SB2011060902 - Multiple vulnerabilities in Techland Chrome 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2011060902

SB2011060902 - Multiple vulnerabilities in Techland Chrome

Published: June 9, 2011 Updated: August 11, 2020

Security Bulletin ID SB2011060902
Severity
Medium
Patch available
YES
Number of vulnerabilities 13
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 77% Low 23%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 13 secuirty vulnerabilities.


1) Use-after-free (CVE-ID: CVE-2011-1808)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing vectors related to incorrect integer calculations during float handling. A remote attackers can cause a denial of service or possibly have unspecified other impact.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


2) Use-after-free (CVE-ID: CVE-2011-1809)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing unknown vectors. A remote attackers can cause a denial of service or possibly have unspecified other impact.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


3) Information disclosure (CVE-ID: CVE-2011-1810)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The Cascading Style Sheets (CSS) implementation in Google Chrome before 12.0.742.91 does not properly restrict access to the visit history, which allows remote attackers to obtain sensitive information via unspecified vectors.


4) Input validation error (CVE-ID: CVE-2011-1812)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 12.0.742.91 allows remote attackers to bypass intended access restrictions via vectors related to extensions.


5) Input validation error (CVE-ID: CVE-2011-1813)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 12.0.742.91 does not properly implement the framework for extensions, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."


6) Access of Uninitialized Pointer (CVE-ID: CVE-2011-1814)

The vulnerability allows a remote non-authenticated attacker to #BASIC_IMPACT#.

Google Chrome before 12.0.742.91 attempts to read data from an uninitialized pointer, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.


7) Cross-site scripting (CVE-ID: CVE-2011-1815)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

Google Chrome before 12.0.742.91 allows remote attackers to inject script into a tab page via vectors related to extensions.


8) Use-after-free (CVE-ID: CVE-2011-1816)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing unknown vectors. A remote attackers can cause a denial of service or possibly have unspecified other impact.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


9) Buffer overflow (CVE-ID: CVE-2011-1817)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 12.0.742.91 does not properly implement history deletion, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.


10) Use-after-free (CVE-ID: CVE-2011-1818)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing unknown vectors. A remote attackers can cause a denial of service or possibly have unspecified other impact.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


11) Cross-site scripting (CVE-ID: CVE-2011-1819)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

Google Chrome before 12.0.742.91 allows remote attackers to perform unspecified injection into a chrome:// page via vectors related to extensions.


12) Input validation error (CVE-ID: CVE-2011-2332)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google V8, as used in Google Chrome before 12.0.742.91, allows remote attackers to bypass the Same Origin Policy via unspecified vectors.


13) Cross-site scripting (CVE-ID: CVE-2011-2342)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The DOM implementation in Google Chrome before 12.0.742.91 allows remote attackers to bypass the Same Origin Policy via unspecified vectors.


Remediation

Install update from vendor's website.

References