SB2011100401 - Multiple vulnerabilities in Techland Chrome 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2011100401

SB2011100401 - Multiple vulnerabilities in Techland Chrome

Published: October 4, 2011 Updated: August 11, 2020

Security Bulletin ID SB2011100401
Severity
Medium
Patch available
YES
Number of vulnerabilities 7
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 7 secuirty vulnerabilities.


1) Use-after-free (CVE-ID: CVE-2011-2876)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing vectors involving a text line box. A remote attackers can cause a denial of service or possibly have unspecified other impact.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


2) Input validation error (CVE-ID: CVE-2011-2877)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 14.0.835.202 does not properly handle SVG text, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to "stale font."


3) Input validation error (CVE-ID: CVE-2011-2878)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 14.0.835.202 does not properly restrict access to the window prototype, which allows remote attackers to bypass the Same Origin Policy via unspecified vectors.


4) Input validation error (CVE-ID: CVE-2011-2879)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 14.0.835.202 does not properly consider object lifetimes and thread safety during the handling of audio nodes, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.


5) Use-after-free (CVE-ID: CVE-2011-2880)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing vectors related to the Google V8 bindings. A remote attackers can cause a denial of service or possibly have unspecified other impact.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


6) Buffer overflow (CVE-ID: CVE-2011-2881)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 14.0.835.202 does not properly handle Google V8 hidden objects, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted JavaScript code.


7) Buffer overflow (CVE-ID: CVE-2011-3873)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 14.0.835.202 does not properly implement shader translation, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.


Remediation

Install update from vendor's website.

References