VulnerabilityModified

CVE-2011-3640

Untrusted search path vulnerability in Mozilla Network Security Services (NSS), as used in Google Chrome before 17 on Windows and Mac OS X, might allow local users to gain privileges via a Trojan horse pkcs11.txt file in a top-level directory.

HIGH 7.1EPSS 1.40%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.40%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

CVSS 2.0: 7.1 HIGHAV:N/AC:H/Au:S/C:C/I:C/A:C
EPSS: 1.40% probability · 71th percentile
CISA KEV: Not listed
Weakness: CWE-426
Affected: google/chrome
Source: secalert@redhat.com

References

http://blog.acrossecurity.com/2011/10/google-chrome-pkcs11txt-file-planting.htmlExploit, Third Party Advisory
http://code.google.com/p/chromium/issues/detail?id=97426Exploit, Issue Tracking, Patch, Vendor Advisory
http://securityreason.com/securityalert/8483Third Party Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=641052Issue Tracking, Patch, Third Party Advisory
https://hermes.opensuse.org/messages/13154861Broken Link
https://hermes.opensuse.org/messages/13155432Broken Link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13414Third Party Advisory
http://blog.acrossecurity.com/2011/10/google-chrome-pkcs11txt-file-planting.htmlExploit, Third Party Advisory
http://code.google.com/p/chromium/issues/detail?id=97426Exploit, Issue Tracking, Patch, Vendor Advisory
http://securityreason.com/securityalert/8483Third Party Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=641052Issue Tracking, Patch, Third Party Advisory
https://hermes.opensuse.org/messages/13154861Broken Link
https://hermes.opensuse.org/messages/13155432Broken Link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13414Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.