Vulnerabilities > CVE-2011-3234 - Out-Of-Bounds Read vulnerability in Google Chrome
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
NONE Integrity impact
NONE Availability impact
PARTIAL Summary
Google Chrome before 14.0.835.163 does not properly handle boxes, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Overread Buffers An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.
Nessus
NASL family Windows NASL id SAFARI_5_1_1.NASL description The version of Safari installed on the remote Windows host is earlier than 5.1.1. Thus, it is potentially affected by numerous issues in the following components : - Safari - WebKit last seen 2020-06-01 modified 2020-06-02 plugin id 56483 published 2011-10-13 reporter This script is Copyright (C) 2011-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/56483 title Safari < 5.1.1 Multiple Vulnerabilities NASL family Peer-To-Peer File Sharing NASL id ITUNES_10_5_BANNER.NASL description The version of Apple iTunes on the remote host is prior to version 10.5. It is, therefore, affected by multiple vulnerabilities in the CoreAudio, CoreFoundation, CoreMedia, ColorSync, ImageIO, and WebKit components. Note that these only affect iTunes for Windows. last seen 2020-06-01 modified 2020-06-02 plugin id 56470 published 2011-10-12 reporter This script is Copyright (C) 2011-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/56470 title Apple iTunes < 10.5 Multiple Vulnerabilities (uncredentialed check) NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_6887828F022911E0B84D00262D5ED8EE.NASL description Google Chrome Releases reports : Fixed in 15.0.874.121 : [103259] High CVE-2011-3900: Out-of-bounds write in v8. Credit to Christian Holler. Fixed in 15.0.874.120 : [100465] High CVE-2011-3892: Double free in Theora decoder. Credit to Aki Helin of OUSPG. [100492] [100543] Medium CVE-2011-3893: Out of bounds reads in MKV and Vorbis media handlers. Credit to Aki Helin of OUSPG. [101172] High CVE-2011-3894: Memory corruption regression in VP8 decoding. Credit to Andrew Scherkus of the Chromium development community. [101458] High CVE-2011-3895: Heap overflow in Vorbis decoder. Credit to Aki Helin of OUSPG. [101624] High CVE-2011-3896: Buffer overflow in shader variable mapping. Credit to Ken last seen 2020-06-01 modified 2020-06-02 plugin id 51069 published 2010-12-08 reporter This script is Copyright (C) 2010-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/51069 title FreeBSD : chromium -- multiple vulnerabilities (6887828f-0229-11e0-b84d-00262d5ed8ee) NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-201111-01.NASL description The remote host is affected by the vulnerability described in GLSA-201111-01 (Chromium, V8: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Chromium and V8. Please review the CVE identifiers and release notes referenced below for details. Impact : A local attacker could gain root privileges (CVE-2011-1444, fixed in chromium-11.0.696.57). A context-dependent attacker could entice a user to open a specially crafted website or JavaScript program using Chromium or V8, possibly resulting in the execution of arbitrary code with the privileges of the process, or a Denial of Service condition. The attacker also could obtain cookies and other sensitive information, conduct man-in-the-middle attacks, perform address bar spoofing, bypass the same origin policy, perform Cross-Site Scripting attacks, or bypass pop-up blocks. Workaround : There is no known workaround at this time. last seen 2020-05-13 modified 2011-11-02 plugin id 56686 published 2011-11-02 reporter This script is Copyright (C) 2011-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/56686 title GLSA-201111-01 : Chromium, V8: Multiple vulnerabilities NASL family Windows NASL id ITUNES_10_5.NASL description The version of Apple iTunes installed on the remote Windows host is older than 10.5. Thus, it is reportedly affected by numerous issues in the following components : - CoreFoundation - ColorSync - CoreAudio - CoreMedia - ImageIO - WebKit last seen 2020-06-01 modified 2020-06-02 plugin id 56469 published 2011-10-12 reporter This script is Copyright (C) 2011-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/56469 title Apple iTunes < 10.5 Multiple Vulnerabilities (credentialed check) NASL family Windows NASL id GOOGLE_CHROME_14_0_835_163.NASL description The version of Google Chrome installed on the remote host is earlier than 14.0.835.163 and is affected by multiple vulnerabilities: - A race condition exists related to the certificate cache. (Issue #49377) - The Windows Media Player plugin allows click-free access to the system Flash. (Issue #51464) - MIME types are not treated authoritatively at plugin load time. (Issue #75070) - An unspecified error allows V8 script object wrappers to crash. (Issue #76771) - The included PDF functionality contains a garbage collection error. (Issue #78639) - Out-of-bounds read issues exist related to media buffers, mp3 files, box handling, Khmer characters, video handling, Tibetan characters, and triangle arrays. (Issues #82438, #85041, #89991, #90134, #90173, #95563, #95625) - An unspecified error allows data displayed in the URL to be spoofed. (Issue #83031) - Use-after-free errors exist related to unload event handling, the document loader, plugin handling, ruby, table style handling, and the focus controller. (Issues #89219, #89330, #91197, #92651, #94800, #93420, #93587) - The URL bar can be spoofed in an unspecified manner related to the forward button. (Issue #89564) - An NULL pointer error exists related to WebSockets. (Issue #89795) - An off-by-one error exists related to the V8 JavaScript engine. (Issue #91120) - A stale node error exists related to CSS stylesheet handling. (Issue #92959) - A cross-origin bypass error exists related to the V8 JavaScript engine. (Issue #93416) - A double-free error exists related to XPath handling in libxml. (Issue #93472) - Incorrect permissions are assigned to non-gallery pages. (Issue #93497) - An improper string read occurs in the included PDF functionality. (Issue #93596) - An unspecified error allows unintended access to objects built in to the V8 JavaScript engine. (Issue #93906) - Self-signed certificates are not pinned properly. (Issue #95917) - A variable-type confusion issue exists in the V8 JavaScript engine related to object sealing. (Issue #95920) last seen 2020-06-01 modified 2020-06-02 plugin id 56230 published 2011-09-19 reporter This script is Copyright (C) 2011-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/56230 title Google Chrome < 14.0.835.163 Multiple Vulnerabilities NASL family MacOS X Local Security Checks NASL id MACOSX_SAFARI5_1_1.NASL description The version of Apple Safari installed on the remote Mac OS X host is earlier than 5.1.1. Thus, it is potentially affected by numerous issues in the following components : - Safari - WebKit last seen 2020-06-01 modified 2020-06-02 plugin id 56482 published 2011-10-13 reporter This script is Copyright (C) 2011-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/56482 title Mac OS X : Apple Safari < 5.1.1
Oval
| accepted | 2014-04-07T04:00:58.063-04:00 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| class | vulnerability | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| contributors |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| definition_extensions |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| description | Google Chrome before 14.0.835.163 does not properly handle boxes, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| family | windows | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| id | oval:org.mitre.oval:def:14224 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| status | accepted | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| submitted | 2011-12-09T10:50:49.000-05:00 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| title | Google Chrome before 14.0.835.163 does not properly handle boxes, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| version | 52 |
Seebug
| bulletinFamily | exploit |
| description | CVE ID: CVE-2010-1823,CVE-2011-0164,CVE-2011-0200,CVE-2011-0204,CVE-2011-0215,CVE-2011-0218,CVE-2011-0221,CVE-2011-0222,CVE-2011-0223,CVE-2011-0225,CVE-2011-0232,CVE-2011-0233,CVE-2011-0234,CVE-2011-0235,CVE-2011-0237,CVE-2011-0238,CVE-2011-0240,CVE-2011-0253,CVE-2011-0254,CVE-2011-0255,CVE-2011-0259,CVE-2011-0981,CVE-2011-0983,CVE-2011-1109,CVE-2011-1114,CVE-2011-1115,CVE-2011-1117,CVE-2011-1121,CVE-2011-1188,CVE-2011-1203,CVE-2011-1204,CVE-2011-1288,CVE-2011-1293,CVE-2011-1296,CVE-2011-1440,CVE-2011-1449,CVE-2011-1451,CVE-2011-1453,CVE-2011-1457,CVE-2011-1462,CVE-2011-1774,CVE-2011-1797,CVE-2011-2338,CVE-2011-2339,CVE-2011-2341,CVE-2011-2351,CVE-2011-2352,CVE-2011-2354,CVE-2011-2356,CVE-2011-2359,CVE-2011-2788,CVE-2011-2790,CVE-2011-2792,CVE-2011-2797,CVE-2011-2799,CVE-2011-2809,CVE-2011-2811,CVE-2011-2813,CVE-2011-2814,CVE-2011-2815,CVE-2011-2816,CVE-2011-2817,CVE-2011-2818,CVE-2011-2820,CVE-2011-2823,CVE-2011-2827,CVE-2011-2831,CVE-2011-3219,CVE-2011-3232,CVE-2011-3233,CVE-2011-3234,CVE-2011-3235,CVE-2011-3236,CVE-2011-3237,CVE-2011-3238,CVE-2011-3239,CVE-2011-3241,CVE-2011-3244,CVE-2011-3252 iTunes是一款媒体播放器的应用程序，2001年1月10日由苹果电脑在旧金山的Macworld Expo推出，用来播放以及管理数字音乐和与视频文件，是管理苹果iPod的文件的主要工具。 Apple iTunes在实现上存在多个漏洞，可被恶意用户利用泄露敏感信息，操作某些数据、执行跨站脚本和欺骗攻击、绕过某些安全限制、控制用户系统。 1）在处理字符串标志化时，CoreFoundation组件中存在错误，通过中间人攻击破坏内存。 2）处理AAC流时CoreAudio组件中存在错误，可造成缓冲区溢出。 3）处理H.264编码文件时CoreMedia组件中存在错误，可造成缓冲区溢出。 4）使用AddressSanitizer时WebKit组件中存在错误，可造成内存破坏； 5）WebKit组件的多个错误可被利用破坏内存。 Apple iTunes 10.x 厂商补丁： Apple ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://support.apple.com/ |
| id | SSV:21013 |
| last seen | 2017-11-19 |
| modified | 2011-10-13 |
| published | 2011-10-13 |
| reporter | Root |
| title | Apple iTunes多个安全漏洞 |
References
- http://code.google.com/p/chromium/issues/detail?id=89991
- http://googlechromereleases.blogspot.com/2011/09/stable-channel-update_16.html
- http://lists.apple.com/archives/Security-announce/2011//Oct/msg00000.html
- http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html
- http://lists.apple.com/archives/Security-announce/2011//Oct/msg00004.html
- http://osvdb.org/75550
- http://support.apple.com/kb/HT4981
- http://support.apple.com/kb/HT4999
- http://support.apple.com/kb/HT5000
- https://exchange.xforce.ibmcloud.com/vulnerabilities/69876
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14224