Google Security Advisories: April 2011 — Google Security Advisories | Vulnetix

Try Vulnetix Request Demo

Google Security Advisories · April 2011 — Google Security Advisories

31 advisories 31 CVEs 1 EXPLOITED

GCVE / Google Cloud / Chrome / Android / Project Zero / OSS for 2011-04. Mirrored into Vulnetix VDB.

Every advisory below is enriched with the Vulnetix VDB exploit-intelligence chip (hover a CVE ID in the interactive page to see CVSS, EPSS, KEV status, and PoC maturity). 1 is already weaponised in the wild.

Back to archive Open Console

What would you fix first?

The advisories below are ordered by the Vulnetix risk prioritization strategy: exploitation evidence first, scores second. On the interactive page you can switch to three other lenses.

Vulnetix priority default

Malware first, then the KEV catalogues, then weaponized and observed exploitation, and only then the scores.
Vendor rating

The vendor's own words, ranked in the vendor's own order.
CVSS score

The CVSS base score the vendor published, or the highest score in the Vulnetix VDB when the vendor published none.
EPSS likelihood

FIRST’s exploit prediction. Advisories that resolve to no CVE have no EPSS and sort last.

How Vulnetix ranks risk Get a free API key

Advisories

CVE-2011-0611

GoogleExploitedCISA KEV listedHIGH2011-04-12

Adobe Flash Player before 10.2.154.27 on Windows, Mac OS X, Linux, and Solaris and 10.2.156.12 and earlier on Android; Adobe AIR before 2.6.19140; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader 9.x before 9.4.4 and 10.x through 10.0.1 on Win...

CVEs:CVE-2011-0611

Affected products

Product	Status	Vendor	Package	Ecosystem
acrobat	affected	adobe	—	—
acrobat_reader	affected	adobe	—	—
adobe_air	affected	adobe	—	—
chrome	affected	google	—	—
flash_player	affected	adobe	—	—
linux_enterprise_desktop	affected	suse	—	—
opensuse	affected	opensuse	—	—

Upstream advisory

CVE-2011-1440

GooglePoC exploitCRITICAL2011-04-28

Use-after-free vulnerability in Google Chrome before 11.0.696.57 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the ruby element and Cascading Style Sheets (CSS) token sequences.

CVEs:CVE-2011-1440

Affected products

Product	Status	Vendor	Package	Ecosystem
chrome	affected	google	—	—
debian_linux	affected	debian	—	—
itunes	affected	apple	—	—
safari	affected	apple	—	—

Upstream advisory

CVE-2011-1301

GoogleEPSS <= 49%HIGH2011-04-15

Use-after-free vulnerability in the GPU process in Google Chrome before 10.0.648.205 allows remote attackers to execute arbitrary code via unknown vectors.

CVEs:CVE-2011-1301

Affected products

Product	Status	Vendor	Package	Ecosystem
chrome	affected	google	—	—

Upstream advisory

CVE-2011-1302

GoogleEPSS <= 49%HIGH2011-04-15

Heap-based buffer overflow in the GPU process in Google Chrome before 10.0.648.205 allows remote attackers to execute arbitrary code via unknown vectors.

CVEs:CVE-2011-1302

Affected products

Product	Status	Vendor	Package	Ecosystem
chrome	affected	google	—	—

Upstream advisory

CVE-2011-1300

GoogleEPSS <= 49%HIGH2011-04-15

The Program::getActiveUniformMaxLength function in libGLESv2/Program.cpp in libGLESv2.dll in the WebGLES library in Almost Native Graphics Layer Engine (ANGLE), as used in Mozilla Firefox 4.x before 4.0.1 on Windows and in the GPU process in Google Chr...

CVEs:CVE-2011-1300

Affected products

Product	Status	Vendor	Package	Ecosystem
chrome	affected	google	—	—
firefox	affected	mozilla	—	—

Upstream advisory

CVE-2011-1451

GoogleEPSS <= 49%HIGH2011-04-28

Google Chrome before 11.0.696.57 does not properly handle DOM id maps, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to "dangling pointers."

CVEs:CVE-2011-1451

Affected products

Product	Status	Vendor	Package	Ecosystem
chrome	affected	google	—	—
iphone_os	affected	apple	—	—
itunes	affected	apple	—	—
safari	affected	apple	—	—

Upstream advisory

CVE-2011-1449

GoogleEPSS <= 49%CRITICAL2011-04-28

Use-after-free vulnerability in the WebSockets implementation in Google Chrome before 11.0.696.57 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

CVEs:CVE-2011-1449

Affected products

Product	Status	Vendor	Package	Ecosystem
chrome	affected	google	—	—
iphone_os	affected	apple	—	—
itunes	affected	apple	—	—
safari	affected	apple	—	—

Upstream advisory

CVE-2011-1691

GoogleEPSS <= 49%HIGH2011-04-15

The counterToCSSValue function in CSSComputedStyleDeclaration.cpp in the Cascading Style Sheets (CSS) implementation in WebCore in WebKit before r82222, as used in Google Chrome before 11.0.696.43 and other products, does not properly handle access to ...

CVEs:CVE-2011-1691

Affected products

Product	Status	Vendor	Package	Ecosystem
chrome	affected	google	—	—

Upstream advisory

CVE-2011-1455

GoogleEPSS <= 49%HIGH2011-04-28

Google Chrome before 11.0.696.57 does not properly handle PDF documents with multipart encoding, which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted document.

CVEs:CVE-2011-1455

Affected products

Product	Status	Vendor	Package	Ecosystem
chrome	affected	google	—	—

Upstream advisory

CVE-2011-1434

GoogleEPSS <= 49%HIGH2011-04-28

Google Chrome before 11.0.696.57 does not ensure thread safety during handling of MIME data, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

CVEs:CVE-2011-1434

Affected products

Product	Status	Vendor	Package	Ecosystem
chrome	affected	google	—	—

Upstream advisory

CVE-2011-1438

GoogleEPSS <= 49%HIGH2011-04-28

Google Chrome before 11.0.696.57 allows remote attackers to bypass the Same Origin Policy via vectors involving blobs.

CVEs:CVE-2011-1438

Affected products

Product	Status	Vendor	Package	Ecosystem
chrome	affected	google	—	—

Upstream advisory

CVE-2011-1450

GoogleEPSS <= 49%HIGH2011-04-28

Google Chrome before 11.0.696.57 does not properly present file dialogs, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to "dangling pointers."

CVEs:CVE-2011-1450

Affected products

Product	Status	Vendor	Package	Ecosystem
chrome	affected	google	—	—

Upstream advisory

CVE-2011-1446

GoogleEPSS <= 49%MEDIUM2011-04-28

Google Chrome before 11.0.696.57 allows remote attackers to spoof the URL bar via vectors involving (1) a navigation error or (2) an interrupted load.

CVEs:CVE-2011-1446

Affected products

Product	Status	Vendor	Package	Ecosystem
chrome	affected	google	—	—

Upstream advisory

CVE-2011-1454

GoogleEPSS <= 49%CRITICAL2011-04-28

Use-after-free vulnerability in the DOM id handling functionality in Google Chrome before 11.0.696.57 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted HTML document.

CVEs:CVE-2011-1454

Affected products

Product	Status	Vendor	Package	Ecosystem
chrome	affected	google	—	—

Upstream advisory

CVE-2011-1435

GoogleEPSS <= 49%MEDIUM2011-04-28

Google Chrome before 11.0.696.57 does not properly implement the tabs permission for extensions, which allows remote attackers to read local files via a crafted extension.

CVEs:CVE-2011-1435

Affected products

Product	Status	Vendor	Package	Ecosystem
chrome	affected	google	—	—

Upstream advisory

CVE-2011-1437

GoogleEPSS <= 49%CRITICAL2011-04-28

Multiple integer overflows in Google Chrome before 11.0.696.57 allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to float rendering.

CVEs:CVE-2011-1437

Affected products

Product	Status	Vendor	Package	Ecosystem
chrome	affected	google	—	—

Upstream advisory

CVE-2011-1443

GoogleEPSS <= 49%HIGH2011-04-28

Google Chrome before 11.0.696.57 does not properly implement layering, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to "stale pointers."

CVEs:CVE-2011-1443

Affected products

Product	Status	Vendor	Package	Ecosystem
chrome	affected	google	—	—

Upstream advisory

CVE-2011-1447

GoogleEPSS <= 49%HIGH2011-04-28

Google Chrome before 11.0.696.57 does not properly handle drop-down lists, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."

CVEs:CVE-2011-1447

Affected products

Product	Status	Vendor	Package	Ecosystem
chrome	affected	google	—	—

Upstream advisory

CVE-2011-1448

GoogleEPSS <= 49%HIGH2011-04-28

Google Chrome before 11.0.696.57 does not properly perform height calculations, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."

CVEs:CVE-2011-1448

Affected products

Product	Status	Vendor	Package	Ecosystem
chrome	affected	google	—	—

Upstream advisory

CVE-2011-1441

GoogleEPSS <= 49%HIGH2011-04-28

Google Chrome before 11.0.696.57 does not properly perform a cast of an unspecified variable during handling of floating select lists, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted HTML d...

CVEs:CVE-2011-1441

Affected products

Product	Status	Vendor	Package	Ecosystem
chrome	affected	google	—	—

Upstream advisory

CVE-2011-1445

GoogleEPSS <= 49%HIGH2011-04-28

Google Chrome before 11.0.696.57 does not properly handle SVG documents, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.

CVEs:CVE-2011-1445

Affected products

Product	Status	Vendor	Package	Ecosystem
chrome	affected	google	—	—

Upstream advisory

CVE-2011-1442

GoogleEPSS <= 49%HIGH2011-04-28

Google Chrome before 11.0.696.57 does not properly handle mutation events, which allows remote attackers to cause a denial of service (node tree corruption) or possibly have unspecified other impact via unknown vectors.

CVEs:CVE-2011-1442

Affected products

Product	Status	Vendor	Package	Ecosystem
chrome	affected	google	—	—

Upstream advisory

CVE-2011-1456

GoogleEPSS <= 49%HIGH2011-04-28

Google Chrome before 11.0.696.57 does not properly handle PDF forms, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to "stale pointers."

CVEs:CVE-2011-1456

Affected products

Product	Status	Vendor	Package	Ecosystem
chrome	affected	google	—	—

Upstream advisory

CVE-2011-1303

GoogleEPSS <= 49%HIGH2011-04-28

Google Chrome before 11.0.696.57 does not properly handle floating objects, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."

CVEs:CVE-2011-1303

Affected products

Product	Status	Vendor	Package	Ecosystem
chrome	affected	google	—	—

Upstream advisory

CVE-2011-1436

GoogleEPSS <= 49%HIGH2011-04-28

Google Chrome before 11.0.696.57 on Linux does not properly interact with the X Window System, which allows remote attackers to cause a denial of service (application crash) via unspecified vectors.

CVEs:CVE-2011-1436

Affected products

Product	Status	Vendor	Package	Ecosystem
chrome	affected	google	—	—

Upstream advisory

CVE-2011-1444

GoogleEPSS <= 49%HIGH2011-04-28

Race condition in the sandbox launcher implementation in Google Chrome before 11.0.696.57 on Linux allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

CVEs:CVE-2011-1444

Affected products

Product	Status	Vendor	Package	Ecosystem
chrome	affected	google	—	—
debian_linux	affected	debian	—	—

Upstream advisory

CVE-2011-1452

GoogleEPSS <= 49%MEDIUM2011-04-28

Google Chrome before 11.0.696.57 allows user-assisted remote attackers to spoof the URL bar via vectors involving a redirect and a manual reload.

CVEs:CVE-2011-1452

Affected products

Product	Status	Vendor	Package	Ecosystem
chrome	affected	google	—	—

Upstream advisory

CVE-2011-1304

GoogleEPSS <= 49%MEDIUM2011-04-28

Unspecified vulnerability in Google Chrome before 11.0.696.57 allows remote attackers to bypass the pop-up blocker via vectors related to plug-ins.

CVEs:CVE-2011-1304

Affected products

Product	Status	Vendor	Package	Ecosystem
chrome	affected	google	—	—

Upstream advisory

CVE-2011-1439

GoogleEPSS <= 49%MEDIUM2011-04-28

Google Chrome before 11.0.696.57 on Linux does not properly isolate renderer processes, which has unspecified impact and remote attack vectors.

CVEs:CVE-2011-1439

Affected products

Product	Status	Vendor	Package	Ecosystem
chrome	affected	google	—	—

Upstream advisory

CVE-2011-1149

Open SourceEPSS <= 49%HIGH2011-04-21

Android before 2.3 does not properly restrict access to the system property space, which allows local applications to bypass the application sandbox and gain privileges, as demonstrated by psneuter and KillingInTheNameOf, related to the use of Android ...

CVEs:CVE-2011-1149

Affected products

Product	Status	Vendor	Package	Ecosystem
android	affected	google	—	—

Upstream advisory

CVE-2011-1717

Open SourceEPSS <= 49%CRITICAL2011-04-18

Skype for Android stores sensitive user data without encryption in sqlite3 databases that have weak permissions, which allows local applications to read user IDs, contacts, phone numbers, date of birth, instant message logs, and other private information.

CVEs:CVE-2011-1717

Affected products

Product	Status	Vendor	Package	Ecosystem
skype_for_android	affected	skype	—	—

Upstream advisory

Need live exploit intelligence?

Every CVE above is indexed in the Vulnetix VDB with KEV, EPSS, and PoC maturity. The interactive page surfaces that on hover.

All months Open Console