In association with heise online

17 July 2009, 16:16

Google closes two vulnerabilities in Chrome

  • Twitter
  • Facebook
  • submit to slashdot
  • StumbleUpon
  • submit to reddit

Google has released version 2.0.172.37 of Chrome 2, a security update fixing two vulnerabilities in its web browser based on Apple’s open source WebKit browser application framework. The cause of the first vulnerability is a heap-based buffer overflow caused by a specially-crafted regular expression in JavaScript on a web page. According to Google, the vulnerability could be used by an attacker to run arbitrary code within the Google Chrome sandbox. Further details of the vulnerability, however, are currently being withheld until "a majority of users are up to date with the fix".

The Chrome 2 update also addresses a critical memory corruption vulnerability in the renderer (tab) process that could cause the browser to allocate very large memory buffers, causing the browser to crash and possibly allowing an attacker to execute arbitrary code with the privileges of the logged in user. According to Google, for an attack to be successful, "an attacker would need to be able to run arbitrary code inside the renderer process". In addition to fixing the security vulnerabilities, the developers have updated the V8 JavaScript engine to version 1.1.10.14 to fix issues with regular expressions and updated Gears to the latest 0.5.25.0 release.

Users that currently have Chrome installed can use the built-in update function by clicking Tools, selecting About Google Chrome and clicking the Update button.

See also:

(crve)

Print Version | Send by email | Permalink: http://h-online.com/-742537
 


  • July's Community Calendar





The H Open

The H Security

The H Developer

The H Internet Toolkit