----------------------------------------------------------------------


Windows Applications Insecure Library Loading

The Official, Verified Secunia List:
http://secunia.com/advisories/windows_insecure_library_loading/

The list is continuously updated as we confirm the vulnerability reports so check back regularly too see if any of your apps are affected.


----------------------------------------------------------------------

TITLE:
Google Chrome Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA41242

VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/41242/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=41242

RELEASE DATE:
2010-09-04

DISCUSS ADVISORY:
http://secunia.com/advisories/41242/#comments

AVAILABLE ON SITE AND IN CUSTOMER AREA:
 * Last Update
 * Popularity
 * Comments
 * Criticality Level
 * Impact
 * Where
 * Solution Status
 * Operating System / Software
 * CVE Reference(s)

http://secunia.com/advisories/41242/

ONLY AVAILABLE IN CUSTOMER AREA:
 * Authentication Level
 * Report Reliability
 * Secunia PoC
 * Secunia Analysis
 * Systems Affected
 * Approve Distribution
 * Remediation Status
 * Secunia CVSS Score
 * CVSS

https://ca.secunia.com/?page=viewadvisory&vuln_id=41242

ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
 * AUTOMATED SCANNING

http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/

DESCRIPTION:
Some vulnerabilities have been reported in Google Chrome, which can
be exploited by malicious people to bypass certain security
restrictions, disclose potentially sensitive information, conduct
spoofing attacks, and compromise a user's system.

1) Certain unspecified homographic sequences can be used to spoof the
URL bar.

2) The application did not properly restrict access to the clipboard,
which can be exploited to e.g. set the clipboard content.

3) A stale pointer error exists related to SVG filters. Further
information is currently not available.

4) An unspecified error can be exploited to enumerate installed
extensions.

5) A use-after-free error exists within the notification presenter.
Further information is currently not available.

6) An unspecified error related to the notification permissions can
be exploited to cause a memory corruption.

7) "Integer errors" exist related to WebSockets. Further information
is currently not available.

8) An unspecified error related to counter nodes can be exploited to
cause a memory corruption.

9) The application may store excessive autocomplete entries. Further
information is currently not available.

10) A stale pointer error exists within the focus handling. Further
information is currently not available.

11) An unspecified error exists within the sandbox parameter
deserialisation.

12) An unspecified error can be exploited to conduct cross-origin
image thefts.

Note: Additionally, an error related to WebSockets can be exploited
to cause a "NULL crash" and the pop-up blocker can be bypassed via
blank frame targets.

SOLUTION:
Fixed in version 6.0.472.53.

PROVIDED AND/OR DISCOVERED BY:
The vendor credits:
1) Chris Weber, Casaba Security
2) Brook Novak
3) Tavis Ormandy, Google Security Team
4) Lostmon
5)  Sergey Glazunov
6) Michal Zalewski, Google Security Team and SkyLined, Google Chrome
Security Team
7) Cris Neckar, Google Chrome Security Team and Keith Campbell
8) kuzzcc
9) Inferno, Google Chrome Security Team
10) Vupen
11) Ashutosh Mehra and Vineet Batra, Adobe Reader Sandbox Team
12) Isaac Dawson

The vendor also credits Marc Schoenefeld for his help regarding a
workaround related to a Windows kernel vulnerability, which was
previously incorrectly reported to be included in version
5.0.375.127.

ORIGINAL ADVISORY:
http://googlechromereleases.blogspot.com/2010/09/stable-and-beta-channel-updates.html

Marc Schoenefeld:
http://www.marc-schoenefeld.de/vulns.html

OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/

DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/

EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/

EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/

EXPLOIT:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------