{"id":250707,"date":"2021-03-04T04:31:25","date_gmt":"2021-03-04T03:31:25","guid":{"rendered":"https:\/\/www.borncity.com\/blog\/?p=250707"},"modified":"2021-06-07T11:21:59","modified_gmt":"2021-06-07T09:21:59","slug":"google-chrome-89-0-4389-72-fixt-ausgenutzte-0-day-schwachstelle","status":"publish","type":"post","link":"https:\/\/borncity.com\/blog\/2021\/03\/04\/google-chrome-89-0-4389-72-fixt-ausgenutzte-0-day-schwachstelle\/","title":{"rendered":"Google Chrome 89.0.4389.72 fixt ausgenutzte 0-day-Schwachstelle"},"content":{"rendered":"<p><img decoding=\"async\" style=\"float: left; margin: 0px 10px 0px 0px; display: inline;\" src=\"https:\/\/borncity.com\/blog\/wp-content\/uploads\/2015\/01\/Chrome.jpg\" \/>[<a href=\"https:\/\/borncity.com\/win\/2021\/03\/04\/google-chrome-89-0-4389-72-fixt-ausgenutzte-0-day-schwachstelle\/\" target=\"_blank\" rel=\"noopener\">English<\/a>]Google hat bereits zum 2. M\u00e4rz 2021 den Google Chrome 89.0.4389.72 freigegeben. Der Browser sollte zeitnah aktualisiert werden, da Google eine aktiv ausgenutzte 0-day-Schwachstelle (die 2. in 2021) schlie\u00dft.<strong> Erg\u00e4nzung:<\/strong> Die Google Entwickler wollen k\u00fcnftig alle 4 Wochen eine neue Version des Browsers freigeben.<\/p>\n<p><!--more--><\/p>\n<p>Mir ist die Information <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/google-fixes-second-actively-exploited-chrome-zero-day-bug-this-year\/\" target=\"_blank\" rel=\"noopener\">hier<\/a> unter die Augen gekommen. Im Google-Blog gibt es <a href=\"https:\/\/chromereleases.googleblog.com\/2021\/03\/stable-channel-update-for-desktop.html\" target=\"_blank\" rel=\"noopener\">diesen Beitrag<\/a> mit einer Liste der im Chrome 89.0.4389.72 f\u00fcr den Desktop geschlossenen Schwachstellen. Hier einige hervorgehobene Schwachstellen, die beseitigt wurden.<\/p>\n<ul>\n<li>[$10000][1171049] High CVE-2021-21159: Heap buffer overflow in TabStrip. Reported by Khalil Zhani on 2021-01-27<\/li>\n<li>[$7500][1170531] High CVE-2021-21160: Heap buffer overflow in WebAudio. Reported by Marcin 'Icewall' Noga of Cisco Talos on 2021-01-25<\/li>\n<li>[$7500][1173702] High CVE-2021-21161: Heap buffer overflow in TabStrip. Reported by Khalil Zhani on 2021-02-02<\/li>\n<li>[$5000][1172054] High CVE-2021-21162: Use after free in WebRTC. Reported by Anonymous on 2021-01-29<\/li>\n<li>[$TBD][1111239] High CVE-2021-21163: Insufficient data validation in Reader Mode. Reported by Alison Huffman, Microsoft Browser Vulnerability Research on 2020-07-30<\/li>\n<li>[$TBD][1164846] High CVE-2021-21164: Insufficient data validation in Chrome for iOS. Reported by Muneaki Nishimura (nishimunea) on 2021-01-11<\/li>\n<li>[$TBD][1174582] High CVE-2021-21165: Object lifecycle issue in audio. Reported by Alison Huffman, Microsoft Browser Vulnerability Research on 2021-02-04<\/li>\n<li>[$TBD][1177465] High CVE-2021-21166: Object lifecycle issue in audio. Reported by Alison Huffman, Microsoft Browser Vulnerability Research on 2021-02-11<\/li>\n<li>[$10000][1161144] Medium CVE-2021-21167: Use after free in bookmarks. Reported by Leecraso and Guang Gong of 360 Alpha Lab on 2020-12-22<\/li>\n<li>[$5000][1152226] Medium CVE-2021-21168: Insufficient policy enforcement in appcache. Reported by Luan Herrera (@lbherrera_) on 2020-11-24<\/li>\n<li>[$5000][1166138] Medium CVE-2021-21169: Out of bounds memory access in V8. Reported by Bohan Liu (@P4nda20371774) and Moon Liang of Tencent Security Xuanwu Lab on 2021-01-13<\/li>\n<li>[$3000][1111646] Medium CVE-2021-21170: Incorrect security UI in Loader. Reported by David Erceg on 2020-07-31<\/li>\n<li>[$3000][1152894] Medium CVE-2021-21171: Incorrect security UI in TabStrip and Navigation. Reported by Irvan Kurniawan (sourc7) on 2020-11-25<\/li>\n<li>[$1000][1150810] Medium CVE-2021-21172: Insufficient policy enforcement in File System API. Reported by Maciej Pulikowski on 2020-11-19<\/li>\n<li>[$500][1154250] Medium CVE-2021-21173: Side-channel information leakage in Network Internals. Reported by Tom Van Goethem from imec-DistriNet, KU Leuven on 2020-12-01<\/li>\n<li>[$500][1158010] Medium CVE-2021-21174: Inappropriate implementation in Referrer. Reported by Ashish Gautam Kamble on 2020-12-11<\/li>\n<li>[$TBD][1146651] Medium CVE-2021-21175: Inappropriate implementation in Site isolation. Reported by Jun Kokatsu, Microsoft Browser Vulnerability Research on 2020-11-07<\/li>\n<li>[$TBD][1170584] Medium CVE-2021-21176: Inappropriate implementation in full screen mode. Reported by Luan Herrera (@lbherrera_) on 2021-01-26<\/li>\n<li>[$TBD][1173879] Medium CVE-2021-21177: Insufficient policy enforcement in Autofill. Reported by Abdulrahman Alqabandi, Microsoft Browser Vulnerability Research on 2021-02-03<\/li>\n<li>[$TBD][1174186] Medium CVE-2021-21178: Inappropriate implementation in Compositing. Reported by Japong on 2021-02-03<\/li>\n<li>[$TBD][1174943] Medium CVE-2021-21179: Use after free in Network Internals. Reported by Anonymous on 2021-02-05<\/li>\n<li>[$TBD][1175507] Medium CVE-2021-21180: Use after free in tab search. Reported by Abdulrahman Alqabandi, Microsoft Browser Vulnerability Research on 2021-02-07<\/li>\n<li>[$TBD][1177875] Medium CVE-2020-27844: Heap buffer overflow in OpenJPEG. Reported by Sean Campbell at Tableau on 2021-02-12<\/li>\n<li>[$TBD][1182767] Medium CVE-2021-21181: Side-channel information leakage in autofill. Reported by Xu Lin (University of Illinois at Chicago), Panagiotis Ilia (University of Illinois at Chicago), Jason Polakis (University of Illinois at Chicago) on 2021-02-26<\/li>\n<li>[$1000][1049265] Low CVE-2021-21182: Insufficient policy enforcement in navigations. Reported by Luan Herrera (@lbherrera_) on 2020-02-05<\/li>\n<li>[$1000][1105875] Low CVE-2021-21183: Inappropriate implementation in performance APIs. Reported by Takashi Yoneuchi (@y0n3uchy) on 2020-07-15<\/li>\n<li>[$1000][1131929] Low CVE-2021-21184: Inappropriate implementation in performance APIs. Reported by James Hartig on 2020-09-24<\/li>\n<li>[$TBD][1100748] Low CVE-2021-21185: Insufficient policy enforcement in extensions. Reported by David Erceg on 2020-06-30<\/li>\n<li>[$TBD][1153445] Low CVE-2021-21186: Insufficient policy enforcement in QR scanning. Reported by dhirajkumarnifty on 2020-11-28<\/li>\n<li>[$TBD][1155516] Low CVE-2021-21187: Insufficient data validation in URL formatting. Reported by Kirtikumar Anandrao Ramchandani on 2020-12-04<\/li>\n<li>[$N\/A][1161739] Low CVE-2021-21188: Use after free in Blink. Reported by Woojin Oh(@pwn_expoit) of STEALIEN on 2020-12-24<\/li>\n<li>[$TBD][1165392] Low CVE-2021-21189: Insufficient policy enforcement in payments. Reported by Khalil Zhani on 2021-01-11<\/li>\n<li>[$TBD][1166091] Low CVE-2021-21190: Uninitialized Use in PDFium. Reported by Zhou Aiting(@zhouat1) of Qihoo 360 Vulcan Team on 2021-01-13<\/li>\n<\/ul>\n<p>Ein Teil der Schwachstellen ist mit der Einstufung High versehen. Google schreibt, dass ein Exploit f\u00fcr CVE-2021-21166 in freier Wildbahn existiert.\u00a0 Weitere Probleme wurden intern durch Audits und Fuzzing aufgesp\u00fcrt und behoben. Der Browser sollte also z\u00fcgig aktualisiert werden. Die Chrome-Version f\u00fcr Windows, Mac und Linux wird in den n\u00e4chsten Tagen \u00fcber die automatische Update-Funktion auf die Systeme ausgerollt. Sie k\u00f6nnen diese Build aber auch <a href=\"https:\/\/www.google.com\/intl\/de_de\/chrome\/\" target=\"_blank\" rel=\"noopener\">hier herunterladen<\/a>.<\/p>\n<p><strong>Erg\u00e4nzung:<\/strong> Die Google Entwickler wollen k\u00fcnftig alle 4 Wochen eine neue Version des Browsers freigeben. Dies wurde im <a href=\"https:\/\/blog.chromium.org\/2021\/03\/speeding-up-release-cycle.html\" target=\"_blank\" rel=\"noopener\">Chromium-Blog angek\u00fcndigt<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>[English]Google hat bereits zum 2. M\u00e4rz 2021 den Google Chrome 89.0.4389.72 freigegeben. Der Browser sollte zeitnah aktualisiert werden, da Google eine aktiv ausgenutzte 0-day-Schwachstelle (die 2. in 2021) schlie\u00dft. Erg\u00e4nzung: Die Google Entwickler wollen k\u00fcnftig alle 4 Wochen eine neue &hellip; <a href=\"https:\/\/borncity.com\/blog\/2021\/03\/04\/google-chrome-89-0-4389-72-fixt-ausgenutzte-0-day-schwachstelle\/\">Weiterlesen <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1356,426,185],"tags":[406,4328,4315],"class_list":["post-250707","post","type-post","status-publish","format-standard","hentry","category-google-chrome-internet","category-sicherheit","category-update","tag-chrome","tag-sicherheit","tag-update"],"_links":{"self":[{"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/posts\/250707","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/comments?post=250707"}],"version-history":[{"count":0,"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/posts\/250707\/revisions"}],"wp:attachment":[{"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/media?parent=250707"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/categories?post=250707"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/tags?post=250707"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}