Stable Channel Update

The Stable channel has been updated to 16.0.912.77 for Windows, Mac, Linux and Chrome Frame Security fixes and rewards: Please see the Chromium security page for more detail. Note that the referenced bugs may be kept private until a majority of our users are up to date with the fix. $1000 106484...

Google Fixes Three High-Priority Bugs in Chrome

Google has released a new version of its Chrome browser, fixing just a small handful of vulnerabilities in the process. All three of the bugs fixed in Chrome were rated high. The release by Google is a pretty small one by the company’s standards. Often, new versions of Chrome will include fixes f...

chromium -- multiple vulnerabilities

Google Chrome Releases reports: 106672 High CVE-2011-3921: Use-after-free in animation frames. Credit to Boris Zbarsky of Mozilla. 107128 High CVE-2011-3919: Heap-buffer-overflow in libxml. Credit to Juri Aedla. 108006 High CVE-2011-3922: Stack-buffer-overflow in glyph handling. Credit to Google...

Microsoft Internet Explorer 缓存对象历史枚举漏洞

Microsoft Internet Explorer 是微软公司推出的一款网页浏览器。 Microsoft Internet Explorer处理缓存对象时在实现上存在安全漏洞，远程攻击者可利用此漏洞枚举已浏览的站点，获取敏感信息 Microsoft Internet Explorer 9.x Microsoft Internet Explorer 8.x Microsoft Internet Explorer 7.x Microsoft Internet Explorer 6.x 临时解决方法： 在浏览可疑站点时，启用 "InPrivate Browsing"；或不浏览可疑站点。...

Google Expands Safe Browsing Alerts to Include Malware Distribution Sites

Google is expanding the amount and kind of data that it supplies to network operators about potentially malicious activity happening on their networks and elsewhere. The company is now giving operators information on dedicated domains that are being used for malware hosting and distribution. Last...

Google Implements Forward Secrecy

Google is stepping up their security game in a big way for the second time this year: introducing a more secure browsing method known as forward secrecy in Gmail and a number of other Web-based services, according to a post on the GoogleOnlineSecurity blog. In recent months, the Silicon Valley...

CVE-2011-4435

The web-server component in the Consolidation and Analysis Engine CAE Server in DB2 Query Monitor in IBM DB2 Tools 2.3.0 for z/OS does not prevent directory browsing, which allows remote attackers to obtain sensitive information via HTTP requests...

CVE-2011-4435

The web-server component in the Consolidation and Analysis Engine CAE Server in DB2 Query Monitor in IBM DB2 Tools 2.3.0 for z/OS does not prevent directory browsing, which allows remote attackers to obtain sensitive information via HTTP requests...

CVE-2011-4435

The web-server component in the Consolidation and Analysis Engine CAE Server in DB2 Query Monitor in IBM DB2 Tools 2.3.0 for z/OS does not prevent directory browsing, which allows remote attackers to obtain sensitive information via HTTP requests...

CVE-2011-4435

CVE-2011-4435 affects the web-server component of the Consolidation and Analysis Engine (CAE) Server in IBM DB2 Tools 2.3.0 for z/OS. The issue is that directory browsing is not prevented, enabling remote attackers to obtain sensitive information via HTTP requests. CVSSv2 metrics indicate a Netwo...

Apple Safari WebKit Private Browsing模式Cookie限制绕过漏洞

CVE ID: CVE-2011-3242 Safari是苹果计算机的最新作业系统Mac OS X中的浏览器，使用了KDE的KHTML作为浏览器的运算核心。 Safari在Private Browsing模式中处理cookie时存在逻辑错误，即使"Block cookies"设置为“Always”也会设置cookie。 Apple Mac OS X 10.6.8 Apple Mac OS X Server v10.6.8 Apple OS X Lion 10.7.2 Apple OS X Lion Server 10.7.2 厂商补丁： Apple -----...

CVE-2011-3225

The SMB File Server component in Apple Mac OS X 10.7 before 10.7.2 does not prevent all guest users from accessing the share point record of a guest-restricted folder, which allows remote attackers to bypass intended browsing restrictions by leveraging access to the nobody account...

CVE-2011-3242

The Private Browsing feature in Apple Safari before 5.1.1 on Mac OS X does not properly recognize the Always value of the Block Cookies setting, which makes it easier for remote web servers to track users via a cookie...

Design/Logic Flaw

The Private Browsing feature in Apple Safari before 5.1.1 on Mac OS X does not properly recognize the Always value of the Block Cookies setting, which makes it easier for remote web servers to track users via a cookie...

CVE-2011-3225

The SMB File Server component in Apple Mac OS X 10.7 before 10.7.2 does not prevent all guest users from accessing the share point record of a guest-restricted folder, which allows remote attackers to bypass intended browsing restrictions by leveraging access to the nobody account...

CVE-2011-3242

The Private Browsing feature in Apple Safari before 5.1.1 on Mac OS X does not properly recognize the Always value of the Block Cookies setting, which makes it easier for remote web servers to track users via a cookie...

CVE-2011-3239

WebKit, as used in Apple iTunes before 10.5, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2011-10-11-1...

CVE-2011-2817

WebKit, as used in Apple iTunes before 10.5, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2011-10-11-1...

CVE-2011-3233

WebKit, as used in Apple iTunes before 10.5, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2011-10-11-1...

CVE-2011-3236

WebKit, as used in Apple iTunes before 10.5, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2011-10-11-1...