Google patches 14 high-risk Chrome browser holes

Discuss any hints or tips regarding Google Chrome. The community appreciates any type of suggestions.

Google patches 14 high-risk Chrome browser holes

Postby BlueWater on Mon Mar 05, 2012 6:49 pm

Google has shipped yet another Chrome browser update to fix more that a dozen “high-risk” security holes that expose millions of users to malicious hacker attacks.

The vulnerabilities were fixed in the newest Google Chrome 17.0.963.65 (Windows, Mac, Linux and Chrome Frame).

As part of its bug bounty program, Google paid $17,500 for the rights of the vulnerability information.

The details:
[$1000] [105867] High CVE-2011-3031: Use-after-free in v8 element wrapper. Credit to Chamal de Silva.
[$1000] [108037] High CVE-2011-3032: Use-after-free in SVG value handling. Credit to Arthur Gerkis.
[$2000] [108406] [115471] High CVE-2011-3033: Buffer overflow in the Skia drawing library. Credit to Aki Helin of OUSPG.
[$1000] [111748] High CVE-2011-3034: Use-after-free in SVG document handling. Credit to Arthur Gerkis.
[$2000] [112212] High CVE-2011-3035: Use-after-free in SVG use handling. Credit to Arthur Gerkis.
[$1000] [113258] High CVE-2011-3036: Bad cast in line box handling. Credit to miaubiz.
[$3000] [113439] [114924] [115028] High CVE-2011-3037: Bad casts in anonymous block splitting. Credit to miaubiz.
[$1000] [113497] High CVE-2011-3038: Use-after-free in multi-column handling. Credit to miaubiz.
[$1000] [113707] High CVE-2011-3039: Use-after-free in quote handling. Credit to miaubiz.
[$500] [114054] High CVE-2011-3040: Out-of-bounds read in text handling. Credit to miaubiz.
[$1000] [114068] High CVE-2011-3041: Use-after-free in class attribute handling. Credit to miaubiz.
[$1000] [114219] High CVE-2011-3042: Use-after-free in table section handling. Credit to miaubiz.
[$1000] [115681] High CVE-2011-3043: Use-after-free in flexbox with floats. Credit to miaubiz.
[$1000] [116093] High CVE-2011-3044: Use-after-free with SVG animation elements. Credit to Arthur Gerkis.


Separately, Google shelled out an additional $30,000 to a trio of researchers who used fuzzing techniques and tools to find and report major holes in the browser.
User avatar
BlueWater
 
Posts: 402
Joined: Sun Sep 11, 2011 8:41 pm

Return to Google Chrome Hints & Tips

Who is online

Users browsing this forum: No registered users and 0 guests

cron