Update bei Google Chrome behebt zwei Sicherheitslücken

Google hat die stabile Version 1.0.154.64 von Google Chrome veröffentlicht. Mit dieser Veröffentlichung schließt Google zwei Sicherheitslücken, die man intern entdeckt hat.

CVE-2009-1441: Input validation error in the browser process.
A failure to properly validate input from a renderer (tab) process could allow an attacker to crash the browser and possibly run arbitrary code with the privileges of the logged on user. To exploit this vulnerability, an attacker would need to be able to run arbitrary code inside the renderer process.

More info: http://code.google.com/p/chromium/issues/detail?id=10869

Severity: Critical. An attacker might be able to run code with the privileges of the logged on user.

Mitigation: An attacker would need to be able to run arbitrary code in the renderer process.

CVE-2009-1442: Integer overflow in Skia 2D graphics.
A failure to check the result of integer multiplication when computing image sizes could allow a specially-crafted image or canvas to cause a tab to crash and it might be possible for an attacker to execute arbitrary code inside the (sandboxed) renderer process.

More info: http://code.google.com/p/chromium/issues/detail?id=10736

Severity: High. An attacker might be able to run arbitrary code within the Google Chrome sandbox.

Mitigations:
A victim would need to visit a page under an attacker’s control.
Any code that an attacker might be able to run inside the renderer process would be inside the sandbox. Click here for more details about sandboxing.

Außerdem wurde bei dem Update Gears 0.5.16.0 integriert. Sollte Google Chrome nicht der Standardbrowser sein, erscheint oben diese Leiste:

Im Screenshot Chromium

---

---