Google Chrome before 18.0.1025.142 does not properly handle the EUC-JP encoding system, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.

Security update for Chromium and V8 to 18.0.1025.142.

Following bugs are listed in the Chrome changelog :

  - [$500]     [109574<https://code.google.com/p/chromium/issues/detail     ?id=109574>] Medium CVE-2011-3058: Bad interaction     possibly leading to XSS in EUC-JP. Credit to Masato     Kinugawa.

  - [$500]     [112317<https://code.google.com/p/chromium/issues/detail     ?id=112317>] Medium CVE-2011-3059: Out-of-bounds read in     SVG text handling. Credit to Arthur Gerkis.

  - [$500]     [114056<https://code.google.com/p/chromium/issues/detail     ?id=114056>] Medium CVE-2011-3060: Out-of-bounds read in     text fragment handling. Credit to miaubiz.

  - [116398     <https://code.google.com/p/chromium/issues/detail?id=116     398>] Medium CVE-2011-3061: SPDY proxy certificate     checking error. Credit to Leonidas Kontothanassis of     Google.

  - [116524     <https://code.google.com/p/chromium/issues/detail?id=116     524>] High CVE-2011-3062: Off-by-one in OpenType     Sanitizer. Credit to Mateusz Jurczyk of the Google     Security Team.

  - [117417     <https://code.google.com/p/chromium/issues/detail?id=117     417>] Low CVE-2011-3063: Validate navigation requests     from the renderer more carefully. Credit to kuzzcc,     Sergey Glazunov, PinkiePie and scarybeasts (Google     Chrome Security Team).

  - [$1000]     [117471<https://code.google.com/p/chromium/issues/detail     ?id=117471>] High CVE-2011-3064: Use-after-free in SVG     clipping. Credit to Atte Kettunen of OUSPG.

  - [$1000]     [117588<https://code.google.com/p/chromium/issues/detail     ?id=117588>] High CVE-2011-3065: Memory corruption in     Skia. Credit to Omair.

  - [$500]     [117794<https://code.google.com/p/chromium/issues/detail     ?id=117794>] Medium CVE-2011-3057: Invalid read in v8.
    Credit to Christian Holler.

The bugs [112317<https://code.google.com/p/chromium/issues/detail?id=112317>], [114056 <https://code.google.com/p/chromium/issues/detail?id=114056>] and [ 117471 <https://code.google.com/p/chromium/issues/detail?id=117471>] were detected using AddressSanitizer<http://code.google.com/p/address-sanitizer/wiki/Addre ssSanitizer> .

We'd also like to thank miaubiz, Chamal de Silva, Atte Kettunen of OUSPG, Aki Helin of OUSPG and Arthur Gerkis for working with us during the development cycle and preventing security regressions from ever reaching the stable channel. $8000 of additional rewards were issued for this awesomeness

The remote host is running a version of Mac OS X 10.8 that is older than version 10.8.3. The newer version contains numerous security-related fixes :

  - A canonicalization issue existed in the handling of URIs with ignorable Unicode character sequences. This issue was addressed by updating mod_hfs_apple to forbid access to URIs with ignorable Unicode character sequences. (CVE-2013-0966)
  - Java Web Start applications would run even if the Java plug-in was disabled. This issue was addressed by removing JNLP files from the CoreTypes safe file type list, so the Web Start application will not be run unless the user opens it in the Downloads directory. (CVE-2013-0967)
  - A canonicalization issue existed in the handling of the EUC-JP encoding, which could lead to a cross-site scripting attack on EUC-JP encoded websites. This issue was addressed by updating the EUC-JP mapping table. (CVE-2011-3058)
  - An error handling issue existed in Identity Services. If the user's AppleID certificate failed to validate, the user's AppleID was assumed to be the empty string. If multiple systems belonging to different users enter this state, applications relying on this identity determination may erroneously extend trust. This issue was addressed by ensuring that NULL is returned instead of an empty string. (CVE-2013-0963)
  - Description: A buffer overflow existed in libtiff's handling of TIFF images. This issue was addressed through additional validation of TIFF images. (CVE-2012-2088)
  - A memory corruption issue existed in the handling of graphics data. This issue was addressed through improved bounds checking.(CVE-2013-0976)
  - An information disclosure issue existed in the handling of APIs related to kernel extensions. Responses containing an OSBundleMachOHeaders key may have included kernel addresses, which may aid in bypassing address space layout randomization protection. (CVE-2012-3749)
  - A logic error existed in VoiceOver's handling of the Login Window, whereby an attacker with access to the keyboard could launch System Preferences and modify the system configuration. This issue was addressed by preventing VoiceOver from launching applications at the Login Window. (CVE-2013-0969)
  - Clicking on a specifically-formatted FaceTime:// URL in Messages could bypass the standard confirmation prompt. This issue was addressed by additional validation of FaceTime:// URLs. (CVE-2013-0970)
  - An issue existed in the Jabber server's handling of dialback result messages. An attacker may cause the Jabber server to disclose information intended for users of federated servers. This issue was addressed through improved handling of dialback result messages. (CVE-2012-3525)
  - Description: A use after free issue existed in the handling of ink annotations in PDF files. This issue was addressed through improved memory management. (CVE-2013-0971)
  - A type casting issue existed in Ruby on Rails' handling of XML parameters. This issue was addressed by disabling XML parameters in the Rails implementation used by Podcast Producer Server. (CVE-2013-0156)
  - A buffer overflow existed in the handling of 'rnet' boxes in MP4 files. This issue was addressed through improved bounds checking. (CVE-2012-3756)

The remote host is running a version of Mac OS X 10.6 or 10.7 that does not have Security Update 2013-001 applied.  This update contains numerous security-related fixes for the following components :

  - Apache
  - CoreTypes (10.7 only)
  - International Components for Unicode
  - Identity Services (10.7 only)
  - ImageIO
  - Messages Server (Server only)
  - PDFKit
  - Podcast Producer Server (Server only)
  - PostgreSQL (Server only)
  - Profile Manager (10.7 Server only)
  - QuickTime
  - Ruby (10.6 Server only)
  - Security
  - Software Update
  - Wiki Server (10.7 Server only)

Note that the update also runs a malware removal tool that will remove the most common variants of malware.

The remote host is running a version of Mac OS X 10.8.x that is prior to 10.8.3. The newer version contains multiple security-related fixes for the following components :

  - Apache
  - CoreTypes
  - International Components for Unicode
  - Identity Services
  - ImageIO
  - IOAcceleratorFamily
  - Kernel
  - Login Window
  - Messages
  - PDFKit
  - QuickTime
  - Security

Note that the update also runs a malware removal tool that will remove the most common variants of malware.

According to its banner, the remote Apple iOS device is missing a security update.  It is, therefore, affected by the following vulnerabilities :

 - An error related to 'EUC-JP' encoding could allow cross-site scripting attacks. (CVE-2011-3058)
 - An out-of-bounds read error exists, related to 802.11i information handling, that could allow remote attackers to disable Wi-Fi. (CVE-2012-2619)
 - An error exists related to certificate-based 'Apple ID' authentication that could allow improper trust extension. (CVE-2013-0963)
 - An error exists related to the 'copyin' and 'copyout' functions that could allow a user-mode process to access the first page of kernel memory. (CVE-2013-0964)
 - An error exists related to Mobile Safari preferences that could improperly allow JavaScript to be enabled after a user has disabled it. (CVE-2013-0974)
 - Many errors exist related to the bundled 'WebKit' components. (CVE-2012-2824, CVE-2012-2857, CVE-2012-2889, CVE-2012-3606, CVE-2012-3607, CVE-2012-3621, CVE-2012-3632, CVE-2012-3687, CVE-2012-3701, CVE-2013-0948, CVE-2013-0949, CVE-2013-0950, CVE-2013-0951, CVE-2013-0952, CVE-2013-0953, CVE-2013-0954, CVE-2013-0955, CVE-2013-0956, CVE-2013-0958, CVE-2013-0959, CVE-2013-0962, CVE-2013-0968)
 - Two intermediate certificates, improperly issued by TURKTRUST certificate authority, are incorrectly trusted.

The mobile device is running a version of iOS that is older than version 6.1.  This version contains security-related fixes for the following issues :

  - An error related to 'EUC-JP' encoding could allow cross-     site scripting attacks. (CVE-2011-3058)

  - An out-of-bounds read error exists related to 802.11i     information handling that could allow remote attackers     to disable WiFi. (CVE-2012-2619)

  - An error exists related to certificate-based     'Apple ID' authentication that could allow improper     trust extension. (CVE-2013-0963)

  - An error exists related to the 'copyin' and 'copyout'     functions that could allow a user-mode process to access     the first page of kernel memory. (CVE-2013-0964)

  - An error exists related to Mobile Safari     preferences that could improperly allow JavaScript     to be enabled after a user has disabled it.
    (CVE-2013-0974)

  - Many errors exist related to the bundled 'WebKit'     components. (CVE-2012-2824, CVE-2012-2857,     CVE-2012-2889, CVE-2012-3606, CVE-2012-3607,     CVE-2012-3621, CVE-2012-3632, CVE-2012-3687,     CVE-2012-3701, CVE-2013-0948, CVE-2013-0949,     CVE-2013-0950, CVE-2013-0951, CVE-2013-0952,     CVE-2013-0953, CVE-2013-0954, CVE-2013-0955,     CVE-2013-0956, CVE-2013-0958, CVE-2013-0959,     CVE-2013-0962, CVE-2013-0968)

  - Two intermediate certificates, improperly issued by     TURKTRUST certificate authority, are incorrectly     trusted.

The remote host is affected by the vulnerability described in GLSA-201203-24 (Chromium, V8: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and V8. Please       review the CVE identifiers and release notes referenced below for       details.
  Impact :

    A context-dependent attacker could entice a user to open a specially       crafted website or JavaScript program using Chromium or V8, possibly       resulting in the execution of arbitrary code with the privileges of the       process, or a Denial of Service condition.
    The attacker could also entice a user to open a specially crafted web       site using Chromium, possibly resulting in cross-site scripting (XSS), or       an unspecified SPDY certificate checking error.
  Workaround :

    There is no known workaround at this time.

Versions of Google Chrome earlier than 18.0.1025.142 are potentially affected by the following vulnerabilities :

  - An error exists in the v8 JavaScript engine that can allow invalid reads. (CVE-2011-3057)

  - An unspecified error exists related to bad interaction and 'EUC-JP'.  This can lead to cross-site scripting attacks. (CVE-2011-3058)

  - Out-of-bounds read errors exist related to SVG text handling and text fragment handling. (CVE-2011-3059, CVE-2011-3060)

  - A certificate checking error exists related to the SPDY protocol. (CVE-2011-3061)

  - An off-by-one error exists in the 'OpenType Sanitizer'. (CVE-2011-3062)

  - Navigation requests from the renderer are not validated carefully enough. (CVE-2011-3063)

  - A use-after-free error exists related to SVG clipping. (CVE-2011-3064)

  - An unspecified memory corruption error exists related to 'Skia'. (CVE-2011-3065)

  - The bundled version of Adobe Flash Player contains errors related to ActiveX and the NetStream class.  These errors can allow memory corruption, denial of service via application crashes and possibly code execution. (CVE-2012-0772, CVE-2012-0773)

The version of Google Chrome installed on the remote host is earlier than 18.0.1025.142 and is, therefore, affected by the following vulnerabilities :

  - An error exists in the v8 JavaScript engine that can     allow invalid reads. (CVE-2011-3057)

  - An unspecified error exists related to bad interaction     and 'EUC-JP'. This can lead to cross-site scripting     attacks. (CVE-2011-3058)

  - Out-of-bounds read errors exist related to SVG text     handling and text fragment handling. (CVE-2011-3059,     CVE-2011-3060)

  - A certificate checking error exists related to the     SPDY protocol. (CVE-2011-3061)

  - An off-by-one error exists in the 'OpenType Sanitizer'.
    (CVE-2011-3062)

  - Navigation requests from the renderer are not validated     carefully enough.(CVE-2011-3063)

  - A use-after-free error exists related to SVG clipping.
    (CVE-2011-3064)

  - An unspecified memory corruption error exists related     to 'Skia'. (CVE-2011-3065)

  - The bundled version of Adobe Flash Player contains     errors related to ActiveX and the NetStream class.
    These errors can allow memory corruption, denial of     service via application crashes and possibly code     execution. (CVE-2012-0772, CVE-2012-0773)

Google Chrome Releases reports :

[109574] Medium CVE-2011-3058: Bad interaction possibly leading to XSS in EUC-JP. Credit to Masato Kinugawa.

[112317] Medium CVE-2011-3059: Out-of-bounds read in SVG text handling. Credit to Arthur Gerkis.

[114056] Medium CVE-2011-3060: Out-of-bounds read in text fragment handling. Credit to miaubiz.

[116398] Medium CVE-2011-3061: SPDY proxy certificate checking error.
Credit to Leonidas Kontothanassis of Google.

[116524] High CVE-2011-3062: Off-by-one in OpenType Sanitizer. Credit to Mateusz Jurczyk of the Google Security Team.

[117417] Low CVE-2011-3063: Validate navigation requests from the renderer more carefully. Credit to kuzzcc, Sergey Glazunov, PinkiePie and scarybeasts (Google Chrome Security Team).

[117471] High CVE-2011-3064: Use-after-free in SVG clipping. Credit to Atte Kettunen of OUSPG.

[117588] High CVE-2011-3065: Memory corruption in Skia. Credit to Omair.

[117794] Medium CVE-2011-3057: Invalid read in v8. Credit to Christian Holler.

ID	Name	Product	Family	Severity
74592	openSUSE Security Update : chromium (openSUSE-SU-2012:0492-1)	Nessus	SuSE Local Security Checks	high
801018	Mac OS X 10.8 < 10.8.3 Multiple Vulnerabilities (Security Update 2013-001)	Log Correlation Engine	Operating System Detection	high
6717	Mac OS X 10.8 < 10.8.3 Multiple Vulnerabilities (Security Update 2013-001)	Nessus Network Monitor	Web Clients	high
65578	Mac OS X Multiple Vulnerabilities (Security Update 2013-001)	Nessus	MacOS X Local Security Checks	high
65577	Mac OS X 10.8.x < 10.8.3 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
6679	Apple iOS < 6.1 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	high
64287	Apple iOS < 6.1 Multiple Vulnerabilities	Nessus	Mobile Devices	high
59616	GLSA-201203-24 : Chromium, V8: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
800957	Google Chrome < 18.0.1025.142 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
58536	Google Chrome < 18.0.1025.142 Multiple Vulnerabilities	Nessus	Windows	high
58521	FreeBSD : chromium -- multiple vulnerabilities (b8f0a391-7910-11e1-8a43-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2011-3058

medium

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

critical