----------------------------------------------------------------------



Secunia integrated with Microsoft WSUS 
http://secunia.com/blog/71/



----------------------------------------------------------------------

TITLE:
Google Chrome Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA37769

VERIFY ADVISORY:
http://secunia.com/advisories/37769/

DESCRIPTION:
Some vulnerabilities and weaknesses have been reported in Google
Chrome, where some have unknown impacts and others can be exploited
by malicious people to disclose potentially sensitive information,
bypass certain security restrictions, or compromise a user's system.

1) A use-after-free error when handling pop-up windows and navigating
away from the current site can be exploited to corrupt memory via a
specially crafted web page.

Successful exploitation may allow execution of arbitrary code.

The vulnerability is confirmed in version 3.0.195.38. Other versions
may also be affected.

2) An unspecified error can be exploited to bypass the pop-up
blocker.

3) A design error in the handling of CSS stylesheets can be exploited
to potentially disclose sensitive information from other domains.

4) An unspecified error allows XMLHttpRequests to directories.

5) An unspecified error exists related to escaping characters in
shortcuts.

6) Unspecified errors exist related to drawing on canvases, which can
corrupt memory.

7) An unspecified error exists during image decoding, which can
corrupt memory.

8) An unspecified error exists, which may result in failure to strip
"Referer".

9) An unspecified error affects cross-domain access.

10) An unspecified error exists in the deserialisation of bitmaps.

SOLUTION:
Upgrade to version 4.0.249.78.

PROVIDED AND/OR DISCOVERED BY:
1) Jakob Balle and Carsten Eiram, Secunia Research.

The vendor credits:
2) SkyLined
3) Chris Evans
4) Chromium development community
5) Michal Zalewski and Inferno of SecureThoughts.com
6) Michal Zalewski and SkyLined
7) Robert Swiecki
8) Chromium development community
9) Tokuji Akamine, Symantec Consulting Services
10) Mark Dowd

ORIGINAL ADVISORY:
Secunia Research:
http://secunia.com/secunia_research/2009-65/

Google:
http://googlechromereleases.blogspot.com/2010/01/stable-channel-update_25.html

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------