Weekly Vulnerabilities Reports > October 18 to 24, 2010

Overview

5 new vulnerabilities reported during this period, including 3 critical vulnerabilities and 2 high severity vulnerabilities. This weekly summary report vulnerabilities in 3 products from 3 vendors including Google, Opensuse, and Debian. Vulnerabilities are notably categorized as "Improper Input Validation", and "Improper Resource Shutdown or Release".

  • 4 reported vulnerabilities are remotely exploitables.
  • 4 reported vulnerabilities are exploitable by an anonymous user.
  • Google has the most reported vulnerabilities, with 5 reported vulnerabilities.
  • Google has the most reported critical vulnerabilities, with 3 reported vulnerabilities.

TOTAL
VULNERABILITIES
CRITICAL RISK
VULNERABILITIES
HIGH RISK
VULNERABILITIES
MEDIUM RISK
VULNERABILITIES
LOW RISK
VULNERABILITIES
REMOTELY
EXPLOITABLE
LOCALLY
EXPLOITABLE
EXPLOIT
AVAILABLE
EXPLOITABLE
ANONYMOUSLY
AFFECTING
WEB APPLICATION

Vulnerability Details

The following table list reported vulnerabilities for the period covered by this report:

Expand/Hide

3 Critical Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2010-10-21 CVE-2010-4042 Google
Opensuse 		Improper Input Validation vulnerability in multiple products

Google Chrome before 7.0.517.41 does not properly handle element maps, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to "stale elements."
9.8
2010-10-21 CVE-2010-4041 Google Unspecified vulnerability in Google Chrome

The sandbox implementation in Google Chrome before 7.0.517.41 on Linux does not properly constrain worker processes, which might allow remote attackers to bypass intended access restrictions via unspecified vectors.
9.8
2010-10-21 CVE-2010-4039 Google Unspecified vulnerability in Google Chrome

Google Chrome before 7.0.517.41 on Linux does not properly set the PATH environment variable, which has unspecified impact and attack vectors.
9.8

2 High Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2010-10-21 CVE-2010-4040 Google
Debian
Opensuse 		Improper Input Validation vulnerability in multiple products

Google Chrome before 7.0.517.41 does not properly handle animated GIF images, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted image.
7.8
2010-10-21 CVE-2010-4038 Google Improper Resource Shutdown or Release vulnerability in Google Chrome

The Web Sockets implementation in Google Chrome before 7.0.517.41 does not properly handle a shutdown action, which allows remote attackers to cause a denial of service (application crash) via unspecified vectors.
7.5

0 Medium Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS

0 Low Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS