The PDF functionality in Google Chrome before 19.0.1084.52 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger out-of-bounds write operations.

Google Chrome Releases reports :

[117409] High CVE-2011-3103: Crashes in v8 garbage collection. Credit to the Chromium development community (Brett Wilson).

[118018] Medium CVE-2011-3104: Out-of-bounds read in Skia. Credit to Google Chrome Security Team (Inferno).

[120912] High CVE-2011-3105: Use-after-free in first-letter handling.
Credit to miaubiz.

[122654] Critical CVE-2011-3106: Browser memory corruption with websockets over SSL. Credit to the Chromium development community (Dharani Govindan).

[124625] High CVE-2011-3107: Crashes in the plug-in JavaScript bindings. Credit to the Chromium development community (Dharani Govindan).

[125159] Critical CVE-2011-3108: Use-after-free in browser cache.
Credit to 'efbiaiinzinz'.

[Linux only] [126296] High CVE-2011-3109: Bad cast in GTK UI. Credit to Micha Bartholome.

[126337] [126343] [126378] [127349] [127819] [127868] High CVE-2011-3110: Out of bounds writes in PDF. Credit to Mateusz Jurczyk of the Google Security Team, with contributions by Gynvael Coldwind of the Google Security Team.

[126414] Medium CVE-2011-3111: Invalid read in v8. Credit to Christian Holler.

[127331] High CVE-2011-3112: Use-after-free with invalid encrypted PDF. Credit to Mateusz Jurczyk of the Google Security Team, with contributions by Gynvael Coldwind of the Google Security Team.

[127883] High CVE-2011-3113: Invalid cast with colorspace handling in PDF. Credit to Mateusz Jurczyk of the Google Security Team, with contributions by Gynvael Coldwind of the Google Security Team.

[128014] High CVE-2011-3114: Buffer overflows with PDF functions.
Credit to Google Chrome Security Team (scarybeasts).

[128018] High CVE-2011-3115: Type corruption in v8. Credit to Christian Holler.

Versions of Google Chrome earlier than 19.0.1084.52 are potentially affected by the following vulnerabilities :

  - An error exists in the v8 JavaScript engine that can cause application crashes during garbage collection. (CVE-2011-3103)

  - An out-of-bounds read error exists related to 'Skia'. (CVE-2011-3104)

  - Use-after-free errors exists related to 'first-letter handling', browser cache, and invalid encrypted PDFs. (CVE-2011-3105, CVE-2011-3108, CVE-2011-3112)

  - A memory corruption error exists related to websockets and SSL. (CVE-2011-3106)

  - An error exists related to plugin-in JavaScript bindings that can cause the application to crash. (CVE-2011-3107)

  - An out-of-bounds write error exists related to PDF processing. (CVE-2011-3110)

  - An invalid read error exists related to the v8 Java Script engine. (CVE-2011-3111)

  - An invalid cast error exists related to colorspace handling in PDF processing. (CVE-2011-3113)

  - A buffer overflow error exists related to PDF functions. (CVE-2011-3114)

  - A type corruption error exists related to the v8 JavaScript engine. (CVE-2011-3115)

The version of Google Chrome installed on the remote host is earlier than 19.0.1084.52 and is, therefore, affected by the following vulnerabilities :

  - An error exists in the v8 JavaScript engine that can     cause application crashes during garbage collection.
    (CVE-2011-3103)

  - An out-of-bounds read error exists related to 'Skia'.
    (CVE-2011-3104)

  - Use-after-free errors exist related to     'first-letter handling', browser cache, and invalid     encrypted PDFs. (CVE-2011-3105, CVE-2011-3108,     CVE-2011-3112)

  - A memory corruption error exists related to websockets     and SSL. (CVE-2011-3106)

  - An error exists related to plugin-in JavaScript     bindings that can cause the application to crash.
    (CVE-2011-3107)

  - An out-of-bounds write error exists related to PDF     processing. (CVE-2011-3110)

  - An invalid read error exists related to the v8     JavaScript engine. (CVE-2011-3111)

  - An invalid cast error exists related to colorspace     handling in PDF processing. (CVE-2011-3113)

  - A buffer overflow error exists related to PDF     functions. (CVE-2011-3114)

  - A type corruption error exists related to the v8     JavaScript engine. (CVE-2011-3115)

ID	Name	Product	Family	Severity
59281	FreeBSD : chromium -- multiple vulnerabilities (219d0bfd-a915-11e1-b519-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	critical
800897	Google Chrome < 19.0.1084.52 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
59255	Google Chrome < 19.0.1084.52 Multiple Vulnerabilities	Nessus	Windows	critical

Detections

Analytics

CVE-2011-3110

high

Tenable Plugins

critical

high

critical