SB2012110701 - Multiple vulnerabilities in Techland Chrome 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2012110701

SB2012110701 - Multiple vulnerabilities in Techland Chrome

Published: November 7, 2012 Updated: January 25, 2023

Security Bulletin ID SB2012110701
Severity
Medium
Patch available
YES
Number of vulnerabilities 10
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 10 secuirty vulnerabilities.


1) Race condition (CVE-ID: CVE-2012-5119)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Race condition in Pepper, as used in Google Chrome before 23.0.1271.64, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to buffers.


2) Use-after-free (CVE-ID: CVE-2012-5121)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing vectors related to video layout. A remote attackers can cause a denial of service or possibly have unspecified other impact.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


3) Resource management error (CVE-ID: CVE-2012-5122)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 23.0.1271.64 does not properly perform a cast of an unspecified variable during handling of input, which allows remote attackers to cause a denial of service or possibly have other impact via unknown vectors.


4) Buffer overflow (CVE-ID: CVE-2012-5123)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

Skia, as used in Google Chrome before 23.0.1271.64, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


5) Buffer overflow (CVE-ID: CVE-2012-5124)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 23.0.1271.64 does not properly handle textures, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.


6) Use-after-free (CVE-ID: CVE-2012-5125)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing vectors related to the handling of extension tabs. A remote attackers can cause a denial of service or possibly have unspecified other impact.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


7) Use-after-free (CVE-ID: CVE-2012-5126)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing vectors related to the handling of plug-in placeholders. A remote attackers can cause a denial of service or possibly have unspecified other impact.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


8) Input validation error (CVE-ID: CVE-2012-5127)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Integer overflow in Google Chrome before 23.0.1271.64 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted WebP image.


9) Use-after-free (CVE-ID: CVE-2012-5116)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing vectors related to the handling of SVG filters. A remote attackers can cause a denial of service or possibly have unspecified other impact.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


10) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2012-5117)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 23.0.1271.64 does not properly restrict the loading of an SVG subresource in the context of an IMG element, which has unspecified impact and remote attack vectors.


Remediation

Install update from vendor's website.

References