Google Chrome before 23.0.1271.91 does not properly perform a cast of an unspecified variable during handling of the INPUT element, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted HTML document.

Chromium was updated to 25.0.1343

  - Security Fixes (bnc#791234 and bnc#792154) :

  - CVE-2012-5131: Corrupt rendering in the Apple OSX driver     for Intel GPUs

  - CVE-2012-5133: Use-after-free in SVG filters.

  - CVE-2012-5130: Out-of-bounds read in Skia

  - CVE-2012-5132: Browser crash with chunked encoding

  - CVE-2012-5134: Buffer underflow in libxml.

  - CVE-2012-5135: Use-after-free with printing.

  - CVE-2012-5136: Bad cast in input element handling.

  - CVE-2012-5138: Incorrect file path handling

  - CVE-2012-5137: Use-after-free in media source handling

  - Correct build so that proprietary codecs can be used     when the chromium-ffmpeg package is installed

  - Update to 25.0.1335

  - (gtk) Fixed <input> selection renders white text on     white background in apps. (Issue: 158422)

  - Fixed translate infobar button to show selected     language. (Issue: 155350)

  - Fixed broken Arabic language. (Issue: 158978)

  - Fixed pre-rendering if the preference is disabled at     start up. (Issue: 159393)

  - Fixed JavaScript rendering issue. (Issue: 159655)

  - No further indications in the ChangeLog

  - Updated V8 - 3.14.5.0

  - Bookmarks are now searched by their title while typing     into the omnibox with matching bookmarks being shown in     the autocomplete suggestions pop-down list. Matching is     done by prefix.

  - Fixed chromium issues 155871, 154173, 155133.

  - Removed patch chomium-ffmpeg-no-pkgconfig.patch

  - Building now internal libffmpegsumo.so based on the     standard chromium ffmpeg codecs

  - Add a configuration file (/etc/default/chromium) where     we can indicate flags for the chromium-browser.

  - add explicit buildrequire on libbz2-devel

The remote host is affected by the vulnerability described in GLSA-201309-16 (Chromium, V8: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and V8. Please       review the CVE identifiers and release notes referenced below for       details.
  Impact :

    A context-dependent attacker could entice a user to open a specially       crafted website or JavaScript program using Chromium or V8, possibly       resulting in the execution of arbitrary code with the privileges of the       process or a Denial of Service condition. Furthermore, a remote attacker       may be able to bypass security restrictions or have other, unspecified,       impact.
  Workaround :

    There is no known workaround at this time.

Versions of Google Chrome earlier than 23.0.1271.91 are potentially affected by the following vulnerabilities :

  - An out-of-bounds read error exists related to 'Skia'. (CVE-2012-5130)

  - An unspecified error exists related to chunked encoding that can result in application crashes. (CVE-2012-5132)

  - Use-after-free errors exist related to 'SVG' filters and printing. (CVE-2012-5133, CVE-2012-5135)

 - A buffer underflow error exists related to 'libxml'. (CVE-2012-5134)

  - A cast error exists related to input element handling. (CVE-2012-5136)
Successful exploitation of any of these issues could lead to an application crash or even allow arbitrary code execution, subject to the user's privileges.

Google Chrome Releases reports :

[156567] High CVE-2012-5133: Use-after-free in SVG filters. Credit to miaubiz.

[148638] Medium CVE-2012-5130: Out-of-bounds read in Skia. Credit to Atte Kettunen of OUSPG.

[155711] Low CVE-2012-5132: Browser crash with chunked encoding.
Credit to Attila Szasz.

[158249] High CVE-2012-5134: Buffer underflow in libxml. Credit to Google Chrome Security Team (Juri Aedla).

[159165] Medium CVE-2012-5135: Use-after-free with printing. Credit to Fermin Serna of Google Security Team.

[159829] Medium CVE-2012-5136: Bad cast in input element handling.
Credit to Google Chrome Security Team (Inferno).

The version of Google Chrome installed on the remote host is earlier than 23.0.1271.91 and is, therefore, affected by the following vulnerabilities :

  - An out-of-bounds read error exists related to 'Skia'.
    (CVE-2012-5130)

  - An unspecified error exists related to chunked encoding     that can result in application crashes. (CVE-2012-5132)

  - Use-after-free errors exist related to 'SVG' filters     and printing. (CVE-2012-5133, CVE-2012-5135)

  - A buffer underflow error exists related to 'libxml'.
    (CVE-2012-5134)

  - A cast error exists related to input element handling.
    (CVE-2012-5136)

Successful exploitation of any of these issues could lead to an application crash or even allow arbitrary code execution, subject to the user's privileges.

ID	Name	Product	Family	Severity
74839	openSUSE Security Update : Chromium (openSUSE-SU-2012:1637-1)	Nessus	SuSE Local Security Checks	critical
70112	GLSA-201309-16 : Chromium, V8: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
800964	Google Chrome < 23.0.1271.91 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
63069	FreeBSD : chromium -- multiple vulnerabilities (4d64fc61-3878-11e2-a4eb-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	high
63063	Google Chrome < 23.0.1271.91 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2012-5136

high

Tenable Plugins

critical

critical

high

high

high