SB2012062703 - Multiple vulnerabilities in Techland Chrome 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2012062703

SB2012062703 - Multiple vulnerabilities in Techland Chrome

Published: June 27, 2012 Updated: January 25, 2023

Security Bulletin ID SB2012062703
Severity
High
Patch available
YES
Number of vulnerabilities 17
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 6% Medium 94%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 17 secuirty vulnerabilities.


1) Input validation error (CVE-ID: CVE-2012-2822)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The PDF functionality in Google Chrome before 20.0.1132.43 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


2) Use-after-free (CVE-ID: CVE-2012-2823)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing vectors related to SVG resources. A remote attackers can cause a denial of service or possibly have unspecified other impact.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


3) Input validation error (CVE-ID: CVE-2012-2825)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The XSL implementation in Google Chrome before 20.0.1132.43 allows remote attackers to cause a denial of service (incorrect read operation) via unspecified vectors.


4) Input validation error (CVE-ID: CVE-2012-2826)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

Google Chrome before 20.0.1132.43 does not properly implement texture conversion, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


5) Input validation error (CVE-ID: CVE-2012-2828)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Multiple integer overflows in the PDF functionality in Google Chrome before 20.0.1132.43 allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document.


6) Use-after-free (CVE-ID: CVE-2012-2829)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing vectors related to the :first-letter pseudo-element. A remote attackers can cause a denial of service or possibly have unspecified other impact.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


7) Input validation error (CVE-ID: CVE-2012-2830)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 20.0.1132.43 does not properly set array values, which allows remote attackers to cause a denial of service (incorrect pointer use) or possibly have unspecified other impact via unknown vectors.


8) Use-after-free (CVE-ID: CVE-2012-2831)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing vectors related to SVG references. A remote attackers can cause a denial of service or possibly have unspecified other impact.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


9) Input validation error (CVE-ID: CVE-2012-2832)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The image-codec implementation in the PDF functionality in Google Chrome before 20.0.1132.43 does not initialize an unspecified pointer, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted document.


10) Buffer overflow (CVE-ID: CVE-2012-2833)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Buffer overflow in the JS API in the PDF functionality in Google Chrome before 20.0.1132.43 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.


11) Input validation error (CVE-ID: CVE-2012-2834)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Integer overflow in Google Chrome before 20.0.1132.43 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted data in the Matroska container format.


12) Information disclosure (CVE-ID: CVE-2012-2815)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

Google Chrome before 20.0.1132.43 allows remote attackers to obtain potentially sensitive information from a fragment identifier by leveraging access to an IFRAME element associated with a different domain.


13) Use-after-free (CVE-ID: CVE-2012-2817)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing vectors related to tables that have sections. A remote attackers can cause a denial of service or possibly have unspecified other impact.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


14) Use-after-free (CVE-ID: CVE-2012-2818)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing vectors related to the layout of documents that use the Cascading Style Sheets (CSS) counters feature. A remote attackers can cause a denial of service or possibly have unspecified other impact.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


15) Input validation error (CVE-ID: CVE-2012-2819)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The texSubImage2D implementation in the WebGL subsystem in Google Chrome before 20.0.1132.43 does not properly handle uploads to floating-point textures, which allows remote attackers to cause a denial of service (assertion failure and application crash) or possibly have unspecified other impact via a crafted web page, as demonstrated by certain WebGL performance tests, aka rdar problem 11520387.


16) Input validation error (CVE-ID: CVE-2012-2820)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

Google Chrome before 20.0.1132.43 does not properly implement SVG filters, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


17) Input validation error (CVE-ID: CVE-2012-2821)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The autofill implementation in Google Chrome before 20.0.1132.43 does not properly display text, which has unspecified impact and remote attack vectors.


Remediation

Install update from vendor's website.

References