Use-after-free vulnerability in Google Chrome before 20.0.1132.57 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to layout height tracking.

Version upgrade of chromium to address multiple security vulnerabilities.

The remote Mac OS X host has Safari installed. 

Versions of Safari earlier than 6.0.1 are reportedly affected by several issues :

  - A logic error in Safari's handling of the Quarantine attribute caused the safe mode not to be triggered on Quarantined files, which could lead to the disclosure of local file contents. (CVE-2012-3713)

  - A rare condition in the handling of Form Autofill could lead to the disclosure of information from the Address Book 'Me' card that was not included in the Autofill popover. (CVE-2012-3714)

  - A logic issue in the handling of HTTPS URLs in the address bar when pasting text could result in the request being sent over HTTP. (CVE-2012-3715)

  - Numerous issues exist in WebKit. (CVE-2011-3105, CVE-2012-2817, CVE-2012-2818, CVE-2012-2829, CVE-2012-2831, CVE-2012-2842, CVE-2012-2843, CVE-2012-3598, CVE-2012-3601, CVE-2012-3602, CVE-2012-3606, CVE-2012-3607, CVE-2012-3612, CVE-2012-3613, CVE-2012-3614, CVE-2012-3616, CVE-2012-3617, CVE-2012-3621, CVE-2012-3622,CVE-2012-3623, CVE-2012-3624, CVE-2012-3632, CVE-2012-3643, CVE-2012-3647, CVE-2012-3648, CVE-2012-3649, CVE-2012-3651, CVE-2012-3652,CVE-2012-3654, CVE-2012-3657, CVE-2012-3658,CVE-2012-3659, CVE-2012-3660, CVE-2012-3671,CVE-2012-3672, CVE-2012-3673, CVE-2012-3675,CVE-2012-3676, CVE-2012-3677, CVE-2012-3684,CVE-2012-3685, CVE-2012-3687, CVE-2012-3688,CVE-2012-3692, CVE-2012-3699, CVE-2012-3700,CVE-2012-3701, CVE-2012-3702, CVE-2012-3703,CVE-2012-3704, CVE-2012-3705, CVE-2012-3706,CVE-2012-3707, CVE-2012-3708, CVE-2012-3709,CVE-2012-3710, CVE-2012-3711, CVE-2012-3712)

The remote host has Safari installed. Versions of Safari earlier than 6.0.1 are reportedly affected by several issues :

  - A logic error in Safari's handling of the Quarantine attribute caused the safe mode not to be triggered on Quarantined files, which could lead to the disclosure of local file contents. (CVE-2012-3713)
 - A rare condition in the handling of Form Autofill could lead to the disclosure of information from the Address Book 'Me' card that was not included in the Autofill popover. (CVE-2012-3714)
 - A logic issue in the handling of HTTPS URLs in the address bar when pasting text could result in the request being sent over HTTP. (CVE-2012-3715)
 - Numerous issues exist in WebKit. (CVE-2011-3105, CVE-2012-2817, CVE-2012-2818, CVE-2012-2829, CVE-2012-2831, CVE-2012-2842, CVE-2012-2843, CVE-2012-3598, CVE-2012-3601, CVE-2012-3602, CVE-2012-3606, CVE-2012-3607, CVE-2012-3612, CVE-2012-3613, CVE-2012-3614, CVE-2012-3616, CVE-2012-3617, CVE-2012-3621, CVE-2012-3622,CVE-2012-3623, CVE-2012-3624, CVE-2012-3632, CVE-2012-3643, CVE-2012-3647, CVE-2012-3648, CVE-2012-3649, CVE-2012-3651, CVE-2012-3652,CVE-2012-3654, CVE-2012-3657, CVE-2012-3658,CVE-2012-3659, CVE-2012-3660, CVE-2012-3671,CVE-2012-3672, CVE-2012-3673, CVE-2012-3675,CVE-2012-3676, CVE-2012-3677, CVE-2012-3684,CVE-2012-3685, CVE-2012-3687, CVE-2012-3688,CVE-2012-3692, CVE-2012-3699, CVE-2012-3700,CVE-2012-3701, CVE-2012-3702, CVE-2012-3703,CVE-2012-3704, CVE-2012-3705, CVE-2012-3706,CVE-2012-3707, CVE-2012-3708, CVE-2012-3709,CVE-2012-3710, CVE-2012-3711, CVE-2012-3712)

The version of Apple Safari installed on the remote Mac OS X host is earlier than 6.0.1.  It is, therefore, potentially affected by several issues :

  - A logic error in Safari's handling of the Quarantine     attribute caused the safe mode not to be triggered on     Quarantined files, which could lead to the disclosure     of local file contents. (CVE-2012-3713)

  - A rare condition in the handling of Form Autofill could     lead to the disclosure of information from the Address     Book 'Me' card that was not included in the Autofill     popover. (CVE-2012-3714)

  - A logic issue in the handling of HTTPS URLs in the     address bar when pasting text could result in the     request being sent over HTTP. (CVE-2012-3715)

  - Numerous issues exist in WebKit. (CVE-2011-3105 /     CVE-2012-2817 / CVE-2012-2818 / CVE-2012-2829 /     CVE-2012-2831 / CVE-2012-2842 / CVE-2012-2843 /     CVE-2012-3598 / CVE-2012-3601 / CVE-2012-3602 /     CVE-2012-3606 / CVE-2012-3607 / CVE-2012-3612 /     CVE-2012-3613 / CVE-2012-3614 / CVE-2012-3616 /     CVE-2012-3617 / CVE-2012-3621 / CVE-2012-3622 /     CVE-2012-3623 / CVE-2012-3624 / CVE-2012-3632 /     CVE-2012-3643 / CVE-2012-3647 / CVE-2012-3648 /     CVE-2012-3649 / CVE-2012-3651 / CVE-2012-3652 /     CVE-2012-3654 / CVE-2012-3657 / CVE-2012-3658 /     CVE-2012-3659 / CVE-2012-3660 / CVE-2012-3671 /     CVE-2012-3672 / CVE-2012-3673 / CVE-2012-3675 /     CVE-2012-3676 / CVE-2012-3677 / CVE-2012-3684 /     CVE-2012-3685 / CVE-2012-3687 / CVE-2012-3688 /     CVE-2012-3692 / CVE-2012-3699 / CVE-2012-3700 /     CVE-2012-3701 / CVE-2012-3702 / CVE-2012-3703 /     CVE-2012-3704 / CVE-2012-3705 / CVE-2012-3706 /     CVE-2012-3707 / CVE-2012-3708 / CVE-2012-3709 /     CVE-2012-3710 / CVE-2012-3711 / CVE-2012-3712)

The remote host has iTunes installed, a popular media player for Windows and Mac OS. 

Versions of iTunes earlier than 10.7 are reportedly affected by multiple memory corruption vulnerabilities in WebKit.

The version of Apple iTunes on the remote host is prior to version 10.7. It is, therefore, affected by multiple memory corruption vulnerabilities in the WebKit component.

The version of Apple iTunes installed on the remote Windows host is older than 10.7 and is, therefore, affected by multiple memory corruption vulnerabilities in WebKit.

The remote host is affected by the vulnerability described in GLSA-201208-03 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium. Please review       the CVE identifiers and release notes referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted web       site using Chromium, possibly resulting in the execution of arbitrary       code with the privileges of the process, a Denial of Service condition,       disclosure of sensitive information, or other unspecified impact.
  Workaround :

    There is no known workaround at this time.

Google Chrome Releases reports :

[129898] High CVE-2012-2842: Use-after-free in counter handling.
Credit to miaubiz.

[130595] High CVE-2012-2843: Use-after-free in layout height tracking.
Credit to miaubiz.

[133450] High CVE-2012-2844: Bad object access with JavaScript in PDF.
Credit to Alexey Samsonov of Google.

Versions of Google Chrome earlier than 20.0.1132.57 are potentially affected by the following vulnerabilities :

  - Use-after-free errors exist related to counter handling and layout height tracking. (CVE-2012-2842, CVE-2012-2843)

  - An error exists related to JavaScript object accesses in PDF handling. (CVE-2012-2844)

The version of Google Chrome installed on the remote host is earlier than 20.0.1132.57 and is, therefore, affected by the following vulnerabilities :

  - Use-after-free errors exist related to counter handling     and layout height tracking. (CVE-2012-2842,     CVE-2012-2843)

  - An error exists related to JavaScript object accesses     in PDF handling. (CVE-2012-2844)

ID	Name	Product	Family	Severity
74715	openSUSE Security Update : chromium / v8 (openSUSE-SU-2012:0993-1)	Nessus	SuSE Local Security Checks	high
800990	Mac OS X : Safari < 6.0.1 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
6582	Safari < 6.0.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
62216	Mac OS X : Apple Safari < 6.0.1 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
6575	iTunes < 10.7 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
62078	Apple iTunes < 10.7 Multiple Vulnerabilities (uncredentialed check)	Nessus	Peer-To-Peer File Sharing	critical
62077	Apple iTunes < 10.7 Multiple Vulnerabilities (credentialed check)	Nessus	Windows	critical
61542	GLSA-201208-03 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
61501	FreeBSD : www/chromium -- multiple vulnerabilities (2092a45b-e2f6-11e1-a8ca-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	high
800952	Google Chrome < 20.0.1132.57 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
59958	Google Chrome < 20.0.1132.57 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2012-2843

critical

Tenable Plugins

high

high

high

high

high

critical

critical

high

high

high

high