling     that can be used to exploit the renderer process.
    (Issue #154983)

  - An unspecified error exists related to IPC handling     that can allow an attacker to escape the application     sandbox. (Issue #154987)

Successful exploitation of any of these issues could lead to an application crash or even allow arbitrary code execution, subject to the user's privileges.

Google Chrome Releases reports :

[154983][154987] Critical CVE-2012-5112: SVG use-after-free and IPC arbitrary file write. Credit to Pinkie Pie.

ID	Name	Product	Family	Severity
6831	iTunes < 11.0.3 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
66499	Apple iTunes < 11.0.3 Multiple Vulnerabilities (uncredentialed check)	Nessus	Peer-To-Peer File Sharing	critical
66498	Apple iTunes < 11.0.3 Multiple Vulnerabilities (credentialed check)	Nessus	Windows	critical
801001	Mac OS X : Safari < 6.0.2 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
6622	Safari < 6.0.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
6615	Apple iOS < 6.0.1 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	high
62803	Apple iOS < 6.0.1 Multiple Vulnerabilities	Nessus	Mobile Devices	critical
62802	Mac OS X : Apple Safari < 6.0.2 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
62652	GLSA-201210-07 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
800888	Google Chrome < 22.0.1229.94 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
6601	Google Chrome < 22.0.1229.94 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
62519	Google Chrome < 22.0.1229.94 Multiple Vulnerabilities	Nessus	Windows	critical
62488	FreeBSD : chromium -- multiple vulnerabilities (09e83f7f-1326-11e2-afe3-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2012-5112

high

Tenable Plugins

high

critical

critical

high

high

high

critical

critical

critical

high

high

critical

critical