Google Chrome before 9.0.597.107 does not properly implement JavaScript dialogs, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted HTML document.

Several vulnerabilities were discovered in the Chromium browser. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2011-1108     Google Chrome before 9.0.597.107 does not properly     implement JavaScript dialogs, which allows remote     attackers to cause a denial of service (application     crash) or possibly have unspecified other impact via a     crafted HTML document.

  - CVE-2011-1109     Google Chrome before 9.0.597.107 does not properly     process nodes in Cascading Style Sheets (CSS)     stylesheets, which allows remote attackers to cause a     denial of service or possibly have unspecified other     impact via unknown vectors that lead to a 'stale     pointer'.

  - CVE-2011-1113     Google Chrome before 9.0.597.107 on 64-bit Linux     platforms does not properly perform pickle     deserialization, which allows remote attackers to cause     a denial of service (out-of-bounds read) via unspecified     vectors.

  - CVE-2011-1114     Google Chrome before 9.0.597.107 does not properly     handle tables, which allows remote attackers to cause a     denial of service or possibly have unspecified other     impact via unknown vectors that lead to a 'stale node'.

  - CVE-2011-1115     Google Chrome before 9.0.597.107 does not properly     render tables, which allows remote attackers to cause a     denial of service or possibly have unspecified other     impact via unknown vectors that lead to a 'stale     pointer'.

  - CVE-2011-1121     Integer overflow in Google Chrome before 9.0.597.107     allows remote attackers to cause a denial of service or     possibly have unspecified other impact via vectors     involving a TEXTAREA element.

  - CVE-2011-1122     The WebGL implementation in Google Chrome before     9.0.597.107 allows remote attackers to cause a denial of     service (out-of-bounds read) via unspecified vectors,     aka Issue 71960.

  - In addition, this upload fixes the following issues     (they don't have a CVE id yet) :

    - Out-of-bounds read in text searching. [69640]
    - Memory corruption in SVG fonts. [72134]

    - Memory corruption with counter nodes. [69628]

    - Stale node in box layout. [70027]

    - Cross-origin error message leak with workers. [70336]

    - Stale pointer in table painting. [72028]

    - Stale pointer with SVG cursors. [73746]

Versions of Google Chrome earlier than 9.0.597.107 are potentially affected by multiple vulnerabilities :

  - An unspecified error exists in the URL bar operations which can allow spoofing attacks. (54262)

  - An unspecified error exists in the processing of JavaScript dialogs. (63732)

  - An unspecified error exists in the processing of CSS nodes which can leave stale pointers in memory. (68263)

  - An unspecified error exists in the processing of key frame rules which can leave stale pointers in memory. (68741)

  - An unspecified error exists in the processing of form controls which can lead to application crashes. (70078)

  - An unspecified error exists in the rendering of SVG animations and other SVG content which can leave stale pointers in memory. (70244, 71296)

  - An unspecified error exists in the processing of tables which can leave stale nodes behind. (71114)

  - An unspecified error exists in the processing of tables which can leave stale pointers in memory. (71115)

  - An unspecified error exists in the processing of XHTML which can leave stale nodes behind. (71386)

  - An unspecified error exists in the processing of textarea elements which can lead to application crashes. (71388)

  - An unspecified error exists in the processing of device orientation which can leave stale pointers in memory. (71595)

  - An unspecified error exists in WebGL which allows out-of-bounds memory accesses. (71717, 71960)

  - An integer overflow exists in the processing of textarea elements which can lead to application crashes. (71855)

  - A use-after-free error exists in the processing of blocked plugins. (72437)

  - An unspecified error exists int he processing of layouts which can leave stale pointers in memory. (73235)

The version of Google Chrome installed on the remote host is earlier than 9.0.597.107.  Such versions are reportedly affected by multiple vulnerabilities :

  - An unspecified error exists in the URL bar operations     which can allow spoofing attacks. (Issue #54262)

  - An unspecified error exists in the processing of     JavaScript dialogs. (Issue #63732)

  - An unspecified error exists in the processing of CSS     nodes which can leave stale pointers in memory.
    (Issue #68263)

  - An unspecified error exists in the processing of key     frame rules which can leave stale pointers in memory.
    (Issue #68741)

  - An unspecified error exists in the processing of form     controls which can lead to application crashes.
    (Issue #70078)

  - An unspecified error exists in the rendering of SVG     animations and other SVG content which can leave stale     pointers in memory. (Issue #70244, #71296)

  - An unspecified error exists in the processing of tables     which can leave stale nodes behind. (Issue #71114)

  - An unspecified error exists in the processing of tables     which can leave stale pointers in memory. (Issue #71115)

  - An unspecified error exists in the processing of XHTML     which can leave stale nodes behind. (Issue #71386)

  - An unspecified error exists in the processing of     textarea elements which can lead to application     crashes. (Issue #71388)

  - An unspecified error exists in the processing of device     orientation which can leave stale pointers in memory.
    (Issue #71595)

  - An unspecified error exists in WebGL which allows     out-of-bounds memory accesses. (Issue #71717, #71960)

  - An integer overflow exists in the processing of     textarea elements which can lead to application     crashes. (Issue #71855)

  - An unspecified error exists which exposes internal     extension functions. (Issue #72214)

  - A use-after-free error exists in the processing of     blocked plugins. (Issue #72437)

  - An unspecified error exists in the processing of     layouts which can leave stale pointers in memory.
    (Issue #73235)

ID	Name	Product	Family	Severity
52621	Debian DSA-2189-1 : chromium-browser - several vulnerabilities	Nessus	Debian Local Security Checks	high
800958	Google Chrome < 9.0.597.107 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
52501	Google Chrome < 9.0.597.107 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2011-1108

high

Tenable Plugins

high

high

high