The drag-and-drop implementation in Google Chrome before 13.0.782.107 on Linux does not properly enforce permissions for files, which allows user-assisted remote attackers to bypass intended access restrictions via unspecified vectors.

Versions of Google Chrome earlier than 13.0.782.107 are potentially affected by multiple vulnerabilities :

  - It is possible to install an extension without a confirmation dialog. (Issue 75821)

  - A stale pointer exists due to bad line box tracking in rendering. (Issue 78841)

  - It is possible to bypass the dangerous file prompt. (Issue 79266)

  - An unspecified issue exists relating to the designation of strings in the basic auth dialog. (Issue 79426)

  - A file permissions error exists with drag and drop.  Note that this issue only affects Chrome on Linux. (Issue 81307)

  - Developer mode NPAPI extension installs are not always confirmed via browser dialog boxes. (Issue 83273)

  - It is possible for the local file path to be disclosed via a GL program log. (CVE-2011-2784)

  - The homepage URL in extensions is not properly sanitized. (Issue 84402)

  - The speech-input bubble is not always displayed on-screen. (Issue 84600)

  - It is possible to crash the browser due to a GPU lock re-entrancy issue. (Issue 84805)

  - A buffer overflow issue exists in inspector serialization. (Issue 85559)

  - A use-after-free issue exists in the Pepper plug-in installation. (Issue 85808)

  - A use-after-free issue exists with floating styles. (Issue 86502)

  - An out-of-bounds write exists in ICU. (Issue 86900)

  - A use-after-free issue exists with float removal. (Issue 87148)

  - A use-after-free issue exists in media selectors. (Issue 87227)

  - An out-of-bounds read exists in text iteration. (Issue 87298)

  - A leak exists relating to cross-frame functions. (Issue 87339)

  - A use-after-free issue exists in Skia. (Issue 87548)

  - A use-after-free issue exists in resource caching. (Issue 87729)

  - Several unspecified internal schemes are web accessible. (Issue 87815)

  - A use-after-free issue exists in HTML range handling. (Issue 87925)

  - It is possible for a client side redirect target to be leaked. (Issue 88337)

  - It is possible for v8 to crash with const lookups. (Issue 88591)

  - A use-after-free issue exists in the frame loader. (Issue 88846)

  - A use-after-free issue exists in display box rendering. (Issue 88889)

  - A PDF crash exists with nested functions. (Issue 89142)

  - A cross-origin script injection issue exists. (Issue 89520)

  - A cross-origin violation exists in base URI handling. (Issue 90222)

ID	Name	Product	Family	Severity
800963	Google Chrome < 13.0.782.107 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
51069	FreeBSD : chromium -- multiple vulnerabilities (6887828f-0229-11e0-b84d-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2011-2782

critical

Tenable Plugins

high

critical