Google Chrome: Multiple vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
                         AUSCERT Security Bulletin

                               ASB-2012.0153
     A number of vulnerabilities have been identified in Google Chrome
                              7 November 2012

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              Google Chrome
Operating System:     Windows
                      Mac OS X
                      Linux variants
Impact/Access:        Access Privileged Data          -- Remote with User Interaction
                      Denial of Service               -- Remote with User Interaction
                      Execute Arbitrary Code/Commands -- Remote with User Interaction
                      Reduced Security                -- Unknown/Unspecified         
Resolution:           Patch/Upgrade
CVE Names:            CVE-2012-5128 CVE-2012-5127 CVE-2012-5126
                      CVE-2012-5125 CVE-2012-5124 CVE-2012-5123
                      CVE-2012-5122 CVE-2012-5121 CVE-2012-5120
                      CVE-2012-5119 CVE-2012-5118 CVE-2012-5117
                      CVE-2012-5116 CVE-2012-5115 
Member content until: Friday, December  7 2012

OVERVIEW

        A number of vulnerabilities have been identified in Google Chrome
        prior to version 23.0.1271.64.


IMPACT

        The vendor has provided the following details regarding these
        vulnerabilities:
        
        "[Mac OS only] [$1000] [149904] High CVE-2012-5115: Defend against wild
        writes in buggy graphics drivers. Credit to miaubiz.
        
        [$3500] [157079] Medium CVE-2012-5127: Integer overflow leading to
        out-of-bounds read in WebP handling. Credit to Phil Turnbull.
        
        [Linux 64-bit only] [$1500] [150729] Medium CVE-2012-5120: Out-of-bounds
        array access in v8. Credit to Atte Kettunen of OUSPG.
        
        [$1000] [143761] High CVE-2012-5116: Use-after-free in SVG filter
        handling. Credit to miaubiz.
        
        [Mac OS only] [$1000] [149717] High CVE-2012-5118: Integer bounds check
        issue in GPU command buffers. Credit to miaubiz.
        
        [$1000] [154055] High CVE-2012-5121: Use-after-free in video layout.
        Credit to Atte Kettunen of OUSPG.
        
        [145915] Low CVE-2012-5117: Inappropriate load of SVG subresource in img
        context. Credit to Felix Gröbert of the Google Security Team.
        
        [149759] Medium CVE-2012-5119: Race condition in Pepper buffer handling.
        Credit to Fermin Serna of the Google Security Team.
        
        [154465] Medium CVE-2012-5122: Bad cast in input handling. Credit to
        Google Chrome Security Team (Inferno).
        
        [154590] [156826] Medium CVE-2012-5123: Out-of-bounds reads in Skia.
        Credit to Google Chrome Security Team (Inferno).
        
        [155323] High CVE-2012-5124: Memory corruption in texture handling.
        Credit to Al Patrick of the Chromium development community.
        
        [156051] Medium CVE-2012-5125: Use-after-free in extension tab handling.
        Credit to Alexander Potapenko of the Chromium development community.
        
        [156366] Medium CVE-2012-5126: Use-after-free in plug-in placeholder
        handling. Credit to Google Chrome Security Team (Inferno).
        
        [157124] High CVE-2012-5128: Bad write in v8. Credit to Google Chrome
        Security Team (Cris Neckar)." [1]


MITIGATION

        The vendor recommends updating Chrome to the latest version to correct
        these issues.


REFERENCES

        [1] Stable Channel Release and Beta Channel Update
            http://googlechromereleases.blogspot.com.au/2012/11/stable-channel-release-and-beta-channel.html

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours 
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBUJnhdO4yVqjM2NGpAQJS+A/+LYsiVvr3+6u/5suui9sk620AkdbZgoUE
V3IRCmq3Wc1BOcBnI+VL3CvceWPv61lyd7WaCRqsgRMUUix77I31Rbo0fztOnPhu
G5Vn9Rz3DKQAWmwwUbDvqy1ULHrKEGUwhDbmllIsN+UOpULZKqqDz4Dqwdv6pXw0
U1/kXd/uEYsM/OO1MHIdngS+0PmEGmTrI1BK9Alzmy1w2tz+DluU4j0z8JpMDMBE
9Ifll464BPxhWrmTyXl9Mwv78fgRXN7WZuczvyalk3qYL7cRg5NHxQrpbF0s1c4a
ILtzL0cr775TKbCcFxvAJ9OO8oT09CJXnqAZvgV9znZDtLCO0YB2RID1yXEGmpnY
zhYubWwr91L9mp8UUUAhEKOMX90Up1YFWOhVv2mL/YZJT7TsOvgV6jb8qOChP8vP
tq6Pw6Yie6Muo30Vc98ulp1UWNvZRHGbCVR6cRyoJTVe9aiSZbLysc71ZJtFaPqc
BCjB1dc+NGu6Xs+SW9mySw1Vrd0a65ZvrHzQyfjTbXqPgRmgBhUqamyhL04Rfpye
JRXM6P7rJ+T+JNpqJ8N9k+eF9AzPMGxBIy8Ob0cVM70OSbRGGjcEY7Qz7cHud3AD
9jvoqSPMjlnkD83fOhQeecgAul/vIJf/jz+RIOVj54g5zdVOl88GzH29u6OkvRHc
3mFXKg9ROKA=
=g2xL
-----END PGP SIGNATURE-----