WebGL Library Multiple Memory Corruption Vulnerabilities

BID:47661

Info

WebGL Library Multiple Memory Corruption Vulnerabilities

Bugtraq ID: 47661
Class: Unknown
CVE: CVE-2011-1302
CVE-2011-0068
Remote: Yes
Local: No
Published: Apr 28 2011 12:00AM
Updated: Mar 19 2015 08:51AM
Credit: Nils, Christoph Diehl, Yuri Ko
Vulnerable: SuSE SUSE Linux Enterprise Server 11 SP1
+ Linux kernel 2.6.5
SuSE SUSE Linux Enterprise Server 10 SP4
+ Linux kernel 2.6.5
SuSE SUSE Linux Enterprise Server 10 SP3
SuSE SUSE Linux Enterprise SDK 11 SP1
SuSE SUSE Linux Enterprise SDK 10 SP4
SuSE SUSE Linux Enterprise Desktop 11 SP1
+ Linux kernel 2.6.5
SuSE SUSE Linux Enterprise Desktop 10 SP4
+ Linux kernel 2.6.5
SuSE openSUSE 11.4
SuSE openSUSE 11.3
S.u.S.E. openSUSE 11.2
Mozilla Firefox 4.0
Khronos Group Industry Consortium WebGL 0
Google Chrome 9.0.597.84
Google Chrome 9.0.597.107
Google Chrome 8.0.552.344
Google Chrome 8.0.552.310
Google Chrome 8.0.552.309
Google Chrome 8.0.552.308
Google Chrome 8.0.552.307
Google Chrome 8.0.552.306
Google Chrome 8.0.552.305
Google Chrome 8.0.552.304
Google Chrome 8.0.552.303
Google Chrome 8.0.552.302
Google Chrome 8.0.552.301
Google Chrome 8.0.552.300
Google Chrome 8.0.552.237
Google Chrome 8.0.552.226
Google Chrome 8.0.552.225
Google Chrome 8.0.552.224
Google Chrome 8.0.552.223
Google Chrome 8.0.552.222
Google Chrome 8.0.552.221
Google Chrome 8.0.552.220
Google Chrome 8.0.552.219
Google Chrome 8.0.552.218
Google Chrome 8.0.552.217
Google Chrome 8.0.552.216
Google Chrome 8.0.552.215
Google Chrome 8.0.552.214
Google Chrome 8.0.552.213
Google Chrome 8.0.552.212
Google Chrome 8.0.552.211
Google Chrome 8.0.552.210
Google Chrome 8.0.552.21
Google Chrome 8.0.552.209
Google Chrome 8.0.552.208
Google Chrome 8.0.552.207
Google Chrome 8.0.552.206
Google Chrome 8.0.552.205
Google Chrome 8.0.552.204
Google Chrome 8.0.552.203
Google Chrome 8.0.552.202
Google Chrome 8.0.552.201
Google Chrome 8.0.552.200
Google Chrome 8.0.552.20
Google Chrome 8.0.552.2
Google Chrome 8.0.552.19
Google Chrome 8.0.552.18
Google Chrome 8.0.552.17
Google Chrome 8.0.552.16
Google Chrome 8.0.552.15
Google Chrome 8.0.552.14
Google Chrome 8.0.552.13
Google Chrome 8.0.552.12
Google Chrome 8.0.552.11
Google Chrome 8.0.552.105
Google Chrome 8.0.552.104
Google Chrome 8.0.552.103
Google Chrome 8.0.552.102
Google Chrome 8.0.552.101
Google Chrome 8.0.552.100
Google Chrome 8.0.552.10
Google Chrome 8.0.552.1
Google Chrome 8.0.552.0
Google Chrome 8.0.551.1
Google Chrome 8.0.551.0
Google Chrome 8.0.550.0
Google Chrome 8.0.549.0
Google Chrome 10.0.648.204
Google Chrome 10.0.648.133
Google Chrome 10.0.648.128
Google Chrome 10.0.648.127
Google Chrome 10.0.648.127
Google Chrome 10
Not Vulnerable: Mozilla Firefox 4.0.1
Google Chrome 10.0.648.205

Discussion

WebGL Library Multiple Memory Corruption Vulnerabilities

WebGL is prone to multiple memory-corruption vulnerabilities that may allow remote code execution.

An attacker can exploit these issues by enticing an unsuspecting user into viewing malicious content. A successful exploit will result in the execution of arbitrary attacker-supplied code in the context of the user running the affected application. Failed exploit attempts will likely result in denial-of-service conditions.

These issues are resolved in Firefox 4.0.1 and Google Chrome 10.0.648.205.

NOTE: These issues were previously discussed in BID 47635 (Mozilla Firefox/Thunderbird/SeaMonkey MFSA 2011-12 through -18 Multiple Vulnerabilities) but have been moved to their own record to better document them.

NOTE (May 10, 2011): This BID was previously titled 'Mozilla Firefox WebGLES library Multiple Memory Corruption Vulnerabilities'. It has been updated to indicate that the vulnerabilities documented in this BID are against the underlying WebGL library and are not specific to the Mozilla Firefox browser. Additional browsers, including Google Chrome, are also affected.

Solution / Fix

WebGL Library Multiple Memory Corruption Vulnerabilities

Solution:
Updates are available. Please see the references for more information.


S.u.S.E. openSUSE 11.4

S.u.S.E. openSUSE 11.3

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report