PT-2011-4124 · Google+1 · Google Chrome+2

Published 2011-08-22 · Updated 2020-05-19 · CVE-2011-2825

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 13.0.782.215 Apple Safari (affected versions not specified) Apple iTunes (affected versions not specified)

Description The issue involves a use-after-free vulnerability that can be exploited by remote attackers to cause a denial of service or possibly have other unspecified impacts. This is achieved through vectors involving custom fonts. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited.

Recommendations For Google Chrome versions prior to 13.0.782.215, update to version 13.0.782.215 or later. For Apple Safari, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Apple iTunes, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2011-2825

ZDI-12-054

Affected Products

Google Chrome

Safari

Itunes

References · 18

• 🔥 http://code.google.com/p/chromium/issues/detail?id=88670 · Exploit
• http://lists.apple.com/archives/security-announce/2012/Mar/msg00001.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2011-2825 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-12-054 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2011-2825 · Security Note
• http://lists.apple.com/archives/security-announce/2012/Mar/msg00003.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2011-2825 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2012/Mar/msg00000.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2011-2825 · Security Note
• http://googlechromereleases.blogspot.com/2011/08/stable-channel-update_22.html · Note
• http://secunia.com/advisories/48288 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14421 · Note
• https://chromereleases.googleblog.com/2011/08/stable-channel-update_22.html · Note
• http://secunia.com/advisories/48377 · Note
• http://secunia.com/advisories/48274 · Note