Google Chrome before 20.0.1132.43 on Windows does not properly isolate sandboxed processes, which might allow remote attackers to cause a denial of service (process interference) via unspecified vectors.

- Update Chromium to 22.0.1190

  - Security Fixes (bnc#769181) :

  - CVE-2012-2815: Leak of iframe fragment id

  - CVE-2012-2816: Prevent sandboxed processes interfering     with each other

  - CVE-2012-2817: Use-after-free in table section handling

  - CVE-2012-2818: Use-after-free in counter layout

  - CVE-2012-2819: Crash in texture handling

  - CVE-2012-2820: Out-of-bounds read in SVG filter handling

  - CVE-2012-2821: Autofill display problem

  - CVE-2012-2823: Use-after-free in SVG resource handling

  - CVE-2012-2826: Out-of-bounds read in texture conversion

  - CVE-2012-2829: Use-after-free in first-letter handling

  - CVE-2012-2830: Wild pointer in array value setting

  - CVE-2012-2831: Use-after-free in SVG reference handling

  - CVE-2012-2834: Integer overflow in Matroska container

  - CVE-2012-2825: Wild read in XSL handling

  - CVE-2012-2807: Integer overflows in libxml

  - Fix update-alternatives within the spec-file

  - Update v8 to 3.12.5.0

  - Fixed Chromium issues: 115100, 129628, 131994, 132727,     132741, 132742, 133211

  - Fixed V8 issues: 915, 1914, 2034, 2087, 2094, 2134,     2156, 2166, 2172, 2177, 2179, 2185

  - Added --extra-code flag to mksnapshot to load JS code     into the VM before creating the snapshot.

  - Support 'restart call frame' command in the debugger.

  - Fixed lazy sweeping heuristics to prevent old-space     expansion. (issue 2194)

  - Fixed sharing of literal boilerplates for optimized     code. (issue 2193)

  - Removed -fomit-frame-pointer flag from Release builds to     make the stack walkable by TCMalloc (Chromium issue     133723).

  - Expose more detailed memory statistics (issue 2201).

  - Fixed Harmony Maps and WeakMaps for undefined values     (Chromium issue 132744).

  - Update v8 to 3.11.10.6

  - Implemented heap profiler memory usage reporting.

  - Preserved error message during finally block in     try..finally. (Chromium issue 129171)

  - Fixed EnsureCanContainElements to properly handle double     values. (issue 2170)

  - Improved heuristics to keep objects in fast mode with     inherited constructors.

  - Performance and stability improvements on all platforms.

  - Implemented ES5-conformant semantics for inherited     setters and read-only properties. Currently behind
    --es5_readonly flag, because it breaks WebKit bindings.

  - Exposed last seen heap object id via v8 public api.

  - Update v8 to 3.11.8.0

  - Avoid overdeep recursion in regexp where a guarded     expression with a minimum repetition count is inside     another quantifier. (Chromium issue 129926)

  - Fixed missing write barrier in store field stub. (issues     2143, 1465, Chromium issue 129355)

  - Proxies: Fixed receiver for setters inherited from     proxies.

  - Proxies: Fixed ToStringArray function so that it does     not reject some keys. (issue 1543)

  - Update v8 to 3.11.7.0

  - Get better function names in stack traces.

  - Fixed RegExp.prototype.toString for incompatible     receivers (issue 1981).

  - Some cleanup to common.gypi. This fixes some host/target     combinations that weren't working in the Make build on     Mac.

  - Handle EINTR in socket functions and continue incomplete     sends. (issue 2098)

  - Fixed python deprecations. (issue 1391)

  - Made socket send and receive more robust and return 0 on     failure. (Chromium issue 15719)

  - Fixed GCC 4.7 (C++11) compilation. (issue 2136)

  - Set '-m32' option for host and target platforms

  - Performance and stability improvements on all platforms.

Versions of Google Chrome earlier than 20.0.1132.43 are potentially affected by the following vulnerabilities :

  - An unspecified error allows access to iFrame fragment ID information, (CVE-2012-2815)

  - An unspecified issue is triggered when sandboxed processes interfere with one another. (CVE-2012-2816)

  - A user-after free issue exists in handling table sections which may allow for execution of arbitrary code. (CVE-2012-02817)

  - An unspecified use-after-free flaw exists in the counter layout which may allow for execution of arbitrary code. (CVE-2012-2818)

  -  A flaw exists in the WebGL subsystem when the texSubImage2d implementation does not properly handle uploads to floating-point textures, which may allow a remote denial of service. (CVE-2012-2919)

  - An out-of-bounds read error occurs during the handling of SVG filters, which may allow a remote denial of service. (CVE-2012-2820)

  - A flaw exists in the autofill display. No further details have been provided. (CVE-2012-2821)

  - An out-of-bounds read error occurs during the handling of PDF files, which may allow multiple unspecified remote denial of service attacks. (CVE-2012-2822)

  - An user-after-free flaw exists during the handling of SVG resources, which may allow for execution of arbitrary code. (CVE-2012-2823, CVE-2012-2831)

  - An user-after-free flaw exists in SVG painting. No further details have been provided. (CVE-2012-2824)

  - An out-of-bounds read error occurs during texture conversion which may allow a remote denial of service. (CVE-2012-2826)

  - An use-after-free flaw in the Mac GUI. No further details have been provided. (CVE-2012-2827)

  - A flaw exists in improper sanitizing of user-supplied inputting resulting in multiple unspecified integer overflows with a specially crafted PDF file. (CVE-2012-2828)

  - An user-after-free flaw is triggered during handling of first letters. No further details have been provided. (CVE-2012-2829)

  - A flaw is triggered when an unspecified NULL pointer dereference occurs in array setting handling. (CVE-2012-2830)

  - A flaw is triggered when a NULL pointer dereference occurs in a PDF image codec. (CVE-2012-2832)

  - An overflow condition occurs when the PDF JS API fails to properly sanitize user-supplied input resulting in a buffer overflow. (CVE-2012-2833)

  - An overflow condition occurs in the Matroska container which fails to properly sanitize user-supplied input resulting in an integer overflow. (CVE-2012-2834)

  - A flaw exists in the way it loads dynamic-link-libraries (DLL). (CVE-2012-2764)

  - A flaw is triggered when an unspecified wild read occurs during the handling of XSL. (CVE-2012-2825)

  - This issue is only present on 64-bit Linux platforms. The libxml is prone to multiple unspecified overflow conditions. (CVE-2012-2807)

The version of Google Chrome installed on the remote host is earlier than 20.0.1132.43 and is, therefore, affected by the following vulnerabilities :

  - An error exists related to the loading of the 'metro'     DLL. (CVE-2012-2764)

  - An error exists related to the leaking of iframe     fragment id. (CVE-2012-2815)

  - An error exists that allows sandboxes to interfere with     each other. (CVE-2012-2816)

  - Multiple use-after-free errors exist related to table     section handling, counter layout, SVG resource handling,     SVG painting, first-letter handling and SVG reference     handling. (CVE-2012-2817, CVE-2012-2818, CVE-2012-2823,     CVE-2012-2824, CVE-2012-2829, CVE-2012-2831)

  - An error exists related to texture handling that can     cause application crashes. (CVE-2012-2819)

  - Out-of-bounds read errors exist related to SVG     filter handling and texture conversion. (CVE-2012-2820,     CVE-2012-2826)

  - An unspecified error exists related to autofill display     actions. (CVE-2012-2821)

  - Several 'OOB' read issues exist related to PDF     processing. (CVE-2012-2822)

  - A read error exists related to XSL handling.
    (CVE-2012-2825)

  - Several integer overflow issues exist related to PDF     processing. (CVE-2012-2828)

  - A pointer issue exists related to the setting of array     values. (CVE-2012-2830)

  - An uninitialized pointer issue exists related to the     PDF image codec. (CVE-2012-2832)

  - A buffer overflow error exists related to the PDF     JavaScript API. (CVE-2012-2833)

  - An integer overflow error exists related to the     'Matroska' container. (CVE-2012-2834)

ID	Name	Product	Family	Severity
74660	openSUSE Security Update : chromium / v8 (openSUSE-SU-2012:0813-1)	Nessus	SuSE Local Security Checks	high
800967	Google Chrome < 20.0.1132.43 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
59735	Google Chrome < 20.0.1132.43 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2012-2816

high

Tenable Plugins

high

high

high