Race condition in Google Chrome before 21.0.1180.89 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving improper interaction between worker processes and an XMLHttpRequest (aka XHR) object.

Chromium was updated to 21.0.1180.88 to fix various bugs and security issues. Security fixes and rewards :

Please see the Chromium security page<http://sites.google.com/a/chromium.org/dev/Home/chromium-security >for more detail. Note that the referenced bugs may be kept private until a majority of our users are up to date with the fix.

  - [$500]     [121347<https://code.google.com/p/chromium/issues/detail     ?id=121347>] Medium CVE-2012-2865: Out-of-bounds read in     line breaking. Credit to miaubiz.

  - [$1000]     [134897<https://code.google.com/p/chromium/issues/detail     ?id=134897>] High CVE-2012-2866: Bad cast with run-ins.
    Credit to miaubiz.

  - [135485     <https://code.google.com/p/chromium/issues/detail?id=135     485>] Low CVE-2012-2867: Browser crash with SPDY.

  - [$500]     [136881<https://code.google.com/p/chromium/issues/detail     ?id=136881>] Medium CVE-2012-2868: Race condition with     workers and XHR. Credit to miaubiz.

  - [137778     <https://code.google.com/p/chromium/issues/detail?id=137     778>] High CVE-2012-2869: Avoid stale buffer in URL     loading. Credit to Fermin Serna of the Google Security     Team.

  - [138672     <https://code.google.com/p/chromium/issues/detail?id=138     672>] [ 140368     <https://code.google.com/p/chromium/issues/detail?id=140     368>] LowCVE-2012-2870: Lower severity memory management     issues in XPath. Credit to Nicolas Gregoire.

  - [$1000]     [138673<https://code.google.com/p/chromium/issues/detail     ?id=138673>] High CVE-2012-2871: Bad cast in XSL     transforms. Credit to Nicolas Gregoire.

  - [$500]     [142956<https://code.google.com/p/chromium/issues/detail     ?id=142956>] Medium CVE-2012-2872: XSS in SSL     interstitial. Credit to Emmanuel Bronshtein.

The remote host is affected by the vulnerability described in GLSA-201210-07 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium. Please review       the CVE identifiers and release notes referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted web       site using Chromium, possibly resulting in the execution of arbitrary       code with the privileges of the process, arbitrary file write, a Denial       of Service condition, Cross-Site Scripting in SSL interstitial and       various Universal Cross-Site Scripting attacks.
  Workaround :

    There is no known workaround at this time.

Versions of Google Chrome earlier than 21.0.1180.89 are potentially affected by the following vulnerabilities :

  - An out-of-bounds read error exists related to line-breaking. (CVE-2012-2865)

  - Variable casting errors exist related to 'run-ins' and XSL transformations. (CVE-2012-2866, CVE-2012-2871)

  - An unspecified error exists related to the SPDY protocol that can result in application crashes. (CVE-2012-2867)

  - A unspecified race condition exists related to 'workers' and XHR. (CVE-2012-2868)

  - An unspecified error exists related to stale buffers and URL loading. (CVE-2012-2869)

  - Memory management issues exist related to XPath processing. (CVE-2012-2870)

  - Cross-site scripting is possible during the SSL interstitial process. (CVE-2012-2872)

Successful exploitation of any of these issue could lead to an application crash or even allow arbitrary code execution, subject to the user's privileges.

The version of Google Chrome installed on the remote host is earlier than 21.0.1180.89 and is, therefore, affected by the following vulnerabilities :

  - An out-of-bounds read error exists related to     line-breaking. (CVE-2012-2865)

  - Variable casting errors exist related to 'run-ins' and     XSL transformations. (CVE-2012-2866, CVE-2012-2871)

  - An unspecified error exists related to the SPDY     protocol that can result in application crashes.
    (CVE-2012-2867)

  - A unspecified race condition exists related to     'workers' and XHR. (CVE-2012-2868)

  - An unspecified error exists related to stale buffers     and URL loading. (CVE-2012-2869)

  - Memory management issues exist related to XPath     processing. (CVE-2012-2870)

  - Cross-site scripting is possible during the SSL     interstitial process. (CVE-2012-2872)

Successful exploitation of any of these issues could lead to an application crash or arbitrary code execution, subject to the user's privileges.

Google Chrome Releases reports :

[121347] Medium CVE-2012-2865: Out-of-bounds read in line breaking.
Credit to miaubiz.

[134897] High CVE-2012-2866: Bad cast with run-ins. Credit to miaubiz.

[135485] Low CVE-2012-2867: Browser crash with SPDY.

[136881] Medium CVE-2012-2868: Race condition with workers and XHR.
Credit to miaubiz.

[137778] High CVE-2012-2869: Avoid stale buffer in URL loading. Credit to Fermin Serna of the Google Security Team.

[138672] [140368] Low CVE-2012-2870: Lower severity memory management issues in XPath. Credit to Nicolas Gregoire.

[138673] High CVE-2012-2871: Bad cast in XSL transforms. Credit to Nicolas Gregoire.

[142956] Medium CVE-2012-2872: XSS in SSL interstitial. Credit to Emmanuel Bronshtein.

ID	Name	Product	Family	Severity
74759	openSUSE Security Update : chromium (openSUSE-SU-2012:1215-1)	Nessus	SuSE Local Security Checks	high
62652	GLSA-201210-07 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
800953	Google Chrome < 21.0.1180.89 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
61774	Google Chrome < 21.0.1180.89 Multiple Vulnerabilities	Nessus	Windows	high
61744	FreeBSD : chromium -- multiple vulnerabilities (ee68923d-f2f5-11e1-8014-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2012-2868

high

Tenable Plugins

high

critical

high

high

high