Vulnerabilities / Threats
5/16/2012
11:34 AM
50%
50%

Google Chrome 19 Debuts, With 20 Bug Patches

Latest release of browser also adds the ability to synchronize open tabs across devices.

Google Drive: 10 Alternatives To See
Google Drive: 10 Alternatives To See
(click image for larger view and for slideshow)
Google Tuesday released version 19 of its Chrome browser, which includes fixes for 20 vulnerabilities, as well as a new feature for sharing open tabs across different devices. But Google said the feature won't be widely available for another few weeks.

The new version of Chrome is available for Windows, Mac, Linux, and Chrome Frame. All current Chrome installations should auto-update to the latest version over the next few days.

Google releases a new, stable version of Chrome about every six to eight weeks.

With the release of Chrome 19, Google also distributed $7,500 as part of its bug bounty program. None of the patched bugs were "critical," meaning--per the Common Vulnerability Scoring System (CVSS)--that attackers could have potentially used them to remotely execute arbitrary code. However, eight of the vulnerabilities patched in the new version of Chrome are of "high" severity, seven are ranked as "medium," and five are of "low" severity.

[ Read It's Browser Version Madness! ]

Six of the bugs were spotted by Google or the broader Chromium (Google Chrome OS) community. A low-risk, Windows-only "bad search path for Windows Media Player plug-in" bug was credited to Microsoft and Microsoft Vulnerability Research.

Full information about all of the bugs has yet to be released; Google typically waits to release detailed information until the majority of Chrome users have received related patches. But many of the patched bugs relate to memory errors in C/C++. Not coincidentally, Google said that a homegrown tool, AddressSanitizer, had been used by researchers to detect many of the patched vulnerabilities.

Unusually, Google also distributed an additional $9,000 in rewards to Aki Helin at the Oulu University Secure Programming Group in Finland, as well as Sławomir Błażek, Chamal de Silva, miaubiz, Arthur Gerkis, and Christian Holler "for working with us during the development cycle and preventing security regressions from ever reaching the stable channel." All feature prominently in Google's Security Hall of Fame, which lists researchers who have helped "make Chromium safer."

Google software engineer and "tab-wrangling server jockey" Raz Mathias explained how Chrome's new tab synchronization feature will work. "When you're signed in to Chrome, your open tabs are synced across all your devices, so you can quickly access them from the 'Other devices' menu on the New Tab page," he said in a blog post. "If you've got Chrome for Android Beta, you can open the same recipe tab right on your phone when you run out to the store for more ingredients. The back and forward buttons will even work, so you can pick up browsing right where you left off."

Chrome isn't the only browser now offering tab synchronization. Notably, Mozilla added tab synchronization to Firefox 4, which it released in 2010.

At this interactive Enterprise Mobility Virtual Event, experts and solution providers will offer detailed insight into how to bring some order to the mobile industry innovation chaos. When you register, you will gain access to live webcast presentations and virtual booths packed with free resources. It happens May 17.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-6090
Published: 2015-04-27
Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) DataMappingEditorCommands, (2) DatastoreEditorCommands, and (3) IEGEditorCommands servlets in IBM Curam Social Program Management (SPM) 5.2 SP6 before EP6, 6.0 SP2 before EP26, 6.0.3 before 6.0.3.0 iFix8, 6.0.4 before 6.0.4.5 iFix...

CVE-2014-6092
Published: 2015-04-27
IBM Curam Social Program Management (SPM) 5.2 before SP6 EP6, 6.0 SP2 before EP26, 6.0.4 before 6.0.4.6, and 6.0.5 before 6.0.5.6 requires failed-login handling for web-service accounts to have the same lockout policy as for standard user accounts, which makes it easier for remote attackers to cause...

CVE-2015-0113
Published: 2015-04-27
The Jazz help system in IBM Rational Collaborative Lifecycle Management 4.0 through 5.0.2, Rational Quality Manager 4.0 through 4.0.7 and 5.0 through 5.0.2, Rational Team Concert 4.0 through 4.0.7 and 5.0 through 5.0.2, Rational Requirements Composer 4.0 through 4.0.7, Rational DOORS Next Generation...

CVE-2015-0174
Published: 2015-04-27
The SNMP implementation in IBM WebSphere Application Server (WAS) 8.5 before 8.5.5.5 does not properly handle configuration data, which allows remote authenticated users to obtain sensitive information via unspecified vectors.

CVE-2015-0175
Published: 2015-04-27
IBM WebSphere Application Server (WAS) 8.5 Liberty Profile before 8.5.5.5 does not properly implement authData elements, which allows remote authenticated users to gain privileges via unspecified vectors.

Dark Reading Radio
Archived Dark Reading Radio
Join security and risk expert John Pironti and Dark Reading Editor-in-Chief Tim Wilson for a live online discussion of the sea-changing shift in security strategy and the many ways it is affecting IT and business.