libvpx, as used in Google Chrome before 8.0.552.215 and possibly other products, allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WebM video. NOTE: this vulnerability exists because of a regression.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - chromium-browser: Negative-size parameter in Libvpx. (CVE-2015-1258)

  - libvpx:  denial of service (DoS) in vpx/src/vpx_image.c file (CVE-2017-13194)

  - libvpx, as used in Google Chrome before 8.0.552.215 and possibly other products, allows remote attackers     to cause a denial of service (out-of-bounds read) via a crafted WebM video. NOTE: this vulnerability     exists because of a regression. (CVE-2010-4489)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

A buffer overread was fixed in libvpx which could lead to crashes of applications using libvpx.

Chris Evans discovered that libvpx did not properly perform bounds checking. If an application using libvpx opened a specially crafted WebM file, an attacker could cause a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Versions of Google Chrome earlier than 8.0.552.215 are potentially affected by multiple vulnerabilities :

  - It may be possible to bypass the pop-up blocker. (17655)

  - A cross-origin video theft vulnerability exists related to canvas. (55747)  - An unspecified crash exists when handling HTML5 databases. (56237)  - Excessive file dialogs could lead to a browser crash. (58329)  - A use after free error exists in history handling. (59554)  - It may be possible to crash the browser when performing http proxy authentication. (61701)  -  An out-of-bounds read regression exists in the WebM video support. (61653)

  - It  may be possible to crash the browser due to bad indexing with malformed video. (62127)

  - A memory corruption issue exists relating t malicious privileged extension. (62168)

  - A use-after-free error exists in the mouse dragging event handling. (63051)

  - A double free error exists in XPath handling. (63444)

The version of Google Chrome installed on the remote host is earlier than 8.0.552.215.  Such versions are reportedly affected by multiple vulnerabilities :

  - It may be possible to bypass the pop-up blocker.
    (Issue #17655)

  - A cross-origin video theft vulnerability exists related     to canvas. (Issue #55745)

  - An unspecified crash exists when handling HTML5     databases. (Issue #56237)

  - Excessive file dialogs could lead to a browser crash.
    (Issue #58329)

  - A use after free error exists in history handling.
    (Issue #59554)

  - It may be possible to crash the browser when performing     http proxy  authentication. (Issue #61701)

  - An out-of-bounds read regression exists in the WebM     video support. (Issue #61701)

  - It may be possible to crash the browser due to bad     indexing with malformed video. (Issue #62127)

  - A memory corruption issue exists relating to malicious     privileged extension. (Issue #62168)

  - A use-after-free error exists in the handling of SVG     animations. (Issue #62401)

  - A use-after-free error exists in the mouse dragging     event handling. (Issue #63051)

  - A double free error exists in XPath handling.
    (Issue #63444)

ID	Name	Product	Family	Severity
199381	RHEL 6 : libvpx (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
74653	openSUSE Security Update : libvpx (openSUSE-SU-2012:0759-1)	Nessus	SuSE Local Security Checks	medium
65102	Ubuntu 10.10 : libvpx vulnerability (USN-1087-1)	Nessus	Ubuntu Local Security Checks	medium
800959	Google Chrome < 8.0.552.215 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
50977	Google Chrome < 8.0.552.215 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2010-4489

medium

Tenable Plugins

high

medium

medium

high

high