ID

VAR-201202-0015

CVE

CVE-2011-3969

TITLE

Used in multiple products Webkit Service disruption in (DoS) Vulnerabilities

DESCRIPTION

Use-after-free vulnerability in Google Chrome before 17.0.963.46 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to layout of SVG documents. This vulnerability Webkit Vulnerability in Google Chrome Other than Webkit Products that use may also be affected.Service disruption by a third party (DoS) You may be put into a state or affected by other details. Google Chrome is prone to multiple vulnerabilities. Attackers can exploit these issues to execute arbitrary code in the context of the browser or cause denial-of-service conditions; other attacks may also be possible. Versions prior to Chrome 17.0.963.46 are vulnerable. Google Chrome is a web browser developed by Google (Google). - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201202-01 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Chromium: Multiple vulnerabilities Date: February 18, 2012 Bugs: #402841, #404067 ID: 201202-01 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been reported in Chromium, some of which may allow execution of arbitrary code. Background ========== Chromium is an open source web browser project. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 www-client/chromium < 17.0.963.56 >= 17.0.963.56 Description =========== Multiple vulnerabilities have been discovered in Chromium. Please review the CVE identifiers and release notes referenced below for details. Impact ====== A remote attacker could entice a user to open a specially crafted web site using Chromium, possibly resulting in the execution of arbitrary code with the privileges of the process, a Denial of Service condition, information leak (clipboard contents), bypass of the Same Origin Policy, or escape from NativeClient's sandbox. A remote attacker could also entice the user to perform a set of UI actions (drag and drop) to trigger an URL bar spoofing vulnerability. Workaround ========== There is no known workaround at this time. Resolution ========== All Chromium users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-client/chromium-17.0.963.56" References ========== [ 1 ] CVE-2011-3016 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3016 [ 2 ] CVE-2011-3017 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3017 [ 3 ] CVE-2011-3018 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3018 [ 4 ] CVE-2011-3019 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3019 [ 5 ] CVE-2011-3020 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3020 [ 6 ] CVE-2011-3021 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3021 [ 7 ] CVE-2011-3022 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3022 [ 8 ] CVE-2011-3023 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3023 [ 9 ] CVE-2011-3024 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3024 [ 10 ] CVE-2011-3025 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3025 [ 11 ] CVE-2011-3027 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3027 [ 12 ] CVE-2011-3953 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3953 [ 13 ] CVE-2011-3954 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3954 [ 14 ] CVE-2011-3955 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3955 [ 15 ] CVE-2011-3956 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3956 [ 16 ] CVE-2011-3957 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3957 [ 17 ] CVE-2011-3958 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3958 [ 18 ] CVE-2011-3959 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3959 [ 19 ] CVE-2011-3960 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3960 [ 20 ] CVE-2011-3961 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3961 [ 21 ] CVE-2011-3962 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3962 [ 22 ] CVE-2011-3963 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3963 [ 23 ] CVE-2011-3964 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3964 [ 24 ] CVE-2011-3965 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3965 [ 25 ] CVE-2011-3966 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3966 [ 26 ] CVE-2011-3967 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3967 [ 27 ] CVE-2011-3968 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3968 [ 28 ] CVE-2011-3969 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3969 [ 29 ] CVE-2011-3970 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3970 [ 30 ] CVE-2011-3971 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3971 [ 31 ] CVE-2011-3972 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3972 [ 32 ] Release Notes 17.0.963.46 http://googlechromereleases.blogspot.com/2012/02/stable-channel-update.ht= ml [ 33 ] Release Notes 17.0.963.56 http://googlechromereleases.blogspot.com/2012/02/chrome-stable-update.htm= l Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-201202-01.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2012 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

resource management error

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

&amp;amp;amp;amp;amp;amp;amp;amp;amp;lt;br&amp;amp;amp;amp;amp;amp;amp;amp;amp;gt;Daniel Cheng of the Chromium development community, Collin Payne, David Grogan of the Chromium development community, Devdatta Akhawe, UC Berkeley, Aki Helin of OUSPG, miaubi

SOURCES

LAST UPDATE DATE

2024-11-23T20:02:42.748000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE