NVD Vulnerability Detail

CVE-2011-3098

Summary	Google Chrome before 19.0.1084.46 on Windows uses an incorrect search path for the Windows Media Player plug-in, which might allow local users to gain privileges via a Trojan horse plug-in in an unspecified directory.
Publication Date	May 16, 2012, 9:55 a.m.
Registration Date	Jan. 28, 2021, 4:39 p.m.
Last Update	Nov. 21, 2024, 10:29 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:o:opensuse:opensuse:12.1:::::::*

Related information, measures and tools

No	URL	タグ
1	http://code.google.com/p/chromium/issues/detail?id=124216	Issue Tracking Patch
2	http://googlechromereleases.blogspot.com/2012/05/stable-channel-update.html	Vendor Advisory
3	http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00017.html
4	http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00009.html	Third Party Advisory
5	http://www.securityfocus.com/bid/53540	Third Party Advisory VDB Entry
6	http://www.securitytracker.com/id?1027067	Third Party Advisory VDB Entry
7	https://exchange.xforce.ibmcloud.com/vulnerabilities/75603
8	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15618
9	http://code.google.com/p/chromium/issues/detail?id=124216	Issue Tracking Patch
10	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15618
11	https://exchange.xforce.ibmcloud.com/vulnerabilities/75603
12	http://www.securitytracker.com/id?1027067	Third Party Advisory VDB Entry
13	http://www.securityfocus.com/bid/53540	Third Party Advisory VDB Entry
14	http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00009.html	Third Party Advisory
15	http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00017.html
16	http://googlechromereleases.blogspot.com/2012/05/stable-channel-update.html	Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-264	認可・権限・アクセス制御	https://cwe.mitre.org/data/definitions/264.html

JVN Vulnerability Information

Windows 上で稼働する Google Chrome における権限を取得される脆弱性

Title	Windows 上で稼働する Google Chrome における権限を取得される脆弱性
Summary	Windows 上で稼働する Google Chrome は、Windows Media Player プラグインに不正な検索パスを使用するため、権限を取得される脆弱性が存在します。
Possible impacts	ローカルユーザにより、不特定のディレクトリ内のトロイの木馬のプラグインを介して、権限を取得される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	May 15, 2012, midnight
Registration Date	May 17, 2012, 2:53 p.m.
Last Update	Nov. 13, 2012, 6:02 p.m.

Affected System

Google

Google Chrome 19.0.1084.46 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2011-3098	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3098
National Vulnerability Database (NVD)
2	CVE-2011-3098	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3098

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-16	https://jvndb.jvn.jp/ja/cwe/CWE-16.html
2	CWE-DesignError	https://www.ipa.go.jp/security/vuln/CWE.html#CWEDesignError

ベンダー情報

No	Name	URL
Google
1	Google Chrome	http://www.google.co.jp/chrome
2	Stable Channel Update	http://googlechromereleases.blogspot.jp/2012/05/stable-channel-update.html
opensuse-security-announce
3	openSUSE-SU-2012:0993	http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00009.html

Change Log

No	Changed Details	Date of change
0	[2012年05月17日] 掲載 [2012年11月13日] ベンダ情報：openSUSE (openSUSE-SU-2012:0993) を追加	Feb. 17, 2018, 10:37 a.m.