Google patches 14 high-risk Chrome browser holes

Google patches 14 high-risk Chrome browser holes

Summary: The vulnerabilities were fixed in the newest Google Chrome 17.0.963.65 (Windows, Mac, Linux and Chrome Frame).

SHARE:
TOPICS: Google, Browser
4

Google has shipped yet another Chrome browser update to fix more that a dozen "high-risk" security holes that expose millions of users to malicious hacker attacks.

The vulnerabilities were fixed in the newest Google Chrome 17.0.963.65 (Windows, Mac, Linux and Chrome Frame).

As part of its bug bounty program, Google paid $17,500 for the rights of the vulnerability information.

The details:follow Ryan Naraine on twitter

  • [$1000] [105867] High CVE-2011-3031: Use-after-free in v8 element wrapper. Credit to Chamal de Silva.
  • [$1000] [108037] High CVE-2011-3032: Use-after-free in SVG value handling. Credit to Arthur Gerkis.
  • [$2000] [108406] [115471] High CVE-2011-3033: Buffer overflow in the Skia drawing library. Credit to Aki Helin of OUSPG.
  • [$1000] [111748] High CVE-2011-3034: Use-after-free in SVG document handling. Credit to Arthur Gerkis.
  • [$2000] [112212] High CVE-2011-3035: Use-after-free in SVG use handling. Credit to Arthur Gerkis.
  • [$1000] [113258] High CVE-2011-3036: Bad cast in line box handling. Credit to miaubiz.
  • [$3000] [113439] [114924] [115028] High CVE-2011-3037: Bad casts in anonymous block splitting. Credit to miaubiz.
  • [$1000] [113497] High CVE-2011-3038: Use-after-free in multi-column handling. Credit to miaubiz.
  • [$1000] [113707] High CVE-2011-3039: Use-after-free in quote handling. Credit to miaubiz.
  • [$500] [114054] High CVE-2011-3040: Out-of-bounds read in text handling. Credit to miaubiz.
  • [$1000] [114068] High CVE-2011-3041: Use-after-free in class attribute handling. Credit to miaubiz.
  • [$1000] [114219] High CVE-2011-3042: Use-after-free in table section handling. Credit to miaubiz.
  • [$1000] [115681] High CVE-2011-3043: Use-after-free in flexbox with floats. Credit to miaubiz.
  • [$1000] [116093] High CVE-2011-3044: Use-after-free with SVG animation elements. Credit to Arthur Gerkis.
  • Separately, Google shelled out an additional $30,000 to a trio of researchers who used fuzzing techniques and tools to find and report major holes in the browser.

    Topics: Google, Browser

    Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

    Talkback

    4 comments
    Log in or register to join the discussion
    • Not a huge Google fan

      but I wish more vendors would follow Google's example on this. I'm all for better security.
      LiquidLearner
    • Wrong version

      Newest version of Chrome is .56 not .65

      And problems: It crashes all the time. Which I NEVER experienced before
      Boan2003
      • 17.0.963.65

        Vulnerability Fixes with Chrome 17.0.963.65, the current version.
        daikon
    • Im shocked, shocked I tell you to hear that chrome has 14 high risk bugs

      The chrome-bois keep telling me it's bug free and faster and more html5 compliant. But it's none of those. What gives?
      Johnny Vegas