The high-risk vulnerabilities addressed in this release include insufficient policy enforcement in WebSockets (CVE-2019-13727), out of bounds write in V8 (CVE-2019-13728 and CVE-2019-13735), use-after-free in WebSockets (CVE-2019-13729), type confusion in V8 (CVE-2019-13730 and CVE-2019-13764), use-after-free in WebAudio (CVE-2019-13732), and out of bounds write in SQLite (CVE-2019-13734). Google revealed that it paid $20,000 for the use-after-free flaw, but has yet to determine the bug bounty reward for the heap buffer overflow.
The two critical flaws include CVE-2019-13725, a use-after-free in the Bluetooth component reported by Gengming Liu and Jianyu Chen of Tencent Keen Security Lab, and CVE-2019-13726, a heap buffer overflow in password manager, reported by Sergei Glazunov of Google Project Zero. Of the remaining bugs reported by external researchers, 8 are considered high risk, 18 have a medium severity rating, and 9 are considered low-risk. Any recommendation on how to fix this? (As running Firefox is not always an option for us.Google this week released Chrome 79 to the stable channel with a total of 51 security fixes, including 37 reported by external researchers, two of which are considered critical severity. We have hundreds of Intel servers and they all appear to be doing the same thing. If I switch to use the latest Firefox, it works fine. I also see "Failed - File Incomplete" if I try it on a fresh install in Windows 10 (default chrome settings). When I click the "Launch Console" button, the popup appears, but the download errors out with "Failed - Bad Certificate".
My entire company is no longer able to remotely manage our servers using Chrome 79.
0 kommentar(er)
