====================================================================

                                             CERT-Renater

                                 Note d'Information No. 2015/VULN170
_____________________________________________________________________

DATE                : 04/09/2015

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Google Chrome versions prior to
                        45.0.2454.85, Chrome OS.

======================================================================
http://googlechromereleases.blogspot.fr/2015/09/stable-channel-update.html
http://googlechromereleases.blogspot.fr/2015/09/stable-update-for-chrome-os.html
______________________________________________________________________

   Stable Channel Update

The Chrome team is delighted to announce the promotion of Chrome 45 to
the stable channel for Windows, Mac and Linux.


Chrome 45.0.2454.85 contains a number of fixes and improvements -- a
list of changes is available in the log.  Watch out for upcoming Chrome
and Chromium blog posts about new features and big efforts delivered in
45.


Security Fixes and Rewards

Note: Access to bug details and links may be kept restricted until a
majority of users are updated with a fix. We will also retain
restrictions if the bug exists in a third party library that other
projects similarly depend on, but haven’t yet fixed.

This update includes 29 security fixes. Below, we highlight fixes that
were contributed by external researchers. Please see the Chromium
security page for more information.

[$7500][516377] High CVE-2015-1291: Cross-origin bypass in DOM. Credit
                  to anonymous.
[$7500][522791] High CVE-2015-1292: Cross-origin bypass in
                  ServiceWorker. Credit to Mariusz Mlynski.
[$7500][524074] High CVE-2015-1293: Cross-origin bypass in DOM. Credit
                  to Mariusz Mlynski.
[$5000][492263] High CVE-2015-1294: Use-after-free in Skia. Credit to
                  cloudfuzzer.
[$3000][502562] High CVE-2015-1295: Use-after-free in Printing. Credit
                  to anonymous.
[$1000][421332] High CVE-2015-1296: Character spoofing in omnibox.
                  Credit to zcorpan.
[$3000][510802] Medium CVE-2015-1297: Permission scoping error in
                  WebRequest. Credit to Alexander Kashev.
[$3000][518827] Medium CVE-2015-1298: URL validation error in
                  extensions. Credit to Rob Wu.
[$2000][416362] Medium CVE-2015-1299: Use-after-free in Blink. Credit
                  to taro.suzuki.dev.
[$1000][511616] Medium CVE-2015-1300: Information leak in Blink. Credit
                  to cgvwzq.

We would also like to thank all security researchers that worked with
us during the development cycle to prevent security bugs from ever
reaching the stable channel. The total value of additional rewards and
their recipients will updated here when all reports have gone through
the reward panel.

As usual, our ongoing internal security work was responsible for a wide
range of fixes:

      [526825] CVE-2015-1301: Various fixes from internal audits, fuzzing
               and other initiatives.
      Multiple vulnerabilities in V8 fixed at the tip of the 4.5 branch
(currently 4.5.103.29).


Many of the above bugs were detected using AddressSanitizer or
MemorySanitizer.

Interested in switching release channels? Find out how.  If you find a
new issue, please let us know by filing a bug.  The community help
forum is also a great place to reach out for help or learn about common
issues.


Vivian Zhi
Google Chrome

______________________________________________________________________

Wednesday, September 2, 2015

   Stable Update for Chrome OS

The Stable channel has been updated to 45.0.2454.86 (Platform version:
7262.52.0) for all Chrome OS devices except Samsung Series 5 550
Chromebook, Samsung Series 3 Chromebox, Samsung Chromebook 2 (13"),
Haier Chromebook 11e, and the Asus Chromebook Flip. This build contains
a number of bug fixes, security updates and feature enhancements.
Systems will be receiving updates over the next several days.

If you find issues, please let us know by visiting our forum or filing
a bug. Interested in switching channels? Find out how. You can submit
feedback using ‘Report an issue...’ in the Chrome menu (three
horizontal bars in the upper right corner of the browser).


Matthew Yuan
Google Chrome

=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================