Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 370481

Summary: <www-client/chromium-12.0.742.91-r1: multiple vulnerabilities (CVE-2011-{1808,1809,1810,1811,1812,1813,1814,1815,1816,1817,1818,1819,2332,2342})
Product: Gentoo Security Reporter: Paweł Hajdan, Jr. (RETIRED) <phajdan.jr>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: RESOLVED FIXED    
Severity: normal CC: alexanderyt, chromium, graphics
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
URL: http://googlechromereleases.blogspot.com/2011/06/chrome-stable-release.html
Whiteboard: B2 [glsa]
Package list:
Runtime testing required: ---

Description Paweł Hajdan, Jr. (RETIRED) gentoo-dev 2011-06-07 16:20:42 UTC
Release notes: http://googlechromereleases.blogspot.com/2011/06/chrome-stable-release.html
Comment 1 Paweł Hajdan, Jr. (RETIRED) gentoo-dev 2011-06-07 16:25:24 UTC
Arches, please stabilize =www-client/chromium-12.0.742.91

I think you'll also need =media-libs/libwebp-1.2
Comment 2 Markos Chandras (RETIRED) gentoo-dev 2011-06-07 17:26:45 UTC
both done on amd64
Comment 3 Markos Chandras (RETIRED) gentoo-dev 2011-06-07 17:28:19 UTC
Sorry, reverted keywords because of this

www-client/chromium/chromium-12.0.742.91.ebuild: amd64(default/linux/amd64/10
.0) ['>=virtual/ffmpeg-0.6.90[threads]', 'dev-python/pyftpdlib'
Comment 4 Ian Delaney (RETIRED) gentoo-dev 2011-06-07 22:36:48 UTC
amd64:


To emerge, required following deps:

>=media-libs/vo-aacenc-0.1.0
=dev-lang/erlang-14.2.2-r1
>=media-video/ffmpeg-0.6.90_rc0-r2
>=virtual/ffmpeg-0.6.90
dev-python/pyftpdlib
>=media-libs/libwebp-0.1.2

emerged straight up.  all working
Comment 5 Paweł Hajdan, Jr. (RETIRED) gentoo-dev 2011-06-17 15:49:07 UTC
Because of bug #371931 we're now back to bundled ffmpeg.

Arches, please stabilize =www-client/chromium-12.0.742.91-r1

I think you also need to stabilize:

=dev-python/pyftpdlib-0.6.0 (I'm the maintainer, OK to stabilize)
=media-libs/libwebp-1.2
Comment 6 Agostino Sarubbo gentoo-dev 2011-06-17 16:43:03 UTC
ON AMD64:

=www-client/chromium-12.0.742.91-r1  OK
=media-libs/libwebp-1.2  OK
=dev-python/pyftpdlib-0.6.0 Is not pulled in, check if it should pulled in and correct the deps if is necessary, otherwise probably open a new bug?
Anyway is ok for me.
Comment 7 Paweł Hajdan, Jr. (RETIRED) gentoo-dev 2011-06-17 16:50:00 UTC
(In reply to comment #6)
> =dev-python/pyftpdlib-0.6.0 Is not pulled in, check if it should pulled in and
> correct the deps if is necessary, otherwise probably open a new bug?

Are you sure you're running with FEATURES="test"? Thanks for testing.
Comment 8 Agostino Sarubbo gentoo-dev 2011-06-17 18:08:03 UTC
I skip it because requires a different locales, I see is pulled in now.
Comment 9 Thomas Kahle (RETIRED) gentoo-dev 2011-06-17 18:19:01 UTC
x86 stable. Thanks for the xtra work Pawel
Comment 10 Markos Chandras (RETIRED) gentoo-dev 2011-06-18 07:48:28 UTC
amd64 done. Thanks Agostino
Comment 11 Tim Sammut (RETIRED) gentoo-dev 2011-06-18 18:21:11 UTC
Thanks, folks. Added to existing GLSA request.
Comment 12 GLSAMaker/CVETool Bot gentoo-dev 2011-11-01 10:02:28 UTC
This issue was resolved and addressed in
 GLSA 201111-01 at http://security.gentoo.org/glsa/glsa-201111-01.xml
by GLSA coordinator Alex Legler (a3li).
Comment 13 GLSAMaker/CVETool Bot gentoo-dev 2011-11-01 10:03:37 UTC
This issue was resolved and addressed in
 GLSA 201111-01 at http://security.gentoo.org/glsa/glsa-201111-01.xml
by GLSA coordinator Alex Legler (a3li).
Comment 14 GLSAMaker/CVETool Bot gentoo-dev 2012-09-11 00:35:36 UTC
CVE-2011-2342 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2342):
  The DOM implementation in Google Chrome before 12.0.742.91 allows remote
  attackers to bypass the Same Origin Policy via unspecified vectors.

CVE-2011-2332 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2332):
  Google V8, as used in Google Chrome before 12.0.742.91, allows remote
  attackers to bypass the Same Origin Policy via unspecified vectors.

CVE-2011-1819 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1819):
  Google Chrome before 12.0.742.91 allows remote attackers to perform
  unspecified injection into a chrome:// page via vectors related to
  extensions.

CVE-2011-1818 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1818):
  Use-after-free vulnerability in the image loader in Google Chrome before
  12.0.742.91 allows remote attackers to cause a denial of service or possibly
  have unspecified other impact via unknown vectors.

CVE-2011-1817 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1817):
  Google Chrome before 12.0.742.91 does not properly implement history
  deletion, which allows remote attackers to cause a denial of service (memory
  corruption) or possibly have unspecified other impact via unknown vectors.

CVE-2011-1816 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1816):
  Use-after-free vulnerability in the developer tools in Google Chrome before
  12.0.742.91 allows remote attackers to cause a denial of service or possibly
  have unspecified other impact via unknown vectors.

CVE-2011-1815 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1815):
  Google Chrome before 12.0.742.91 allows remote attackers to inject script
  into a tab page via vectors related to extensions.

CVE-2011-1814 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1814):
  Google Chrome before 12.0.742.91 attempts to read data from an uninitialized
  pointer, which allows remote attackers to cause a denial of service or
  possibly have unspecified other impact via unknown vectors.

CVE-2011-1813 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1813):
  Google Chrome before 12.0.742.91 does not properly implement the framework
  for extensions, which allows remote attackers to cause a denial of service
  or possibly have unspecified other impact via unknown vectors that lead to a
  "stale pointer."

CVE-2011-1812 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1812):
  Google Chrome before 12.0.742.91 allows remote attackers to bypass intended
  access restrictions via vectors related to extensions.

CVE-2011-1811 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1811):
  Google Chrome before 12.0.742.91 does not properly handle a large number of
  form submissions, which allows remote attackers to cause a denial of service
  (application crash) via unspecified vectors.

CVE-2011-1810 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1810):
  The Cascading Style Sheets (CSS) implementation in Google Chrome before
  12.0.742.91 does not properly restrict access to the visit history, which
  allows remote attackers to obtain sensitive information via unspecified
  vectors.

CVE-2011-1809 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1809):
  Use-after-free vulnerability in the accessibility feature in Google Chrome
  before 12.0.742.91 allows remote attackers to cause a denial of service or
  possibly have unspecified other impact via unknown vectors.

CVE-2011-1808 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1808):
  Use-after-free vulnerability in Google Chrome before 12.0.742.91 allows
  remote attackers to cause a denial of service or possibly have unspecified
  other impact via vectors related to incorrect integer calculations during
  float handling.