Multiple vulnerabilities in Techland Chrome

1) Resource management error

EUVDB-ID: #VU43190

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2013-0828

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The PDF functionality in Google Chrome before 24.0.1312.52 does not properly perform a cast of an unspecified variable during processing of the root of the structure tree, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted document.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 24.0.1272.0 - 24.0.1312.50

CPE2.3

• cpe:2.3:a:google:google_chrome:24.0.1272.0:*:*:*:*:*:*:*
• cpe:2.3:a:google:google_chrome:24.0.1272.1:*:*:*:*:*:*:*
• cpe:2.3:a:google:google_chrome:24.0.1273.0:*:*:*:*:*:*:*

External links

https://googlechromereleases.blogspot.com/2013/01/stable-channel-update.html
https://code.google.com/p/chromium/issues/detail?id=162153
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16272

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU43191

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2013-0829

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Google Chrome before 24.0.1312.52 does not properly maintain database metadata, which allows remote attackers to bypass intended file-access restrictions via unspecified vectors.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 24.0.1272.0 - 24.0.1312.50

CPE2.3

• cpe:2.3:a:google:google_chrome:24.0.1272.0:*:*:*:*:*:*:*
• cpe:2.3:a:google:google_chrome:24.0.1272.1:*:*:*:*:*:*:*
• cpe:2.3:a:google:google_chrome:24.0.1273.0:*:*:*:*:*:*:*

External links

https://googlechromereleases.blogspot.com/2013/01/stable-channel-update.html
https://code.google.com/p/chromium/issues/detail?id=162114
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16322

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Input validation error

EUVDB-ID: #VU43200

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2012-5151

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Integer overflow in Google Chrome before 24.0.1312.52 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code in a PDF document.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 24.0.1272.0 - 24.0.1312.50

CPE2.3

• cpe:2.3:a:google:google_chrome:24.0.1272.0:*:*:*:*:*:*:*
• cpe:2.3:a:google:google_chrome:24.0.1272.1:*:*:*:*:*:*:*
• cpe:2.3:a:google:google_chrome:24.0.1273.0:*:*:*:*:*:*:*

External links

https://googlechromereleases.blogspot.com/2013/01/stable-channel-update.html
https://code.google.com/p/chromium/issues/detail?id=165538
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16453

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Use-after-free

EUVDB-ID: #VU43204

Risk: Medium

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2012-5156

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing vectors involving PDF fields. A remote attackers can cause a denial of service or possibly have unspecified other impact.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 24.0.1272.0 - 24.0.1312.50

CPE2.3

• cpe:2.3:a:google:google_chrome:24.0.1272.0:*:*:*:*:*:*:*
• cpe:2.3:a:google:google_chrome:24.0.1272.1:*:*:*:*:*:*:*
• cpe:2.3:a:google:google_chrome:24.0.1273.0:*:*:*:*:*:*:*

External links

https://googlechromereleases.blogspot.com/2013/01/stable-channel-update.html
https://code.google.com/p/chromium/issues/detail?id=162778
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16330

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Buffer overflow

EUVDB-ID: #VU43205

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2012-5157

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

Google Chrome before 24.0.1312.52 does not properly handle image data in PDF documents, which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted document.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 24.0.1272.0 - 24.0.1312.50

CPE2.3

• cpe:2.3:a:google:google_chrome:24.0.1272.0:*:*:*:*:*:*:*
• cpe:2.3:a:google:google_chrome:24.0.1272.1:*:*:*:*:*:*:*
• cpe:2.3:a:google:google_chrome:24.0.1273.0:*:*:*:*:*:*:*

External links

https://googlechromereleases.blogspot.com/2013/01/stable-channel-update.html
https://code.google.com/p/chromium/issues/detail?id=162156
https://code.google.com/p/chromium/issues/detail?id=162776
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16424

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.