Use-after-free vulnerability in the frame-loader implementation in Google Chrome before 10.0.648.204 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

Several vulnerabilities were discovered in the Chromium browser. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2011-1292     Use-after-free vulnerability in the frame-loader     implementation in Google Chrome allows remote attackers     to cause a denial of service or possibly have     unspecified other impact via unknown vectors.

  - CVE-2011-1293     Use-after-free vulnerability in the HTMLCollection     implementation in Google Chrome allows remote attackers     to cause a denial of service or possibly have     unspecified other impact via unknown vectors.

  - CVE-2011-1440     Use-after-free vulnerability in Google Chrome allows     remote attackers to cause a denial of service or     possibly have unspecified other impact via vectors     related to the Ruby element and Cascading Style Sheets     (CSS) token sequences.

  - CVE-2011-1444     Race condition in the sandbox launcher implementation in     Google Chrome on Linux allows remote attackers to cause     a denial of service or possibly have unspecified other     impact via unknown vectors.

  - CVE-2011-1797     Google Chrome does not properly render tables, which     allows remote attackers to cause a denial of service or     possibly have unspecified other impact via unknown     vectors that lead to a 'stale pointer'.

  - CVE-2011-1799     Google Chrome does not properly perform casts of     variables during interaction with the WebKit engine,     which allows remote attackers to cause a denial of     service or possibly have unspecified other impact via     unknown vectors.

Versions of Google Chrome earlier than 10.0.648.204 are potentially affected by multiple vulnerabilities :

  - A buffer error exists in string handling functions. (72517)

  - A use-after-free error exists in the process for loading frames. (73216)

  - A use-after-free error exists in the processing of HTML Collections. (73595)

  - An error exists in the processing of CSS which leaves stale pointers behind. (74562)

  - An unspecified error allows DOM tree corruption related to broken node-hierarchy. (74991)

  - An error exists in the processing of SVG text which leaves stale pointers behind. (75170)

The version of Google Chrome installed on the remote host is earlier than 10.0.648.204.  Such versions of Chrome are affected by multiple vulnerabilities:

  - A buffer error exists in string handling functions.
    (Issue #72517)

  - A use-after-free error exists in the processes for     loading frames. (Issue #73216)

  - A use-after-free error exists in the processing of     HTML Collections. (Issue #73595)

  - An error exists in the processing of CSS which leaves     stale pointers behind. (Issue #74562)

  - An unspecified error allows DOM tree corruption related     to broken node-hierarchy. (Issue #74991)

  - An error exists in the processing of SVG text which     leaves stale pointers behind. (Issue #75170)

ID	Name	Product	Family	Severity
55033	Debian DSA-2245-1 : chromium-browser - several vulnerabilities	Nessus	Debian Local Security Checks	high
800965	Google Chrome < 10.0.648.204 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
52975	Google Chrome < 10.0.648.204 Multiple Vulnerabilities	Nessus	Windows	high
51069	FreeBSD : chromium -- multiple vulnerabilities (6887828f-0229-11e0-b84d-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2011-1292

critical

Tenable Plugins

high

high

high

critical