September 27, 2016

Google Fixes High Priority Security Vulnerabilities with new Release of Chrome

(LiveHacking.Com) – Google has released Chrome 18.0.1025.168 on Windows, Mac and Linux to fix several High priority security bugs. Under Google’s ranking scheme a vulnerability is of ‘High’ severity when it could let an attacker read or modify confidential data belonging to other web sites or execute arbitrary code within the confines of the sandbox. Google also rate vulnerabilities that interfere with browser security features (e.g. that can disrupt the location bar and lock icon) are also high severity.

This release fixes five security vulnerabilities of which three are rated as High. All the High rated vulnerabilities are related to use after free conditions which are often used as the starting point of an exploit to execute arbitrary code on the victim’s computer. One of the vulnerabilities was found by security researcher miaubiz who received $1000 under the Chromium Vulnerability Rewards Program.

The full list of fixes is as follows:

  • [106413] High CVE-2011-3078: Use after free in floats handling. Credit to Google Chrome Security Team (Marty Barbella) and independent later discovery by miaubiz.
  • [117110] High CVE-2012-1521: Use after free in xml parser. Credit to Google Chrome Security Team (SkyLined) and independent later discovery by  wushi of team509 reported through iDefense VCP (V-874rcfpq7z).
  • [117627] Medium CVE-2011-3079: IPC validation failure. Credit to PinkiePie.
  • [121726] Medium CVE-2011-3080: Race condition in sandbox IPC. Credit to Willem Pinckaers of Matasano.
  • [$1000] [121899] High CVE-2011-3081: Use after free in floats handling. Credit to miaubiz.

Note that the referenced bugs may be kept private by Google  until a majority of Chrome users are up to date with the fix.


Share and Enjoy:
  • Print
  • Digg
  • StumbleUpon
  • del.icio.us
  • Facebook
  • Yahoo! Buzz
  • Twitter
  • Google Bookmarks