Mesa, as used in Google Chrome before 21.0.1183.0 on the Acer AC700, Cr-48, and Samsung Series 5 and 5 550 Chromebook platforms, and the Samsung Chromebox Series 3, allows remote attackers to execute arbitrary code via unspecified vectors that trigger an "array overflow."

Mesa was updated to fix a buffer overrun in glsl shaders :

  -     U_glsl-linker-Avoid-buffer-over-run-in-parcel_out_unif.p     atch 

  - Avoid buffer over-run in     parcel_out_uniform_storage::visit_field When too may     uniforms are used, the error will be caught in     check_resources (src/glsl/linker.cpp). (CVE-2012-2864,     bnc#777461)

The remote host is affected by the vulnerability described in GLSA-201404-06 (Mesa: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mesa. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute       arbitrary code with the privileges of the process, or cause a Denial of       Service condition.
  Workaround :

    There is no known workaround at this time.

Updated mesa packages fix security vulnerability :

The glsl shaders are vulnerable to a buffer overrun in parcel_out_uniform_storage::visit_field. When too many uniforms are used, the error will now be caught in check_resources (src/glsl/linker.cpp) (CVE-2012-2864).

Additionally, Mesa has been updated to 8.0.4, fixing several bugs.

It was discovered that Mesa incorrectly handled certain arrays. An attacker could use this issue to cause Mesa to crash, resulting in a denial of service, or possibly execute arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
74744	openSUSE Security Update : Mesa (openSUSE-SU-2012:1120-1)	Nessus	SuSE Local Security Checks	critical
73406	GLSA-201404-06 : Mesa: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
66115	Mandriva Linux Security Advisory : mesa (MDVSA-2013:103)	Nessus	Mandriva Local Security Checks	critical
62817	Ubuntu 12.04 LTS : mesa vulnerability (USN-1623-1)	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2012-2864

critical

Tenable Plugins

critical

critical

critical

critical