製品・ソフトウェアに関する情報

JVN脆弱性詳細

Google Chrome で使用される Microsoft Windows のカーネルモードドライバにおける任意のコードを実行される脆弱性

Title	Google Chrome で使用される Microsoft Windows のカーネルモードドライバにおける任意のコードを実行される脆弱性
Summary	Google Chrome および他の製品で使用される Microsoft Windows のカーネルモードドライバは、メモリのオブジェクトを適切に処理しないため、任意のコードを実行される脆弱性が存在します。マイクロソフトセキュリティ情報には、この脆弱性は「TrueType フォントの解析の脆弱性」と記載されています。
Possible impacts	第三者により、巧妙に細工された TrueType フォントファイルを介して、任意のコードを実行される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Sept. 25, 2012, midnight
Registration Date	Sept. 28, 2012, 11:54 a.m.
Last Update	Nov. 16, 2012, 11:09 a.m.

CVSS2.0 : 危険
Score	10
Vector	AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected System

マイクロソフト

Microsoft Windows 7 (x32) SP1 以前

Microsoft Windows 7 (x64) SP1 以前

Microsoft Windows 8 for 32-bit Systems

Microsoft Windows 8 for 64-bit Systems

Microsoft Windows RT

Microsoft Windows Server 2003 (itanium) SP2

Microsoft Windows Server 2003 (x64) SP2

Microsoft Windows Server 2003 SP2

Microsoft Windows Server 2008 (itanium) SP2

Microsoft Windows Server 2008 (x64) SP2

Microsoft Windows Server 2008 (x86) SP2

Microsoft Windows Server 2008 r2(itanium) SP1 以前

Microsoft Windows Server 2008 r2(x64) SP1 以前

Microsoft Windows Server 2012

Microsoft Windows Vista (x64) SP2

Microsoft Windows Vista SP2

Microsoft Windows XP (x64) SP2

Microsoft Windows XP sp3 SP3

Google

Google Chrome 22.0.1229.79 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2012-2897	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2897
National Vulnerability Database (NVD)
2	CVE-2012-2897	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-2897

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-119	https://jvndb.jvn.jp/ja/cwe/CWE-119.html

ベンダー情報

No	Name	URL
Google
1	Google Chrome	http://www.google.co.jp/chrome/intl/ja/landing_ff_yt.html?hl=ja&hl=ja
2	Stable Channel Update	http://googlechromereleases.blogspot.jp/2012/09/stable-channel-update_25.html
Microsoft Security Bulletin
3	MS12-075	http://technet.microsoft.com/en-us/security/bulletin/ms12-075
マイクロソフトセキュリティ情報
4	MS12-075	http://technet.microsoft.com/ja-jp/security/bulletin/ms12-075
富士通セキュリティ情報
5	TA12-318A	http://software.fujitsu.com/jp/security/vulnerabilities/ta12-318a.html

その他

No	Name	URL
JPCERT 注意喚起
1	JPCERT-AT-2012-0035	http://www.jpcert.or.jp/at/2012/at120035.txt
JVN
2	JVNTA12-318A	http://jvn.jp/cert/JVNTA12-318A
US-CERT Cyber Security Alerts
3	TA12-318A	http://www.us-cert.gov/cas/techalerts/TA12-318A.html
警察庁 @police
4	マイクロソフト社のセキュリティ修正プログラムについて(MS12-071,072,073,074,075,076)(2012年11月14日)	http://www.npa.go.jp/cyberpolice/#topics

Change Log

No	Changed Details	Date of change
0	[2012年09月28日] 掲載 [2012年10月22日] CVSS による深刻度：基本値と攻撃条件の複雑さ、機密性、完全性、可用性への影響を変更 CWE による脆弱性タイプ一覧：CWE-ID を変更 [2012年11月16日] タイトル：NVD の変更に伴い内容を更新概要：NVD の変更に伴い内容を更新想定される影響：NVD の変更に伴い内容を更新影響を受けるシステム：マイクロソフト (MS12-075) の情報を追加ベンダ情報：マイクロソフト (MS12-075) を追加[2012年11月16日] ベンダ情報：富士通 (TA12-318A) を追加	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2012-2897

Summary	The kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, Windows Server 2012, and Windows RT, as used by Google Chrome before 22.0.1229.79 and other programs, do not properly handle objects in memory, which allows remote attackers to execute arbitrary code via a crafted TrueType font file, aka "Windows Font Parsing Vulnerability" or "TrueType Font Parsing Vulnerability."
Publication Date	Sept. 26, 2012, 7:56 p.m.
Registration Date	Jan. 28, 2021, 2:59 p.m.
Last Update	Nov. 21, 2024, 10:39 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:google:chrome::::::::		22.0.1229.78
cpe:2.3:a:google:chrome:22.0.1229.0:::::::*
cpe:2.3:a:google:chrome:22.0.1229.1:::::::*
cpe:2.3:a:google:chrome:22.0.1229.2:::::::*
cpe:2.3:a:google:chrome:22.0.1229.3:::::::*
cpe:2.3:a:google:chrome:22.0.1229.4:::::::*
cpe:2.3:a:google:chrome:22.0.1229.6:::::::*
cpe:2.3:a:google:chrome:22.0.1229.7:::::::*
cpe:2.3:a:google:chrome:22.0.1229.8:::::::*
cpe:2.3:a:google:chrome:22.0.1229.9:::::::*
cpe:2.3:a:google:chrome:22.0.1229.10:::::::*
cpe:2.3:a:google:chrome:22.0.1229.11:::::::*
cpe:2.3:a:google:chrome:22.0.1229.12:::::::*
cpe:2.3:a:google:chrome:22.0.1229.14:::::::*
cpe:2.3:a:google:chrome:22.0.1229.16:::::::*
cpe:2.3:a:google:chrome:22.0.1229.17:::::::*
cpe:2.3:a:google:chrome:22.0.1229.18:::::::*
cpe:2.3:a:google:chrome:22.0.1229.20:::::::*
cpe:2.3:a:google:chrome:22.0.1229.21:::::::*
cpe:2.3:a:google:chrome:22.0.1229.22:::::::*
cpe:2.3:a:google:chrome:22.0.1229.23:::::::*
cpe:2.3:a:google:chrome:22.0.1229.24:::::::*
cpe:2.3:a:google:chrome:22.0.1229.25:::::::*
cpe:2.3:a:google:chrome:22.0.1229.26:::::::*
cpe:2.3:a:google:chrome:22.0.1229.27:::::::*
cpe:2.3:a:google:chrome:22.0.1229.28:::::::*
cpe:2.3:a:google:chrome:22.0.1229.29:::::::*
cpe:2.3:a:google:chrome:22.0.1229.31:::::::*
cpe:2.3:a:google:chrome:22.0.1229.32:::::::*
cpe:2.3:a:google:chrome:22.0.1229.33:::::::*
cpe:2.3:a:google:chrome:22.0.1229.35:::::::*
cpe:2.3:a:google:chrome:22.0.1229.36:::::::*
cpe:2.3:a:google:chrome:22.0.1229.37:::::::*
cpe:2.3:a:google:chrome:22.0.1229.39:::::::*
cpe:2.3:a:google:chrome:22.0.1229.48:::::::*
cpe:2.3:a:google:chrome:22.0.1229.49:::::::*
cpe:2.3:a:google:chrome:22.0.1229.50:::::::*
cpe:2.3:a:google:chrome:22.0.1229.51:::::::*
cpe:2.3:a:google:chrome:22.0.1229.52:::::::*
cpe:2.3:a:google:chrome:22.0.1229.53:::::::*
cpe:2.3:a:google:chrome:22.0.1229.54:::::::*
cpe:2.3:a:google:chrome:22.0.1229.55:::::::*
cpe:2.3:a:google:chrome:22.0.1229.56:::::::*
cpe:2.3:a:google:chrome:22.0.1229.57:::::::*
cpe:2.3:a:google:chrome:22.0.1229.58:::::::*
cpe:2.3:a:google:chrome:22.0.1229.59:::::::*
cpe:2.3:a:google:chrome:22.0.1229.60:::::::*
cpe:2.3:a:google:chrome:22.0.1229.62:::::::*
cpe:2.3:a:google:chrome:22.0.1229.63:::::::*
cpe:2.3:a:google:chrome:22.0.1229.64:::::::*
cpe:2.3:a:google:chrome:22.0.1229.65:::::::*
cpe:2.3:a:google:chrome:22.0.1229.67:::::::*
cpe:2.3:a:google:chrome:22.0.1229.76:::::::*
cpe:2.3:o:microsoft:windows_7:-:sp1:x86:::::*
cpe:2.3:o:microsoft:windows_7:-:::::::*
cpe:2.3:o:microsoft:windows_7:-:sp1:x64:::::*
cpe:2.3:o:microsoft:windows_8:-:-:x86:::::*
cpe:2.3:o:microsoft:windows_8:-:-:x64:::::*
cpe:2.3:o:microsoft:windows_rt:-:::::::*
cpe:2.3:o:microsoft:windows_server_2003::sp2::::::*
cpe:2.3:o:microsoft:windows_server_2008::sp2:x86:::::
cpe:2.3:o:microsoft:windows_server_2008::sp2:x64:::::
cpe:2.3:o:microsoft:windows_server_2008::r2:itanium:::::
cpe:2.3:o:microsoft:windows_server_2008::r2:x64:::::
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:::::*
cpe:2.3:o:microsoft:windows_server_2012:-:::::::*
cpe:2.3:o:microsoft:windows_vista::sp2::::::*
cpe:2.3:o:microsoft:windows_vista:-:sp2::::::
cpe:2.3:o:microsoft:windows_xp::sp3::::::*
cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:::::*

Related information, measures and tools

No	URL	refsource	タグ
1	http://googlechromereleases.blogspot.com/2012/09/stable-channel-update_25.html
2	http://googlechromereleases.blogspot.com/2012/09/stable-channel-update_25.html
3	http://secunia.com/advisories/51239
4	http://secunia.com/advisories/51239
5	http://www.securitytracker.com/id?1027750
6	http://www.securitytracker.com/id?1027750
7	http://www.us-cert.gov/cas/techalerts/TA12-318A.html
8	http://www.us-cert.gov/cas/techalerts/TA12-318A.html
9	https://code.google.com/p/chromium/issues/detail?id=146254
10	https://code.google.com/p/chromium/issues/detail?id=146254
11	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-075
12	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-075
13	https://exchange.xforce.ibmcloud.com/vulnerabilities/78822
14	https://exchange.xforce.ibmcloud.com/vulnerabilities/78822
15	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15847
16	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15847

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-119	バッファエラー	https://cwe.mitre.org/data/definitions/118.html

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:google:chrome::::::::		22.0.1229.78
cpe:2.3:a:google:chrome:22.0.1229.0:::::::*
cpe:2.3:a:google:chrome:22.0.1229.1:::::::*
cpe:2.3:a:google:chrome:22.0.1229.2:::::::*
cpe:2.3:a:google:chrome:22.0.1229.3:::::::*
cpe:2.3:a:google:chrome:22.0.1229.4:::::::*
cpe:2.3:a:google:chrome:22.0.1229.6:::::::*
cpe:2.3:a:google:chrome:22.0.1229.7:::::::*
cpe:2.3:a:google:chrome:22.0.1229.8:::::::*
cpe:2.3:a:google:chrome:22.0.1229.9:::::::*
cpe:2.3:a:google:chrome:22.0.1229.10:::::::*
cpe:2.3:a:google:chrome:22.0.1229.11:::::::*
cpe:2.3:a:google:chrome:22.0.1229.12:::::::*
cpe:2.3:a:google:chrome:22.0.1229.14:::::::*
cpe:2.3:a:google:chrome:22.0.1229.16:::::::*
cpe:2.3:a:google:chrome:22.0.1229.17:::::::*
cpe:2.3:a:google:chrome:22.0.1229.18:::::::*
cpe:2.3:a:google:chrome:22.0.1229.20:::::::*
cpe:2.3:a:google:chrome:22.0.1229.21:::::::*
cpe:2.3:a:google:chrome:22.0.1229.22:::::::*
cpe:2.3:a:google:chrome:22.0.1229.23:::::::*
cpe:2.3:a:google:chrome:22.0.1229.24:::::::*
cpe:2.3:a:google:chrome:22.0.1229.25:::::::*
cpe:2.3:a:google:chrome:22.0.1229.26:::::::*
cpe:2.3:a:google:chrome:22.0.1229.27:::::::*
cpe:2.3:a:google:chrome:22.0.1229.28:::::::*
cpe:2.3:a:google:chrome:22.0.1229.29:::::::*
cpe:2.3:a:google:chrome:22.0.1229.31:::::::*
cpe:2.3:a:google:chrome:22.0.1229.32:::::::*
cpe:2.3:a:google:chrome:22.0.1229.33:::::::*
cpe:2.3:a:google:chrome:22.0.1229.35:::::::*
cpe:2.3:a:google:chrome:22.0.1229.36:::::::*
cpe:2.3:a:google:chrome:22.0.1229.37:::::::*
cpe:2.3:a:google:chrome:22.0.1229.39:::::::*
cpe:2.3:a:google:chrome:22.0.1229.48:::::::*
cpe:2.3:a:google:chrome:22.0.1229.49:::::::*
cpe:2.3:a:google:chrome:22.0.1229.50:::::::*
cpe:2.3:a:google:chrome:22.0.1229.51:::::::*
cpe:2.3:a:google:chrome:22.0.1229.52:::::::*
cpe:2.3:a:google:chrome:22.0.1229.53:::::::*
cpe:2.3:a:google:chrome:22.0.1229.54:::::::*
cpe:2.3:a:google:chrome:22.0.1229.55:::::::*
cpe:2.3:a:google:chrome:22.0.1229.56:::::::*
cpe:2.3:a:google:chrome:22.0.1229.57:::::::*
cpe:2.3:a:google:chrome:22.0.1229.58:::::::*
cpe:2.3:a:google:chrome:22.0.1229.59:::::::*
cpe:2.3:a:google:chrome:22.0.1229.60:::::::*
cpe:2.3:a:google:chrome:22.0.1229.62:::::::*
cpe:2.3:a:google:chrome:22.0.1229.63:::::::*
cpe:2.3:a:google:chrome:22.0.1229.64:::::::*
cpe:2.3:a:google:chrome:22.0.1229.65:::::::*
cpe:2.3:a:google:chrome:22.0.1229.67:::::::*
cpe:2.3:a:google:chrome:22.0.1229.76:::::::*
cpe:2.3:o:microsoft:windows_7:-:sp1:x86:::::*
cpe:2.3:o:microsoft:windows_7:-:::::::*
cpe:2.3:o:microsoft:windows_7:-:sp1:x64:::::*
cpe:2.3:o:microsoft:windows_8:-:-:x86:::::*
cpe:2.3:o:microsoft:windows_8:-:-:x64:::::*
cpe:2.3:o:microsoft:windows_rt:-:::::::*
cpe:2.3:o:microsoft:windows_server_2003::sp2::::::*
cpe:2.3:o:microsoft:windows_server_2008::sp2:x86:::::
cpe:2.3:o:microsoft:windows_server_2008::sp2:x64:::::
cpe:2.3:o:microsoft:windows_server_2008::r2:itanium:::::
cpe:2.3:o:microsoft:windows_server_2008::r2:x64:::::
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:::::*
cpe:2.3:o:microsoft:windows_server_2012:-:::::::*
cpe:2.3:o:microsoft:windows_vista::sp2::::::*
cpe:2.3:o:microsoft:windows_vista:-:sp2::::::
cpe:2.3:o:microsoft:windows_xp::sp3::::::*
cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:::::*