ID

VAR-201301-0067

CVE

CVE-2012-5155

TITLE

Mac OS X Run on Google Chrome Vulnerable to access restrictions

DESCRIPTION

Google Chrome before 24.0.1312.52 on Mac OS X does not use an appropriate sandboxing approach for worker processes, which makes it easier for remote attackers to bypass intended access restrictions via unspecified vectors. Google Chrome is prone to multiple vulnerabilities. Attackers can exploit these issues to execute arbitrary code in the context of the browser, bypass security restrictions, or cause denial-of-service conditions; other attacks may also be possible. Versions prior to Chrome 24.0.1312.52 are vulnerable. This BID is being retired. The following individual records exist to better document the issues: 59438 Google Chrome Extension Process CVE-2013-0831 Unspecified Security Vulnerability 59436 Google Chrome CVE-2013-0836 Denial of Service Vulnerability 59435 Google Chrome CVE-2013-0837 Denial of Service Vulnerability 59437 Google Chrome CVE-2013-0835 Geolocation Implementation Denial of Service Vulnerability 59431 Google Chrome CVE-2013-0829 Security Bypass Vulnerability 59433 Google Chrome CVE-2013-0838 Unspecified Security Vulnerability 59430 Google Chrome CVE-2013-0828 Denial of Service Vulnerability 59428 Google Chrome CVE-2013-0832 Use-After-Free Remote Code Execution Vulnerability 59421 Google Chrome CVE-2012-5155 Security Bypass Vulnerability 59426 Google Chrome CVE-2012-5157 Denial of Service Vulnerability 59427 Google Chrome CVE-2013-0833 Denial of Service Vulnerability 59429 Google Chrome CVE-2013-0834 Denial of Service Vulnerability 59425 Google Chrome CVE-2012-5153 Out of Bounds Denial of Service Vulnerability 59424 Google Chrome CVE-2012-5156 Use-After-Free Remote Code Execution Vulnerability 59423 Google Chrome CVE-2013-0830 Unspecified Security Vulnerability 59422 Google Chrome CVE-2012-5154 Integer Overflow Vulnerability 59420 Google Chrome CVE-2012-5152 Denial of Service Vulnerability 59414 Google Chrome CVE-2012-5146 Same Origin Policy Security Bypass Vulnerability 59413 Google Chrome CVE-2012-5148 Unspecified Security Vulnerability 59418 Google Chrome CVE-2012-5147 Use-After-Free Remote Code Execution Vulnerability 59416 Google Chrome CVE-2012-5145 Use-After-Free Remote Code Execution Vulnerability 59419 Google Chrome CVE-2012-5151 Integer Overflow Vulnerability 59415 Google Chrome CVE-2012-5149 Integer Overflow Vulnerability 59417 Google Chrome CVE-2012-5150 Use-After-Free Remote Code Execution Vulnerability. Note: This issue was previously covered in BID 57251 (Google Chrome Prior to 24.0.1312.52 Multiple Security Vulnerabilities) but has been given its own record for better documentation. ---------------------------------------------------------------------- The final version of the CSI 6.0 has been released. Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/ ---------------------------------------------------------------------- TITLE: Google Chrome Multiple Vulnerabilities SECUNIA ADVISORY ID: SA51825 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/51825/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=51825 RELEASE DATE: 2013-01-11 DISCUSS ADVISORY: http://secunia.com/advisories/51825/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/51825/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=51825 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: Multiple vulnerabilities have been reported in Google Chrome, where some have an unknown impact and others can be exploited by malicious people to bypass certain security restrictions and compromise a user's system. 1) A buffer overflow vulnerability exists in the bundled version of Adobe Flash Player. For more information: SA51771 2) A use-after-free error exists when handling SVG layouts. 3) An error when handling URLs can be exploited to bypass the same origin policy. 4) A use-after-free error exists when handling certain DOM objects. 5) An unspecified error exists when handling certain filenames. 6) An integer overflow error exists when handling audio IPC. 7) A use-after-free error exists when seeking video. 8) An integer overflow error exists when handling JavaScript in PDF files. 9) An out-of-bounds read error exists when seeking video. 10) An out-of-bounds stack access error exists in v8. 11) An integer overflow error exists in shared memory allocation. NOTE: This vulnerability affects Windows only. 12) An unspecified error can be exploited to bypass the sandbox for worker processes. NOTE: This security issue affects Mac only. 13) A use-after-free error exists when handling certain fields in PDF files. 14) Some out-of-bounds read errors exist when handling images in PDF files. 15) A bad cast error exists in PDF root handling. 16) An unspecified error can be exploited to corrupt database metadata and access certain files. 17) A use-after-free error exists when printing. 18) An out-of-bounds read error exists when printing. 19) An out-of-bounds read error exists when handling glyph. 20) An unspecified error exists within v8 garbage collection. 21) An unspecified error exists within extension tab handling. SOLUTION: Upgrade to version 24.0.1312.52. PROVIDED AND/OR DISCOVERED BY: The vendor credits: 2) Atte Kettunen, OUSPG 3) Erling A Ellingsen and Subodh Iyengar, Facebook 4) Jose A. Vazquez 5) Justin Schuh, Google Chrome Security Team 6, 11) Chris Evans, Google Chrome Security Team 7, 9) Inferno, Google Chrome Security Team 8, 13, 14, 15) Mateusz Jurczyk and Gynvael Coldwind, Google Security Team 10) Andreas Rossberg, Chromium development community 12) Julien Tinnes, Google Chrome Security Team 16) Juri Aedla, Google Chrome Security Team 17, 18, 19, 20) Cris Neckar, Google Chrome Security Team 21) Tom Nielsen ORIGINAL ADVISORY: http://googlechromereleases.blogspot.com/2013/01/stable-channel-update.html OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

network

TYPE

permissions and access control

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Atte Kettunen of OUSPG, Jos?? A. V??zquez, Justin Schuh, Chris Evans, Google Chrome Security Team (Inferno), Julien Tinnes, Mateusz Jurczyk, Gynvael Coldwind, Andreas Rossberg of the Chromium development community, Erling A Ellingsen and Subodh Iyenger of

SOURCES

LAST UPDATE DATE

2025-04-11T21:15:36.956000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE