Use-after-free vulnerability in the UI in Google Chrome before 20.0.1132.43 on Mac OS X allows attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

Versions of Google Chrome earlier than 20.0.1132.43 are potentially affected by the following vulnerabilities :

  - An unspecified error allows access to iFrame fragment ID information, (CVE-2012-2815)

  - An unspecified issue is triggered when sandboxed processes interfere with one another. (CVE-2012-2816)

  - A user-after free issue exists in handling table sections which may allow for execution of arbitrary code. (CVE-2012-02817)

  - An unspecified use-after-free flaw exists in the counter layout which may allow for execution of arbitrary code. (CVE-2012-2818)

  -  A flaw exists in the WebGL subsystem when the texSubImage2d implementation does not properly handle uploads to floating-point textures, which may allow a remote denial of service. (CVE-2012-2919)

  - An out-of-bounds read error occurs during the handling of SVG filters, which may allow a remote denial of service. (CVE-2012-2820)

  - A flaw exists in the autofill display. No further details have been provided. (CVE-2012-2821)

  - An out-of-bounds read error occurs during the handling of PDF files, which may allow multiple unspecified remote denial of service attacks. (CVE-2012-2822)

  - An user-after-free flaw exists during the handling of SVG resources, which may allow for execution of arbitrary code. (CVE-2012-2823, CVE-2012-2831)

  - An user-after-free flaw exists in SVG painting. No further details have been provided. (CVE-2012-2824)

  - An out-of-bounds read error occurs during texture conversion which may allow a remote denial of service. (CVE-2012-2826)

  - An use-after-free flaw in the Mac GUI. No further details have been provided. (CVE-2012-2827)

  - A flaw exists in improper sanitizing of user-supplied inputting resulting in multiple unspecified integer overflows with a specially crafted PDF file. (CVE-2012-2828)

  - An user-after-free flaw is triggered during handling of first letters. No further details have been provided. (CVE-2012-2829)

  - A flaw is triggered when an unspecified NULL pointer dereference occurs in array setting handling. (CVE-2012-2830)

  - A flaw is triggered when a NULL pointer dereference occurs in a PDF image codec. (CVE-2012-2832)

  - An overflow condition occurs when the PDF JS API fails to properly sanitize user-supplied input resulting in a buffer overflow. (CVE-2012-2833)

  - An overflow condition occurs in the Matroska container which fails to properly sanitize user-supplied input resulting in an integer overflow. (CVE-2012-2834)

  - A flaw exists in the way it loads dynamic-link-libraries (DLL). (CVE-2012-2764)

  - A flaw is triggered when an unspecified wild read occurs during the handling of XSL. (CVE-2012-2825)

  - This issue is only present on 64-bit Linux platforms. The libxml is prone to multiple unspecified overflow conditions. (CVE-2012-2807)

Google Chrome Releases reports :

[118633] Low CVE-2012-2815: Leak of iframe fragment id. Credit to Elie Bursztein of Google.

[120222] High CVE-2012-2817: Use-after-free in table section handling.
Credit to miaubiz.

[120944] High CVE-2012-2818: Use-after-free in counter layout. Credit to miaubiz.

[120977] High CVE-2012-2819: Crash in texture handling. Credit to Ken 'gets' Russell of the Chromium development community.

[121926] Medium CVE-2012-2820: Out-of-bounds read in SVG filter handling. Credit to Atte Kettunen of OUSPG.

[122925] Medium CVE-2012-2821: Autofill display problem. Credit to 'simonbrown60'.

[various] Medium CVE-2012-2822: Misc. lower severity OOB read issues in PDF. Credit to awesome ASAN and various Googlers (Kostya Serebryany, Evgeniy Stepanov, Mateusz Jurczyk, Gynvael Coldwind).

[124356] High CVE-2012-2823: Use-after-free in SVG resource handling.
Credit to miaubiz.

[125374] High CVE-2012-2824: Use-after-free in SVG painting. Credit to miaubiz.

[128688] Medium CVE-2012-2826: Out-of-bounds read in texture conversion. Credit to Google Chrome Security Team (Inferno).

[Mac only] [129826] Low CVE-2012-2827: Use-after-free in Mac UI.
Credit to the Chromium development community (Dharani Govindan).

[129857] High CVE-2012-2828: Integer overflows in PDF. Credit to Mateusz Jurczyk of Google Security Team and Google Chrome Security Team (Chris Evans).

[129947] High CVE-2012-2829: Use-after-free in first-letter handling.
Credit to miaubiz.

[129951] High CVE-2012-2830: Wild pointer in array value setting.
Credit to miaubiz.

[130356] High CVE-2012-2831: Use-after-free in SVG reference handling.
Credit to miaubiz.

[131553] High CVE-2012-2832: Uninitialized pointer in PDF image codec.
Credit to Mateusz Jurczyk of Google Security Team.

[132156] High CVE-2012-2833: Buffer overflow in PDF JS API. Credit to Mateusz Jurczyk of Google Security Team.

[132779] High CVE-2012-2834: Integer overflow in Matroska container.
Credit to Juri Aedla.

ID	Name	Product	Family	Severity
800967	Google Chrome < 20.0.1132.43 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
59750	FreeBSD : chromium -- multiple vulnerabilities (ff922811-c096-11e1-b0f4-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2012-2827

high

Tenable Plugins

high

high