| Descripción: | Summary:
The remote host is missing an update to the system
as announced in the referenced advisory.
Vulnerability Insight:
The following package is affected: chromium
CVE-2011-3045
Integer signedness error in pngrutil.c in libpng before 1.4.10beta01,
as used in Google Chrome before 17.0.963.83 and other products, allows
remote attackers to cause a denial of service (application crash) or
possibly execute arbitrary code via a crafted PNG file, a different
vulnerability than CVE-2011-3026.
CVE-2011-3049
Google Chrome before 17.0.963.83 does not properly restrict the
extension web request API, which allows remote attackers to cause a
denial of service (disrupted system requests) via a crafted extension.
CVE-2011-3050
Use-after-free vulnerability in the Cascading Style Sheets (CSS)
implementation in Google Chrome before 17.0.963.83 allows remote
attackers to cause a denial of service or possibly have unspecified
other impact via vectors related to the :first-letter pseudo-element.
CVE-2011-3051
Use-after-free vulnerability in the Cascading Style Sheets (CSS)
implementation in Google Chrome before 17.0.963.83 allows remote
attackers to cause a denial of service or possibly have unspecified
other impact via vectors related to the cross-fade function.
CVE-2011-3052
The WebGL implementation in Google Chrome before 17.0.963.83 does not
properly handle CANVAS elements, which allows remote attackers to
cause a denial of service (memory corruption) or possibly have
unspecified other impact via unknown vectors.
CVE-2011-3053
Use-after-free vulnerability in Google Chrome before 17.0.963.83
allows remote attackers to cause a denial of service or possibly have
unspecified other impact via vectors related to block splitting.
CVE-2011-3054
The WebUI privilege implementation in Google Chrome before 17.0.963.83
does not properly perform isolation, which allows remote attackers to
bypass intended access restrictions via unspecified vectors.
CVE-2011-3055
The browser native UI in Google Chrome before 17.0.963.83 does not
require user confirmation before an unpacked extension installation,
which allows user-assisted remote attackers to have an unspecified
impact via a crafted extension.
CVE-2011-3056
Google Chrome before 17.0.963.83 allows remote attackers to bypass the
Same Origin Policy via vectors involving a 'magic iframe.'
CVE-2011-3057
Google V8, as used in Google Chrome before 17.0.963.83, allows remote
attackers to cause a denial of service via vectors that trigger an
invalid read operation.
This VT has been deprecated and is therefore no longer functional.
Solution:
Update your system with the appropriate patches or
software upgrades.
CVSS Score:
6.8
CVSS Vector:
AV:N/AC:M/Au:N/C:P/I:P/A:P
|
