Input validation error in Techland Chrome

1) Input validation error

EUVDB-ID: #VU44084

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2011-3087

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Google Chrome before 19.0.1084.46 does not properly perform window navigation, which has unspecified impact and remote attack vectors.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 19.0.1084.45

CPE2.3

• cpe:2.3:a:google:google_chrome:19.0.1084.45:*:*:*:*:*:*:*

External links

https://code.google.com/p/chromium/issues/detail?id=118664
https://googlechromereleases.blogspot.com/2012/05/stable-channel-update.html
https://lists.opensuse.org/opensuse-security-announce/2012-05/msg00017.html
https://security.gentoo.org/glsa/glsa-201205-03.xml
https://www.securityfocus.com/bid/53540
https://www.securitytracker.com/id?1027067
https://exchange.xforce.ibmcloud.com/vulnerabilities/75592
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15567

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.