Bug 445246 (CVE-2012-5137)

Summary:	<www-client/chromium-23.0.1271.95 Use-after-free in media source handling + Incorrect file path handling (CVE-2012-{5137,5138})
Product:	Gentoo Security	Reporter:	Mike Gilbert <floppym>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	major	CC:	chromium
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	http://googlechromereleases.blogspot.com/2012/11/stable-channel-update_29.html
Whiteboard:	A2 [glsa]
Package list:		Runtime testing required:	---

Description Mike Gilbert gentoo-dev

2012-11-29 20:11:41 UTC

Release notes in URL.

Comment 1 Mike Gilbert gentoo-dev

2012-11-30 00:34:37 UTC

Please stabilize.

=www-client/chromium-23.0.1271.95

Comment 2 Agostino Sarubbo gentoo-dev

2012-11-30 11:34:12 UTC

amd64 stable

Comment 3 Agostino Sarubbo gentoo-dev

2012-11-30 11:36:04 UTC

x86 stable

Comment 4 Sean Amoss (RETIRED) gentoo-dev

2012-12-01 14:09:22 UTC

Added to existing GLSA draft.

Comment 5 GLSAMaker/CVETool Bot gentoo-dev

2012-12-04 22:06:52 UTC

CVE-2012-5138 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-5138):
  Google Chrome before 23.0.1271.95 does not properly handle file paths, which
  has unspecified impact and attack vectors.

CVE-2012-5137 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-5137):
  Use-after-free vulnerability in Google Chrome before 23.0.1271.95 allows
  remote attackers to cause a denial of service or possibly have unspecified
  other impact via vectors related to the Media Source API.

Comment 6 GLSAMaker/CVETool Bot gentoo-dev

2013-09-25 00:10:30 UTC

This issue was resolved and addressed in
 GLSA 201309-16 at http://security.gentoo.org/glsa/glsa-201309-16.xml
by GLSA coordinator Sean Amoss (ackle).