Vulnetix
Try Vulnetix Request Demo
Google Security Advisories · September 2011 — Google Security Advisories
35 advisories 35 CVEs

GCVE / Google Cloud / Chrome / Android / Project Zero / OSS for 2011-09. Mirrored into Vulnetix VDB.

Every advisory below is enriched with the Vulnetix VDB exploit-intelligence chip (hover a CVE ID in the interactive page to see CVSS, EPSS, KEV status, and PoC maturity).

Back to archive Open Console

What would you fix first?

The advisories below are ordered by the Vulnetix risk prioritization strategy: exploitation evidence first, scores second. On the interactive page you can switch to three other lenses.

How Vulnetix ranks risk Get a free API key

Advisories

CVE-2011-3389

GoogleWeaponized exploitMEDIUM2011-09-06

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-i...

CVEs:CVE-2011-3389

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
curl affected haxx — —
debian_linux affected debian — —
enterprise_linux_desktop affected redhat — —
enterprise_linux_eus affected redhat — —
enterprise_linux_server affected redhat — —
enterprise_linux_server_aus affected redhat — —
enterprise_linux_workstation affected redhat — —
firefox affected mozilla — —
internet_explorer affected microsoft — —
opera_browser affected opera — —
simatic_rf615r_firmware affected siemens — —
simatic_rf68xr_firmware affected siemens — —
ubuntu_linux affected canonical — —
windows affected microsoft — —
Upstream advisory

CVE-2011-2841

GoogleActive exploitation (sightings)HIGH2011-09-17

Google Chrome before 14.0.835.163 does not properly perform garbage collection during the processing of PDF documents, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document.

CVEs:CVE-2011-2841

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
Upstream advisory

CVE-2011-2834

GooglePoC exploitCRITICAL2011-09-17

Double free vulnerability in libxml2, as used in Google Chrome before 14.0.835.163, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to XPath handling.

CVEs:CVE-2011-2834

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
debian_linux affected debian — —
enterprise_linux_desktop affected redhat — —
enterprise_linux_server affected redhat — —
enterprise_linux_server_eus affected redhat — —
enterprise_linux_workstation affected redhat — —
iphone_os affected apple — —
mac_os_x affected apple — —
Upstream advisory

DSA-2307-1

Open SourcePoC exploit2011-09-11

chromium-browser - several

Affected products

ProductStatusVendorPackageEcosystem
chromium-browser affected Debian:6.0 chromium-browser —
Upstream advisory

CVE-2011-3234

GoogleEPSS <= 49%HIGH2011-09-17

Google Chrome before 14.0.835.163 does not properly handle boxes, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.

CVEs:CVE-2011-3234

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
iphone_os affected apple — —
itunes affected apple — —
safari affected apple — —
Upstream advisory

CVE-2011-2860

GoogleEPSS <= 49%CRITICAL2011-09-16

Use-after-free vulnerability in Google Chrome before 14.0.835.163 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to table styles.

CVEs:CVE-2011-2860

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
iphone_os affected apple — —
itunes affected apple — —
safari affected apple — —
Upstream advisory

CVE-2011-2854

GoogleEPSS <= 49%CRITICAL2011-09-16

Use-after-free vulnerability in Google Chrome before 14.0.835.163 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to "ruby / table style handing."

CVEs:CVE-2011-2854

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
iphone_os affected apple — —
itunes affected apple — —
safari affected apple — —
Upstream advisory

CVE-2011-2847

GoogleEPSS <= 49%CRITICAL2011-09-16

Use-after-free vulnerability in the document loader in Google Chrome before 14.0.835.163 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document.

CVEs:CVE-2011-2847

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
iphone_os affected apple — —
itunes affected apple — —
safari affected apple — —
Upstream advisory

CVE-2011-2855

GoogleEPSS <= 49%HIGH2011-09-16

Google Chrome before 14.0.835.163 does not properly handle Cascading Style Sheets (CSS) token sequences, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale node."

CVEs:CVE-2011-2855

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
iphone_os affected apple — —
itunes affected apple — —
safari affected apple — —
Upstream advisory

CVE-2011-2857

GoogleEPSS <= 49%CRITICAL2011-09-16

Use-after-free vulnerability in Google Chrome before 14.0.835.163 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the focus controller.

CVEs:CVE-2011-2857

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
iphone_os affected apple — —
itunes affected apple — —
safari affected apple — —
Upstream advisory

CVE-2011-2846

GoogleEPSS <= 49%CRITICAL2011-09-16

Use-after-free vulnerability in Google Chrome before 14.0.835.163 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to unload event handling.

CVEs:CVE-2011-2846

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
iphone_os affected apple — —
itunes affected apple — —
safari affected apple — —
Upstream advisory

CVE-2011-2861

GoogleEPSS <= 49%MEDIUM2011-09-17

Google Chrome before 14.0.835.163 does not properly handle strings in PDF documents, which allows remote attackers to have an unspecified impact via a crafted document that triggers an incorrect read operation.

CVEs:CVE-2011-2861

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
Upstream advisory

CVE-2011-2853

GoogleEPSS <= 49%CRITICAL2011-09-17

Use-after-free vulnerability in Google Chrome before 14.0.835.163 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to plug-in handling.

CVEs:CVE-2011-2853

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
Upstream advisory

CVE-2011-2875

GoogleEPSS <= 49%HIGH2011-09-17

Google V8, as used in Google Chrome before 14.0.835.163, does not properly perform object sealing, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage "type confusion."

CVEs:CVE-2011-2875

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
Upstream advisory

CVE-2011-2844

GoogleEPSS <= 49%HIGH2011-09-17

Google Chrome before 14.0.835.163 does not properly process MP3 files, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.

CVEs:CVE-2011-2844

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
Upstream advisory

CVE-2011-2851

GoogleEPSS <= 49%HIGH2011-09-17

Google Chrome before 14.0.835.163 does not properly handle video, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.

CVEs:CVE-2011-2851

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
Upstream advisory

CVE-2011-2864

GoogleEPSS <= 49%HIGH2011-09-17

Google Chrome before 14.0.835.163 does not properly handle Tibetan characters, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.

CVEs:CVE-2011-2864

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
Upstream advisory

CVE-2011-2850

GoogleEPSS <= 49%HIGH2011-09-17

Google Chrome before 14.0.835.163 does not properly handle Khmer characters, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.

CVEs:CVE-2011-2850

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
Upstream advisory

CVE-2011-2858

GoogleEPSS <= 49%HIGH2011-09-17

Google Chrome before 14.0.835.163 does not properly handle triangle arrays, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.

CVEs:CVE-2011-2858

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
Upstream advisory

CVE-2011-2843

GoogleEPSS <= 49%HIGH2011-09-17

Google Chrome before 14.0.835.163 does not properly handle media buffers, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.

CVEs:CVE-2011-2843

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
Upstream advisory

CVE-2011-2852

GoogleEPSS <= 49%HIGH2011-09-17

Off-by-one error in Google V8, as used in Google Chrome before 14.0.835.163, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

CVEs:CVE-2011-2852

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
Upstream advisory

CVE-2011-2836

GoogleEPSS <= 49%HIGH2011-09-17

Google Chrome before 14.0.835.163 does not require Infobar interaction before use of the Windows Media Player plug-in, which makes it easier for remote attackers to have an unspecified impact via crafted Flash content.

CVEs:CVE-2011-2836

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
Upstream advisory

CVE-2011-2849

GoogleEPSS <= 49%HIGH2011-09-17

The WebSockets implementation in Google Chrome before 14.0.835.163 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via unspecified vectors.

CVEs:CVE-2011-2849

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
Upstream advisory

CVE-2011-2840

GoogleEPSS <= 49%MEDIUM2011-09-17

Google Chrome before 14.0.835.163 allows user-assisted remote attackers to spoof the URL bar via vectors related to "unusual user interaction."

CVEs:CVE-2011-2840

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
Upstream advisory

CVE-2011-2838

GoogleEPSS <= 49%HIGH2011-09-17

Google Chrome before 14.0.835.163 does not properly consider the MIME type during the loading of a plug-in, which has unspecified impact and remote attack vectors.

CVEs:CVE-2011-2838

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
Upstream advisory

CVE-2011-2848

GoogleEPSS <= 49%MEDIUM2011-09-17

Google Chrome before 14.0.835.163 allows user-assisted remote attackers to spoof the URL bar via vectors related to the forward button.

CVEs:CVE-2011-2848

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
Upstream advisory

CVE-2011-2842

GoogleEPSS <= 49%HIGH2011-09-17

The installer in Google Chrome before 14.0.835.163 on Mac OS X does not properly handle lock files, which has unspecified impact and attack vectors.

CVEs:CVE-2011-2842

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
Upstream advisory

CVE-2011-2837

GoogleEPSS <= 49%HIGH2011-09-17

Google Chrome before 14.0.835.163 on Linux does not use the PIC and PIE compiler options for position-independent code, which has unspecified impact and attack vectors.

CVEs:CVE-2011-2837

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
Upstream advisory

CVE-2011-2856

GoogleEPSS <= 49%HIGH2011-09-17

Google V8, as used in Google Chrome before 14.0.835.163, allows remote attackers to bypass the Same Origin Policy via unspecified vectors.

CVEs:CVE-2011-2856

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
Upstream advisory

CVE-2011-3420

GoogleEPSS <= 49%HIGH2011-09-10

Multiple unspecified vulnerabilities in Google Chrome before 14.0.835.157 on the Acer AC700, Samsung Series 5, and Cr-48 Chromebook platforms have unknown impact and attack vectors.

CVEs:CVE-2011-3420

Affected products

ProductStatusVendorPackageEcosystem
ac700_chromebook affected acer — —
chrome_os affected google — —
cr-48_chromebook affected google — —
series_5_chromebook affected samsung — —
Upstream advisory

CVE-2011-2862

GoogleEPSS <= 49%HIGH2011-09-17

Google V8, as used in Google Chrome before 14.0.835.163, does not properly restrict access to built-in objects, which has unspecified impact and remote attack vectors.

CVEs:CVE-2011-2862

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
Upstream advisory

CVE-2011-3421

GoogleEPSS <= 49%HIGH2011-09-10

Multiple unspecified vulnerabilities in Google Chrome before 14.0.835.125 on the Acer AC700, Samsung Series 5, and Cr-48 Chromebook platforms have unknown impact and attack vectors.

CVEs:CVE-2011-3421

Affected products

ProductStatusVendorPackageEcosystem
ac700_chromebook affected acer — —
chrome_os affected google — —
cr-48_chromebook affected google — —
series_5_chromebook affected samsung — —
Upstream advisory

CVE-2011-2859

GoogleEPSS <= 49%MEDIUM2011-09-17

Google Chrome before 14.0.835.163 uses incorrect permissions for non-gallery pages, which has unspecified impact and attack vectors.

CVEs:CVE-2011-2859

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
Upstream advisory

CVE-2011-2874

GoogleEPSS <= 49%MEDIUM2011-09-17

Google Chrome before 14.0.835.163 does not perform an expected pin operation for a self-signed certificate during a session, which has unspecified impact and remote attack vectors.

CVEs:CVE-2011-2874

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
Upstream advisory

CVE-2011-2835

GoogleEPSS <= 49%HIGH2011-09-17

Race condition in Google Chrome before 14.0.835.163 allows attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the certificate cache.

CVEs:CVE-2011-2835

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
Upstream advisory

Need live exploit intelligence?

Every CVE above is indexed in the Vulnetix VDB with KEV, EPSS, and PoC maturity. The interactive page surfaces that on hover.

All months Open Console