Use-after-free vulnerability in Google Chrome before 23.0.1271.64 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to video layout.

The remote host is affected by the vulnerability described in GLSA-201309-16 (Chromium, V8: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and V8. Please       review the CVE identifiers and release notes referenced below for       details.
  Impact :

    A context-dependent attacker could entice a user to open a specially       crafted website or JavaScript program using Chromium or V8, possibly       resulting in the execution of arbitrary code with the privileges of the       process or a Denial of Service condition. Furthermore, a remote attacker       may be able to bypass security restrictions or have other, unspecified,       impact.
  Workaround :

    There is no known workaround at this time.

Versions of Google Chrome earlier than 23.0.1271.64 are potentially affected by the following vulnerabilities :

  - Use-after-free errors exist related to SVG filter handling, video layout, extension tab handling and plug-in placeholder handling. (CVE-2012-5116, CVE-2012-5121, CVE-2012-5125, CVE-2012-5126)

  - An error exists related to inappropriate SVG subresource loading in the 'img' context. (CVE-2012-5117)

  - A race condition exists related to 'Pepper' buffer handling. (CVE-2012-5119)

  - A bad cast error exists related to input handling. (CVE-2012-5122)

  - Out-of-bounds reads exist related to Skia. (CVE-2012-5123)

  - A memory corruption error exists related to texture handling. (CVE-2012-5124)

  - An integer overflow error exists related to 'WebP' handling. This error can lead to out-of-bounds reads. (CVE-2012-5127)

  - An improper write error exists related to the 'v8' JavaScript engine. (CVE-2012-5128)

Successful exploitation of any of these issues could lead to an application crash or even allow arbitrary code execution, subject to the user's privileges.

The version of Google Chrome installed on the remote host is earlier than 23.0.1271.64 and is, therefore, affected by the following vulnerabilities :

  - Use-after-free errors exist related to SVG filter     handling, video layout, extension tab handling and     plug-in placeholder handling. (CVE-2012-5116,     CVE-2012-5121, CVE-2012-5125, CVE-2012-5126)

  - An error exists related to inappropriate SVG     subresource loading in the 'img' context.
    (CVE-2012-5117)

  - A race condition exists related to 'Pepper' buffer     handling. (CVE-2012-5119)

  - A bad cast error exists related to input handling.
    (CVE-2012-5122)

  - Out-of-bounds reads exist related to Skia.
    (CVE-2012-5123)

  - A memory corruption error exists related to texture     handling. (CVE-2012-5124)

  - An integer overflow error exists related to 'WebP'     handling. This error can lead to out-of-bounds reads.
    (CVE-2012-5127)

  - An improper write error exists related to the 'v8'     JavaScript engine. (CVE-2012-5128)

Successful exploitation of any of these issues could lead to an application crash or even allow arbitrary code execution, subject to the user's privileges.

Google Chrome Releases reports :

[157079] Medium CVE-2012-5127: Integer overflow leading to out-of-bounds read in WebP handling. Credit to Phil Turnbull.

[Linux 64-bit only] [150729] Medium CVE-2012-5120: Out-of-bounds array access in v8. Credit to Atte Kettunen of OUSPG.

[143761] High CVE-2012-5116: Use-after-free in SVG filter handling.
Credit to miaubiz.

[Mac OS only] [149717] High CVE-2012-5118: Integer bounds check issue in GPU command buffers. Credit to miaubiz.

[154055] High CVE-2012-5121: Use-after-free in video layout. Credit to Atte Kettunen of OUSPG.

[145915] Low CVE-2012-5117: Inappropriate load of SVG subresource in img context. Credit to Felix Grobert of the Google Security Team.

[149759] Medium CVE-2012-5119: Race condition in Pepper buffer handling. Credit to Fermin Serna of the Google Security Team.

[154465] Medium CVE-2012-5122: Bad cast in input handling. Credit to Google Chrome Security Team (Inferno).

[154590] [156826] Medium CVE-2012-5123: Out-of-bounds reads in Skia.
Credit to Google Chrome Security Team (Inferno).

[155323] High CVE-2012-5124: Memory corruption in texture handling.
Credit to Al Patrick of the Chromium development community.

[156051] Medium CVE-2012-5125: Use-after-free in extension tab handling. Credit to Alexander Potapenko of the Chromium development community.

[156366] Medium CVE-2012-5126: Use-after-free in plug-in placeholder handling. Credit to Google Chrome Security Team (Inferno).

[157124] High CVE-2012-5128: Bad write in v8. Credit to Google Chrome Security Team (Cris Neckar).

ID	Name	Product	Family	Severity
70112	GLSA-201309-16 : Chromium, V8: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
800919	Google Chrome < 23.0.1271.64 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
62861	Google Chrome < 23.0.1271.64 Multiple Vulnerabilities	Nessus	Windows	high
62856	FreeBSD : chromium -- multiple vulnerabilities (209c068d-28be-11e2-9160-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2012-5121

critical

Tenable Plugins

critical

high

high

high