Chrome 17.0.963.46 Stable released


Recommended Posts

The Chrome team is excited to announce the release of Chrome 17 to the Stable Channel for Windows, Mac, Linux and Chrome Frame. 17.0.963.46 contains a number of new features including:
  • New Extensions APIs
  • Updated Omnibox Prerendering
  • Download Scanning Protection
  • Many other small changes

Security fixes and rewards:

Please seethe Chromium security page for more detail. Note that the referenced bugs may be kept private until a majority of our users are up to date with the fix

  • [73478] Low CVE-2011-3953: Avoid clipboard monitoring after paste event. Credit to Daniel Cheng of the Chromium development community.
  • [92550] Low CVE-2011-3954: Crash with excessive database usage. Credit to Collin Payne.
  • [93106] High CVE-2011-3955: Crash aborting an IndexDB transaction. Credit to David Grogan of the Chromium development community.
  • [103630] Low CVE-2011-3956: Incorrect handling of sandboxed origins inside extensions. Credit to Devdatta Akhawe, UC Berkeley.
  • [$1000] [104056] High CVE-2011-3957: Use-after-free in PDF garbage collection. Credit to Aki Helin of OUSPG.
  • [$2000] [105459] High CVE-2011-3958: Bad casts with column spans. Credit to miaubiz.
  • [$1000] [106441] High CVE-2011-3959: Buffer overflow in locale handling. Credit to Aki Helin of OUSPG.
  • [$500] [108416] Medium CVE-2011-3960: Out-of-bounds read in audio decoding. Credit to Aki Helin of OUSPG.
  • [$1000] [108871] Critical CVE-2011-3961: Race condition after crash of utility process. Credit to Shawn Goertzen.
  • [$500] [108901] Medium CVE-2011-3962: Out-of-bounds read in path clipping. Credit to Aki Helin of OUSPG.
  • [109094] Medium CVE-2011-3963: Out-of-bounds read in PDF fax image handling. Credit to Atte Kettunen of OUSPG.
  • [109245] Low CVE-2011-3964: URL bar confusion after drag + drop. Credit to Code Audit Labs of VulnHunt.com.
  • [109664] Low CVE-2011-3965: Crash in signature check. Credit to S?awomir B?a?ek.
  • [$1000] [109716] High CVE-2011-3966: Use-after-free in stylesheet error handling. Credit to Aki Helin of OUSPG.
  • [109717] Low CVE-2011-3967: Crash with unusual certificate. Credit to Ben Carrillo.
  • [$1000] [109743] High CVE-2011-3968: Use-after-free in CSS handling. Credit to Arthur Gerkis.
  • [$1000] [110112] High CVE-2011-3969: Use-after-free in SVG layout. Credit to Arthur Gerkis.
  • [$500] [110277] Medium CVE-2011-3970: Out-of-bounds read in libxslt. Credit to Aki Helin of OUSPG.
  • [$1000] [110374] High CVE-2011-3971: Use-after-free with mousemove events. Credit to Arthur Gerkis.
  • [110559] Medium CVE-2011-3972: Out-of-bounds read in shader translator. Credit to Google Chrome Security Team (Inferno).

The bugs [105459], [106441], [108416], [108901], [109716], [109743], [110112], [110277], [110374] and [110559] were detected usingAddressSanitizer.

In addition, we would like to thank miaubiz, Drew Yao and Braden Thomas of Apple, S?awomir B?a?ek, Aki Helin of OUSPG, Chamal de Silva and Atte Kettunen of OUSPG for working with us in the development cycle and preventing bugs from ever reaching the stable channel. Various rewards were issued, including a top $3133.70 reward to Aki Helin.

http://googlechromer...nel-update.html

Link to comment
https://www.neowin.net/forum/topic/1056850-chrome-17096346-stable-released/
Share on other sites

This has the webRequest API so blocking video ads with an adblock extension should work as good as Firefox now.

yes, thats an awesome feature. I was waiting for download protection. it protects all those stupid people who download and install what ever they find in the internet.

The Chrome Stable channel has been updated to 17.0.963.56 on Windows, Mac, Linux and Chrome Frame. This release fixes a number of stability and security issues in Chrome, and also includes a new version of Flash. More info on the Flash update is available from Adobe.

Security fixes and rewards:

Please see the Chromium security page for more detail. Note that the referenced bugs may be kept private until a majority of our users are up to date with the fix.

  • [105803]HighCVE-2011-3015: Integer overflows in PDF codecs. Credit to Google Chrome Security Team (scarybeasts).
  • [$500] [106336] MediumCVE-2011-3016: Read-after-free with counter nodes. Credit to miaubiz.
  • [$1000] [108695]HighCVE-2011-3017: Possible use-after-free in database handling. Credit to miaubiz.
  • [$1000] [110172]HighCVE-2011-3018: Heap overflow in path rendering. Credit to Aki Helin of OUSPG.
  • [110849] High CVE-2011-3019: Heap buffer overflow in MKV handling. Credit to Google Chrome Security Team (scarybeasts) and Mateusz Jurczyk of the Google Security Team.
  • [111575] Medium CVE-2011-3020: Native client validator error. Credit to Nick Bray of the Chromium development community.
  • [$1000] [111779] HighCVE-2011-3021: Use-after-free in subframe loading. Credit to Arthur Gerkis.
  • [112236] MediumCVE-2011-3022: Inappropriate use of http for translation script. Credit to Google Chrome Security Team (Jorge Obes).
  • [$500] [112259] MediumCVE-2011-3023: Use-after-free with drag and drop. Credit to pa_kt.
  • [112451] LowCVE-2011-3024: Browser crash with empty x509 certificate. Credit to chrometot.
  • [$500] [112670] MediumCVE-2011-3025: Out-of-bounds read in h.264 parsing. Credit to S?awomir B?a?ek.
  • [$1337] [112822] HighCVE-2011-3026: Integer overflow / truncation in libpng. Credit to J?ri Aedla.
  • [$1000] [112847]HighCVE-2011-3027: Bad cast in column handling. Credit to miaubiz.

http://googlechromereleases.blogspot.com/2012/02/chrome-stable-update.html

  • 3 weeks later...
The Chrome Stable channel has been updated to 17.0.963.65 on Windows, Mac, Linux and Chrome Frame. This release fixes a number of issues including:
  • Cursors and backgrounds sometimes do not load (bug 111218)
  • Plugins not loading on some pages (bug 108228)
  • Text paste includes trailing spaces (bug 106551)
  • Websites using touch controls break (bug 110332)

Along with these fixes, the release contains an updated version of the Adobe Flash player. More information on Flash updates is available from Adobe.

Security fixes and rewards:

Firstly, we have some special rewards for some special bugs!

  • [$10,000] [116661] Rockstar CVE-1337-d00d1: Excessive WebKit fuzzing. Credit to miaubiz.
  • [$10,000] [116662] Legend CVE-1337-d00d2: Awesome variety of fuzz targets. Credit to Aki Helin of OUSPG.
  • [$10,000] [116663] Superhero CVE-1337-d00d3: Significant pain inflicted upon SVG. Credit to Arthur Gerkis.

To determine the above rewards, we looked at bug finding performance over the past few months. The three named individuals stood out significantly. It also shouldn?t come as a surprise that they all feature (and earn more!) in the release notes below.

We have always reserved the right to arbitrarily reward sustained, extraordinary contributions. In this instance, we?re dropping a surprise bonus. We reserve the right to do so again and reserve the right to do so on a more regular basis! Chrome has a leading reputation for security and it wouldn?t be possible without the aggressive bug hunting of the wider community.

Please seethe Chromium security page for more detail. Note that the referenced bugs may be kept private until a majority of our users are up to date with the fix.

  • [$1000] [105867] High CVE-2011-3031: Use-after-free in v8 element wrapper. Credit to Chamal de Silva.
  • [$1000] [108037] High CVE-2011-3032: Use-after-free in SVG value handling. Credit to Arthur Gerkis.
  • [$2000] [108406] [115471] High CVE-2011-3033: Buffer overflow in the Skia drawing library. Credit to Aki Helin of OUSPG.
  • [$1000] [111748] High CVE-2011-3034: Use-after-free in SVG document handling. Credit to Arthur Gerkis.
  • [$2000] [112212] High CVE-2011-3035: Use-after-free in SVG use handling. Credit to Arthur Gerkis.
  • [$1000] [113258] High CVE-2011-3036: Bad cast in line box handling. Credit to miaubiz.
  • [$3000] [113439] [114924] [115028] High CVE-2011-3037: Bad casts in anonymous block splitting. Credit to miaubiz.
  • [$1000] [113497] High CVE-2011-3038: Use-after-free in multi-column handling. Credit to miaubiz.
  • [$1000] [113707] High CVE-2011-3039: Use-after-free in quote handling. Credit to miaubiz.
  • [$500] [114054] High CVE-2011-3040: Out-of-bounds read in text handling. Credit to miaubiz.
  • [$1000] [114068] High CVE-2011-3041: Use-after-free in class attribute handling. Credit to miaubiz.
  • [$1000] [114219] High CVE-2011-3042: Use-after-free in table section handling. Credit to miaubiz.
  • [$1000] [115681] High CVE-2011-3043: Use-after-free in flexbox with floats. Credit to miaubiz.
  • [$1000] [116093] High CVE-2011-3044: Use-after-free with SVG animation elements. Credit to Arthur Gerkis.

The majority of the above bugs were detected using AddressSanitizer, which rocks.

More detailed updates are available on the Chrome Blog. Full details about what changes are in this release are available in the SVN revision log. Interested in hopping on the stable channel? Find out how. If you find a new issue, please let us know by filing a bug.

http://googlechromereleases.blogspot.com/2012/03/chrome-stable-update.html

  • 2 weeks later...
Some of the items listed below represent the start of hardening measures based on study of the exploits submitted to the Pwnium competition.

[$1000] [113902] High CVE-2011-3050: Use-after-free with first-letter handling. Credit to miaubiz.

[116162] High CVE-2011-3045: libpng integer issue from upstream. Credit to Glenn Randers-Pehrson of the libpng project.

[$1000] [116461] High CVE-2011-3051: Use-after-free in CSS cross-fade handling. Credit to Arthur Gerkis.

[116637] High CVE-2011-3052: Memory corruption in WebGL canvas handling. Credit to Ben Vanik of Google.

[$1000] [116746] High CVE-2011-3053: Use-after-free in block splitting. Credit to miaubiz.

[117418] Low CVE-2011-3054: Apply additional isolations to webui privileges. Credit to Sergey Glazunov.

[117736] Low CVE-2011-3055: Prompt in the browser native UI for unpacked extension installation. Credit to PinkiePie.

[$2000] [117550] High CVE-2011-3056: Cross-origin violation with ?magic iframe?. Credit to Sergey Glazunov.

[$500] [117794] Medium CVE-2011-3057: Invalid read in v8. Credit to Christian Holler.

Also, this single low severity issue was fixed in a previous patch but we forgot to issue proper credit:

[108648] Low CVE-2011-3049: Extension web request API can interfere with system requests. Credit to Michael Gundlach

http://googlechromereleases.blogspot.com/2012/03/stable-channel-update_21.html

This topic is now closed to further replies.
  • Posts

    • You sound like some Ukrainians in Crimea before 2014: "I didn't vote for USSR disbanding - I want Ukraine to be part of Russia again" 🤣
    • Uninstalr 3.1 by Razvan Serea Introducing Uninstalr: Easy to use and very accurate software uninstaller for Windows. It can uninstall multiple apps at the same time and we think it’s pretty cool. Developed with expertise by Macecraft Software - the minds behind jv16 PowerTools. Key Features Batch uninstall many apps at the same time. Supports unattended uninstallation of apps. Supports monitoring of new software installations. Also detects portable apps and previously uninstalled software leftovers. Shows all the data added to your system by installed software on a file by file basis. Shows all the data it will remove before starting the uninstallation. Filter and search the list of installed software. According to our benchmark, Uninstalr is the most accurate software uninstaller by leaving the least amount of leftovers when uninstalling apps. Supports detection and uninstallation of Microsoft Store, Steam, Big Fish Game System, Chocolatey, NuGet and Ninite installed software. Supports Windows Dark Mode. Supports Windows 11, 10, 8 and 7. Comes with these translations builtin: Chinese Simplified, Chinese Traditional, Czech, Danish, English, Filipino, Finnish, French, German, Greek, Hindi, Hungarian, Indonesian, Italian, Japanese, Korean, Malay, Norwegian, Polish, Portuguese, Romanian, Slovak, Spanish, Swedish, Thai, Turkish, Ukrainian and Vietnamese. Has a single executable file portable version and a normal setup version. Uninstalr is freeware, lightweight and easy to use. No bells and whistles, no nonsense. Uninstalr’s custom uninstallation engine has a dedicated support for the detection and uninstallation of 15 types of apps: Normal Windows apps Microsoft Store apps Portable apps Chocolatey apps Ninite apps PortableApps.com apps Steam games EA App games Epic Games Store games Riot platform games GOG Galaxy games WarGaming.net games Battle.net games itch.io games Big Fish platform games Uninstalr 3.1 changelog: Key Changes Uninstalr now starts and shows the list of installed apps faster after the initial scan has been completed, and with much smaller memory usage. Uninstalr now detects and highlights apps that automatically start with Windows. Greatly improved the detection of portable apps. Improvements New feature: Uninstalr now detects and highlights apps that automatically start with Windows. New feature: Uninstalr now highlights possible leftovers and apps from Russia and China. This can be disabled from the Settings. New feature: A new filter that allows you to show only software that is installed to other than the system drive. New feature: Users can now select to always do the deepest and the most accurate scan for installed apps, at the cost of the analysis taking a longer time. Greatly improved the detection of portable apps, such as added dedicated support for MiTeC, EZ Tools and SysInternals tools. Improved support for portable apps installed via Windows System Control Center (WSCC). NirSoft portable apps are now listed with "NirSoft" prefix for easier identification. Improved the speed of uninstalling apps. The main installed software listing search will now find "Xbox GameBar" if you search for "Game bar" and vice versa. The tooltip now displays more detailed information of the installed apps, such as its registry key and uninstaller path. The links in the About section now look more like clickable links. The main menu is now more clearly indicated in the main user interface. Microsoft Teams Meeting Add-in for Microsoft Office ships with some Windows 11 installations and is now considered a builtin Windows app and only listed if builtin Windows apps filter is enabled. Added a Help button to the main user interface that opens the help section of the website. Added an option not to close Uninstalr after uninstallation. If you open the Uninstalr website from the app, the website now receives the version number of your current Uninstalr version and warns you if you are using anything but the latest version. Improved the accuracy of the New Software Monitor. Improved confirmation messages for Steam and other platform related uninstalls. Improved the uninstallation performance of Steam games. Fixes: Known bug fixed: Some installed app names are capitalized incorrectly, such as "CCleaner Portable" is listed as "ccleaner portable". Known bug fixed: Some apps can be listed twice, for example, Smart Defrag can be listed once as Smart Defrag and then Smart Defrag Home. Known bug fixed: On the pre-uninstallation screen, the Scripts checkbox can be checked by default on Dark Mode but not on the normal mode. Known bug fixed: Perform Deep Analysis can be started only by clicking the button, not via the Right Click menu, main menu or F4 keyboard shortcut. Muse Hub could be incorrectly listed as Adobe Muse. SyncTrayzor was incorrectly detected as two unrelated software, SyncTrayzor and Syncthing. Smart Defrag was incorrectly listed twice as Smart Defrag 11 and Smart Defrag Home. It was possible to enter non-printable characters to the search input boxes of the main screen, and the path listing screen, which caused the UI to look funny. Changing the translation from Settings, especially many times in a row, caused the UI to distort. If you had multiple instances of portable apps on your system, such as the 64b and 32b versions of the same portable app, typically only one of them was detected, not both. In some very rare cases, Uninstalr UI could start with random characters in its search input boxes, which could make the UI look rather confusing. This was a rare issue, only reported by two users. The pre-uninstallation screen could display non-existing paths for example as the software's installation directory or main exe file. This was a cosmetic issue. New Software Monitor cannot detect the installation of Claude. Selecting all the found software made the UI look funny with the top panel covering everything else (because the names of all the selected software were listed there). Sometimes a Steam game could be listed a normal app instead of a Steam game. If the system restart after an uninstallation is delayed, e.g. because of Windows Updates being installed, this additional delay is incorrectly added to the time how long the uninstallation process took. This cosmetic bug could cause the program incorrectly report an uninstallation time longer than the actual uninstallation time. Uninstalling Minecraft could simply fail. The Only scan the system drive for installed apps setting does not fully work. If some apps are installed to a non system drive and this setting is enabled, the app could still be detected and listed on the main user interface. Changing any settings could also incorrectly alter the Only Scan The System Drive For Installed Apps setting. Microsoft OneDrive and Copilot are not always detected. If you enter something to the search filter field, then select the text and press the Delete key, this triggers the Uninstall button click even if your intent was to delete the text input. If you press the F5 key to refresh the screen during the uninstallation loading screen, the program will crash. If you enabled some setting, such as "Do not analyze installed app installation sizes", it could automatically be unchecked later. Uninstalr doesn't warn you if you try to remove Fortec antivirus. There should be a warning if user attempts to remove any antivirus or antimalware type program. Such programs should not be uninstalled using a third party uninstaller, as they are typically protected against automated uninstallation, for security reasons. With "Do not analyze installed app installation sizes" option checked from the Settings, Uninstalr could still display some installation size related elements in the UI which was confusing. The "Only scan the system drive" option moved under Improve Scan Speed from the General settings. If two software have the exact same name and version number, selecting both of them for uninstallation fails because only one is actually selected. Sorting the installed apps by size sometimes fails and the order is incorrect. The "Don't show which paths are currently analyzed" did not work correctly - some parts of the UI still show the currently analyzed path with this setting checked. The "Don't list software less than 10 MB" filter did not work correctly - some apps smaller than 10 MB could still be listed. Uninstalr could start very quickly and display an empty list of detected apps. Restarting the app usually fixed the issue and the list of installed apps was properly displayed. If you placed portable Uninstalr to a same folder with other portable apps, those were not detected because Uninstalr automatically added its installation folder to the ignore list. When trying to uninstall some specific software, Uninstalr could get stuck on the Searching for more data relating to the app phase. Uninstalr could sometimes do a silent uninstallation even if user had unchecked the Perform a silent uninstallation option. Known issues: Uninstalr can fail to run with an Out Of Memory error in systems that have a lot of installed apps. Using the New Software Monitor tool multiple times during one session can cause the program to get stuck on the Scanning stage. The "uninstallation completed" message box sometimes closes when the user moves the mouse cursor over the button before user clicks it. There is no feedback for the user after Fix Information feature has been used. The Right Click menu's Select by publisher option can display the number of apps per each publisher without correct vertical alignment. The default user interface might not display all of the found installed apps if you have over 600 installed apps. If you do, using the Screen Reader Compatible Interface solves the issue. Leftover apptype filter checkbox is shown in red font only in Dark Mode. Clicking the app's icon from the Windows Taskbar doesn't minimize/restore the app like other apps. The warning about an app that user wishes to uninstall being related to some other app user did not select can sometimes be inaccurate. If app's language is changed without restarting Uninstalr, the list of installed software might not automatically refresh. When software is being uninstalled, the UI can say it is processing paths unrelating to the uninstalled app. This is purely cosmetic and does not mean these paths are removed. Uninstalr might not properly detect and/or uninstall Steam games if they are installed to a drive different than Steam's default location in C:\. You might see "This action is only valid for products that are currently installed" error message from Windows Installer during uninstallation. This is a cosmetic issue. Download: Uninstalr 3.1 | 7.1 MB (Free, paid version available) Download: Uninstalr Setup 3.1 View: Uninstalr Website | Screenshot Get alerted to all of our Software updates on Twitter at @NeowinSoftware
    • I and many others did not vote to get out of the E.u because of Putin or Farage, we did so for our own reasons. You don't have to tel me what my own did or did not do when it comes to the E.U. The EEC is or was the European Economic Community, a different beast to what the E.U is now.The EEC was a mainly about trading, the E.U have gone far beyond that and as I have said before, is now more of a United States of Europe. The U.K did not vote to join a United States of Europe. Anyway, they did not want us in there in the first place, Charles de Gaulle stopped us joining as he claimed we didn’t agree with the core ideas of integration. He was not wrong and that is why we voted out of the E.U when the time came. I was not old enough to vote the first time. My only regret is that we did not have the referendum years ago and got out years ago. If we rejoined, we would have to agree to join the Euro and no doubt Schengen, agree with freedom of movement, we have enough problem with people coming over here as it is. i have no problem with people coming over here if they work and don't try to push their way of life onto us. The E.U has a currency, freedom of movement, an anthem a flag, a parliament, well they are there, not sure if they do anything. Don't sound like something that is just for trading. Oh yeah, also wanted a euro Army. How many stupid rules have the E.U made that we had to follow? I doubt I will see the Uk rejoin the E.U, which suits me. Oh yeah, my partner is Polish, she came over here before Poland joined the E.U and she got fed up of people just coming over here with ease, while she had to struggle. She is now a British citizen and have been for a fair few years
    • Hello, Paul. Thanks for the editorial. It was interesting. I'm going research more into the app and its concept. Of course, if you know me at all, you know that I'd say your articles needs some editing! I always do, don't I? For instance, the article occasionally mentions relays before defining it.
    • Screamer is 50% off on Steam, making it £24.99 here in the UK: https://store.steampowered.com/app/2814990/Screamer/ You might remember the series from the mid 90s / early 2000s, this new game is also by Milestone who created the older games.
  • Recent Achievements

    • Week One Done
      flexorcist earned a badge
      Week One Done
    • One Month Later
      Woland13 earned a badge
      One Month Later
    • Week One Done
      Woland13 earned a badge
      Week One Done
    • One Year In
      bernmeister earned a badge
      One Year In
    • Week One Done
      Scoobystu earned a badge
      Week One Done
  • Popular Contributors

    1. 1
      +primortal
      495
    2. 2
      +Edouard
      226
    3. 3
      PsYcHoKiLLa
      153
    4. 4
      Steven P.
      75
    5. 5
      FloatingFatMan
      71
  • Tell a friend

    Love Neowin? Tell a friend!