Integer overflow in Google Chrome before 23.0.1271.64 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted WebP image.

The remote host is affected by the vulnerability described in GLSA-201312-08 (WebP: User-assisted execution of arbitrary code)

    An integer overflow flaw has been found in WebP.
  Impact :

    A remote attacker could entice a user to open a specially crafted image       in an application linked against WebP, possibly resulting in execution of       arbitrary code with the privileges of the process or a Denial of Service       condition.
  Workaround :

    There is no known workaround at this time.

The remote host is affected by the vulnerability described in GLSA-201309-16 (Chromium, V8: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and V8. Please       review the CVE identifiers and release notes referenced below for       details.
  Impact :

    A context-dependent attacker could entice a user to open a specially       crafted website or JavaScript program using Chromium or V8, possibly       resulting in the execution of arbitrary code with the privileges of the       process or a Denial of Service condition. Furthermore, a remote attacker       may be able to bypass security restrictions or have other, unspecified,       impact.
  Workaround :

    There is no known workaround at this time.

Security libwebp release, where an integer overflow allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted WebP image.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Versions of Google Chrome earlier than 23.0.1271.64 are potentially affected by the following vulnerabilities :

  - Use-after-free errors exist related to SVG filter handling, video layout, extension tab handling and plug-in placeholder handling. (CVE-2012-5116, CVE-2012-5121, CVE-2012-5125, CVE-2012-5126)

  - An error exists related to inappropriate SVG subresource loading in the 'img' context. (CVE-2012-5117)

  - A race condition exists related to 'Pepper' buffer handling. (CVE-2012-5119)

  - A bad cast error exists related to input handling. (CVE-2012-5122)

  - Out-of-bounds reads exist related to Skia. (CVE-2012-5123)

  - A memory corruption error exists related to texture handling. (CVE-2012-5124)

  - An integer overflow error exists related to 'WebP' handling. This error can lead to out-of-bounds reads. (CVE-2012-5127)

  - An improper write error exists related to the 'v8' JavaScript engine. (CVE-2012-5128)

Successful exploitation of any of these issues could lead to an application crash or even allow arbitrary code execution, subject to the user's privileges.

The version of Google Chrome installed on the remote host is earlier than 23.0.1271.64 and is, therefore, affected by the following vulnerabilities :

  - Use-after-free errors exist related to SVG filter     handling, video layout, extension tab handling and     plug-in placeholder handling. (CVE-2012-5116,     CVE-2012-5121, CVE-2012-5125, CVE-2012-5126)

  - An error exists related to inappropriate SVG     subresource loading in the 'img' context.
    (CVE-2012-5117)

  - A race condition exists related to 'Pepper' buffer     handling. (CVE-2012-5119)

  - A bad cast error exists related to input handling.
    (CVE-2012-5122)

  - Out-of-bounds reads exist related to Skia.
    (CVE-2012-5123)

  - A memory corruption error exists related to texture     handling. (CVE-2012-5124)

  - An integer overflow error exists related to 'WebP'     handling. This error can lead to out-of-bounds reads.
    (CVE-2012-5127)

  - An improper write error exists related to the 'v8'     JavaScript engine. (CVE-2012-5128)

Successful exploitation of any of these issues could lead to an application crash or even allow arbitrary code execution, subject to the user's privileges.

Google Chrome Releases reports :

[157079] Medium CVE-2012-5127: Integer overflow leading to out-of-bounds read in WebP handling. Credit to Phil Turnbull.

[Linux 64-bit only] [150729] Medium CVE-2012-5120: Out-of-bounds array access in v8. Credit to Atte Kettunen of OUSPG.

[143761] High CVE-2012-5116: Use-after-free in SVG filter handling.
Credit to miaubiz.

[Mac OS only] [149717] High CVE-2012-5118: Integer bounds check issue in GPU command buffers. Credit to miaubiz.

[154055] High CVE-2012-5121: Use-after-free in video layout. Credit to Atte Kettunen of OUSPG.

[145915] Low CVE-2012-5117: Inappropriate load of SVG subresource in img context. Credit to Felix Grobert of the Google Security Team.

[149759] Medium CVE-2012-5119: Race condition in Pepper buffer handling. Credit to Fermin Serna of the Google Security Team.

[154465] Medium CVE-2012-5122: Bad cast in input handling. Credit to Google Chrome Security Team (Inferno).

[154590] [156826] Medium CVE-2012-5123: Out-of-bounds reads in Skia.
Credit to Google Chrome Security Team (Inferno).

[155323] High CVE-2012-5124: Memory corruption in texture handling.
Credit to Al Patrick of the Chromium development community.

[156051] Medium CVE-2012-5125: Use-after-free in extension tab handling. Credit to Alexander Potapenko of the Chromium development community.

[156366] Medium CVE-2012-5126: Use-after-free in plug-in placeholder handling. Credit to Google Chrome Security Team (Inferno).

[157124] High CVE-2012-5128: Bad write in v8. Credit to Google Chrome Security Team (Cris Neckar).

ID	Name	Product	Family	Severity
71286	GLSA-201312-08 : WebP: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	high
70112	GLSA-201309-16 : Chromium, V8: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
64450	Fedora 16 : OpenImageIO-1.0.11-2.fc16 / gdal-1.7.3-15.fc16 / libwebp-0.2.1-1.fc16 (2013-1494)	Nessus	Fedora Local Security Checks	high
64449	Fedora 18 : OpenImageIO-1.0.11-2.fc18 / gdal-1.9.1-14.fc18.1 / leptonica-1.69-5.fc18 / etc (2013-1490)	Nessus	Fedora Local Security Checks	high
64448	Fedora 17 : OpenImageIO-1.0.11-2.fc17 / gdal-1.9.1-14.fc17.1 / leptonica-1.69-5.fc17 / etc (2013-1473)	Nessus	Fedora Local Security Checks	high
800919	Google Chrome < 23.0.1271.64 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
62861	Google Chrome < 23.0.1271.64 Multiple Vulnerabilities	Nessus	Windows	high
62856	FreeBSD : chromium -- multiple vulnerabilities (209c068d-28be-11e2-9160-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2012-5127

high

Tenable Plugins

high

critical

high

high

high

high

high

high