The GPU process in Google Chrome before 17.0.963.79 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) by leveraging an error in the plug-in loading mechanism.

Changes in chromium :

  - Update to 19.0.1066

  - Fixed Chrome install/update resets Google search     preferences (Issue: 105390)

  - Don't trigger accelerated compositing on 3D CSS when     using swiftshader (Issue: 116401)

  - Fixed a GPU crash (Issue: 116096)

  - More fixes for Back button frequently hangs (Issue:
    93427)

  - Bastion now works (Issue: 116285)

  - Fixed Composited layer sorting irregularity with     accelerated canvas (Issue: 102943)

  - Fixed Composited layer sorting irregularity with     accelerated canvas (Issue: 102943)

  - Fixed Google Feedback causes render process to use too     much memory (Issue: 114489)

  - Fixed after upgrade, some pages are rendered as blank     (Issue: 109888)

  - Fixed Pasting text into a single-line text field     shouldn't keep literal newlines (Issue: 106551)

  - Security Fixes :

  - Critical CVE-2011-3047: Errant plug-in load and GPU     process memory corruption

  - Critical CVE-2011-3046: UXSS and bad history navigation.

  - Update to 19.0.1060

  - Fixed NTP signed in state is missing (Issue: 112676)

  - Fixed gmail seems to redraw itself (all white)     occasionally (Issue: 111263)

  - Focus 'OK' button on JavaScript dialogs (Issue: 111015)

  - Fixed Back button frequently hangs (Issue: 93427)

  - Increase the buffer size to fix muted playback rate     (Issue: 108239)

  - Fixed Empty span with line-height renders with non-zero     height (Issue: 109811)

  - Marked the Certum Trusted Network CA as an issuer of     extended-validation (EV) certificates.

  - Fixed importing of bookmarks, history, etc. from Firefox     10+.

  - Fixed issues - 114001, 110785, 114168, 114598, 111663,     113636, 112676

  - Fixed several crashes (Issues: 111376, 108688, 114391)

  - Fixed Firefox browser in Import Bookmarks and Settings     drop-down (Issue: 114476)

  - Sync: Sessions aren't associating pre-existing tabs     (Issue: 113319)

  - Fixed All 'Extensions' make an entry under the 'NTP     Apps' page (Issue: 113672)

  - Security Fixes (bnc#750407) :

  - High CVE-2011-3031: Use-after-free in v8 element     wrapper.

  - High CVE-2011-3032: Use-after-free in SVG value     handling.

  - High CVE-2011-3033: Buffer overflow in the Skia drawing     library.

  - High CVE-2011-3034: Use-after-free in SVG document     handling.

  - High CVE-2011-3035: Use-after-free in SVG use handling.

  - High CVE-2011-3036: Bad cast in line box handling.

  - High CVE-2011-3037: Bad casts in anonymous block     splitting.

  - High CVE-2011-3038: Use-after-free in multi-column     handling.

  - High CVE-2011-3039: Use-after-free in quote handling.

  - High CVE-2011-3040: Out-of-bounds read in text handling.

  - High CVE-2011-3041: Use-after-free in class attribute     handling.

  - High CVE-2011-3042: Use-after-free in table section     handling.

  - High CVE-2011-3043: Use-after-free in flexbox with     floats.

  - High CVE-2011-3044: Use-after-free with SVG animation     elements.

Changes in v8 :

  - Update to 3.9.13.0

  - Add code kind check before preparing for OSR. (issue     1900, 115073)

  - Pass zone explicitly to zone-allocation on x64 and ARM.
    (issue 1802)

  - Port string construct stub to x64. (issue 849)

  - Performance and stability improvements on all platforms.

The remote host is affected by the vulnerability described in GLSA-201203-19 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium. Please review       the CVE identifiers and release notes referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted web       site using Chromium, possibly resulting in the execution of arbitrary       code with the privileges of the process, a Denial of Service condition,       Universal Cross-Site Scripting, or installation of an extension without       user interaction.
    A remote attacker could also entice a user to install a specially       crafted extension that would interfere with browser-issued web requests.
  Workaround :

    There is no known workaround at this time.

Versions of Google Chrome earlier than 17.0.963.79 are potentially affected by memory corruption vulnerabilities related to plugin loading and GPU processing.

The version of Google Chrome installed on the remote host is earlier than 17.0.963.79 and is, therefore, affected by memory corruption vulnerabilities related to plugin loading and GPU processing.

Google Chrome Releases reports :

[117620] [117656] Critical CVE-2011-3047: Errant plug-in load and GPU process memory corruption. Credit to PinkiePie.

ID	Name	Product	Family	Severity
74570	openSUSE Security Update : chromium / v8 (openSUSE-SU-2012:0374-1)	Nessus	SuSE Local Security Checks	critical
59611	GLSA-201203-19 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
800893	Google Chrome < 17.0.963.79 Memory Corruption Vulnerabilities	Log Correlation Engine	Web Clients	high
6349	Google Chrome < 17.0.963.79 Memory Corruption	Nessus Network Monitor	Web Clients	high
58342	Google Chrome < 17.0.963.79 Memory Corruption Vulnerabilities	Nessus	Windows	high
58316	FreeBSD : chromium -- Errant plug-in load and GPU process memory corruption (ab1f515d-6b69-11e1-8288-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2011-3047

high

Tenable Plugins

critical

critical

high

high

high

critical