(CVE-2012-2842) <chromium-browser-20.0.1132.57 : use-after-free vulnerability (CVE-2012-{2842,2843,2844})

[Karma Dorje]

The Stable channel has been updated to 20.0.1132.57 for Windows, Mac, Linux, and Chrome Frame. Along with below mentioned security fixes, this build contains an update to Flash player, v8 (3.10.8.20) and couple of stability/bug fixes.

Security fixes and rewards:

Please see the Chromium security page for more detail. Note that the referenced bugs may be kept private until a majority of our users are up to date with the fix.

[$1000] [129898] High CVE-2012-2842: Use-after-free in counter handling. Credit to miaubiz.
[$1000] [130595] High CVE-2012-2843: Use-after-free in layout height tracking. Credit to miaubiz.
[133450] High CVE-2012-2844: Bad object access with JavaScript in PDF. Credit to Alexey Samsonov of Google.

http://googlechromereleases.blogspot.com/2012/07/stable-channel-update.html

[Mike Gilbert (floppym)]

Release notes in URL.

[Mike Gilbert (floppym)]

Let's stabilize it.

=dev-lang/v8-3.10.8.20
=www-client/chromium/20.0.1132.57

[Rich0 (rich0)]

amd64 stable

[Marc Deslauriers (mdeslaur)]

Thanks for taking the time to report this bug and helping to make Ubuntu better. Since the package referred to in this bug is in universe or multiverse, it is community maintained. If you are able, I suggest coordinating with upstream and posting a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures

[Jdhore (jdhore)]

x86 stable

[Glsamaker (glsamaker)]

CVE-2012-2843 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2843):
  Use-after-free vulnerability in Google Chrome before 20.0.1132.57 allows
  remote attackers to cause a denial of service or possibly have unspecified
  other impact via vectors related to layout height tracking.

CVE-2012-2842 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2842):
  Use-after-free vulnerability in Google Chrome before 20.0.1132.57 allows
  remote attackers to cause a denial of service or possibly have unspecified
  other impact via vectors related to counter handling.

[Ackle (ackle)]

Thanks, everyone. GLSA draft is ready and needs 1 more approval.

[Glsamaker (glsamaker)]

This issue was resolved and addressed in
 GLSA 201208-03 at http://security.gentoo.org/glsa/glsa-201208-03.xml
by GLSA coordinator Sean Amoss (ackle).

[Dmitry Shachnev (mitya57)]

https://launchpad.net/ubuntu/+source/chromium-browser/22.0.1229.79~r158531-0ubuntu1

chromium-browser (22.0.1229.79~r158531-0ubuntu1) quantal-proposed; urgency=low

  * New upstream release from the Stable Channel
  * debian/control
    - fixed typo in description for chromium-codecs-ffmpeg
  * debian/patches/fix-armhf-ftbfs.patch
    - Dropped, no longer needed
  * debian/chromium-browser.install
    - Install demo extension
  * debian/rules
    - Updated INSTALL_EXCLUDE_FILES
    - build with gcc 4.7
  * debian/patches/1-infobars.patch,
    debian/patches/2-get-domain-tld.patch,
    debian/patches/3-chrome-xid.patch,
    debian/patches/4-chromeless-window-launch-option.patch,
    debian/patches/5-desktop-integration-settings.patch,
    debian/patches/fix-1034541.patch
    - Updated for v22
  * debian/patches/6-passwordless-install-support.patch
    - Webapp package installation (LP: #1059460)
  * debian/patches/7-plugin-status.patch
    - Don't block npapi plugins on linux, which is required by
      unity-chromium-extension

 -- Ken VanDine <email address hidden> Fri, 12 Oct 2012 09:31:11 -0400