Google Patches 10 Chrome Flaws Ahead of Pwn2Own, Pwnium

Google raised the degree of difficulty for Pwn2Own and Pwnium hacking contestants by patching 10 vulnerabilities in its Web browser last night. The popular contests, which kick off tomorrow in Vancouver at the CanSecWest Conference, feature millions in prize money for researchers who can crack no...

Pwn2Own, Pwnium Attract Dollars and 0-Days by the Bushel

The new year is barely two months old and it’s already been a brutal one for the disclosure of new vulnerabilities. Java, Adobe Reader, Flash, Google Chrome and a number of other widely deployed applications have all been hit with a slew of serious bugs in just the last few weeks. And that’s like...

Google Announces Pwnium 3, Ups Ante and Offers $3M+ in Rewards

Search giant Google is planning a third iteration of its vulnerability-finding contest, Pwnium. This year’s competition is set to be held alongside next month’s CanSecWest security conference on March 7 in Vancouver, BC. Unlike last year’s inaugural Pwnium, which was parallel to CanSecWest’s olde...

CVE-2012-1876

Microsoft Internet Explorer 6 through 9, and 10 Consumer Preview, does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by attempting to access a nonexistent object, leading to a heap-based buffer overflow, aka "Col Element Remote Code Execution...

CVE-2012-1876

CVE-2012-1876 affects Microsoft Internet Explorer 6–9 and IE10 (Consumer Preview); memory handling flaw when accessing a nonexistent object triggers a heap-based overflow, enabling remote code execution. Exploitation demonstrated (MS12-037), with multiple public exploits and bypass techniques (AS...

CVE-2012-1845

Use-after-free vulnerability in Google Chrome 17.0.963.66 and earlier allows remote attackers to bypass the DEP and ASLR protection mechanisms, and execute arbitrary code, via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2012. NOTE: the primary affected...

Design/Logic Flaw

Use-after-free vulnerability in Google Chrome 17.0.963.66 and earlier allows remote attackers to bypass the DEP and ASLR protection mechanisms, and execute arbitrary code, via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2012. NOTE: the primary affected...

CVE-2012-1845

Use-after-free vulnerability in Google Chrome 17.0.963.66 and earlier allows remote attackers to bypass the DEP and ASLR protection mechanisms, and execute arbitrary code, via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2012. NOTE: the primary affected...

Code injection

Google Chrome 17.0.963.66 and earlier allows remote attackers to bypass the sandbox protection mechanism by leveraging access to a sandboxed process, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2012. NOTE: the primary affected product may be clarified later; it was not...

CVE-2012-1846

Google Chrome 17.0.963.66 and earlier allows remote attackers to bypass the sandbox protection mechanism by leveraging access to a sandboxed process, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2012. NOTE: the primary affected product may be clarified later; it was not...

CVE-2012-1846

Summary: CVE-2012-1846 affects Google Chrome (notably 17.0.963.66 and earlier) and describes a sandbox bypass that enables remote code execution by abusing access to a sandboxed process. The connected OpenVAS entries reference “Google Chrome Full Sandbox Escape and Code Execution Vulnerability” a...

CVE-2012-1845

CVE-2012-1845 is a use-after-free vulnerability in Google Chrome (affected versions 17.0.963.66 and earlier) that allowed remote code execution by bypassing DEP/ASLR. The issue was demonstrated by VUPEN at Pwn2Own (CanSecWest 2012). Connected sources also reference Chrome sandbox-escape/code-exec...

CVE-2012-1845

Use-after-free vulnerability in Google Chrome 17.0.963.66 and earlier allows remote attackers to bypass the DEP and ASLR protection mechanisms, and execute arbitrary code, via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2012. NOTE: the primary affected...

CVE-2012-1846

Removed by vendor...

CVE-2012-1845

Removed by vendor...

Memory corruption

Microsoft Internet Explorer 6 through 9, and 10 Consumer Preview, allows remote attackers to bypass Protected Mode or cause a denial of service memory corruption by leveraging access to a Low integrity process, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2012...

CVE-2012-1545

Microsoft Internet Explorer 6 through 9, and 10 Consumer Preview, allows remote attackers to bypass Protected Mode or cause a denial of service memory corruption by leveraging access to a Low integrity process, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2012...

Offense is Being Pushed Underground

VANCOUVER–One of the first things we’re taught as kids is that sharing is good. If you have two Chocodiles and Billy has none, you give him one. Sharing once was the norm in the security community–or, more specifically, certain sections of it–as well, but if the atmosphere at the CanSecWest...

Google Hands out $60k Reward for Full Chrome Compromise in Pwnium Contest

VANCOUVER–Well, that didn’t take long. Before the first session of the CanSecWest conference here even started on Wednesday, a researcher had already succeeded in scoring a full compromise of Google Chrome, using two distinct bugs, and earning himself a $60,000 reward as part of the company’s...

Google предлагает вознаграждение за эксплойты $20000-$60000

Компания Google объявила о расширении программы вознаграждений Chromium Security Rewards. В частности, предлагается премия за 0-day эксплойты Chrome, Flash, Windows и др. За них будут платить от $20K до $60K. Программа Chromium Security Rewards предполагает выплату вознаграждения за найденные...