Multiple vulnerabilities in Techland Chrome

1) Input validation error

EUVDB-ID: #VU45269

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2011-1107

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to manipulate data.

Unspecified vulnerability in Google Chrome before 9.0.597.107 allows remote attackers to spoof the URL bar via unknown vectors.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 9.0.597.0 - 9.0.597.106

CPE2.3

External links

https://code.google.com/p/chromium/issues/detail?id=54262
https://googlechromereleases.blogspot.com/2011/02/stable-channel-update_28.html
https://lists.apple.com/archives/security-announce/2011//Jul/msg00002.html
https://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html
https://support.apple.com/kb/HT4808
https://support.apple.com/kb/HT4999
https://www.securityfocus.com/bid/46614
https://exchange.xforce.ibmcloud.com/vulnerabilities/65725
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14322

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Input validation error

EUVDB-ID: #VU45270

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2011-1108

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 9.0.597.107 does not properly implement JavaScript dialogs, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted HTML document.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 9.0.597.0 - 9.0.597.106

CPE2.3

External links

https://code.google.com/p/chromium/issues/detail?id=63732
https://googlechromereleases.blogspot.com/2011/02/stable-channel-update_28.html
https://www.securityfocus.com/bid/46614
https://exchange.xforce.ibmcloud.com/vulnerabilities/65726
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14345

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Input validation error

EUVDB-ID: #VU45271

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2011-1109

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 9.0.597.107 does not properly process nodes in Cascading Style Sheets (CSS) stylesheets, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 9.0.597.0 - 9.0.597.106

CPE2.3

External links

https://code.google.com/p/chromium/issues/detail?id=68263
https://googlechromereleases.blogspot.com/2011/02/stable-channel-update_28.html
https://lists.apple.com/archives/security-announce/2011//Jul/msg00002.html
https://lists.apple.com/archives/Security-announce/2011//Oct/msg00000.html
https://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html
https://support.apple.com/kb/HT4808
https://support.apple.com/kb/HT4981
https://support.apple.com/kb/HT4999
https://www.securityfocus.com/bid/46614
https://exchange.xforce.ibmcloud.com/vulnerabilities/65727
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14422

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Input validation error

EUVDB-ID: #VU45272

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2011-1110

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 9.0.597.107 does not properly implement key frame rules, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 9.0.597.0 - 9.0.597.106

CPE2.3

External links

https://code.google.com/p/chromium/issues/detail?id=68741
https://googlechromereleases.blogspot.com/2011/02/stable-channel-update_28.html
https://www.securityfocus.com/bid/46614
https://exchange.xforce.ibmcloud.com/vulnerabilities/65728
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14415

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Input validation error

EUVDB-ID: #VU45273

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2011-1111

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 9.0.597.107 does not properly implement forms controls, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via unknown vectors.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 9.0.597.0 - 9.0.597.106

CPE2.3

External links

https://code.google.com/p/chromium/issues/detail?id=70078
https://googlechromereleases.blogspot.com/2011/02/stable-channel-update_28.html
https://www.securityfocus.com/bid/46614
https://exchange.xforce.ibmcloud.com/vulnerabilities/65729
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14245

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Input validation error

EUVDB-ID: #VU45274

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2011-1112

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 9.0.597.107 does not properly perform SVG rendering, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via unknown vectors.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 9.0.597.0 - 9.0.597.106

CPE2.3

External links

https://code.google.com/p/chromium/issues/detail?id=70244
https://googlechromereleases.blogspot.com/2011/02/stable-channel-update_28.html
https://www.securityfocus.com/bid/46614
https://exchange.xforce.ibmcloud.com/vulnerabilities/65730
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14648

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Input validation error

EUVDB-ID: #VU45275

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2011-1114

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 9.0.597.107 does not properly handle tables, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale node."

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 9.0.597.0 - 9.0.597.106

CPE2.3

External links

https://code.google.com/p/chromium/issues/detail?id=71114
https://googlechromereleases.blogspot.com/2011/02/stable-channel-update_28.html
https://lists.apple.com/archives/security-announce/2011//Jul/msg00002.html
https://lists.apple.com/archives/Security-announce/2011//Oct/msg00000.html
https://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html
https://support.apple.com/kb/HT4808
https://support.apple.com/kb/HT4981
https://support.apple.com/kb/HT4999
https://www.securityfocus.com/bid/46614
https://exchange.xforce.ibmcloud.com/vulnerabilities/65732
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14404

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Input validation error

EUVDB-ID: #VU45276

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2011-1115

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 9.0.597.107 does not properly render tables, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 9.0.597.0 - 9.0.597.106

CPE2.3

External links

https://code.google.com/p/chromium/issues/detail?id=71115
https://googlechromereleases.blogspot.com/2011/02/stable-channel-update_28.html
https://lists.apple.com/archives/security-announce/2011//Jul/msg00002.html
https://lists.apple.com/archives/Security-announce/2011//Oct/msg00000.html
https://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html
https://support.apple.com/kb/HT4808
https://support.apple.com/kb/HT4981
https://support.apple.com/kb/HT4999
https://www.securityfocus.com/bid/46614
https://exchange.xforce.ibmcloud.com/vulnerabilities/65733
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13641

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Input validation error

EUVDB-ID: #VU45277

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2011-1116

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 9.0.597.107 does not properly handle SVG animations, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 9.0.597.0 - 9.0.597.106

CPE2.3

External links

https://code.google.com/p/chromium/issues/detail?id=71296
https://googlechromereleases.blogspot.com/2011/02/stable-channel-update_28.html
https://www.securityfocus.com/bid/46614
https://exchange.xforce.ibmcloud.com/vulnerabilities/65734
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14205

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Input validation error

EUVDB-ID: #VU45278

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2011-1117

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 9.0.597.107 does not properly handle XHTML documents, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to "stale nodes."

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 9.0.597.0 - 9.0.597.106

CPE2.3

External links

https://code.google.com/p/chromium/issues/detail?id=71386
https://googlechromereleases.blogspot.com/2011/02/stable-channel-update_28.html
https://lists.apple.com/archives/security-announce/2011//Jul/msg00002.html
https://lists.apple.com/archives/Security-announce/2011//Oct/msg00000.html
https://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html
https://support.apple.com/kb/HT4808
https://support.apple.com/kb/HT4981
https://support.apple.com/kb/HT4999
https://www.securityfocus.com/bid/46614
https://exchange.xforce.ibmcloud.com/vulnerabilities/65735
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14487

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Input validation error

EUVDB-ID: #VU45279

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2011-1118

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 9.0.597.107 does not properly handle TEXTAREA elements, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted HTML document.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 9.0.597.0 - 9.0.597.106

CPE2.3

External links

https://code.google.com/p/chromium/issues/detail?id=71388
https://googlechromereleases.blogspot.com/2011/02/stable-channel-update_28.html
https://www.securityfocus.com/bid/46614
https://exchange.xforce.ibmcloud.com/vulnerabilities/65736
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14341

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Input validation error

EUVDB-ID: #VU45280

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2011-1119

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 9.0.597.107 does not properly determine device orientation, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 9.0.597.0 - 9.0.597.106

CPE2.3

External links

https://code.google.com/p/chromium/issues/detail?id=71595
https://googlechromereleases.blogspot.com/2011/02/stable-channel-update_28.html
https://www.securityfocus.com/bid/46614
https://exchange.xforce.ibmcloud.com/vulnerabilities/65737
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14542

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Out-of-bounds read

EUVDB-ID: #VU45281

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2011-1120

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The WebGL implementation in Google Chrome before 9.0.597.107 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors, aka Issue 71717.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 9.0.597.0 - 9.0.597.106

CPE2.3

External links

https://code.google.com/p/chromium/issues/detail?id=71717
https://googlechromereleases.blogspot.com/2011/02/stable-channel-update_28.html
https://www.securityfocus.com/bid/46614
https://exchange.xforce.ibmcloud.com/vulnerabilities/65738
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14459

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Integer overflow

EUVDB-ID: #VU45282

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2011-1121

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Integer overflow in Google Chrome before 9.0.597.107 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving a TEXTAREA element.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 9.0.597.0 - 9.0.597.106

CPE2.3

External links

https://code.google.com/p/chromium/issues/detail?id=71855
https://googlechromereleases.blogspot.com/2011/02/stable-channel-update_28.html
https://lists.apple.com/archives/security-announce/2011//Jul/msg00002.html
https://lists.apple.com/archives/Security-announce/2011//Oct/msg00000.html
https://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html
https://support.apple.com/kb/HT4808
https://support.apple.com/kb/HT4981
https://support.apple.com/kb/HT4999
https://www.securityfocus.com/bid/46614
https://exchange.xforce.ibmcloud.com/vulnerabilities/65739
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14685

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Out-of-bounds read

EUVDB-ID: #VU45283

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2011-1122

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The WebGL implementation in Google Chrome before 9.0.597.107 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors, aka Issue 71960.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 9.0.597.0 - 9.0.597.106

CPE2.3

External links

https://code.google.com/p/chromium/issues/detail?id=71960
https://googlechromereleases.blogspot.com/2011/02/stable-channel-update_28.html
https://www.securityfocus.com/bid/46614
https://exchange.xforce.ibmcloud.com/vulnerabilities/65740
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14559

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Use-after-free

EUVDB-ID: #VU45284

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2011-1124

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing vectors related to blocked plug-ins. A remote attackers can cause a denial of service or possibly have unspecified other impact.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update to version 9.0.597.107.

Vulnerable software versions

Google Chrome: 9.0.597.0 - 9.0.597.106

CPE2.3

External links

https://code.google.com/p/chromium/issues/detail?id=72437
https://googlechromereleases.blogspot.com/2011/02/stable-channel-update_28.html
https://www.securityfocus.com/bid/46614
https://exchange.xforce.ibmcloud.com/vulnerabilities/65742
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14563

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Input validation error

EUVDB-ID: #VU45285

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2011-1125

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 9.0.597.107 does not properly perform layout, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 9.0.597.0 - 9.0.597.106

CPE2.3

External links

https://code.google.com/p/chromium/issues/detail?id=73235
https://googlechromereleases.blogspot.com/2011/02/stable-channel-update_28.html
https://www.securityfocus.com/bid/46614
https://exchange.xforce.ibmcloud.com/vulnerabilities/65743
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14368

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Risk	Medium
Patch available	YES
Number of vulnerabilities	17
CVE-ID	CVE-2011-1107 CVE-2011-1108 CVE-2011-1109 CVE-2011-1110 CVE-2011-1111 CVE-2011-1112 CVE-2011-1114 CVE-2011-1115 CVE-2011-1116 CVE-2011-1117 CVE-2011-1118 CVE-2011-1119 CVE-2011-1120 CVE-2011-1121 CVE-2011-1122 CVE-2011-1124 CVE-2011-1125
CWE-ID	CWE-20 CWE-125 CWE-190 CWE-416
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	Google Chrome Client/Desktop applications / Web browsers
Vendor	Google