----------------------------------------------------------------------


Windows Applications Insecure Library Loading

The Official, Verified Secunia List:
http://secunia.com/advisories/windows_insecure_library_loading/

The list is continuously updated as we confirm the vulnerability reports so check back regularly too see if any of your apps are affected.


----------------------------------------------------------------------

TITLE:
Google Chrome Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA41888

VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/41888/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=41888

RELEASE DATE:
2010-10-21

DISCUSS ADVISORY:
http://secunia.com/advisories/41888/#comments

AVAILABLE ON SITE AND IN CUSTOMER AREA:
 * Last Update
 * Popularity
 * Comments
 * Criticality Level
 * Impact
 * Where
 * Solution Status
 * Operating System / Software
 * CVE Reference(s)

http://secunia.com/advisories/41888/

ONLY AVAILABLE IN CUSTOMER AREA:
 * Authentication Level
 * Report Reliability
 * Secunia PoC
 * Secunia Analysis
 * Systems Affected
 * Approve Distribution
 * Remediation Status
 * Secunia CVSS Score
 * CVSS

https://ca.secunia.com/?page=viewadvisory&vuln_id=41888

ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
 * AUTOMATED SCANNING

http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/

DESCRIPTION:
Some vulnerabilities have been reported in Google Chrome, where some
have unknown impacts and others can can be exploited by malicious
people to conduct spoofing attacks, bypass certain security
restrictions, and potentially compromise a user's system.

1) An unspecified error can be exploited to conduct "autofill /
autocomplete profile spamming".

2) An unspecified error related to forms can be exploited to e.g.
cause a crash.

3) An unspecified error related to form autofills can be exploited to
e.g. cause a crash.

4) An unspecified error related to page unloads can be exploited to
conduct URL spoofing attacks.

5) An unspecified error allows to bypass the pop-up blocker.

6) An unspecified error related to a shutdown with Web Sockets can be
exploited to e.g. cause a crash.

7) An unspecified error exists within the generation of the PATH
variable.

Note: This only affects the Linux version.

8) An unspecified error related to animated GIFs can be exploited to
cause a memory corruption.

9) An unspecified error exists within the sandboxing of worker
processes.

Note: This only affects the Linux version.

10) An unspecified error exists due to "stale elements in an element
map".

SOLUTION:
Fixed in version 7.0.517.41.

PROVIDED AND/OR DISCOVERED BY:
1) Inferno, Google Chrome Security Team
2, 3, 6) Chromium development community
4) Independently discovered by kuzzcc and Jordi Chancel
5) kuzzcc
7) Dan Rosenberg, Virtual Security Research
8) Simon Schaak
9) Chris Evans, Google Chrome Security Team
10) Michal Zalewski, Google Security Team

ORIGINAL ADVISORY:
http://googlechromereleases.blogspot.com/2010/10/stable-channel-update.html

OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/

DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/

EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/

EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/

EXPLOIT:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------