Google Chrome prior to 3.0.195.32 Multiple Security Vulnerabilities

Bugtraq ID:	36947
Class:	Unknown
CVE:	CVE-2009-3934
Remote:	Yes
Local:	No
Published:	Nov 05 2009 12:00AM
Updated:	Nov 16 2009 06:46PM
Credit:	Inferno of SecureThoughts.com, Google Chrome security team
Vulnerable:	Google Chrome 3.0.195 .24 Google Chrome 3.0.195 .21 Google Chrome 3.0 Beta
Not Vulnerable:	Google Chrome 3.0.195 .32

Google Chrome prior to 3.0.195.32 Multiple Security Vulnerabilities

Google Chrome is prone to a security-bypass issue and a memory-corruption issue.

Attackers can exploit these issues to bypass certain security checks, trick users into executing scripts in the local context, execute arbitrary code in the context of the browser, and cause a denial-of-service condition; other attacks are also possible.

Versions prior to Chrome 3.0.195.32 are vulnerable.

Google Chrome prior to 3.0.195.32 Multiple Security Vulnerabilities

Attackers can use standard tools to exploit the security-bypass issue. We are not aware of any exploits for the memory-corruption issue.

Google Chrome prior to 3.0.195.32 Multiple Security Vulnerabilities

Solution:
Vendor updates are available. Please see the references for details.

Google Chrome prior to 3.0.195.32 Multiple Security Vulnerabilities

References:

• Google Chrome Homepage (Google)
  
• Stable Channel Update (Google)
  
• Using Blended Browser Threats involving Chrome to steal files on your computer (Inferno)
  
• Using Blended Browser Threats involving Chrome to steal files on your computer ("Inferno" )