PT-2009-6149 · Google+1 · Google Chrome+1

James Robinson · Publicado 2009-11-12 · Atualizado 2017-08-17 · CVE-2009-3933

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions WebKit versions before r50173 Google Chrome versions before 3.0.195.32

Description The issue allows remote attackers to cause a denial of service, resulting in CPU consumption, by calling the JavaScript setInterval method on a web page. This triggers an incompatibility between the WTF::currentTime and base::Time functions.

Recommendations For WebKit versions before r50173, update to version r50173 or later. For Google Chrome versions before 3.0.195.32, update to version 3.0.195.32 or later.

Correção

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2009-3933

Produtos afetados

Google Chrome

Webkit

Referências · 13

• http://googlechromereleases.blogspot.com/2009/11/stable-channel-update.html · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54297 · Nota
• http://trac.webkit.org/changeset/50173 · Nota
• http://code.google.com/p/chromium/issues/detail?id=25892 · Nota
• http://src.chromium.org/viewvc/chrome?view=rev&revision=30311 · Nota
• http://src.chromium.org/viewvc/chrome/branches/195/src/webkit/webkit.gyp?r1=30311&r2=30310 · Nota
• http://codereview.chromium.org/339039 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2009-3933 · Nota de Segurança
• http://secunia.com/advisories/43068 · Nota
• http://osvdb.org/59745 · Nota
• https://bugs.webkit.org/show_bug.cgi?id=30833 · Nota
• http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html · Aviso do Fabricante
• http://vupen.com/english/advisories/2011/0212 · Nota