‹ Volver al listado

CVE-2011-1691

Estado: ModificadaMedia (5)—
Gravedad5Media · CVSS 2.0
Probabilidad de explotación1.58 %mayor que el 75 % de las CVE
Explotación activaNono figura en el catálogo de CISA
Exploit públicoNo conocidosin código público localizado

La función counterToCSSValue en CSSComputedStyleDeclaration.cpp en las Hojas de Estilo en Cascada (CSS) implementada en WebCore en WebKit anterior a r82222, tal como se usa en Google Chrome anterior a v11.0.696.43 y otros productos, no controla correctamente el acceso a los atributos counterIncrement (1) y (2) counterReset de CSSStyleDeclaration proporcionado por una llamada al método getComputedStyle, permitiendo a atacantes remotos provocar una denegación de servicio (desreferencia a puntero NULL y caída de la aplicación) a través de código JavaScript manipulado.

CVSS

Puntuación base
5
Versión
2.0
Vector
AV:N/AC:L/Au:N/C:N/I:N/A:P

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días
1.58 %
Percentil entre todas las CVEs puntuadas
75
Fecha de la puntuación
22/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Google — Chrome

CWE

Referencias

Mostrar las 12 referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2011-1691",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2011-04-15T00:55:02.287",
  "references": [
    {
      "url": "http://code.google.com/p/chromium/issues/detail?id=77665",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://googlechromereleases.blogspot.com/2011/04/beta-channel-update_12.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://trac.webkit.org/changeset/82222",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://bugs.webkit.org/show_bug.cgi?id=57266",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/66818",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14365",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://code.google.com/p/chromium/issues/detail?id=77665",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://googlechromereleases.blogspot.com/2011/04/beta-channel-update_12.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://trac.webkit.org/changeset/82222",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugs.webkit.org/show_bug.cgi?id=57266",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/66818",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14365",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-476"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The counterToCSSValue function in CSSComputedStyleDeclaration.cpp in the Cascading Style Sheets (CSS) implementation in WebCore in WebKit before r82222, as used in Google Chrome before 11.0.696.43 and other products, does not properly handle access to the (1) counterIncrement and (2) counterReset attributes of CSSStyleDeclaration data provided by a getComputedStyle method call, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted JavaScript code."
    },
    {
      "lang": "es",
      "value": "La función counterToCSSValue en CSSComputedStyleDeclaration.cpp en las Hojas de Estilo en Cascada (CSS) implementada en WebCore en WebKit anterior a r82222, tal como se usa en Google Chrome anterior a v11.0.696.43 y otros productos, no controla correctamente el acceso a los atributos counterIncrement (1) y (2) counterReset de CSSStyleDeclaration proporcionado por una llamada al método getComputedStyle, permitiendo a atacantes remotos provocar una denegación de servicio (desreferencia a puntero NULL y caída de la aplicación) a través de código JavaScript manipulado."
    }
  ],
  "lastModified": "2026-06-16T23:29:50.670",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0F9D94EF-9F7D-4E97-AEEA-50F9F332528B",
              "versionEndExcluding": "11.0.696.43"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}