WebKit contains a flaw in the WebGL subsystem as WebCore::GraphicsContext3D::getImageData [platform/graphics/cairo/GraphicsContext3DCairo.cpp, platform/graphics/cg/GraphicsContext3DCG.cpp, platform/graphics/qt/GraphicsContext3DQt.cpp, platform/graphics/skia/GraphicsContext3DSkia.cpp] incorrectly calculates the size of a destination buffer. The issue is triggered when the texSubImage2d implementation does not properly handle uploads to floating-point textures. With a specially crafted web page, a context-dependent attacker can corrupt memory to cause a denial of service or potentially execute arbitrary code.

Upgrade to version 1.8.2 and 1.9.3, or higher, as they have been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Upgrade to Google Chrome version 20.0.1132.43 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• CVE ID: 2012-2819 (see also: NVD)
• Secunia Advisory ID: 49724 49738 50259
• Bugtraq ID: 54203
• Related OSVDB ID: 83237 83238 83239 83240 83241 83242 83243 83244 83245 83246 83247 83248 83249 83250 83251 83252 83253 83255 83256 83257 83266
• Vendor Specific News/Changelog Entry: http://code.google.com/p/chromium/issues/detail?id=120977
  http://lists.opensuse.org/opensuse-updates/2012-07/msg00003.html
  http://security.gentoo.org/glsa/glsa-201208-03.xml
  http://trac.webkit.org/changeset/117191
  http://trac.webkit.org/changeset/118410
  https://bugs.webkit.org/show_bug.cgi?id=85942
  https://chromiumcodereview.appspot.com/10444013
• Vendor Specific Advisory URL: http://googlechromereleases.blogspot.com/2012/06/stable-channel-update_26.html
• Other Advisory URL: https://hermes.opensuse.org/messages/15075728

• Ken “gets” Russell - Chromium development community