Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2011.0927
chromium-browser security update
12 September 2011
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: chromium-browser
Publisher: Debian
Operating System: Debian GNU/Linux 6
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Access Privileged Data -- Remote with User Interaction
Denial of Service -- Remote with User Interaction
Provide Misleading Information -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2011-2818 CVE-2011-2800 CVE-2011-2359
Reference: ASB-2011.0060
ESB-2011.0886.2
ESB-2011.0891
ESB-2011.0895
Original Bulletin:
http://www.debian.org/security/2011/dsa-2307
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-2307-1 security@debian.org
http://www.debian.org/security/ Giuseppe Iuculano
September 11, 2011 http://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : chromium-browser
Vulnerability : several
Problem type : remote
Debian-specific: no
CVE ID : CVE-2011-2359 CVE-2011-2800 CVE-2011-2818
Several vulnerabilities were discovered in the Chromium browser.
The Common Vulnerabilities and Exposures project identifies
the following problems:
CVE-2011-2818
Use-after-free vulnerability in Google Chrome allows remote attackers to
cause a denial of service or possibly have unspecified other impact via
vectors related to display box rendering.
CVE-2011-2800
Google Chrome before allows remote attackers to obtain potentially sensitive
information about client-side redirect targets via a crafted web site.
CVE-2011-2359
Google Chrome does not properly track line boxes during rendering, which
allows remote attackers to cause a denial of service or possibly have
unspecified other impact via unknown vectors that lead to a "stale pointer."
Several unauthorised SSL certificates have been found in the wild issued
for the DigiNotar Certificate Authority, obtained through a security
compromise with said company.
This update blacklists SSL certificates issued by DigiNotar-controlled
intermediate CAs used by the Dutch PKIoverheid program.
For the stable distribution (squeeze), this problem has been fixed in
version 6.0.472.63~r59945-5+squeeze6.
For the testing distribution (wheezy), this problem has been fixed in
version 13.0.782.220~r99552-1.
For the unstable distribution (sid), this problem has been fixed in
version 13.0.782.220~r99552-1.
We recommend that you upgrade your chromium-browser packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iEYEARECAAYFAk5s8YQACgkQNxpp46476ap/pQCfYj8I6fU6tsysf3xg/jw3s5s3
L9wAmgKPaN+O2PSeHts4U6Dog1+ka+Py
=RzCD
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBTm1n4O4yVqjM2NGpAQKiBw//WuvILa2K0GNtyUJtVGUm4Mdpvd2zKjEl
bz/8bpsjh9/P/F7QT2ULq5Xxzl3blFyEW/TTF56vs/E/sba5R9pxm5ds3AI7IZca
U8B22oLOndVu+RlgnkCXvM8sqLIk6mtBSH9VmBNrMgm9x9MYgLbzuJWYokAsQ01y
szWhKJtru4lATYhYcWcQXJmbrZ7/B7eoUzv+IZvR+ifaUgVkBN4EaoUaHE8fKd6K
mQbHr1+xy5Z1rB9SyaMOZP5+sARod1fKHrVeRR64z8pN2iEAa4N4/hhwpNoJuwig
mfvtTUIIJhYLzFVVxLidSCjlO0oTlaYgCmMxS7CWYd2J1l7AA1+pdC2KTQ9z9GvN
5uTQzcgxM01AnQPVcXx9GTOIQWZGC07LEaQpmT+BeusaMeFsjHpU1FQLjlgvpY2w
ZqBC7XEWXSzgvB/E9vPQs5P9AHBLYF9KQ+PTEU9dcdMNyD2sAI4VvPobbsaHCcjJ
vDQjKPOXFz5pIhc/V4594gQRl5YIl2iJvs7vloqtL+QDMLEH4kNqI5opfHToA/7C
0UebphAZSDrPlDBJdDvToulYmmW8SZp1eS7iA6SOikzxWAxcWyhnblcXZMaOwu62
Xp+4ThgM+ScBK8RCxABKX4kRHI8rSsaSQM3gYkjQ2caNjullpA1gf8Ph5vtlqNcw
jjuNgaBDWM4=
=9HW7
-----END PGP SIGNATURE-----