====================================================================

                           CERT-Renater

               Note d'Information No. 2015/VULN093
_____________________________________________________________________

DATE                : 20/05/2015

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Google Chrome versions prior to 43.0.2357.65.

======================================================================
http://googlechromereleases.blogspot.fr/2015/05/stable-channel-update_19.html
______________________________________________________________________


Stable Channel Update

The Chrome team is happy to announce the promotion of Chrome 43 to the
stable channel for Windows, Mac and Linux. Chrome 43.0.2357.65 contains
a number of fixes and improvements.  A list of changes is available in
the log.

Security Fixes and Rewards

Note: Access to bug details and links may be kept restricted until a
majority of users are updated with a fix. We will also retain
restrictions if the bug exists in a third party library that other
projects similarly depend on, but haven’t yet fixed.

This update includes 37 security fixes. Below, we highlight fixes that
were contributed by external researchers. Please see the Chromium
security page for more information.


[$16337][474029] High CVE-2015-1252: Sandbox escape in Chrome. Credit to
anonymous.
[$7500][464552] High CVE-2015-1253: Cross-origin bypass in DOM. Credit
to anonymous.
[$3000][444927] High CVE-2015-1254: Cross-origin bypass in Editing.
Credit to armin@rawsec.net.
[$3000][473253] High CVE-2015-1255: Use-after-free in WebAudio. Credit
to Khalil Zhani.
[$2000][478549] High CVE-2015-1256: Use-after-free in SVG. Credit to
Atte Kettunen of OUSPG.
[481015] High CVE-2015-1251: Use-after-free in Speech. Credit to
SkyLined working with HP's Zero Day Initiative
[$1500][468519] Medium CVE-2015-1257: Container-overflow in SVG. Credit
to miaubiz.
[$1000][450939] Medium CVE-2015-1258: Negative-size parameter in Libvpx.
Credit to cloudfuzzer
[$1000][468167] Medium CVE-2015-1259: Uninitialized value in PDFium.
Credit to Atte Kettunen of OUSPG
[$1000][474370] Medium CVE-2015-1260: Use-after-free in WebRTC. Credit
to Khalil Zhani.
[$500][466351] Medium CVE-2015-1261: URL bar spoofing. Credit to Juho
Nurminen.
[$500][476647] Medium CVE-2015-1262: Uninitialized value in Blink.
Credit to miaubiz.
[$500][479162] Low CVE-2015-1263: Insecure download of spellcheck
dictionary. Credit to Mike Ruddy.
[$500][481015] Low CVE-2015-1264: Cross-site scripting in bookmarks.
Credit to K0r3Ph1L.

We would also like to thank all security researchers that worked with
us during the development cycle to prevent security bugs from ever
reaching the stable channel. The total value of additional rewards and
their recipients will updated here when all reports have gone through
the reward panel.


As usual, our ongoing internal security work was responsible for a wide
range of fixes:

    [489518] CVE-2015-1265: Various fixes from internal audits, fuzzing
and other initiatives.
    Multiple vulnerabilities in V8 fixed at the tip of the 4.3 branch
(currently 4.3.61.21).


Many of the above bugs were detected using AddressSanitizer or
MemorySanitizer.

Interested in switching release channels? Find out how. If you find a
new issue, please let us know by filing a bug.

Are you a project manager,  with a technical background, who is
passionate about Chrome and moving the web forward?  We are hiring!

Anthony Laforge
Google Chrome

=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================