Zero Day

Ryan Naraine, Emil Protalinski and Dancho Danchev

Google spends $17,000 on Chrome browser vulnerabilities

By Ryan Naraine | August 3, 2011, 12:02pm PDT

Summary: The Chrome 13.0.782.107 update, released via the browser’s silent automatic update mechanism, fixes a total of 30 vulnerablities, some serious enough to allow drive-by download attacks.

Google has release another Chrome browser point update to fix multiple critical security vulnerabilities that affect Windows, Mac, Linux, and Chrome Frame users.

The Chrome 13.0.782.107 update, released via the browser’s silent automatic update mechanism, fixes a total of 30 vulnerablities, some serious enough to allow drive-by download attacks.

The company said it paid about $17,000 in bounties to hackers who found and reported the vulnerabilities.

Some of the “high-risk” issues fixed:

[$1000 each] [78841] High CVE-2011-2359: Stale pointer due to bad line box tracking in rendering. Credit to miaubiz and Martin Barbella.
[$1000] [86502] High CVE-2011-2790: Use-after-free with floating styles. Credit to miaubiz.
[$1000] [86900] High CVE-2011-2791: Out-of-bounds write in ICU. Credit to Yang Dingning from NCNIPC, Graduate University of Chinese Academy of Sciences.
[$1000] [87148] High CVE-2011-2792: Use-after-free with float removal. Credit to miaubiz.
[$1000] [87227] High CVE-2011-2793: Use-after-free in media selectors. Credit to miaubiz.
[87548] High CVE-2011-2796: Use-after-free in Skia. Credit to Google Chrome Security Team (Inferno) and Kostya Serebryany of the Chromium development community.
[$1000] [87729] High CVE-2011-2797: Use-after-free in resource caching. Credit to miaubiz.
[87815] Low CVE-2011-2798: Prevent a couple of internal schemes from being web accessible. Credit to sirdarckcat of the Google Security Team.
[$1000] [87925] High CVE-2011-2799: Use-after-free in HTML range handling. Credit to miaubiz.
[$1000] [88591] High CVE-2011-2802: v8 crash with const lookups. Credit to Christian Holler.
[$1000] [88846] High CVE-2011-2801: Use-after-free in frame loader. Credit to miaubiz.
[$1000] [88889] High CVE-2011-2818: Use-after-free in display box rendering. Credit to Martin Barbella.
[$500] [89142] High CVE-2011-2804: PDF crash with nested functions. Credit to Aki Helin of OUSPG.
[$1500] [89520] High CVE-2011-2805: Cross-origin script injection. Credit to Sergey Glazunov.
[$1500] [90222] High CVE-2011-2819: Cross-origin violation in base URI handling. Credit to Sergey Glazunov.

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

More from “Zero Day”

BlueHat Prize: A new twist on security research incentives

Apple QuickTime flaws haunt Windows users

Topics

Google Inc., Vulnerability, Web Browser, Ryan Naraine, Browser Vulnerability, Web Browsers, Patches, Security, Internet

Ryan Naraine is a journalist and social media enthusiast specializing in Internet and computer security issues.

Full Bio
Disclosure
Contact

Vendor HotSpot

The 360° Conversation around Cloud Computing

TECH VISUALIZER brings the social conversation to life... powered by Brocade

Learn More »

Related Discussions on TechRepublic

Did you know you can take part in these discussions with your ZDNet membership?

Is your agile project management tools serving you effectively

Ask a Question Start a Discussion

Comments

Add Your Opinion

Join the conversation!

Follow via:: RSS; Email Alert

Just In

RE: Google spends $17,000 on Chrome browser vulnerabilities

sirnem 20th Sep

m2 pvp serverlar tan??t??m?? pvp serverler mt2 private servers metin2 pvp serverler metin2 games metin2 pvp serverlar
mt2 pvp servers pvp metin2 online games mt2 pvp m2 games servers metin2
private servers mt2 private server m2 private online game metin 2
g??zel s??zler roms guzel sozler
face 100 ifadeleri yemek tarifleri yemek tarifleri face guncel news face t He Facebook land facebook
games hiller metin2 hile games dowland metin2 indir

chat
mynet
sex
sex hikayeleri

View in thread

Please Select
Please Select

0 Votes

+ -

RE: Google spends $17,000 on Chrome browser vulnerabilities

Alexander2011 3rd Aug

When i view over 40 picture chrome can't open pictures .avant doesn't happen.This is a bug of chrome.

Reply
Flag

0 Votes

+ -

RE: Google spends $17,000 on Chrome browser vulnerabilities

Greg2bme 5th Aug

Since updating Google Chrome to version 13.0.782.107, it's been mostly sluggish and most times non responsive when trying to load pages. Something got broke.

Reply
Flag

0 Votes

+ -

RE: Google spends $17,000 on Chrome browser vulnerabilities

Cattleya.vns 13th Aug

Yes, Chrome 13 crash every time.

Reply
Flag

0 Votes

+ -

RE: Google spends $17,000 on Chrome browser vulnerabilities

whitenexus 13th Aug

@Cattleya.vns

I run the Alpha build (15.0.849.0) of Chrome and this thing rocks! It just keeps getting better and better with each version.

Reply
Flag

0 Votes

+ -

RE: Google spends $17,000 on Chrome browser vulnerabilities

Greg2bme 14th Aug

@whitenexus

How can the beta version of Google Chrome run better than the stable version of Google Chrome? That's backwards. Google needs to work harder on browser stability. Because Chrome starts off good, but then performance deteriorates after a while. And I hate when the built in flash gets nonresponsive and Google Chrome keeps asking me if I would like to stop it.