Google Chrome before 23.0.1271.95 does not properly handle file paths, which has unspecified impact and attack vectors.

Chromium was updated to 25.0.1343

  - Security Fixes (bnc#791234 and bnc#792154) :

  - CVE-2012-5131: Corrupt rendering in the Apple OSX driver     for Intel GPUs

  - CVE-2012-5133: Use-after-free in SVG filters.

  - CVE-2012-5130: Out-of-bounds read in Skia

  - CVE-2012-5132: Browser crash with chunked encoding

  - CVE-2012-5134: Buffer underflow in libxml.

  - CVE-2012-5135: Use-after-free with printing.

  - CVE-2012-5136: Bad cast in input element handling.

  - CVE-2012-5138: Incorrect file path handling

  - CVE-2012-5137: Use-after-free in media source handling

  - Correct build so that proprietary codecs can be used     when the chromium-ffmpeg package is installed

  - Update to 25.0.1335

  - (gtk) Fixed <input> selection renders white text on     white background in apps. (Issue: 158422)

  - Fixed translate infobar button to show selected     language. (Issue: 155350)

  - Fixed broken Arabic language. (Issue: 158978)

  - Fixed pre-rendering if the preference is disabled at     start up. (Issue: 159393)

  - Fixed JavaScript rendering issue. (Issue: 159655)

  - No further indications in the ChangeLog

  - Updated V8 - 3.14.5.0

  - Bookmarks are now searched by their title while typing     into the omnibox with matching bookmarks being shown in     the autocomplete suggestions pop-down list. Matching is     done by prefix.

  - Fixed chromium issues 155871, 154173, 155133.

  - Removed patch chomium-ffmpeg-no-pkgconfig.patch

  - Building now internal libffmpegsumo.so based on the     standard chromium ffmpeg codecs

  - Add a configuration file (/etc/default/chromium) where     we can indicate flags for the chromium-browser.

  - add explicit buildrequire on libbz2-devel

The remote host is affected by the vulnerability described in GLSA-201309-16 (Chromium, V8: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and V8. Please       review the CVE identifiers and release notes referenced below for       details.
  Impact :

    A context-dependent attacker could entice a user to open a specially       crafted website or JavaScript program using Chromium or V8, possibly       resulting in the execution of arbitrary code with the privileges of the       process or a Denial of Service condition. Furthermore, a remote attacker       may be able to bypass security restrictions or have other, unspecified,       impact.
  Workaround :

    There is no known workaround at this time.

Google Chrome Releases reports :

[161564] High CVE-2012-5138: Incorrect file path handling. Credit to Google Chrome Security Team (Juri Aedla).

[162835] High CVE-2012-5137: Use-after-free in media source handling.
Credit to Pinkie Pie.

The version of Google Chrome installed on the remote host is earlier than 23.0.1271.95 and is, therefore, affected by the following vulnerabilities :

  - A use-after-free error exists related to media source     handling. (CVE-2012-5137)

  - An unspecified error exists related to file path     handling. (CVE-2012-5138)

Successful exploitation of either of these issues could lead to an application crash or even allow arbitrary code execution, subject to the user's privileges.

ID	Name	Product	Family	Severity
74839	openSUSE Security Update : Chromium (openSUSE-SU-2012:1637-1)	Nessus	SuSE Local Security Checks	critical
70112	GLSA-201309-16 : Chromium, V8: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
63115	FreeBSD : chromium -- multiple vulnerabilities (5af51ae9-3acd-11e2-a4eb-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	critical
63110	Google Chrome < 23.0.1271.95 Multiple Vulnerabilities	Nessus	Windows	critical

Detections

Analytics

CVE-2012-5138

critical

Tenable Plugins

critical

critical

critical

critical