-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
                         AUSCERT Security Bulletin

                               ASB-2012.0073
     A number of vulnerabilities have been identified in Google Chrome
                                16 May 2012

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              Google Chrome
Operating System:     UNIX variants (UNIX, Linux, OSX)
                      Windows
Impact/Access:        Execute Arbitrary Code/Commands -- Remote with User Interaction
                      Denial of Service               -- Remote with User Interaction
                      Provide Misleading Information  -- Remote with User Interaction
                      Unauthorised Access             -- Remote with User Interaction
Resolution:           Patch/Upgrade
CVE Names:            CVE-2011-3102 CVE-2011-3101 CVE-2011-3100
                      CVE-2011-3099 CVE-2011-3098 CVE-2011-3097
                      CVE-2011-3096 CVE-2011-3095 CVE-2011-3094
                      CVE-2011-3093 CVE-2011-3092 CVE-2011-3091
                      CVE-2011-3090 CVE-2011-3089 CVE-2011-3088
                      CVE-2011-3087 CVE-2011-3086 CVE-2011-3085
                      CVE-2011-3084 CVE-2011-3083 
Member content until: Friday, June 15 2012

OVERVIEW

        A number of vulnerabilities have been identified in Google Chrome prior
        to Chrome 19. [1]


IMPACT

        Google has provided the following information:
        
        "[112983] Low CVE-2011-3083: Browser crash with video + FTP. Credit to
        Aki Helin of OUSPG.
        [113496] Low CVE-2011-3084: Load links from internal pages in their own
        process. Credit to Brett Wilson of the Chromium development community.
        [118374] Medium CVE-2011-3085: UI corruption with long autofilled
        values. Credit to psaldorn.
        [$1000] [118642] High CVE-2011-3086: Use-after-free with style element.
        Credit to Arthur Gerkis.
        [118664] Low CVE-2011-3087: Incorrect window navigation. Credit to
        Charlie Reis of the Chromium development community.
        [$500] [120648] Medium CVE-2011-3088: Out-of-bounds read in hairline
        drawing. Credit to Aki Helin of OUSPG.
        [$1000] [120711] High CVE-2011-3089: Use-after-free in table handling.
        Credit to miaubiz.
        [$500] [121223] Medium CVE-2011-3090: Race condition with workers.
        Credit to Arthur Gerkis.
        [121734] High CVE-2011-3091: Use-after-free with indexed DB. Credit to
        Google Chrome Security Team (Inferno).
        [$1000] [122337] High CVE-2011-3092: Invalid write in v8 regex. Credit
        to Christian Holler.
        [$500] [122585] Medium CVE-2011-3093: Out-of-bounds read in glyph
        handling. Credit to miaubiz.
        [122586] Medium CVE-2011-3094: Out-of-bounds read in Tibetan handling.
        Credit to miaubiz.
        [$1000] [123481] High CVE-2011-3095: Out-of-bounds write in OGG
        container. Credit to Hannu Heikkinen.
        [Linux only] [123530] Low CVE-2011-3096: Use-after-free in GTK omnibox
        handling. Credit to Arthur Gerkis.
        [123733] [124182] High CVE-2011-3097: Out-of-bounds write in sampled
        functions with PDF. Credit to Kostya Serebryany of Google and Evgeniy
        Stepanov of Google.
        [Windows only] [124216] Low CVE-2011-3098: Bad search path for Windows
        Media Player plug-in. Credit to Haifei Li of Microsoft and MSVR
        (MSVR:159).
        [124479] High CVE-2011-3099: Use-after-free in PDF with corrupt font
        encoding name. Credit to Mateusz Jurczyk of Google Security Team and
        Gynvael Coldwind of Google Security Team.
        [124652] Medium CVE-2011-3100: Out-of-bounds read drawing dash paths.
        Credit to Google Chrome Security Team (Inferno).
        [Linux only] [$500] [118970] Medium CVE-2011-3101: Work around Linux
        Nvidia driver bug. Credit to Aki Helin of OUSPG.
        [$1500] [125462] High CVE-2011-3102: Off-by-one out-of-bounds write in
        libxml. Credit to Jri Aedla." [1]


MITIGATION

        Users should upgrade to Chrome 19. [1]


REFERENCES

        [1] Stable Channel Update
            http://googlechromereleases.blogspot.com.au/search/label/Stable%20updates

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours 
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBT7NGPO4yVqjM2NGpAQJmpQ//Z6Lz6nis4bS1tuw/dcwtXG9HEeojWJBP
n4IZLjqLjQq+/CQG5J9pdcl6PUjJWtha8aZ5GWvJTTxTU6cE1J9irZF6HYu8/8HK
9hUH/MQQeeD+XB54lz7VCw9qPneULpg0pYLDfnsCFEOy6dQafC635UbHFCxe+/G8
xcM5Zrp04oy+pLFFRgVxEzLIheqDhqRGKdmGrZWulRBvO+MFBVyxOU+FoyW5+K7P
xIP5r99FDkd1LXfLODDjUeGKodXhn3TAithTJuNNeOWmm0wOqipJae0VSjTKUn1u
eEUfv6NLcud7XpPJ6eVhhd56UdOtuL2ZVgQgNtGQjQKWPuzc/hi1veVdWw6iEfZe
UWiXSPvKpzsyNJ4BijlWKFlyaZvWNIZxbBjKQREPY4yfBzPD/61lPD5mTXAfUpBi
oQ4rN8z0PfHeJgYDkvntBmJ1szIpLRO994Rvp2aKAUnZ6up4C9bxu/3hqEZd8w5E
81wydyp6mZFdK3uJ1rV8T2prUrhYqA67seeCilNOcrYCDzTHZyu9qXZyjCy73zJi
5GuJFVuWmsCwk5MurL74l7f1XvjH6PlTiTEluII5QwpgQtwCdwiUFnzbxmumcmFV
cVjlnKKfZbIP6vnPYLqRbfJoeNsZ1dve+ZdE0WDHOrkXYWcuiUQAmYG6lEEg0x7o
zs2kcvVyS40=
=O8rr
-----END PGP SIGNATURE-----