Google Chrome before 17.0.963.83 allows remote attackers to bypass the Same Origin Policy via vectors involving a "magic iframe."

- Update to 19.0.1079 Security Fixes (bnc#754456) :

  - High CVE-2011-3050: Use-after-free with first-letter     handling

  - High CVE-2011-3045: libpng integer issue from upstream

  - High CVE-2011-3051: Use-after-free in CSS cross-fade     handling

  - High CVE-2011-3052: Memory corruption in WebGL canvas     handling

  - High CVE-2011-3053: Use-after-free in block splitting

  - Low CVE-2011-3054: Apply additional isolations to webui     privileges

  - Low CVE-2011-3055: Prompt in the browser native UI for     unpacked extension installation

  - High CVE-2011-3056: Cross-origin violation with     &ldquo;magic iframe&rdquo;.

  - Low CVE-2011-3049: Extension web request API can     interfere with system requests Other Fixes :

  - The short-cut key for caps lock (Shift + Search) is     disabled when an accessibility screen reader is enabled

  - Fixes an issue with files not being displayed in File     Manager when some file names contain UTF-8 characters     (generally accented characters)

  - Fixed dialog boxes in settings. (Issue: 118031)

  - Fixed flash videos turning white on mac when running     with 

    --disable-composited-core-animation-plugins (Issue:
    117916) 

  - Change to look for correctly sized favicon when multiple     images are provided. (Issue: 118275)

  - Fixed issues - 116044, 117470, 117068, 117668, 118620

  - Update to 19.0.1077

  - Update to 19.0.1074

  - Build Chromium on openSUSE > 12.1 with the gold linker 

  - Fix build issues with GCC 4.7

  - Update to 19.0.1071

  - Several fixes and improvements in the new Settings,     Extensions, and Help pages.

  - Fixed the flashing when switched between composited and     non-composited mode. [Issue: 116603]

  - Fixed stability issues 116913, 117217, 117347, 117081

The remote host is affected by the vulnerability described in GLSA-201203-19 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium. Please review       the CVE identifiers and release notes referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted web       site using Chromium, possibly resulting in the execution of arbitrary       code with the privileges of the process, a Denial of Service condition,       Universal Cross-Site Scripting, or installation of an extension without       user interaction.
    A remote attacker could also entice a user to install a specially       crafted extension that would interfere with browser-issued web requests.
  Workaround :

    There is no known workaround at this time.

The remote host has Safari installed. 

Versions of Safari earlier than 5.1.7 are reportedly affected by several issues :

  - Two unspecified errors that can allow malicious sites to perform cross-site scripting attacks. (CVE-2011-3046, CVE-2011-3056)

  - An unspecified memory corruption error exists that can allows malicious sites to crash the application or potentially execute arbitrary code. (CVE-2012-0672)

  - A state-tracking issue exists that can allow malicious sites to populate HTML form values of other sites with arbitrary data. (CVE-2012-0676)

The version of Safari installed on the remote host reportedly is affected by several issues :

  - Two unspecified errors exist that can allow malicious     sites to perform cross-site scripting attacks.
    (CVE-2011-3046, CVE-2011-3056)

  - An unspecified memory corruption error exists that can     allow malicious sites to crash the application or     potentially execute arbitrary code. (CVE-2012-0672)

  - A state-tracking issue exists that can allow malicious     sites to populate HTML form values of other sites with     arbitrary data. (CVE-2012-0676)

The version of Apple Safari installed on the remote Mac OS X host is earlier than 5.1.7.  It is, therefore, potentially affected by several issues :

   - Two unspecified errors exist that can allow malicious     sites to perform cross-site scripting attacks.
    (CVE-2011-3046, CVE-2011-3056)

  - An unspecified memory corruption error exists that can     allow malicious sites to crash the application or     potentially execute arbitrary code. (CVE-2012-0672)

  - A state-tracking issue exists that can allow malicious     sites to populate HTML form values of other sites with     arbitrary data. (CVE-2012-0676)

According to its banner, the remote Apple iOS device is missing a security update.  Versions of Apple iOS 3.0 through 5.1.0 are affected by vulnerabilities within the following components :

 - Safari
 - WebKit

Google Chrome Releases reports :

[113902] High CVE-2011-3050: Use-after-free with first-letter handling. Credit to miaubiz.

[116162] High CVE-2011-3045: libpng integer issue from upstream.
Credit to Glenn Randers-Pehrson of the libpng project.

[116461] High CVE-2011-3051: Use-after-free in CSS cross-fade handling. Credit to Arthur Gerkis.

[116637] High CVE-2011-3052: Memory corruption in WebGL canvas handling. Credit to Ben Vanik of Google.

[116746] High CVE-2011-3053: Use-after-free in block splitting. Credit to miaubiz.

[117418] Low CVE-2011-3054: Apply additional isolations to webui privileges. Credit to Sergey Glazunov.

[117736] Low CVE-2011-3055: Prompt in the browser native UI for unpacked extension installation. Credit to PinkiePie.

[117550] High CVE-2011-3056: Cross-origin violation with 'magic iframe'. Credit to Sergey Glazunov.

[117794] Medium CVE-2011-3057: Invalid read in v8. Credit to Christian Holler.

[108648] Low CVE-2011-3049: Extension web request API can interfere with system requests. Credit to Michael Gundlach. Fixed in an earlier release.

The version of Google Chrome installed on the remote host is earlier than 17.0.963.83 and is, therefore, affected by the following vulnerabilities :

  - An unspecified integer issue exists in libpng.
    (CVE-2011-3045)

  - An error exists related to the extension web request     API that could allow denial of service attacks.
    Note this issue was corrected in a previous, unspecified     release. (CVE-2011-3049)

  - Use-after-free errors exist related to 'first-letter'     handling, CSS cross-fade handling and block splitting.
    (CVE-2011-3050, CVE-2011-3051, CVE-2011-3053)

  - A memory corruption error exists related to WebGL     canvas handling. (CVE-2011-3052)

  - An error exists related to webui privilege isolation.
    (CVE-2011-3054)

  - Installation of unpacked extensions does not use the     application's native user interface for prompts.
    (CVE-2011-3055)

  - A cross-origin violation is possible with 'magic iframe'.
    (CVE-2011-3056)

  - The v8 JavaScript engine could allow invalid reads to     take place. (CVE-2011-3057)

Versions of Google Chrome earlier than 17.0.963.83 are potentially affected by the following vulnerabilities :

  - An unspecified integer issue exists in libpng. (CVE-2011-3045)

  - Use-after-free errors exist related to 'first-letter' handling, CSS cross-fade handling and block splitting. (CVE-2011-3050, CVE_2011-3051, CVE-2011-3053)

  - A memory corruption error exists related to WebGL canvas handling. (CVE-2011-3052)

  - An error exists related to webui privilege isolation. (CVE-2011-3054)

  - Installation of unpacked extensions does not use the application's native user interface for prompts. (CVE-2011-3055)

  - A cross-origin violation is possible with 'magic iframe'. (CVE-2011-3056)

  - The v8 JavaScript engine can allow invalid reads to take place. (CVE-2011-3057)

The mobile device is running a version of iOS that is older than version 5.1.1.  Version 5.1.1 contains numerous security-related fixes for the following vulnerabilities :

  - Attackers can use a vulnerability in WebKit to perform     cross-site scripting attacks, possibly leaking data such     as cookies, user information, and passwords.
    (CVE-2011-3046, CVE-2011-3056)

  - A remote code execution vulnerability in WebKit could     allow a malicious site to run code on the host iOS     device giving the attacker access to critical data on     the phone.(CVE-2012-0672)

  - Vulnerabilities in Safari can allow malicious sites to     spoof the address in the address bar of the browser.
    This attack allows an attacker to redirect victims to a     malicious site without the user's ability to notice.
    (CVE-2012-0674)

ID	Name	Product	Family	Severity
74587	openSUSE Security Update : chromium / v8 (openSUSE-SU-2012:0466-1)	Nessus	SuSE Local Security Checks	medium
59611	GLSA-201203-19 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
800989	Safari < 5.1.7 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
6483	Safari < 5.1.7 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
59069	Safari < 5.1.7 Multiple Vulnerabilities	Nessus	Windows	high
59068	Mac OS X : Apple Safari < 5.1.7 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
6481	Apple iOS < 5.1.1 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	high
58438	FreeBSD : chromium -- multiple vulnerabilities (330106da-7406-11e1-a1d7-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	high
58434	Google Chrome < 17.0.963.83 Multiple Vulnerabilities	Nessus	Windows	high
800954	Google Chrome < 17.0.963.83 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
60027	Apple iOS < 5.1.1 Multiple Vulnerabilities	Nessus	Mobile Devices	critical

Detections

Analytics

CVE-2011-3056

high

Tenable Plugins

medium

critical

high

high

high

high

high

high

high

high

critical