[Winvulns-announcements] BES Auto Notification: New Fixlets Published in Fixlet Site: 'Vulnerabilities to Windows Systems'

Wed Jun 6 05:20:08 PDT 2012

Fixlet Site - 'Vulnerabilities to Windows Systems'
Current Version: 304	Published: Tue, 05 Jun 2012 18:30:22  GMT

New Fixlets:
============

***************************************************************
Title: Vulnerability in the PDF functionality in Google Chrome before 19.0.1084.52 via vectors that trigger out-of-bounds write operations
Severity: High
Fixlet ID: 1466601
Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval14666.html
Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3110
Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo

Fixlet Description: The PDF functionality in Google Chrome before 19.0.1084.52 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger out-of-bounds write operations.

***************************************************************
Title: Use-after-free vulnerability in Google Chrome before 19.0.1084.52 via vectors related to the browser cache
Severity: High
Fixlet ID: 1494701
Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval14947.html
Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3108
Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo

Fixlet Description: Use-after-free vulnerability in Google Chrome before 19.0.1084.52 allows remote attackers to execute arbitrary code via vectors related to the browser cache.

***************************************************************
Title: Use-after-free vulnerability in the PDF functionality in Google Chrome before 19.0.1084.52 via an invalid encrypted document
Severity: Medium
Fixlet ID: 1507601
Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval15076.html
Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3112
Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo

Fixlet Description: Use-after-free vulnerability in the PDF functionality in Google Chrome before 19.0.1084.52 allows remote attackers to cause a denial of service or possibly have unspecified other impact via an invalid encrypted document.

***************************************************************
Title: Google V8, as used in Google Chrome before 19.0.1084.52, does not properly perform garbage collection
Severity: High
Fixlet ID: 1509501
Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval15095.html
Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3103
Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo

Fixlet Description: Google V8, as used in Google Chrome before 19.0.1084.52, does not properly perform garbage collection, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted JavaScript code.

***************************************************************
Title: Google Chrome before 19.0.1084.52 does not properly implement JavaScript bindings for plug-ins
Severity: High
Fixlet ID: 1540901
Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval15409.html
Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3107
Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo

Fixlet Description: Google Chrome before 19.0.1084.52 does not properly implement JavaScript bindings for plug-ins, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via unknown vectors.

***************************************************************
Title: Vulnerability in Google V8, as used in Google Chrome before 19.0.1084.52 via vectors that trigger "type corruption"
Severity: High
Fixlet ID: 1543301
Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval15433.html
Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3115
Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo

Fixlet Description: Google V8, as used in Google Chrome before 19.0.1084.52, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger "type corruption."

***************************************************************
Title: The WebSockets implementation in Google Chrome before 19.0.1084.52 does not properly handle use of SSL
Severity: High
Fixlet ID: 1547001
Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval15470.html
Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3106
Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo

Fixlet Description: The WebSockets implementation in Google Chrome before 19.0.1084.52 does not properly handle use of SSL, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.

***************************************************************
Title: Vulnerability in Skia, as used in Google Chrome before 19.0.1084.52
Severity: Medium
Fixlet ID: 1547101
Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval15471.html
Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3104
Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo

Fixlet Description: Skia, as used in Google Chrome before 19.0.1084.52, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.

***************************************************************
Title: Use-after-free vulnerability in the Cascading Style Sheets (CSS) implementation in Google Chrome before 19.0.1084.52 via vectors related to the :first-letter pseudo-element
Severity: High
Fixlet ID: 1553501
Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval15535.html
Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3105
Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo

Fixlet Description: Use-after-free vulnerability in the Cascading Style Sheets (CSS) implementation in Google Chrome before 19.0.1084.52 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the :first-letter pseudo-element.

***************************************************************
Title: Multiple buffer overflows in the PDF functionality in Google Chrome before 19.0.1084.52 via vectors that trigger unknown function calls
Severity: High
Fixlet ID: 1554501
Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval15545.html
Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3114
Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo

Fixlet Description: Multiple buffer overflows in the PDF functionality in Google Chrome before 19.0.1084.52 allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger unknown function calls.

***************************************************************
Title: Vulnerability in Google V8, as used in Google Chrome before 19.0.1084.52, via unspecified vectors.
Severity: Medium
Fixlet ID: 1554901
Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval15549.html
Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3111
Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo

Fixlet Description: Google V8, as used in Google Chrome before 19.0.1084.52, allows remote attackers to cause a denial of service (invalid read operation) via unspecified vectors.

***************************************************************
Title: The PDF functionality in Google Chrome before 19.0.1084.52 does not properly perform a cast of an unspecified variable during handling of color spaces
Severity: High
Fixlet ID: 1556601
Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval15566.html
Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3113
Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo

Fixlet Description: The PDF functionality in Google Chrome before 19.0.1084.52 does not properly perform a cast of an unspecified variable during handling of color spaces, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted document.