FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2011-3046

This CVE name corresponds to:

Entered	Topic
2012-03-09	chromium -- cross-site scripting vulnerability

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2011-3046 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2011-3046
Phase	Assigned(20110809)

Description

The extension subsystem in Google Chrome before 17.0.963.78 does not properly handle history navigation, which allows remote attackers to execute arbitrary code by leveraging a "Universal XSS (UXSS)" issue.

References

Source	Reference
MISC	http://www.zdnet.com/blog/security/cansecwest-pwnium-google-chrome-hacked-with-sandbox-bypass/10563
CONFIRM	http://code.google.com/p/chromium/issues/detail?id=117226
CONFIRM	http://code.google.com/p/chromium/issues/detail?id=117230
CONFIRM	http://googlechromereleases.blogspot.com/2012/03/chrome-stable-channel-update.html
CONFIRM	https://plus.google.com/u/0/116651741222993143554/posts/5Eq5d9XgFqs
CONFIRM	http://support.apple.com/kb/HT5282
APPLE	APPLE-SA-2012-05-07-1
APPLE	APPLE-SA-2012-05-09-2
GENTOO	GLSA-201203-19
OVAL	oval:org.mitre.oval:def:14686
SECUNIA	47292
SECUNIA	48527
SECUNIA	48419