Multiple unspecified vulnerabilities in the PDF functionality in Google Chrome before 21.0.1180.57 on Mac OS X and Linux, and before 21.0.1180.60 on Windows and Chrome Frame, allow remote attackers to have an unknown impact via a crafted document.

Google Chrome Releases reports :

[Linux only] [125225] Medium CVE-2012-2846: Cross-process interference in renderers. Credit to Google Chrome Security Team (Julien Tinnes).

[127522] Low CVE-2012-2847: Missing re-prompt to user upon excessive downloads. Credit to Matt Austin of Aspect Security.

[127525] Medium CVE-2012-2848: Overly broad file access granted after drag+drop. Credit to Matt Austin of Aspect Security.

[128163] Low CVE-2012-2849: Off-by-one read in GIF decoder. Credit to Atte Kettunen of OUSPG.

[130251] [130592] [130611] [131068] [131237] [131252] [131621] [131690] [132860] Medium CVE-2012-2850: Various lower severity issues in the PDF viewer. Credit to Mateusz Jurczyk of Google Security Team, with contributions by Gynvael Coldwind of Google Security Team.

[132585] [132694] [132861] High CVE-2012-2851: Integer overflows in PDF viewer. Credit to Mateusz Jurczyk of Google Security Team, with contributions by Gynvael Coldwind of Google Security Team.

[134028] High CVE-2012-2852: Use-after-free with bad object linkage in PDF. Credit to Alexey Samsonov of Google.

[134101] Medium CVE-2012-2853: webRequest can interfere with the Chrome Web Store. Credit to Trev of Adblock.

[134519] Low CVE-2012-2854: Leak of pointer values to WebUI renderers.
Credit to Nasko Oskov of the Chromium development community.

[134888] High CVE-2012-2855: Use-after-free in PDF viewer. Credit to Mateusz Jurczyk of Google Security Team, with contributions by Gynvael Coldwind of Google Security Team.

[134954] [135264] High CVE-2012-2856: Out-of-bounds writes in PDF viewer. Credit to Mateusz Jurczyk of Google Security Team, with contributions by Gynvael Coldwind of Google Security Team.

[136235] High CVE-2012-2857: Use-after-free in CSS DOM. Credit to Arthur Gerkis.

[136894] High CVE-2012-2858: Buffer overflow in WebP decoder. Credit to Juri Aedla.

[Linux only] [137541] Critical CVE-2012-2859: Crash in tab handling.
Credit to Jeff Roberts of Google Security Team.

[137671] Medium CVE-2012-2860: Out-of-bounds access when clicking in date picker. Credit to Chamal de Silva.

Versions of Google Chrome earlier than 21.0.1180.60 are potentially affected by the following vulnerabilities :

  - Re-prompts are not displayed for excessive downloads. (CVE-2012-2847)

  - Drag and drop file access restrictions are not restrictive enough. (CVE-2012-2848)

  - An off-by-one read error exists related to GIF decoding. (CVE-2012-2849)

  - Various, unspecified errors exist related to PDF processing. (CVE-2012-2850)

  - Various, unspecified integer overflows exist related to PDF processing. (CVE-2012-2851)

  - A use-after-free error exists related to object linkage and PDF processing. (CVE-2012-2852)

  - An error exists related to 'webRequest' and 'Chrome Web Store' interference. (CVE-2012-2853)

  - Pointer values can be leaked to 'WebUI' renderers. (CVE-2012-2854)

  - An unspecified use-after-free error exists related to PDF processing. (CVE-2012-2855)

  - Unspecified out-of-bounds reads exist related to the PDF viewer. (CVE-2012-2856)  - A use-after-free error exists related to CSS DOM processing. (CVE-2012-2857)  - A buffer overflow exists related to 'WebP' decoding. (CVE-2012-2858)

  - An out-of-bounds access error exists related to the date picker. (CVE-2012-2860)

The version of Google Chrome installed on the remote host is earlier than 21.0.1180.60 and is, therefore, affected by the following vulnerabilities :

  - Re-prompts are not displayed for excessive     downloads. (CVE-2012-2847)

  - Drag and drop file access restrictions are not     restrictive enough. (CVE-2012-2848)

  - An off-by-one read error exists related to GIF     decoding. (CVE-2012-2849)

  - Various, unspecified errors exist related to PDF     processing. (CVE-2012-2850)

  - Various, unspecified integer overflows exist related     to PDF processing. (CVE-2012-2851)

  - A use-after-free error exists related to object linkage     and PDF processing. (CVE-2012-2852)

  - An error exists related to 'webRequest' and 'Chrome Web     Store' interference. (CVE-2012-2853)

  - Pointer values can be leaked to 'WebUI' renderers.
    (CVE-2012-2854)

  - An unspecified use-after-free error exists related to     PDF processing. (CVE-2012-2855)

  - Unspecified out-of-bounds reads exist related to the     PDF viewer. (CVE-2012-2856)

  - A use-after-free error exists related to CSS DOM     processing. (CVE-2012-2857)

  - A buffer overflow exists related to 'WebP' decoding.
    (CVE-2012-2858)

  - An out-of-bounds access error exists related to the     date picker. (CVE-2012-2860)

ID	Name	Product	Family	Severity
61505	FreeBSD : chromium -- multiple vulnerabilities (ce84e136-e2f6-11e1-a8ca-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	high
800901	Google Chrome < 21.0.1180.60 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
61381	Google Chrome < 21.0.1180.60 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2012-2850

high

Tenable Plugins

high

high

high