Image via CrunchBaseGoogle Squashes 12 Chrome Bugs, Fixes Flash - PCWorldGoogle last week patched 12 vulnerabilities in its Chrome browser, all of them rated as high-level threats by the company's security team.
The patched version of Chrome also included an update to Adobe's Flash Player, giving Google users an early fix for a critical flaw that hackers have been exploiting with rigged PDF documents. Adobe planned to release that Flash patch to users of other browsers later in the week.
The dozen flaws fixed in Chrome 7.0.517.44 include a pair related to SVG (Scalable Vector Graphics), a collection of XML specifications for describing two-dimensional vector graphics; one in Chrome's V8 JavaScript engine; and three involving aspects of the browser's text handling.
Google paid $7,500 in bounties to eight researchers who reported 11 of the 12 bugs, the most it's awarded since mid-August when the company handed out $8,674.
As usual, Google locked down its bug tracking database to bar outsiders from picking up technical details of the vulnerabilities. The company usually unlocks access to a flaw several weeks after a patch ships, to give users time to update before the information goes public.
Other browser makers, including Mozilla, do the same.
The update to the "stable" build -- Google maintains three separate "channels" for Chrome, ranging from stable to "beta" to "dev" -- included a revamped version of Flash Player, the popular media playing plug-in.
Seven months ago, Google and Adobe struck a deal that lets the former bundle Flash Player with Chrome and upgrade the plug-in using the browser's own silent updater, This is the second time in six weeks that Chrome users received a patched Flash Player before people running rival browsers, such as Microsoft's Internet Explorer or Mozilla's Firefox.
Last week, Adobe confirmed that Flash contained a critical bug that attackers were exploiting in the wild, and promised to fix the flaw by Nov. 9. Earlier this week, however, Adobe bumped up the release of the Flash update to, saying that it had wrapped up work faster than anticipated.
Although the bug is in Flash, hackers are actually using malicious PDF documents; Adobe's Reader includes code to render Flash from within a PDF, and that code is also flawed. Adobe is planning to issue a fix for Reader and the Acrobat PDF-creation software the week of Nov. 15.
Thursday's update was the second round of Chrome security fixes since the browser jumped to version 7 late last month.
According to Web metrics company Net Applications, Google's hands-off update technology -- which automatically applies not only patches, but also new features -- shifted the bulk of Chrome 6 users to the new Chrome 7 within days.
A week after the Oct. 21 launch of Chrome 7, that version outnumbered its predecessor in usage share by more than 7-to-1.
No comments:
Post a Comment
Note: Only a member of this blog may post a comment.