ID

VAR-201206-0120

CVE

CVE-2012-2824

TITLE

Used in multiple products Webkit Service disruption in (DoS) Vulnerabilities

DESCRIPTION

Use-after-free vulnerability in Google Chrome before 20.0.1132.43 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to SVG painting. This vulnerability Webkit Vulnerability in Google Chrome Other than Webkit Products that use may also be affected.Service disruption by a third party (DoS) There is a possibility of being affected unspecified, such as being in a state. Google Chrome is prone to multiple vulnerabilities. Attackers can exploit these issues to execute arbitrary code in the context of the browser, bypass security restrictions, or cause denial-of-service conditions; other attacks may also be possible. Versions prior to Chrome 20.0.1132.43 are vulnerable. NOTE: The CVE-2012-2764 issue has been moved to BID 54477 (Google Chrome 'metro_driver.dll' DLL Loading Arbitrary Code Execution Vulnerability) to better document it. NOTE: The CVE-2012-2807 issue has been moved to BID 54718 (libxml2 CVE-2012-2807 Multiple Integer Overflow Vulnerabilities) to better document it. CVE-ID CVE-2013-0962 : Mario Heiderich of Cure53 For OS X Lion systems Safari 6.0.3 is available via the Apple Software Update application. For OS X Mountain Lion systems Safari 6.0.3 is included with OS X v10.8.3. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2013-01-28-1 iOS 6.1 Software Update iOS 6.1 Software Update is now available and addresses the following: Identity Services Available for: iPhone 3GS and later, iPod touch (4th generation) and later, iPad 2 and later Impact: Authentication relying on certificate-based Apple ID authentication may be bypassed Description: An error handling issue existed in Identity Services. If the user's AppleID certificate failed to validate, the user's AppleID was assumed to be the empty string. If multiple systems belonging to different users enter this state, applications relying on this identity determination may erroneously extend trust. This issue was addressed by ensuring that NULL is returned instead of an empty string. CVE-ID CVE-2013-0963 International Components for Unicode Available for: iPhone 3GS and later, iPod touch (4th generation) and later, iPad 2 and later Impact: Visiting a maliciously crafted website may lead to a cross- site scripting attack Description: A canonicalization issue existed in the handling of the EUC-JP encoding, which could lead to a cross-site scripting attack on EUC-JP encoded websites. This issue was addressed by updating the EUC-JP mapping table. CVE-ID CVE-2011-3058 : Masato Kinugawa Kernel Available for: iPhone 3GS and later, iPod touch (4th generation) and later, iPad 2 and later Impact: A user-mode process may be able to access the first page of kernel memory Description: The iOS kernel has checks to validate that the user- mode pointer and length passed to the copyin and copyout functions would not result in a user-mode process being able to directly access kernel memory. The checks were not being used if the length was smaller than one page. This issue was addressed through additional validation of the arguments to copyin and copyout. CVE-ID CVE-2013-0964 : Mark Dowd of Azimuth Security Security Available for: iPhone 3GS and later, iPod touch (4th generation) and later, iPad 2 and later Impact: An attacker with a privileged network position may intercept user credentials or other sensitive information Description: Several intermediate CA certificates were mistakenly issued by TURKTRUST. This may allow a man-in-the-middle attacker to redirect connections and intercept user credentials or other sensitive information. This issue was addressed by not allowing the incorrect SSL certificates. StoreKit Available for: iPhone 3GS and later, iPod touch (4th generation) and later, iPad 2 and later Impact: JavaScript may be enabled in Mobile Safari without user interaction Description: If a user disabled JavaScript in Safari Preferences, visiting a site which displayed a Smart App Banner would re-enable JavaScript without warning the user. This issue was addressed by not enabling JavaScript when visiting a site with a Smart App Banner. CVE-ID CVE-2013-0974 : Andrew Plotkin of Zarfhome Software Consulting, Ben Madison of BitCloud, Marek Durcek WebKit Available for: iPhone 3GS and later, iPod touch (4th generation) and later, iPad 2 and later Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues existed in WebKit. These issues were addressed through improved memory handling. This issue was addressed through additional validation of pasted content. CVE-ID CVE-2013-0962 : Mario Heiderich of Cure53 WebKit Available for: iPhone 3GS and later, iPod touch (4th generation) and later, iPad 2 and later Impact: Visiting a maliciously crafted website may lead to a cross- site scripting attack Description: A cross-site scripting issue existed in the handling of frame elements. This issue was addressed through improved origin tracking. CVE-ID CVE-2012-2889 : Sergey Glazunov WiFi Available for: iPhone 3GS, iPhone 4, iPod touch (4th generation), iPad 2 Impact: A remote attacker on the same WiFi network may be able to temporarily disable WiFi Description: An out of bounds read issue exists in Broadcom's BCM4325 and BCM4329 firmware's handling of 802.11i information elements. This issue was addressed through additional validation of 802.11i information elements. CVE-ID CVE-2012-2619 : Andres Blanco and Matias Eissler of Core Security Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBAgAGBQJRBffvAAoJEPefwLHPlZEwzYgP/0qhsTft9TUGuphoY9tth5WB D0+8pAKs+1HU+nMOaEKPbK+zdMxblhRNPQyhMuTAQaY5Z/iGn1EXVCTlQBO8esRW epxNZuhFoaW4wzK9kvw5d/HZ9tfq059ozlFOp1TI2D6J5RwNgxDfigt2PUKCTV4X u/BONQHIfINYMofgf5897LHYYFSU2+NJj5ouM5dY4Y/kfJkwAnG5AWCAGlEt3QOo MZdaVv3/itPj4te838FYCVAepel3xBWX0Hhuu87+waHslRrIfQl+EvNk3YZXxWiF O5Hw9Ng/H8n0sbeA39w0U8tw+q/wPhVexdULgRjBH65+6g7Cu5u+rMuYuRjl8fO/ glLhKZNSrQDa5ZNOraOrF62AFVByHaSxv4cZwo262/6uH93FIBtklMt947GMVQLC 1FT0CIGNJb1/0156bvsABfRScBtK9ZdIUjXhOHMinhQJX3qiBqyKc4/juYPmC9VC KXk2/K8b0sGWQRc5RuQsSpzkZF9WcrwmgGOBIghp2DLmbAAj0uh2Ttf1GdrOaajR XpZ2TTJ5qE+IHNU0/etroTYnzjKVjQ0pODrPZj7ALLXULTraXJRJy7fqraUzsHbi AZiRca+3x/S9nqV0NpTNPZgTwxenox10t0w5vhcBK+SPGga1oVRbtOjGtVIkgoG4 KI3sdgb6PtpZWuIJ6iZA =J2jv -----END PGP SIGNATURE----- . ---------------------------------------------------------------------- Become a PSI 3.0 beta tester! Test-drive the new beta version and tell us what you think about its extended automatic update function and significantly enhanced user-interface. Download it here! http://secunia.com/psi_30_beta_launch ---------------------------------------------------------------------- TITLE: Google Chrome Multiple Vulnerabilities SECUNIA ADVISORY ID: SA49724 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/49724/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=49724 RELEASE DATE: 2012-06-27 DISCUSS ADVISORY: http://secunia.com/advisories/49724/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/49724/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=49724 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: Multiple vulnerabilities have been reported in Google Chrome, where some have unknown impacts and others can be exploited by malicious people to disclose certain sensitive information, bypass certain security restrictions, and compromise a user's system. 1) An unspecified error can be exploited to disclose the iFrame fragment ID. 2) An unspecified error can be exploited to interrupt other sandboxed processes Note: This vulnerability affects Windows only. 3) A use-after-free error exists within table section handling. 4) A use-after-free error exists within counter layout handling. 5) An unspecified error exists within texture handling. 6 An out-of-bounds read error exists within SVG filter handling. 7) An unspecified error exists within autofill display. 8) Multiple out-of-bounds read errors exists in the PDF section. 9) A use-after-free error exists within SVG resource handling. 10) A use-after-free error exists within SVG painting. 11) An out-of-bounds read error exists within texture conversion. 12) A use-after-free error exists within the Mac UI. Note: This vulnerability affects Mac OS only. 13) Multiple integer overflow errors exist within the PDF section. 14) A use-after-free error exists within first-letter handling. 15) A error when setting array values can be exploited to defererence a NULL-pointer. 16) A use-after-free error exists within SVG reference handling. 17) A NULL-pointer dereference error exists within PDF image codec. 18) An error within the PDF JS API can be exploited to cause a buffer overflow. 19) An integer overflow error exists within the Matroska container. SOLUTION: Upgrade to version 20.0.1132.43. Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ PROVIDED AND/OR DISCOVERED BY: The vendor credits: 1) Elie Bursztein of Google 2) Justin Schuh, Google Chrome Security Team 3, 4, 9, 10, 14, 15, 16) miaubiz 5) Ken "gets" Russell, Chromium development community 6) Atte Kettunen, OUSPG 7) simonbrown60 8) Kostya Serebryany, Evgeniy Stepanov, Mateusz Jurczyk, and Gynvael Coldwind, Google 11) Inferno, Google Chrome Security Team 12) Dharani Govindan, Chromium development community. 13) Mateusz Jurczyk, Google Security Team and Chris Evans, Google Chrome Security Team. 17, 18) Mateusz Jurczyk, Google Security Team. 19) J\xfcri Aedla. ORIGINAL ADVISORY: http://googlechromereleases.blogspot.com/2012/06/stable-channel-update_26.html OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . In certain contexts, an active network attacker could present untrusted certificates to iTunes and they would be accepted without warning. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201208-03 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Chromium: Multiple vulnerabilities Date: August 14, 2012 Bugs: #423719, #426204, #429174 ID: 201208-03 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been reported in Chromium, some of which may allow execution of arbitrary code. Background ========== Chromium is an open source web browser project. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 www-client/chromium < 21.0.1180.57 >= 21.0.1180.57 Description =========== Multiple vulnerabilities have been discovered in Chromium. Please review the CVE identifiers and release notes referenced below for details. Impact ====== A remote attacker could entice a user to open a specially crafted web site using Chromium, possibly resulting in the execution of arbitrary code with the privileges of the process, a Denial of Service condition, disclosure of sensitive information, or other unspecified impact. Workaround ========== There is no known workaround at this time. Resolution ========== All Chromium users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-client/chromium-21.0.1180.57" References ========== [ 1 ] CVE-2012-2815 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2815 [ 2 ] CVE-2012-2817 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2817 [ 3 ] CVE-2012-2818 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2818 [ 4 ] CVE-2012-2819 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2819 [ 5 ] CVE-2012-2820 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2820 [ 6 ] CVE-2012-2821 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2821 [ 7 ] CVE-2012-2823 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2823 [ 8 ] CVE-2012-2824 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2824 [ 9 ] CVE-2012-2825 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2825 [ 10 ] CVE-2012-2826 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2826 [ 11 ] CVE-2012-2829 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2829 [ 12 ] CVE-2012-2830 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2830 [ 13 ] CVE-2012-2831 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2831 [ 14 ] CVE-2012-2834 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2834 [ 15 ] CVE-2012-2842 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2842 [ 16 ] CVE-2012-2843 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2843 [ 17 ] CVE-2012-2846 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2846 [ 18 ] CVE-2012-2847 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2847 [ 19 ] CVE-2012-2848 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2848 [ 20 ] CVE-2012-2849 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2849 [ 21 ] CVE-2012-2853 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2853 [ 22 ] CVE-2012-2854 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2854 [ 23 ] CVE-2012-2857 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2857 [ 24 ] CVE-2012-2858 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2858 [ 25 ] CVE-2012-2859 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2859 [ 26 ] CVE-2012-2860 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2860 [ 27 ] Release Notes 20.0.1132.43 http://googlechromereleases.blogspot.com/2012/06/stable-channel-update_26= .html [ 28 ] Release Notes 20.0.1132.57 http://googlechromereleases.blogspot.com/2012/07/stable-channel-update.ht= ml [ 29 ] Release Notes 21.0.1180.57 http://googlechromereleases.blogspot.com/2012/07/stable-channel-release.h= tml Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-201208-03.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2012 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5

AFFECTED PRODUCTS