SB2011031102 - Multiple vulnerabilities in Techland Chrome 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2011031102

SB2011031102 - Multiple vulnerabilities in Techland Chrome

Published: March 11, 2011 Updated: August 11, 2020

Security Bulletin ID SB2011031102
Severity
Medium
Patch available
YES
Number of vulnerabilities 20
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 20 secuirty vulnerabilities.


1) Type conversion (CVE-ID: CVE-2011-1200)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 10.0.648.127 does not properly perform a cast of an unspecified variable during text rendering, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted document.


2) Input validation error (CVE-ID: CVE-2011-1201)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The context implementation in WebKit, as used in Google Chrome before 10.0.648.127, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."


3) Input validation error (CVE-ID: CVE-2011-1203)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 10.0.648.127 does not properly handle SVG cursors, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."


4) Input validation error (CVE-ID: CVE-2011-1204)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 10.0.648.127 does not properly handle attributes, which allows remote attackers to cause a denial of service (DOM tree corruption) or possibly have unspecified other impact via a crafted document.


5) Buffer overflow (CVE-ID: CVE-2011-1285)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The regular-expression functionality in Google Chrome before 10.0.648.127 does not properly implement reentrancy, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.


6) Input validation error (CVE-ID: CVE-2011-1286)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google V8, as used in Google Chrome before 10.0.648.127, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that trigger incorrect access to memory.


7) Input validation error (CVE-ID: CVE-2011-1413)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

Google Chrome before 10.0.648.127 on Linux does not properly mitigate an unspecified flaw in an X server, which allows remote attackers to cause a denial of service (application crash) via vectors involving long messages.


8) Information disclosure (CVE-ID: CVE-2011-1190)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The Web Workers implementation in Google Chrome before 10.0.648.127 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, related to an "error message leak."


9) Use-after-free (CVE-ID: CVE-2011-1191)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing vectors related to the handling of DOM URLs. A remote attackers can cause a denial of service or possibly have unspecified other impact.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


10) Input validation error (CVE-ID: CVE-2011-1193)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google V8, as used in Google Chrome before 10.0.648.127, allows remote attackers to bypass the Same Origin Policy via unspecified vectors.


11) Input validation error (CVE-ID: CVE-2011-1194)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

Multiple unspecified vulnerabilities in Google Chrome before 10.0.648.127 allow remote attackers to bypass the pop-up blocker via unknown vectors.


12) Use-after-free (CVE-ID: CVE-2011-1195)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing vectors related to "document script lifetime handling. A remote attackers can cause a denial of service or possibly have unspecified other impact.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


13) Input validation error (CVE-ID: CVE-2011-1196)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The OGG container implementation in Google Chrome before 10.0.648.127 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that trigger an out-of-bounds write.


14) Input validation error (CVE-ID: CVE-2011-1197)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 10.0.648.127 does not properly perform table painting, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."


15) Buffer overflow (CVE-ID: CVE-2011-1198)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The video functionality in Google Chrome before 10.0.648.127 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that trigger use of a malformed "out-of-bounds structure."


16) Input validation error (CVE-ID: CVE-2011-1199)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 10.0.648.127 does not properly handle DataView objects, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via unknown vectors.


17) Input validation error (CVE-ID: CVE-2011-1185)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 10.0.648.127 does not prevent (1) navigation and (2) close operations on the top location of a sandboxed frame, which has unspecified impact and remote attack vectors.


18) Information disclosure (CVE-ID: CVE-2011-1187)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

Google Chrome before 10.0.648.127 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, related to an "error message leak."


19) Input validation error (CVE-ID: CVE-2011-1188)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 10.0.648.127 does not properly handle counter nodes, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.


20) Input validation error (CVE-ID: CVE-2011-1189)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 10.0.648.127 does not properly perform box layout, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale node."


Remediation

Install update from vendor's website.

References