SB2012010804 - Gentoo update for Chromium, V8
Published: January 8, 2012 Updated: September 25, 2016
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 13 secuirty vulnerabilities.
1) Incorrect Comparison (CVE-ID: CVE-2011-3903)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
Google Chrome before 16.0.912.63 does not properly perform regex matching, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
2) Use-after-free (CVE-ID: CVE-2011-3904)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when processing vectors related to bidirectional text (aka bidi) handling. A remote attackers can cause a denial of service or possibly have unspecified other impact.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
3) Out-of-bounds read (CVE-ID: CVE-2011-3906)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
The PDF parser in Google Chrome before 16.0.912.63 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
4) Input validation error (CVE-ID: CVE-2011-3907)
The vulnerability allows a remote non-authenticated attacker to manipulate data.
The view-source feature in Google Chrome before 16.0.912.63 allows remote attackers to spoof the URL bar via unspecified vectors.
5) Out-of-bounds read (CVE-ID: CVE-2011-3908)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
Google Chrome before 16.0.912.63 does not properly parse SVG documents, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
6) Buffer overflow (CVE-ID: CVE-2011-3909)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
The Cascading Style Sheets (CSS) implementation in Google Chrome before 16.0.912.63 on 64-bit platforms does not properly manage property arrays, which allows remote attackers to cause a denial of service (memory corruption) via unspecified vectors.
7) Out-of-bounds read (CVE-ID: CVE-2011-3910)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
Google Chrome before 16.0.912.63 does not properly handle YUV video frames, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
8) Use-after-free (CVE-ID: CVE-2011-3912)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when processing vectors related to SVG filters. A remote attackers can cause a denial of service or possibly have unspecified other impact.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
9) Use-after-free (CVE-ID: CVE-2011-3913)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when processing vectors related to Range handling. A remote attackers can cause a denial of service or possibly have unspecified other impact.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
10) Out-of-bounds write (CVE-ID: CVE-2011-3914)
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
The internationalization (aka i18n) functionality in Google V8, as used in Google Chrome before 16.0.912.63, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that trigger an out-of-bounds write.
11) Stack-based buffer overflow (CVE-ID: CVE-2011-3917)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing unknown vectors. A remote unauthenticated attacker can trigger stack-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
12) Use-after-free (CVE-ID: CVE-2011-3921)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when processing vectors involving animation frames. A remote attackers can cause a denial of service or possibly have unspecified other impact.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
13) Stack-based buffer overflow (CVE-ID: CVE-2011-3922)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing vectors related to glyph handling. A remote unauthenticated attacker can trigger stack-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Remediation
Install update from vendor's website.