Chrome 17.0.963.46 Stable released


Recommended Posts

The Chrome team is excited to announce the release of Chrome 17 to the Stable Channel for Windows, Mac, Linux and Chrome Frame. 17.0.963.46 contains a number of new features including:
  • New Extensions APIs
  • Updated Omnibox Prerendering
  • Download Scanning Protection
  • Many other small changes

Security fixes and rewards:

Please seethe Chromium security page for more detail. Note that the referenced bugs may be kept private until a majority of our users are up to date with the fix

  • [73478] Low CVE-2011-3953: Avoid clipboard monitoring after paste event. Credit to Daniel Cheng of the Chromium development community.
  • [92550] Low CVE-2011-3954: Crash with excessive database usage. Credit to Collin Payne.
  • [93106] High CVE-2011-3955: Crash aborting an IndexDB transaction. Credit to David Grogan of the Chromium development community.
  • [103630] Low CVE-2011-3956: Incorrect handling of sandboxed origins inside extensions. Credit to Devdatta Akhawe, UC Berkeley.
  • [$1000] [104056] High CVE-2011-3957: Use-after-free in PDF garbage collection. Credit to Aki Helin of OUSPG.
  • [$2000] [105459] High CVE-2011-3958: Bad casts with column spans. Credit to miaubiz.
  • [$1000] [106441] High CVE-2011-3959: Buffer overflow in locale handling. Credit to Aki Helin of OUSPG.
  • [$500] [108416] Medium CVE-2011-3960: Out-of-bounds read in audio decoding. Credit to Aki Helin of OUSPG.
  • [$1000] [108871] Critical CVE-2011-3961: Race condition after crash of utility process. Credit to Shawn Goertzen.
  • [$500] [108901] Medium CVE-2011-3962: Out-of-bounds read in path clipping. Credit to Aki Helin of OUSPG.
  • [109094] Medium CVE-2011-3963: Out-of-bounds read in PDF fax image handling. Credit to Atte Kettunen of OUSPG.
  • [109245] Low CVE-2011-3964: URL bar confusion after drag + drop. Credit to Code Audit Labs of VulnHunt.com.
  • [109664] Low CVE-2011-3965: Crash in signature check. Credit to S?awomir B?a?ek.
  • [$1000] [109716] High CVE-2011-3966: Use-after-free in stylesheet error handling. Credit to Aki Helin of OUSPG.
  • [109717] Low CVE-2011-3967: Crash with unusual certificate. Credit to Ben Carrillo.
  • [$1000] [109743] High CVE-2011-3968: Use-after-free in CSS handling. Credit to Arthur Gerkis.
  • [$1000] [110112] High CVE-2011-3969: Use-after-free in SVG layout. Credit to Arthur Gerkis.
  • [$500] [110277] Medium CVE-2011-3970: Out-of-bounds read in libxslt. Credit to Aki Helin of OUSPG.
  • [$1000] [110374] High CVE-2011-3971: Use-after-free with mousemove events. Credit to Arthur Gerkis.
  • [110559] Medium CVE-2011-3972: Out-of-bounds read in shader translator. Credit to Google Chrome Security Team (Inferno).

The bugs [105459], [106441], [108416], [108901], [109716], [109743], [110112], [110277], [110374] and [110559] were detected usingAddressSanitizer.

In addition, we would like to thank miaubiz, Drew Yao and Braden Thomas of Apple, S?awomir B?a?ek, Aki Helin of OUSPG, Chamal de Silva and Atte Kettunen of OUSPG for working with us in the development cycle and preventing bugs from ever reaching the stable channel. Various rewards were issued, including a top $3133.70 reward to Aki Helin.

http://googlechromer...nel-update.html

Link to comment
https://www.neowin.net/forum/topic/1056850-chrome-17096346-stable-released/
Share on other sites

This has the webRequest API so blocking video ads with an adblock extension should work as good as Firefox now.

yes, thats an awesome feature. I was waiting for download protection. it protects all those stupid people who download and install what ever they find in the internet.

The Chrome Stable channel has been updated to 17.0.963.56 on Windows, Mac, Linux and Chrome Frame. This release fixes a number of stability and security issues in Chrome, and also includes a new version of Flash. More info on the Flash update is available from Adobe.

Security fixes and rewards:

Please see the Chromium security page for more detail. Note that the referenced bugs may be kept private until a majority of our users are up to date with the fix.

  • [105803]HighCVE-2011-3015: Integer overflows in PDF codecs. Credit to Google Chrome Security Team (scarybeasts).
  • [$500] [106336] MediumCVE-2011-3016: Read-after-free with counter nodes. Credit to miaubiz.
  • [$1000] [108695]HighCVE-2011-3017: Possible use-after-free in database handling. Credit to miaubiz.
  • [$1000] [110172]HighCVE-2011-3018: Heap overflow in path rendering. Credit to Aki Helin of OUSPG.
  • [110849] High CVE-2011-3019: Heap buffer overflow in MKV handling. Credit to Google Chrome Security Team (scarybeasts) and Mateusz Jurczyk of the Google Security Team.
  • [111575] Medium CVE-2011-3020: Native client validator error. Credit to Nick Bray of the Chromium development community.
  • [$1000] [111779] HighCVE-2011-3021: Use-after-free in subframe loading. Credit to Arthur Gerkis.
  • [112236] MediumCVE-2011-3022: Inappropriate use of http for translation script. Credit to Google Chrome Security Team (Jorge Obes).
  • [$500] [112259] MediumCVE-2011-3023: Use-after-free with drag and drop. Credit to pa_kt.
  • [112451] LowCVE-2011-3024: Browser crash with empty x509 certificate. Credit to chrometot.
  • [$500] [112670] MediumCVE-2011-3025: Out-of-bounds read in h.264 parsing. Credit to S?awomir B?a?ek.
  • [$1337] [112822] HighCVE-2011-3026: Integer overflow / truncation in libpng. Credit to J?ri Aedla.
  • [$1000] [112847]HighCVE-2011-3027: Bad cast in column handling. Credit to miaubiz.

http://googlechromereleases.blogspot.com/2012/02/chrome-stable-update.html

  • 3 weeks later...
The Chrome Stable channel has been updated to 17.0.963.65 on Windows, Mac, Linux and Chrome Frame. This release fixes a number of issues including:
  • Cursors and backgrounds sometimes do not load (bug 111218)
  • Plugins not loading on some pages (bug 108228)
  • Text paste includes trailing spaces (bug 106551)
  • Websites using touch controls break (bug 110332)

Along with these fixes, the release contains an updated version of the Adobe Flash player. More information on Flash updates is available from Adobe.

Security fixes and rewards:

Firstly, we have some special rewards for some special bugs!

  • [$10,000] [116661] Rockstar CVE-1337-d00d1: Excessive WebKit fuzzing. Credit to miaubiz.
  • [$10,000] [116662] Legend CVE-1337-d00d2: Awesome variety of fuzz targets. Credit to Aki Helin of OUSPG.
  • [$10,000] [116663] Superhero CVE-1337-d00d3: Significant pain inflicted upon SVG. Credit to Arthur Gerkis.

To determine the above rewards, we looked at bug finding performance over the past few months. The three named individuals stood out significantly. It also shouldn?t come as a surprise that they all feature (and earn more!) in the release notes below.

We have always reserved the right to arbitrarily reward sustained, extraordinary contributions. In this instance, we?re dropping a surprise bonus. We reserve the right to do so again and reserve the right to do so on a more regular basis! Chrome has a leading reputation for security and it wouldn?t be possible without the aggressive bug hunting of the wider community.

Please seethe Chromium security page for more detail. Note that the referenced bugs may be kept private until a majority of our users are up to date with the fix.

  • [$1000] [105867] High CVE-2011-3031: Use-after-free in v8 element wrapper. Credit to Chamal de Silva.
  • [$1000] [108037] High CVE-2011-3032: Use-after-free in SVG value handling. Credit to Arthur Gerkis.
  • [$2000] [108406] [115471] High CVE-2011-3033: Buffer overflow in the Skia drawing library. Credit to Aki Helin of OUSPG.
  • [$1000] [111748] High CVE-2011-3034: Use-after-free in SVG document handling. Credit to Arthur Gerkis.
  • [$2000] [112212] High CVE-2011-3035: Use-after-free in SVG use handling. Credit to Arthur Gerkis.
  • [$1000] [113258] High CVE-2011-3036: Bad cast in line box handling. Credit to miaubiz.
  • [$3000] [113439] [114924] [115028] High CVE-2011-3037: Bad casts in anonymous block splitting. Credit to miaubiz.
  • [$1000] [113497] High CVE-2011-3038: Use-after-free in multi-column handling. Credit to miaubiz.
  • [$1000] [113707] High CVE-2011-3039: Use-after-free in quote handling. Credit to miaubiz.
  • [$500] [114054] High CVE-2011-3040: Out-of-bounds read in text handling. Credit to miaubiz.
  • [$1000] [114068] High CVE-2011-3041: Use-after-free in class attribute handling. Credit to miaubiz.
  • [$1000] [114219] High CVE-2011-3042: Use-after-free in table section handling. Credit to miaubiz.
  • [$1000] [115681] High CVE-2011-3043: Use-after-free in flexbox with floats. Credit to miaubiz.
  • [$1000] [116093] High CVE-2011-3044: Use-after-free with SVG animation elements. Credit to Arthur Gerkis.

The majority of the above bugs were detected using AddressSanitizer, which rocks.

More detailed updates are available on the Chrome Blog. Full details about what changes are in this release are available in the SVN revision log. Interested in hopping on the stable channel? Find out how. If you find a new issue, please let us know by filing a bug.

http://googlechromereleases.blogspot.com/2012/03/chrome-stable-update.html

  • 2 weeks later...
Some of the items listed below represent the start of hardening measures based on study of the exploits submitted to the Pwnium competition.

[$1000] [113902] High CVE-2011-3050: Use-after-free with first-letter handling. Credit to miaubiz.

[116162] High CVE-2011-3045: libpng integer issue from upstream. Credit to Glenn Randers-Pehrson of the libpng project.

[$1000] [116461] High CVE-2011-3051: Use-after-free in CSS cross-fade handling. Credit to Arthur Gerkis.

[116637] High CVE-2011-3052: Memory corruption in WebGL canvas handling. Credit to Ben Vanik of Google.

[$1000] [116746] High CVE-2011-3053: Use-after-free in block splitting. Credit to miaubiz.

[117418] Low CVE-2011-3054: Apply additional isolations to webui privileges. Credit to Sergey Glazunov.

[117736] Low CVE-2011-3055: Prompt in the browser native UI for unpacked extension installation. Credit to PinkiePie.

[$2000] [117550] High CVE-2011-3056: Cross-origin violation with ?magic iframe?. Credit to Sergey Glazunov.

[$500] [117794] Medium CVE-2011-3057: Invalid read in v8. Credit to Christian Holler.

Also, this single low severity issue was fixed in a previous patch but we forgot to issue proper credit:

[108648] Low CVE-2011-3049: Extension web request API can interfere with system requests. Credit to Michael Gundlach

http://googlechromereleases.blogspot.com/2012/03/stable-channel-update_21.html

This topic is now closed to further replies.
  • Posts

    • Just when I thought EA couldn't go lower. They surpassed my expectations
    • The GEEKOM A8 mini PC is 20% off (lower than Prime Day pricing) plus Huge Storewide Sale by Steven Parker GEEKOM is back with a deal on a variant of its A8 Mini PC powered by AMD's Ryzen 7 8945HS, which came out in 2024 with a TDP of just 45W, with a base clock of 3.8 GHz and a Turbo Boost of 4.9 GHz; although we never reviewed this variant, we did check out the Ryzen 9 version. As a reminder of what you get, below are the specifications for this Mini PC. GEEKOM A8 Dimensions 112.4 mm x 112.4 mm x 37 mm Weight 450g CPU Ryzen 7 8745HS (8 cores, 16 threads, 16MB L3 cache, 3.8 - 4.9 GHz, TDP: 45 W) cTDP: 35-54W (Default 45W) Graphics AMD Radeon™ 780M Graphics 12 RDNA 3 Graphics Cores 2700MHz 768 shading units / stream processors (12 CUs), 48 texture mapping units, and 32 ROPs NPU XDNA architecture (Up to 16 NPU TOPS) Memory 16GB Dual-channel Crucial DDR5-5600MT/s SODIMM (up to 64GB) Storage 1TB NVMe M.2 (PCIe Gen 4.0 x4) Operating System Windows 11 Pro Bluetooth Bluetooth v5.2 Wireless LAN Wi-Fi 6E Kensington Lock No SD Card reader Yes (left side) Adapter 120W, 6.32A, 19V Power Adapter Front I/O Ports 2 x USB 3.2 Gen 2 Type-A 1 x 3.5mm front stereo headset jack Rear I/O Ports 1 x USB 3.2 Gen 2 Type-A 1 x USB 4 Gen 3 Type-C with Power delivery up to 15W (5V 3A) 1 x USB 3.2 Gen 2 Type-C 1 x USB 2.0 Type-A 2 x HDMI 2.0b 1 x 2.5G RJ45 LAN 1 x DC-in Deal Price $519 (buying links below) GEEKOM has two configurations of the A8, with the only difference being the slightly less-powerful Ryzen 7 CPU with half the storage (1TB) and DDR5 memory (16GB). This knocks $350 off the price compared to the $999 Ryzen 9 configuration. In both instances, a Windows 11 Pro license is also pre-loaded. As I said previously, this appears to be an update on the A7 with the only difference being the newer CPU. The packaging has changed quite a bit from the A7. Instead of dark colors, now the box is completely white, and the foam cushion has been replaced by a cardboard mould that the A8 sits in, above a small envelope that contains a thank you card and booklet that has guidance on all of the controls, how to access the A8 to swap out the SSD or memory, and safety information in several European languages. Upon removing the cardboard mould, you can find another cardboard compartment that contains the power lead, HDMI cable, VESA plate, and a bag of screws. What’s In The Box 1 x A8 Mini PC 1 x Power Adapter 1 x HDMI Cable 1 x VESA plate and bag of screws 1 x Envelope with booklet and Thank you card Unlike the A7, the VESA mount option is back with the A8. In short, you have everything you need to get started. All products sold by GEEKOM receive a 3-year free Warranty from the date you receive the product. If needed, you can RMA or return locally relative to your region (the U.S. has a U.S. warehouse, mainland E.U. has a German warehouse). GEEKOM A8 at GEEKOM U.S. for $519 was $649 (20% off) GEEKOM A8 at GEEKOM U.K. for £503 was £629 (20% off) GEEKOM A8 at GEEKOM CA for $735.20 was $919 (20% off) Use coupon code NWGKA820 when checking out. This flash deal expires on July 2. Next up is the highest savings on the A7 Max series of Mini PC in the Spring Sale. The GEEKOM [2026 Edition] A7 MAX with AMD Ryzen 9 7940HS, 16GB DDR5, and 1TB SSD. Operating System: Windows 11 Pro CPU Model: Ryzen 9 7940HS CPU Speed: 5.2 GHz Cache Size: 24 MB Graphics Card Description: Integrated Graphics Coprocessor: AMD Radeon 780M Memory Storage Capacity: 16GB DDR5 SSD: 1 TB We reviewed this Mini PC back in January, and praised it for its modern internals like a dedicated NPU and DDR5 memory; as such, it is more than capable of keeping up with today's offerings of Mini PC on the market. GEEKOM A7 Max at GEEKOM U.S. for $587 (was $699) 16% off GEEKOM A7 Max at GEEKOM U.K. for £551 was £689 (20% off) Use coupon code NWGKA7MAX when checking out. This flash deal expires on July 2. Huge Summer Sale If the above deals don't tickle your fancy, from today, there are deep discounts on a range of other GEEKOM products. From June 15 to June 30, the GEEKOM Official Store will be running its Summer Sale, with discounts starting from 15% off across the entire lineup, up to 50%! This is their biggest promotion of the year so far, offering pricing that is even lower than select Prime Day deals. You can check out the discounts at the dedicated Summer Sale landing pages below. GEEKOM U.S. Summer Sale GEEKOM U.K. Summer Sale What's more, all products from GEEKOM receive a 3-year free Warranty from the date you receive the product. If needed, you can RMA or return locally relative to your region (the U.S. has a U.S. warehouse, mainland E.U. has a German warehouse, the U.K. has a U.K. warehouse, Australia has an AU warehouse). While the Summer Sale ends on June 30, deals on the A8 and A7 Max will remain active until July 2.
  • Recent Achievements

    • Week One Done
      Jeroen Wilms earned a badge
      Week One Done
    • Week One Done
      rolfus earned a badge
      Week One Done
    • One Month Later
      Leroy Jethro Gibbs earned a badge
      One Month Later
    • Conversation Starter
      flexorcist earned a badge
      Conversation Starter
    • One Month Later
      AndreaB earned a badge
      One Month Later
  • Popular Contributors

    1. 1
      +primortal
      515
    2. 2
      +Edouard
      205
    3. 3
      PsYcHoKiLLa
      136
    4. 4
      ATLien_0
      88
    5. 5
      Steven P.
      86
  • Tell a friend

    Love Neowin? Tell a friend!