PT-2013-2721 · Gnome+1 · Pango+1

Publicado 2013-04-10 · Atualizado 2013-04-11 · CVE-2013-0927

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Google Chrome OS versions prior to 26.0.1410.57

Description The issue allows attackers to bypass intended access restrictions via crafted configuration data in the .pangorc file or the file referenced by the PANGO RC FILE environment variable. This is due to the Pango pango-utils.c read config implementation loading the contents of these files.

Recommendations For Google Chrome OS versions prior to 26.0.1410.57, update to version 26.0.1410.57 or later to resolve the issue. As a temporary workaround, consider restricting access to the .pangorc file and the file referenced by the PANGO RC FILE environment variable to minimize the risk of exploitation.

Correção

Link Following

Enumeração de Fraquezas

CWE-59

Identificadores relacionados

CVE-2013-0927

Produtos afetados

Google Chrome

Pango

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2013-0927 · Nota de Segurança
• http://googlechromereleases.blogspot.com/2013/04/chrome-os-stable-channel-update.html · Nota
• https://code.google.com/p/chromium/issues/detail?id=189250 · Nota
• http://git.chromium.org/gitweb/?p=chromiumos/overlays/chromiumos-overlay.git%3Ba=commit%3Bh=fb5a664def6cd34bf7295489ea73e1d989bdd6d0 · Nota