SB2012092602 - Multiple vulnerabilities in Techland Chrome 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2012092602

SB2012092602 - Multiple vulnerabilities in Techland Chrome

Published: September 26, 2012 Updated: January 25, 2023

Security Bulletin ID SB2012092602
Severity
Medium
Patch available
YES
Number of vulnerabilities 7
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 7 secuirty vulnerabilities.


1) Input validation error (CVE-ID: CVE-2012-2892)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

Unspecified vulnerability in Google Chrome before 22.0.1229.79 allows remote attackers to bypass the pop-up blocker via unknown vectors.


2) Resource management error (CVE-ID: CVE-2012-2893)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Double free vulnerability in libxslt, as used in Google Chrome before 22.0.1229.79, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to XSL transforms.


3) Resource management error (CVE-ID: CVE-2012-2894)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 22.0.1229.79 does not properly handle graphics-context data structures, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via unknown vectors.


4) Buffer overflow (CVE-ID: CVE-2012-2895)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The PDF functionality in Google Chrome before 22.0.1229.79 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger out-of-bounds write operations.


5) Input validation error (CVE-ID: CVE-2012-2875)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Multiple unspecified vulnerabilities in the PDF functionality in Google Chrome before 22.0.1229.79 allow remote attackers to have an unknown impact via a crafted document.


6) Use-after-free (CVE-ID: CVE-2012-2890)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing a crafted document. A remote attackers can cause a denial of service or possibly have unspecified other impact.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


7) Information disclosure (CVE-ID: CVE-2012-2891)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The IPC implementation in Google Chrome before 22.0.1229.79 allows attackers to obtain potentially sensitive information about memory addresses via unspecified vectors.


Remediation

Install update from vendor's website.

References