Vulnerability CVE-2012-5117 - CERT Civis.Net

Vulnerability Name:

CVE-2012-5117 (CCN-79864)

Assigned:

2012-11-06

Published:

2012-11-06

Updated:

2017-09-19

Summary:

Google Chrome before 23.0.1271.64 does not properly restrict the loading of an SVG subresource in the context of an IMG element, which has unspecified impact and remote attack vectors.

CVSS v3 Severity:

7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
5.5 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
5.5 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2012-5117

Source: CONFIRM
Type: Vendor Advisory
http://googlechromereleases.blogspot.com/2012/11/stable-channel-release-and-beta-channel.html

Source: CCN
Type: Google Chrome Releases Web site
Stable Channel Release and Beta Channel Update

Source: OSVDB
Type: Broken Link
87076

Source: CCN
Type: SA51210
Google Chrome Multiple Vulnerabilities

Source: CCN
Type: OSVDB ID: 87076
Google Chrome img Context SVG Subresource Loading Issue

Source: BID
Type: Third Party Advisory, VDB Entry
56413

Source: CCN
Type: BID-56413
Google Chrome Prior to 23.0.1271.64 Multiple Security Vulnerabilities

Source: CONFIRM
Type: Issue Tracking, Patch
https://code.google.com/p/chromium/issues/detail?id=145915

Source: XF
Type: UNKNOWN
chrome-cve20125117-code-exec(79864)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:15912

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2012-5117

Vulnerable Configuration:

Configuration 1:

cpe:/a:google:chrome:23.0.1271.0:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.1:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.2:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.3:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.4:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.5:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.6:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.7:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.8:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.9:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.10:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.11:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.12:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.13:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.14:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.15:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.16:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.17:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.18:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.19:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.20:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.21:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.22:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.23:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.24:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.26:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.30:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.31:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.32:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.33:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.35:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.36:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.37:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.38:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.39:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.40:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.41:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.44:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.45:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.46:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.49:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.50:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.51:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.52:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.53:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.54:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.55:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.56:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.57:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.58:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.59:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.60:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:23.0.1271.61:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:*:*:*:*:*:*:*:* (Version <= 23.0.1271.62)

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.mitre.oval:def:15912	V	Google Chrome before 23.0.1271.64 does not properly restrict the loading of an SVG subresource in the context of an IMG element	2013-08-12
oval:com.ubuntu.precise:def:20125117000	V	CVE-2012-5117 on Ubuntu 12.04 LTS (precise) - medium.	2012-11-07