Race condition in the Inter-process Communication (IPC) implementation in Google Chrome before 18.0.1025.168 allows attackers to bypass intended sandbox restrictions via unspecified vectors.

Chromium version 20.0.1128 fixes several security issues :

  - CVE-2011-3078: Use after free in floats handling.

  - CVE-2012-1521: Use after free in xml parser.

  - CVE-2011-3079: IPC validation failure.

  - CVE-2011-3080: Race condition in sandbox IPC

  - CVE-2011-3081: Use after free in floats handling.

Versions of Google Chrome prior to 18.0.1025.168 are affected by the following vulnerabilities :

  - Use-after-free errors exist related to floating element handling and the xml parser. (CVE-2011-3078, CVE-2012-1521, CVE-2011-3081)

  - A validation error exists related to Inter-Process Communications (IPC). (CVE-2011-3079)

  - A race condition exists in the method 'CrossCallParamsEx::CreateFromBuffer' in the file 'sandbox/src/crosscall_server.cc' and is related to sandbox Inter-Process Communication (IPC). (CVE-2011-3080)

Google Chrome Releases reports :

[106413] High CVE-2011-3078: Use after free in floats handling. Credit to Google Chrome Security Team (Marty Barbella) and independent later discovery by miaubiz.

[117627] Medium CVE-2011-3079: IPC validation failure. Credit to PinkiePie.

[121726] Medium CVE-2011-3080: Race condition in sandbox IPC. Credit to Willem Pinckaers of Matasano.

[121899] High CVE-2011-3081: Use after free in floats handling. Credit to miaubiz.

[117110] High CVE-2012-1521: Use after free in xml parser. Credit to Google Chrome Security Team (SkyLined) and independent later discovery by wushi of team509 reported through iDefense VCP (V-874rcfpq7z).

The version of Google Chrome installed on the remote host is earlier than 18.0.1025.168 and is, therefore, affected by the following vulnerabilities :

  - Use-after-free errors exist related to floating element     handling and the xml parser. (CVE-2011-3078,     CVE-2012-1521, CVE-2011-3081)

  - A validation error exists related to Inter-Process     Communications (IPC). (CVE-2011-3079)

  - A race condition exists in the method     'CrossCallParamsEx::CreateFromBuffer' in the file     'sandbox/src/crosscall_server.cc' and is related to     sandbox Inter-Process Communication (IPC).
    (CVE-2011-3080)

ID	Name	Product	Family	Severity
74622	openSUSE Security Update : chromium / v8 (openSUSE-SU-2012:0613-1)	Nessus	SuSE Local Security Checks	critical
800935	Google Chrome < 18.0.1025.168 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
58963	FreeBSD : chromium -- multiple vulnerabilities (94c0ac4f-9388-11e1-b242-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	critical
58954	Google Chrome < 18.0.1025.168 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2011-3080

critical

Tenable Plugins

critical

high

critical

high