5 ms·

Does anybody have more details about this bug or the fix. The Google code link 403s for me: [$2337] [93906] High CVE-2011-2862: Unintended access to v8 built-i

Does anybody have more details about this bug or the fix. The Google code link 403s for me: [$2337] [93906] High CVE-2011-2862: Unintended access to v8 built-in objects. Credit to Sergey Glazunov. [93906] http://code.google.com/p/chromium/issues/detail?id=93906 http://code.google.com/p/chromium/issues/detail?id=93906

aboodman 15y ago
I think the release managers usually unlock security bugs for a release once most of the population has been updated. So check back in a few days to a week.
- simonbrown 15y ago
  The blog posts mention that the bugs are only kept private until most people are up to date, but some never seem to be made public. For example: http://googlechromereleases.blogspot.com/2011/01/chrome-stable-release.html http://googlechromereleases.blogspot.com/2011/01/chrome-stab... Some of the bugs (e.g. 66560) still give me a 403 (although some are accessible).
  - aboodman 15y ago
    Of the 15 bugs there, 9 are open now. I'll poke someone more knowledgable and ask them to explain why the others have not been opened. I could imagine that it's that the process for unlocking them is manual and easy to forget, or it could be that other instances of those bugs were uncovered so it still isn't safe to open them.
    - aboodman 15y ago
      aayra (who replied to great-grandparent) works on Chrome security team. It looks like all the bugs that are still closed are WebKit bugs (css, svg, etc), and we don't open them until the other WebKit clients are updated.
- aarya 15y ago
  66560 is a webkit issue. Webkit is an open source project. Webkit vulnerabilities are not disclosed until all the other consumers like Safari are updated.
justinschuh 15y ago
Just to expand on @aboodman and @aarya's responses, for any third-party dependencies we don't disclose the details of the vulnerability until we're reasonably certain all affected parties have had time to deploy a fix.
dminor 15y ago
It seems like Sergey Glazunov practically makes a full time living off of Chrome bug bounties. Someone should do an interview with him - I bet it would be pretty interesting.
- justinschuh 15y ago
  Sergey's a university student in Russia, and he's actually quite private. As interesting as it would be to here his perspective and approach (almost all manual source auditing) I'm not sure he'd be entirely comfortable with that level of attention.

aboodman 15y ago

I think the release managers usually unlock security bugs for a release once most of the population has been updated. So check back in a few days to a week.

simonbrown 15y ago
The blog posts mention that the bugs are only kept private until most people are up to date, but some never seem to be made public. For example: http://googlechromereleases.blogspot.com/2011/01/chrome-stable-release.html http://googlechromereleases.blogspot.com/2011/01/chrome-stab... Some of the bugs (e.g. 66560) still give me a 403 (although some are accessible).
- aboodman 15y ago
  Of the 15 bugs there, 9 are open now. I'll poke someone more knowledgable and ask them to explain why the others have not been opened. I could imagine that it's that the process for unlocking them is manual and easy to forget, or it could be that other instances of those bugs were uncovered so it still isn't safe to open them.
  - aboodman 15y ago
    aayra (who replied to great-grandparent) works on Chrome security team. It looks like all the bugs that are still closed are WebKit bugs (css, svg, etc), and we don't open them until the other WebKit clients are updated.
aarya 15y ago
66560 is a webkit issue. Webkit is an open source project. Webkit vulnerabilities are not disclosed until all the other consumers like Safari are updated.

justinschuh 15y ago

Just to expand on @aboodman and @aarya's responses, for any third-party dependencies we don't disclose the details of the vulnerability until we're reasonably certain all affected parties have had time to deploy a fix.

dminor 15y ago

It seems like Sergey Glazunov practically makes a full time living off of Chrome bug bounties. Someone should do an interview with him - I bet it would be pretty interesting.

justinschuh 15y ago
Sergey's a university student in Russia, and he's actually quite private. As interesting as it would be to here his perspective and approach (almost all manual source auditing) I'm not sure he'd be entirely comfortable with that level of attention.