Google Chrome before 9.0.597.84 does not properly restrict drag and drop operations, which might allow remote attackers to bypass the Same Origin Policy via unspecified vectors.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - WebKit: Improper handling of data types from event objects (CVE-2010-4205)

  - webkitgtk: heap-based buffer overflow (WSA-2015-0001) (CVE-2014-1303)

  - Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and     Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a     denial of service (application crash) via vectors involving HTML document subtrees. (CVE-2010-1761)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This version upgrade of webkit to 1.2.7 fixes the following bugs :

  - CVE-2010-2441: CVSS v2 Base Score: 4.3     (AV:N/AC:M/Au:N/C:P/I:N/A:N): Permissions, Privileges,     and Access Control (CWE-264)

  - CVE-2010-2901: CVSS v2 Base Score: 3.7     (AV:L/AC:H/Au:N/C:P/I:P/A:P): Buffer Errors (CWE-119)

  - CVE-2010-4042: CVSS v2 Base Score: 3.7     (AV:L/AC:H/Au:N/C:P/I:P/A:P): Input Validation (CWE-20)

  - CVE-2010-4492: CVSS v2 Base Score: 7.5     (AV:N/AC:L/Au:N/C:P/I:P/A:P): Resource Management Errors     (CWE-399)

  - CVE-2010-4493: CVSS v2 Base Score: 3.7     (AV:L/AC:H/Au:N/C:P/I:P/A:P): Resource Management Errors     (CWE-399)

  - CVE-2010-4578: CVSS v2 Base Score: 3.7     (AV:L/AC:H/Au:N/C:P/I:P/A:P): Input Validation (CWE-20)

  - CVE-2011-0482: CVSS v2 Base Score: 3.7     (AV:L/AC:H/Au:N/C:P/I:P/A:P): Numeric Errors (CWE-189)

  - CVE-2011-0778: CVSS v2 Base Score: 3.7     (AV:L/AC:H/Au:N/C:P/I:P/A:P): Permissions, Privileges,     and Access Control (CWE-264)

A large number of security issues were discovered in the WebKit browser and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Webkit version 1.2.7 fixes several security issues. (CVE-2010-2441 / CVE-2010-2901 / CVE-2010-4042 / CVE-2010-4492 / CVE-2010-4493 / CVE-2010-4578 / CVE-2011-0482 / CVE-2011-0778)

Several vulnerabilities have been discovered in WebKit, a Web content engine library for GTK+. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2010-1783     WebKit does not properly handle dynamic modification of     a text node, which allows remote attackers to execute     arbitrary code or cause a denial of service (memory     corruption and application crash) via a crafted HTML     document.

  - CVE-2010-2901     The rendering implementation in WebKit allows remote     attackers to cause a denial of service (memory     corruption) or possibly have unspecified other impact     via unknown vectors.

  - CVE-2010-4199     WebKit does not properly perform a cast of an     unspecified variable during processing of an SVG <use>     element, which allows remote attackers to cause a denial     of service or possibly have unspecified other impact via     a crafted SVG document.

  - CVE-2010-4040     WebKit does not properly handle animated GIF images,     which allows remote attackers to cause a denial of     service (memory corruption) or possibly have unspecified     other impact via a crafted image.

  - CVE-2010-4492     Use-after-free vulnerability in WebKit allows remote     attackers to cause a denial of service or possibly have     unspecified other impact via vectors involving SVG     animations.

  - CVE-2010-4493     Use-after-free vulnerability in WebKit allows remote     attackers to cause a denial of service via vectors     related to the handling of mouse dragging events.

  - CVE-2010-4577     The CSSParser::parseFontFaceSrc function in     WebCore/css/CSSParser.cpp in WebKit does not properly     parse Cascading Style Sheets (CSS) token sequences,     which allows remote attackers to cause a denial of     service (out-of-bounds read) via a crafted local font,     related to 'Type Confusion'.

  - CVE-2010-4578     WebKit does not properly perform cursor handling, which     allows remote attackers to cause a denial of service or     possibly have unspecified other impact via unknown     vectors that lead to 'stale pointers'.

  - CVE-2011-0482     WebKit does not properly perform a cast of an     unspecified variable during handling of anchors, which     allows remote attackers to cause a denial of service or     possibly have unspecified other impact via a crafted     HTML document.

  - CVE-2011-0778     WebKit does not properly restrict drag and drop     operations, which might allow remote attackers to bypass     the Same Origin Policy via unspecified vectors.

Several vulnerabilities were discovered in the Chromium browser. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2011-0777     Use-after-free vulnerability in Google Chrome before     9.0.597.84 allows remote attackers to cause a denial of     service or possibly have unspecified other impact via     vectors related to image loading.

  - CVE-2011-0778     Google Chrome before 9.0.597.84 does not properly     restrict drag and drop operations, which might allow     remote attackers to bypass the Same Origin Policy via     unspecified vectors.

  - CVE-2011-0783     Unspecified vulnerability in Google Chrome before     9.0.597.84 allows user-assisted remote attackers to     cause a denial of service (application crash) via     vectors involving a 'bad volume setting'.

  - CVE-2011-0983     Google Chrome before 9.0.597.94 does not properly handle     anonymous blocks, which allows remote attackers to cause     a denial of service or possibly have unspecified other     impact via unknown vectors that lead to a 'stale     pointer'.

  - CVE-2011-0981     Google Chrome before 9.0.597.94 does not properly     perform event handling for animations, which allows     remote attackers to cause a denial of service or     possibly have unspecified other impact via unknown     vectors that lead to a'stale pointer'.

  - CVE-2011-0984     Google Chrome before 9.0.597.94 does not properly handle     plug-ins, which allows remote attackers to cause a     denial of service (out-of-bounds read) via unspecified     vectors.

  - CVE-2011-0985     Google Chrome before 9.0.597.94 does not properly     perform process termination upon memory exhaustion,     which has unspecified impact and remote attack vectors.

- Fixes the following CVEs: CVE-2010-4492 CVE-2010-4493     CVE-2011-0482 CVE-2010-4199 CVE-2010-4578 CVE-2010-4040     CVE-2011-0778 CVE-2010-2901 CVE-2010-4042

  - Fixes a regression caused by earlier fix for     CVE-2010-1791. This caused webkitgtk to crash on certain     sites with JavaScript.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Gustavo Noronha Silva reports :

This release has essentially security fixes. Refer to the WebKit/gtk/NEWS file inside the tarball for details. We would like to thank the Red Hat security team (Huzaifa Sidhpurwala in particular) and Michael Gilbert from Debian for their help in checking (and pushing!) security issues affecting the WebKitGTK+ stable branch for this release.

Versions of Google Chrome earlier than 9.0.597.84 are potentially affected by multiple vulnerabilities :

  - A minor sandbox leak exists in stat(). Note this issue only affects Google Chrome on Mac OS. (429889)

  - A use-after-free issue exists in image loading. (55381)

  - An unspecified issue exists relating to cross-origin drag and drop. (59081)

  - A browser crash can occur when handling extensions with a missing key. (62791)

  - A browser crash issue exists relating to the PDF event handler. (64051)

  - An unspecified issue exists relating t the merging of autofill profiles. (65669)

  - A potential crash exists in the Mac OS 10.5 SSL libraries. Note that this issue only affects Google Chrome on Mac OS. (66931)

  - A browser crash issue exists relating to bad volume settings (68244)

  - A race condition exists in audio handling. (69195)

The version of Google Chrome installed on the remote host is earlier than 9.0.597.84.  It therefore is reportedly affected by multiple vulnerabilities :

  - A use-after-free issue exists in image loading.
    (Issue #55381)

  - An unspecified issue exists relating to cross-origin     drag and drop. (Issue #59081)

  - A browser crash can occur when handling extensions with     a missing key. (Issue #62791)

  - A browser crash issue exists relating to the PDF event     handler. (Issue #64051)

  - An unspecified issue exists relating to the merging of     autofill profiles. (Issue #65669)

  - A browser crash issue exists relating to bad volume     settings. (Issue #68244)

  - A race condition exists in audio handling.
    (Issue #69195)

ID	Name	Product	Family	Severity
199473	RHEL 6 : webkitgtk (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
75630	openSUSE Security Update : libwebkit (openSUSE-SU-2011:0482-1)	Nessus	SuSE Local Security Checks	critical
55967	Ubuntu 10.04 LTS / 10.10 : webkit vulnerabilities (USN-1195-1)	Nessus	Ubuntu Local Security Checks	critical
55453	SuSE 11.1 Security Update : webkit (SAT Patch Number 4765)	Nessus	SuSE Local Security Checks	critical
53886	openSUSE Security Update : libwebkit (openSUSE-SU-2011:0482-1)	Nessus	SuSE Local Security Checks	critical
52620	Debian DSA-2188-1 : webkit - several vulnerabilities	Nessus	Debian Local Security Checks	critical
52029	Debian DSA-2166-1 : chromium-browser - several vulnerabilities	Nessus	Debian Local Security Checks	critical
52018	Fedora 13 : webkitgtk-1.2.7-1.fc13 (2011-1224)	Nessus	Fedora Local Security Checks	critical
51950	FreeBSD : webkit-gtk2 -- Multiple vurnabilities. (35ecdcbe-3501-11e0-afcd-0015f2db7bde)	Nessus	FreeBSD Local Security Checks	critical
800942	Google Chrome < 9.0.597.84 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
51872	Google Chrome < 9.0.597.84 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2011-0778

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

high