Buffer overflow in Skia, as used in Google Chrome before 17.0.963.65, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

Changes in chromium :

  - Update to 19.0.1066

  - Fixed Chrome install/update resets Google search     preferences (Issue: 105390)

  - Don't trigger accelerated compositing on 3D CSS when     using swiftshader (Issue: 116401)

  - Fixed a GPU crash (Issue: 116096)

  - More fixes for Back button frequently hangs (Issue:
    93427)

  - Bastion now works (Issue: 116285)

  - Fixed Composited layer sorting irregularity with     accelerated canvas (Issue: 102943)

  - Fixed Composited layer sorting irregularity with     accelerated canvas (Issue: 102943)

  - Fixed Google Feedback causes render process to use too     much memory (Issue: 114489)

  - Fixed after upgrade, some pages are rendered as blank     (Issue: 109888)

  - Fixed Pasting text into a single-line text field     shouldn't keep literal newlines (Issue: 106551)

  - Security Fixes :

  - Critical CVE-2011-3047: Errant plug-in load and GPU     process memory corruption

  - Critical CVE-2011-3046: UXSS and bad history navigation.

  - Update to 19.0.1060

  - Fixed NTP signed in state is missing (Issue: 112676)

  - Fixed gmail seems to redraw itself (all white)     occasionally (Issue: 111263)

  - Focus 'OK' button on JavaScript dialogs (Issue: 111015)

  - Fixed Back button frequently hangs (Issue: 93427)

  - Increase the buffer size to fix muted playback rate     (Issue: 108239)

  - Fixed Empty span with line-height renders with non-zero     height (Issue: 109811)

  - Marked the Certum Trusted Network CA as an issuer of     extended-validation (EV) certificates.

  - Fixed importing of bookmarks, history, etc. from Firefox     10+.

  - Fixed issues - 114001, 110785, 114168, 114598, 111663,     113636, 112676

  - Fixed several crashes (Issues: 111376, 108688, 114391)

  - Fixed Firefox browser in Import Bookmarks and Settings     drop-down (Issue: 114476)

  - Sync: Sessions aren't associating pre-existing tabs     (Issue: 113319)

  - Fixed All 'Extensions' make an entry under the 'NTP     Apps' page (Issue: 113672)

  - Security Fixes (bnc#750407) :

  - High CVE-2011-3031: Use-after-free in v8 element     wrapper.

  - High CVE-2011-3032: Use-after-free in SVG value     handling.

  - High CVE-2011-3033: Buffer overflow in the Skia drawing     library.

  - High CVE-2011-3034: Use-after-free in SVG document     handling.

  - High CVE-2011-3035: Use-after-free in SVG use handling.

  - High CVE-2011-3036: Bad cast in line box handling.

  - High CVE-2011-3037: Bad casts in anonymous block     splitting.

  - High CVE-2011-3038: Use-after-free in multi-column     handling.

  - High CVE-2011-3039: Use-after-free in quote handling.

  - High CVE-2011-3040: Out-of-bounds read in text handling.

  - High CVE-2011-3041: Use-after-free in class attribute     handling.

  - High CVE-2011-3042: Use-after-free in table section     handling.

  - High CVE-2011-3043: Use-after-free in flexbox with     floats.

  - High CVE-2011-3044: Use-after-free with SVG animation     elements.

Changes in v8 :

  - Update to 3.9.13.0

  - Add code kind check before preparing for OSR. (issue     1900, 115073)

  - Pass zone explicitly to zone-allocation on x64 and ARM.
    (issue 1802)

  - Port string construct stub to x64. (issue 849)

  - Performance and stability improvements on all platforms.

The remote host is affected by the vulnerability described in GLSA-201203-19 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium. Please review       the CVE identifiers and release notes referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted web       site using Chromium, possibly resulting in the execution of arbitrary       code with the privileges of the process, a Denial of Service condition,       Universal Cross-Site Scripting, or installation of an extension without       user interaction.
    A remote attacker could also entice a user to install a specially       crafted extension that would interfere with browser-issued web requests.
  Workaround :

    There is no known workaround at this time.

Google Chrome Releases reports :

[105867] High CVE-2011-3031: Use-after-free in v8 element wrapper.
Credit to Chamal de Silva.

[108037] High CVE-2011-3032: Use-after-free in SVG value handling.
Credit to Arthur Gerkis.

[108406] [115471] High CVE-2011-3033: Buffer overflow in the Skia drawing library. Credit to Aki Helin of OUSPG.

[111748] High CVE-2011-3034: Use-after-free in SVG document handling.
Credit to Arthur Gerkis.

[112212] High CVE-2011-3035: Use-after-free in SVG use handling.
Credit to Arthur Gerkis.

[113258] High CVE-2011-3036: Bad cast in line box handling. Credit to miaubiz.

[113439] [114924] [115028] High CVE-2011-3037: Bad casts in anonymous block splitting. Credit to miaubiz.

[113497] High CVE-2011-3038: Use-after-free in multi-column handling.
Credit to miaubiz.

[113707] High CVE-2011-3039: Use-after-free in quote handling. Credit to miaubiz.

[114054] High CVE-2011-3040: Out-of-bounds read in text handling.
Credit to miaubiz.

[114068] High CVE-2011-3041: Use-after-free in class attribute handling. Credit to miaubiz.

[114219] High CVE-2011-3042: Use-after-free in table section handling.
Credit to miaubiz.

[115681] High CVE-2011-3043: Use-after-free in flexbox with floats.
Credit to miaubiz.

[116093] High CVE-2011-3044: Use-after-free with SVG animation elements. Credit to Arthur Gerkis.

Versions of Google Chrome earlier than 17.0.963.65 are potentially affected by the following vulnerabilities :

  - Use-after-free errors exist related to 'v8 element wrapper', SVG value handling, SVG document handling, SVG use handling, multi-column handling, quote handling, class attribute handling, table section handling, flexbox with floats and SVG animation elements. (CVE-2011-3031, CVE-2011-3032, CVE-2011-3034, CVE-2011-3035, CVE-2011-3038, CVE-2011-3039, CVE-2011-3041, CVE-2011-3042, CVE-2011-3043, CVE-2011-3044)

  - An error exists in the 'Skia' drawing library that can allow buffer overflows. (CVE-2011-3033)

  - Casting errors exist related to line box handling and anonymous block splitting. (CVE-2011-3036, CVE-2011-3037)

  - An out-of-bounds read error exists related to text handling. (CVE-2011-3040)

The version of Google Chrome installed on the remote host is earlier than 17.0.963.65 and is, therefore, affected by the following vulnerabilities:

  - Use-after-free errors exist related to 'v8 element     wrapper', SVG value handling, SVG document handling,     SVG use handling, multi-column handling, quote     handling, class attribute handling, table section     handling, flexbox with floats and SVG animation     elements. (CVE-2011-3031, CVE-2011-3032, CVE-2011-3034,     CVE-2011-3035, CVE-2011-3038, CVE-2011-3039,     CVE-2011-3041, CVE-2011-3042, CVE-2011-3043,     CVE-2011-3044)

  - An error exists in the 'Skia' drawing library that can     allow buffer overflows. (CVE-2011-3033)

  - Casting errors exist related to line box handling and     anonymous block splitting. (CVE-2011-3036,     CVE-2011-3037)

  - An out-of-bounds read error exists related to text     handling. (CVE-2011-3040)

ID	Name	Product	Family	Severity
74570	openSUSE Security Update : chromium / v8 (openSUSE-SU-2012:0374-1)	Nessus	SuSE Local Security Checks	critical
59611	GLSA-201203-19 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
58210	FreeBSD : chromium -- multiple vulnerabilities (99aef698-66ed-11e1-8288-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	high
800899	Google Chrome < 17.0.963.65 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
58206	Google Chrome < 17.0.963.65 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2011-3033

high

Tenable Plugins

critical

critical

high

high

high