What’s Vulnerable › Vulnerabilities

CVE-2011-1300

• Severity: critical (CVSS 10.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2011-04-15 · updated 2026-06-16
• Weakness: CWE-189

Description

The Program::getActiveUniformMaxLength function in libGLESv2/Program.cpp in libGLESv2.dll in the WebGLES library in Almost Native Graphics Layer Engine (ANGLE), as used in Mozilla Firefox 4.x before 4.0.1 on Windows and in the GPU process in Google Chrome before 10.0.648.205 on Windows, allows remote attackers to execute arbitrary code via unspecified vectors, related to an "off-by-three" error.

Affected products

• Google Chrome: before 10.0.648.205 — fixed in 10.0.648.205
• Mozilla Firefox: 4.0, 4.0-beta1, 4.0-beta10, 4.0-beta11, 4.0-beta12, 4.0-beta2 (+7)

How to fix

Upgrade to a fixed version: Google Chrome 10.0.648.205. Check the vendor advisory for mitigations.

References

• http://code.google.com/p/angleproject/source/detail?r=611
• http://code.google.com/p/chromium/issues/detail?id=70070
• http://googlechromereleases.blogspot.com/2011/04/stable-channel-update.html
• http://secunia.com/advisories/44141
• http://www.mozilla.org/security/announce/2011/mfsa2011-17.html
• http://www.securityfocus.com/bid/47377
• http://www.securitytracker.com/id?1025377
• http://www.vupen.com/english/advisories/2011/1006
• https://bugzilla.mozilla.org/show_bug.cgi?id=623791
• https://exchange.xforce.ibmcloud.com/vulnerabilities/66766
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14466
• http://code.google.com/p/angleproject/source/detail?r=611

Get alerted when CVE-2011-1300 or the next vulnerability affects your stack