Sign-up

ID

VAR-201102-0149


CVE

CVE-2011-0776


TITLE

Mac OS X Run on Google Chrome Vulnerability in obtaining important information in sandbox implementation

Trust: 0.8

sources: JVNDB: JVNDB-2011-002846

DESCRIPTION

The sandbox implementation in Google Chrome before 9.0.597.84 on Mac OS X might allow remote attackers to obtain potentially sensitive information about local files via vectors related to the stat system call. Google Chrome is prone to multiple vulnerabilities. Attackers may exploit these issues to execute arbitrary code in the context of the browser or cause denial-of-service conditions; other attacks are also possible. Chrome versions prior to 9.0.597.84 are vulnerable. Google Chrome is a web browser developed by Google (Google)

Trust: 1.98

sources: NVD: CVE-2011-0776 // JVNDB: JVNDB-2011-002846 // BID: 46144 // VULHUB: VHN-48721

AFFECTED PRODUCTS

vendor:googlemodel:chromescope:ltversion:9.0.597.84

Trust: 1.8

vendor:googlemodel:chromescope:eqversion:9.0.597.75

Trust: 0.6

vendor:googlemodel:chromescope:eqversion:9.0.597.76

Trust: 0.6

vendor:googlemodel:chromescope:eqversion:9.0.597.79

Trust: 0.6

vendor:googlemodel:chromescope:eqversion:9.0.597.82

Trust: 0.6

vendor:googlemodel:chromescope:eqversion:9.0.597.83

Trust: 0.6

vendor:googlemodel:chromescope:eqversion:9.0.597.77

Trust: 0.6

vendor:googlemodel:chromescope:eqversion:9.0.597.8

Trust: 0.6

vendor:googlemodel:chromescope:eqversion:9.0.597.78

Trust: 0.6

vendor:googlemodel:chromescope:eqversion:9.0.597.81

Trust: 0.6

vendor:googlemodel:chromescope:eqversion:9.0.597.80

Trust: 0.6

vendor:webkitmodel:open source project webkitscope:eqversion:1.2.5

Trust: 0.3

vendor:webkitmodel:open source project webkitscope:eqversion:1.2.3

Trust: 0.3

vendor:webkitmodel:open source project webkitscope:eqversion:1.2.2

Trust: 0.3

vendor:webkitmodel:open source project webkit r77705scope: - version: -

Trust: 0.3

vendor:webkitmodel:open source project webkit r52833scope: - version: -

Trust: 0.3

vendor:webkitmodel:open source project webkit r52401scope: - version: -

Trust: 0.3

vendor:webkitmodel:open source project webkit r51295scope: - version: -

Trust: 0.3

vendor:webkitmodel:open source project webkit r38566scope: - version: -

Trust: 0.3

vendor:webkitmodel:open source project webkitscope:eqversion:1.2.x

Trust: 0.3

vendor:webkitmodel:open source project webkitscope:eqversion:1.2.2-1

Trust: 0.3

vendor:webkitmodel:open source project webkitscope:eqversion:0

Trust: 0.3

vendor:ubuntumodel:linux powerpcscope:eqversion:10.10

Trust: 0.3

vendor:ubuntumodel:linux i386scope:eqversion:10.10

Trust: 0.3

vendor:ubuntumodel:linux armscope:eqversion:10.10

Trust: 0.3

vendor:ubuntumodel:linux amd64scope:eqversion:10.10

Trust: 0.3

vendor:ubuntumodel:linux sparcscope:eqversion:10.04

Trust: 0.3

vendor:ubuntumodel:linux powerpcscope:eqversion:10.04

Trust: 0.3

vendor:ubuntumodel:linux i386scope:eqversion:10.04

Trust: 0.3

vendor:ubuntumodel:linux armscope:eqversion:10.04

Trust: 0.3

vendor:ubuntumodel:linux amd64scope:eqversion:10.04

Trust: 0.3

vendor:srwaremodel:ironscope:eqversion:8.0.555.1

Trust: 0.3

vendor:srwaremodel:ironscope:eqversion:8.0.555.0

Trust: 0.3

vendor:s u s emodel:opensusescope:eqversion:11.3

Trust: 0.3

vendor:s u s emodel:opensusescope:eqversion:11.2

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.310

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.309

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.308

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.307

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.306

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.305

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.304

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.303

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.302

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.301

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.300

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.237

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.226

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.225

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.224

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.223

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.222

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.221

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.220

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.219

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.218

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.217

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.216

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.215

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.214

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.213

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.212

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.211

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.210

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.21

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.209

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.208

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.207

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.206

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.205

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.204

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.203

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.202

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.201

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.200

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.20

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.2

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.19

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.18

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.17

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.16

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.15

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.14

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.13

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.12

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.11

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.105

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.104

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.103

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.102

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.101

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.100

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.10

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.1

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.552.0

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.551.1

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.551.0

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.550.0

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:8.0.549.0

Trust: 0.3

vendor:googlemodel:chromescope:eqversion:7.0.548.0

Trust: 0.3

vendor:debianmodel:linux sparcscope:eqversion:5.0

Trust: 0.3

vendor:debianmodel:linux s/390scope:eqversion:5.0

Trust: 0.3

vendor:debianmodel:linux powerpcscope:eqversion:5.0

Trust: 0.3

vendor:debianmodel:linux mipselscope:eqversion:5.0

Trust: 0.3

vendor:debianmodel:linux mipsscope:eqversion:5.0

Trust: 0.3

vendor:debianmodel:linux m68kscope:eqversion:5.0

Trust: 0.3

vendor:debianmodel:linux ia-64scope:eqversion:5.0

Trust: 0.3

vendor:debianmodel:linux ia-32scope:eqversion:5.0

Trust: 0.3

vendor:debianmodel:linux hppascope:eqversion:5.0

Trust: 0.3

vendor:debianmodel:linux armelscope:eqversion:5.0

Trust: 0.3

vendor:debianmodel:linux armscope:eqversion:5.0

Trust: 0.3

vendor:debianmodel:linux amd64scope:eqversion:5.0

Trust: 0.3

vendor:debianmodel:linux alphascope:eqversion:5.0

Trust: 0.3

vendor:debianmodel:linuxscope:eqversion:5.0

Trust: 0.3

vendor:srwaremodel:ironscope:neversion:9.0.600.1

Trust: 0.3

vendor:googlemodel:chromescope:neversion:9.0.597.84

Trust: 0.3

sources: BID: 46144 // JVNDB: JVNDB-2011-002846 // CNNVD: CNNVD-201102-063 // NVD: CVE-2011-0776

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2011-0776
value: MEDIUM

Trust: 1.0

NVD: CVE-2011-0776
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201102-063
value: MEDIUM

Trust: 0.6

VULHUB: VHN-48721
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2011-0776
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-48721
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-48721 // JVNDB: JVNDB-2011-002846 // CNNVD: CNNVD-201102-063 // NVD: CVE-2011-0776

PROBLEMTYPE DATA

problemtype:CWE-200

Trust: 1.9

sources: VULHUB: VHN-48721 // JVNDB: JVNDB-2011-002846 // NVD: CVE-2011-0776

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201102-063

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-201102-063

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2011-002846

PATCH
title:Google Chromeurl:http://www.google.co.jp/chrome/intl/ja/landing_ff_yt.html?hl=ja&hl=ja
Trust: 0.8
title:stable-channel-updateurl:http://googlechromereleases.blogspot.com/2011/02/stable-channel-update.html
Trust: 0.8
title:Google Chrome Sandbox implements remedial measures for leaks of sensitive informationurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=120623
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2011-002846 // 
            
            
            
            CNNVD: CNNVD-201102-063

EXTERNAL IDS
db:NVDid:CVE-2011-0776
Trust: 2.8
db:JVNDBid:JVNDB-2011-002846
Trust: 0.8
db:CNNVDid:CNNVD-201102-063
Trust: 0.7
db:BIDid:46144
Trust: 0.3
db:VULHUBid:VHN-48721
Trust: 0.1
sources:
            
            
            VULHUB: VHN-48721 // 
            
            
            
            BID: 46144 // 
            
            
            
            JVNDB: JVNDB-2011-002846 // 
            
            
            
            CNNVD: CNNVD-201102-063 // 
            
            
            
            NVD: CVE-2011-0776

REFERENCES
url:http://googlechromereleases.blogspot.com/2011/02/stable-channel-update.html
Trust: 2.0
url:http://code.google.com/p/chromium/issues/detail?id=42989
Trust: 1.7
url:https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a13895
Trust: 1.7
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-0776
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-0776
Trust: 0.8
url:http://www.google.com/chrome
Trust: 0.3
url:http://www.srware.net/forum/viewtopic.php?f=18&t=2190
Trust: 0.3
sources:
            
            
            VULHUB: VHN-48721 // 
            
            
            
            BID: 46144 // 
            
            
            
            JVNDB: JVNDB-2011-002846 // 
            
            
            
            CNNVD: CNNVD-201102-063 // 
            
            
            
            NVD: CVE-2011-0776

CREDITS
Daniel Cheng of the Chromium development community, Aki Helin of OUSPG, Google Chrome Security Team (SkyLined, Inferno) and the Google Security Team (Michal Zalewski, David Bloom), Brian Kirchoff, Dan Morrison, Matthew Heidermann, Reddit.
Trust: 0.3
sources:
            
            
            BID: 46144

SOURCES
db:VULHUBid:VHN-48721
db:BIDid:46144
db:JVNDBid:JVNDB-2011-002846
db:CNNVDid:CNNVD-201102-063
db:NVDid:CVE-2011-0776

LAST UPDATE DATE
2024-11-23T20:19:17.627000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-48721date:2020-06-04T00:00:00
db:BIDid:46144date:2015-04-13T21:44:00
db:JVNDBid:JVNDB-2011-002846date:2011-11-16T00:00:00
db:CNNVDid:CNNVD-201102-063date:2020-06-05T00:00:00
db:NVDid:CVE-2011-0776date:2024-11-21T01:24:48.933

SOURCES RELEASE DATE
db:VULHUBid:VHN-48721date:2011-02-04T00:00:00
db:BIDid:46144date:2011-02-03T00:00:00
db:JVNDBid:JVNDB-2011-002846date:2011-11-16T00:00:00
db:CNNVDid:CNNVD-201102-063date:2011-02-09T00:00:00
db:NVDid:CVE-2011-0776date:2011-02-04T18:00:03.127