October 2022 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1202693] New: torbrowser-launcher not starting
by bugzilla_noreply＠suse.com 06 Jan '23

06 Jan '23

https://bugzilla.suse.com/show_bug.cgi?id=1202693 Bug ID: 1202693 Summary: torbrowser-launcher not starting Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: X11 Applications Assignee: screening-team-bugs(a)suse.de Reporter: mvetter(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- $ zypper in torbrowser-launcher $ torbrowser-launcher Tor Browser Launcher By Micah Lee, licensed under MIT version 0.3.5 https://github.com/micahflee/torbrowser-launcher Creating GnuPG homedir /home/michael/.local/share/torbrowser/gnupg_homedir Warning: Ignoring XDG_SESSION_TYPE=wayland on Gnome. Use QT_QPA_PLATFORM=wayland to run on Wayland anyway. Downloading Tor Browser for the first time. Downloading https://aus1.torproject.org/torbrowser/update_3/release/Linux_x86_64-gcc3/x… Traceback (most recent call last): File "/usr/bin/torbrowser-launcher", line 30, in <module> torbrowser_launcher.main() File "/usr/lib/python3.10/site-packages/torbrowser_launcher/__init__.py", line 92, in main gui.move( TypeError: arguments did not match any overloaded call: move(self, QPoint): argument 1 has unexpected type 'float' move(self, int, int): argument 1 has unexpected type 'float' -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1202160] New: AUDIT-FIND: libiio-usb-udev-rules: insecure permissions
by bugzilla_noreply＠suse.com 05 Jan '23

05 Jan '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1202160 Bug ID: 1202160 Summary: AUDIT-FIND: libiio-usb-udev-rules: insecure permissions Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: wolfgang.frisch(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- During a routine audit of udev scripts in openSUSE Factory, it was noticed that libiio-usb-udev-rules grants world-writable permissions: ``` SUBSYSTEM=="usb", PROGRAM=="/bin/sh -c '/usr/bin/iio_info -S usb=%s{idVendor}:%s{idProduct} | grep %s{idVendor}:%s{idProduct}'", RESULT!="", MODE="666" ``` This means unprivileged users have unrestricted read/write access to any IIO USB device or any device deemed by `iio_info` to be an IIO device. While this is not a security vulnerability per se, yet, hardening measures are warranted. It would be preferable to restrict access to a group, e.g.: MODE="660", GROUP="plugdev", or at least MODE="0664", GROUP="plugdev". What do you think? For reference, we already have udev rules with stricter permissions: ``` i+ | rtl-sdr-udev | Udev rules for RTL2832 | package i+ | uhd-udev | UHD udev rules | package ``` -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1202361] New: net-snmp logrotate will not reload snmpd.service and opened and delete net-snmpd.log will eat all free space
by bugzilla_noreply＠suse.com 05 Jan '23

05 Jan '23

https://bugzilla.suse.com/show_bug.cgi?id=1202361 Bug ID: 1202361 Summary: net-snmp logrotate will not reload snmpd.service and opened and delete net-snmpd.log will eat all free space Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.3 Hardware: Other OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: michal.siska(a)cs-soft.cz QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- All our openSUSE Leap 15.3 servers had full disk in df, while du shows not that much used space. The problem is in logrotate for net-snmp.log and not working postrotate skript. Here is full demonstration: localhost:~ # df -h Filesystem Size Used Avail Use% Mounted on devtmpfs 4,0M 0 4,0M 0% /dev tmpfs 3,9G 0 3,9G 0% /dev/shm tmpfs 1,6G 157M 1,5G 10% /run tmpfs 4,0M 0 4,0M 0% /sys/fs/cgroup /dev/sda2 78G 78G 0 100% / tmpfs 796M 52K 796M 1% /run/user/26 tmpfs 796M 52K 796M 1% /run/user/0 localhost:~ # lsof +L1 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NLINK NODE NAME snmpd 1630 root 3w REG 8,2 63071232000 0 2098987 /var/log/net-snmpd.log-20220628 (deleted) snmpd 1630 root 8w REG 8,2 63071232000 0 2098987 /var/log/net-snmpd.log-20220628 (deleted) localhost:~ # systemctl reload snmpd.service localhost:~ # lsof +L1 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NLINK NODE NAME localhost:~ # df -h Filesystem Size Used Avail Use% Mounted on devtmpfs 4,0M 0 4,0M 0% /dev tmpfs 3,9G 0 3,9G 0% /dev/shm tmpfs 1,6G 157M 1,5G 10% /run tmpfs 4,0M 0 4,0M 0% /sys/fs/cgroup /dev/sda2 78G 19G 55G 26% / tmpfs 796M 52K 796M 1% /run/user/26 tmpfs 796M 52K 796M 1% /run/user/0 localhost:~ # cat /etc/logrotate.d/net-snmp /var/log/net-snmpd.log { compress dateext maxage 365 rotate 99 size=+1024k notifempty missingok create 600 root root su root root sharedscripts postrotate /etc/init.d/snmpd reload ||: if [ -x /etc/init.d/snmptrapd ] ; then \ /etc/init.d/snmptrapd reload ||: ; \ fi endscript } localhost:~ # /etc/init.d/snmpd reload -bash: /etc/init.d/snmpd: No such file or directory -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1199941] New: kmozillahelper uses up all X clients given enough logout/login cycles
by bugzilla_noreply＠suse.com 04 Jan '23

04 Jan '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1199941 Bug ID: 1199941 Summary: kmozillahelper uses up all X clients given enough logout/login cycles Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Firefox Assignee: factory-mozilla(a)lists.opensuse.org Reporter: marix(a)marix.org QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- A couple days ago I ran into the issue of applications no longer starting reliably on my openSUSE Leap 15.4 system. Launching applications like "glxinfo" or "xlsclients" would fail with the error message `Maximum number of clients reached: unable to open display ":0"`. In searching for the error message I came across https://unix.stackexchange.com/questions/250920/debugging-maximum-number-of…. Using the method described there to get the application using up the most x client connections, I found that kmozillahelper was using up more than 170 of them. Closing Firefox and one `killall kmozillahelper` later I could reliably start applications again. While my immediate problem is gone, it seems that there seems to be a leak of kmozillahelper process instances when restoring a KDE session after having logged out with an open Firefox. I.e., on third login after the killall, a `ps aux | grep kmozillahelper` will produce the following: marix 5109 0.0 0.1 413872 44192 ? Sl 11:10 0:00 /usr/lib/mozilla/kmozillahelper -session 10ca646469000165348143300000027740024_1653489712_189016 marix 5144 0.0 0.1 413872 44184 ? Sl 11:10 0:00 /usr/lib/mozilla/kmozillahelper -session 10ca646469000165348930800000285810021_1653489712_189016 marix 6070 0.2 0.1 416140 46532 ? Sl 11:10 0:00 /usr/lib/mozilla/kmozillahelper Stopping Firefox will kill the process that does not have a -session argument. However, if I logout without closing Firefox first, the next login will show four kmozillahelper processes of which three have a with -session. The two already existing in the current session, and a third one with a new sessionid. As the session-id-less process instance is properly cleaned up if Firefox is closed during a session, the problem can be worked around by closing Firefox before logging out. However, this kind of contradicts the point of having resumable sessions. -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1133423] New: AutoYaST: repository priority not working in add-on section
by bugzilla_noreply＠novell.com 04 Jan '23

04 Jan '23

http://bugzilla.suse.com/show_bug.cgi?id=1133423 Bug ID: 1133423 Summary: AutoYaST: repository priority not working in add-on section Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.0 Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Installation Assignee: yast2-maintainers(a)suse.de Reporter: apoulat(a)vitechnology.com QA Contact: jsrain(a)suse.com Found By: --- Blocker: --- Created attachment 803606 --> http://bugzilla.suse.com/attachment.cgi?id=803606&action=edit add-on.xml Hi, I've just seen that, for example with attached add-on.xml given to AutoYaST, with, as you can see one repository with priority 20 and another with priority 10, they both, after install, have a (default) 99 priority (checked with "zypper -lr -p" command). See documentation about that here: https://doc.opensuse.org/projects/autoyast/#idm139966593990112 Note: I'm not sure on how <product> and <product_dir> tags are relevant then I tried without them and there is still the same issue. Thanks -- You are receiving this mail because: You are on the CC list for the bug.

2 7

[Bug 1202423] New: VUL-0: CVE-2022-35978: minetest: Mod scripts can escape sandbox in single player
by bugzilla_noreply＠suse.com 03 Jan '23

03 Jan '23

https://bugzilla.suse.com/show_bug.cgi?id=1202423 Bug ID: 1202423 Summary: VUL-0: CVE-2022-35978: minetest: Mod scripts can escape sandbox in single player Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other URL: https://smash.suse.de/issue/339900/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Security Assignee: dap.darkness(a)gmail.com Reporter: cathy.hu(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2022-35978 Minetest is a free open-source voxel game engine with easy modding and game creation. In **single player**, a mod can set a global setting that controls the Lua script loaded to display the main menu. The script is then loaded as soon as the game session is exited. The Lua environment the menu runs in is not sandboxed and can directly interfere with the user's system. There are currently no known workarounds. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-35978 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35978 https://github.com/minetest/minetest/commit/da71e86633d0b27cd02d7aac9fdac62… https://github.com/minetest/minetest/security/advisories/GHSA-663q-pcjw-27cc https://dev.minetest.net/Changelog#5.5.0_.E2.86.92_5.6.0 -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1029961] New: [META] Finalize /bin -> /usr/bin merge
by bugzilla_noreply＠novell.com 03 Jan '23

03 Jan '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1029961 Bug ID: 1029961 Summary: [META] Finalize /bin -> /usr/bin merge Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: daniel.molkentin(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Some packages still install files to /bin that are not symlinks. A "find /bin -type f -exec rpm -qf {} \; | sort -u" on a recent TW yields: bash-4.4-95.1.x86_64 dbus-1-1.10.16-1.1.x86_64 keyutils-1.5.9-5.33.x86_64 ksh-93v-6.15.x86_64 net-tools-deprecated-1.60-770.1.x86_64 procps-3.3.12-3.1.x86_64 psmisc-22.21-6.9.x86_64 rpm-4.13.0.1-1.1.x86_64 sash-3.8-2.8.x86_64 sysvinit-tools-2.88+-103.1.x86_64 tar-1.29-3.1.x86_64 tcsh-6.20.00-3.1.x86_64 util-linux-2.29.1-1.1.x86_64 vim-8.0.324-2.1.x86_64 These packages should all install their binaries to %_bindir, i.e. /usr/bin, and have a symlink in /bin. This would finalize the /bin deprecation. I am opening bugs for each of the packages. Once they are all closed, I'll close this one. -- You are receiving this mail because: You are on the CC list for the bug.

2 67

[Bug 1182960] New: VUL-0: chromium: Update to 89.0.4389.72
by bugzilla_noreply＠suse.com 03 Jan '23

03 Jan '23

https://bugzilla.suse.com/show_bug.cgi?id=1182960 Bug ID: 1182960 Summary: VUL-0: chromium: Update to 89.0.4389.72 Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.2 Hardware: Other OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: gmbr3(a)opensuse.org Reporter: atoptsoglou(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- CVE-2021-21159: Heap buffer overflow in TabStrip. Reported by Khalil Zhani on 2021-01-27 CVE-2021-21160: Heap buffer overflow in WebAudio. Reported by Aleksandar Nikolic of Cisco Talos on 2021-01-25 CVE-2021-21161: Heap buffer overflow in TabStrip. Reported by Khalil Zhani on 2021-02-02 CVE-2021-21162: Use after free in WebRTC. Reported by Anonymous on 2021-01-29 CVE-2021-21163: Insufficient data validation in Reader Mode. Reported by Alison Huffman, Microsoft Browser Vulnerability Research on 2020-07-30 CVE-2021-21164: Insufficient data validation in Chrome for iOS. Reported by Muneaki Nishimura (nishimunea) on 2021-01-11 CVE-2021-21165: Object lifecycle issue in audio. Reported by Alison Huffman, Microsoft Browser Vulnerability Research on 2021-02-04 CVE-2021-21166: Object lifecycle issue in audio. Reported by Alison Huffman, Microsoft Browser Vulnerability Research on 2021-02-11 CVE-2021-21167: Use after free in bookmarks. Reported by Leecraso and Guang Gong of 360 Alpha Lab on 2020-12-22 CVE-2021-21168: Insufficient policy enforcement in appcache. Reported by Luan Herrera (@lbherrera_) on 2020-11-24 CVE-2021-21169: Out of bounds memory access in V8. Reported by Bohan Liu (@P4nda20371774) of Tencent Security Xuanwu Lab on 2021-01-13 CVE-2021-21170: Incorrect security UI in Loader. Reported by David Erceg on 2020-07-31 CVE-2021-21171: Incorrect security UI in TabStrip and Navigation. Reported by Irvan Kurniawan (sourc7) on 2020-11-25 CVE-2021-21172: Insufficient policy enforcement in File System API. Reported by Maciej Pulikowski on 2020-11-19 CVE-2021-21173: Side-channel information leakage in Network Internals. Reported by Tom Van Goethem from imec-DistriNet, KU Leuven on 2020-12-01 CVE-2021-21174: Inappropriate implementation in Referrer. Reported by Ashish Gautam Kamble on 2020-12-11 CVE-2021-21175: Inappropriate implementation in Site isolation. Reported by Jun Kokatsu, Microsoft Browser Vulnerability Research on 2020-11-07 CVE-2021-21176: Inappropriate implementation in full screen mode. Reported by Luan Herrera (@lbherrera_) on 2021-01-26 CVE-2021-21177: Insufficient policy enforcement in Autofill. Reported by Abdulrahman Alqabandi, Microsoft Browser Vulnerability Research on 2021-02-03 CVE-2021-21178: Inappropriate implementation in Compositing. Reported by Japong on 2021-02-03 CVE-2021-21179: Use after free in Network Internals. Reported by Anonymous on 2021-02-05 CVE-2021-21180: Use after free in tab search. Reported by Abdulrahman Alqabandi, Microsoft Browser Vulnerability Research on 2021-02-07 CVE-2020-27844: Heap buffer overflow in OpenJPEG. Reported by Sean Campbell at Tableau on 2021-02-12 CVE-2021-21181: Side-channel information leakage in autofill. Reported by Xu Lin (University of Illinois at Chicago), Panagiotis Ilia (University of Illinois at Chicago), Jason Polakis (University of Illinois at Chicago) on 2021-02-26 CVE-2021-21182: Insufficient policy enforcement in navigations. Reported by Luan Herrera (@lbherrera_) on 2020-02-05 CVE-2021-21183: Inappropriate implementation in performance APIs. Reported by Takashi Yoneuchi (@y0n3uchy) on 2020-07-15 CVE-2021-21184: Inappropriate implementation in performance APIs. Reported by James Hartig on 2020-09-24 CVE-2021-21185: Insufficient policy enforcement in extensions. Reported by David Erceg on 2020-06-30 CVE-2021-21186: Insufficient policy enforcement in QR scanning. Reported by dhirajkumarnifty on 2020-11-28 CVE-2021-21187: Insufficient data validation in URL formatting. Reported by Kirtikumar Anandrao Ramchandani on 2020-12-04 CVE-2021-21188: Use after free in Blink. Reported by Woojin Oh(@pwn_expoit) of STEALIEN on 2020-12-24 CVE-2021-21189: Insufficient policy enforcement in payments. Reported by Khalil Zhani on 2021-01-11 CVE-2021-21190: Uninitialized Use in PDFium. Reported by Zhou Aiting(@zhouat1) of Qihoo 360 Vulcan Team on 2021-01-13 -- You are receiving this mail because: You are on the CC list for the bug.

1 10

[Bug 1194331] New: VUL-0: chromium: multiple security issues fixed in 97.0.4692.71
by bugzilla_noreply＠suse.com 03 Jan '23

03 Jan '23

https://bugzilla.suse.com/show_bug.cgi?id=1194331 Bug ID: 1194331 Summary: VUL-0: chromium: multiple security issues fixed in 97.0.4692.71 Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.3 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: gmbr3(a)opensuse.org Reporter: gianluca.gabrielli(a)suse.com QA Contact: security-team(a)suse.de Found By: --- Blocker: --- The Chrome team is delighted to announce the promotion of Chrome 97 to the stable channel for Windows, Mac and Linux.This will roll out over the coming days/weeks. Chrome 97.0.4692.71 contains a number of fixes and improvements -- a list of changes is available in the log. Watch out for upcoming Chrome and Chromium blog posts about new features and big efforts delivered in 97. Security Fixes and Rewards Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven��t yet fixed. This update includes 37 security fixes. Below, we highlight fixes that were contributed by external researchers. Please see the Chrome Security Page for more information. [$TBD][1275020] Critical CVE-2022-0096: Use after free in Storage. Reported by Yangkang (@dnpushme) of 360 ATA on 2021-11-30 [$10000][1117173] High CVE-2022-0097: Inappropriate implementation in DevTools. Reported by David Erceg on 2020-08-17 [$10000][1273609] High CVE-2022-0098: Use after free in Screen Capture. Reported by @ginggilBesel on 2021-11-24 [$5000][1245629] High CVE-2022-0099: Use after free in Sign-in. Reported by Rox on 2021-09-01 [$TBD][1238209] High CVE-2022-0100: Heap buffer overflow in Media streams API. Reported by Cassidy Kim of Amber Security Lab, OPPO Mobile Telecommunications Corp. Ltd. on 2021-08-10 [$TBD][1249426] High CVE-2022-0101: Heap buffer overflow in Bookmarks. Reported by raven (@raid_akame) on 2021-09-14 [$TBD][1260129] High CVE-2022-0102: Type Confusion in V8 . Reported by Brendon Tiszka on 2021-10-14 [$TBD][1272266] High CVE-2022-0103: Use after free in SwiftShader. Reported by Abraruddin Khan and Omair on 2021-11-21 [$TBD][1273661] High CVE-2022-0104: Heap buffer overflow in ANGLE. Reported by Abraruddin Khan and Omair on 2021-11-25 [$TBD][1274376] High CVE-2022-0105: Use after free in PDF. Reported by Cassidy Kim of Amber Security Lab, OPPO Mobile Telecommunications Corp. Ltd. on 2021-11-28 [$TBD][1278960] High CVE-2022-0106: Use after free in Autofill. Reported by Khalil Zhani on 2021-12-10 [$10000][1248438] Medium CVE-2022-0107: Use after free in File Manager API. Reported by raven (@raid_akame) on 2021-09-10 [$5000][1248444] Medium CVE-2022-0108: Inappropriate implementation in Navigation. Reported by Luan Herrera (@lbherrera_) on 2021-09-10 [$4000][1261689] Medium CVE-2022-0109: Inappropriate implementation in Autofill. Reported by Young Min Kim (@ylemkimon), CompSec Lab at Seoul National University on 2021-10-20 [$3000][1237310] Medium CVE-2022-0110: Incorrect security UI in Autofill. Reported by Alesandro Ortiz on 2021-08-06 [$3000][1241188] Medium CVE-2022-0111: Inappropriate implementation in Navigation. Reported by garygreen on 2021-08-18 [$3000][1255713] Medium CVE-2022-0112: Incorrect security UI in Browser UI. Reported by Thomas Orlita on 2021-10-04 [$1000][1039885] Medium CVE-2022-0113: Inappropriate implementation in Blink. Reported by Luan Herrera (@lbherrera_) on 2020-01-07 [$TBD][1267627] Medium CVE-2022-0114: Out of bounds memory access in Web Serial. Reported by Looben Yang on 2021-11-06 [$NA][1268903] Medium CVE-2022-0115: Uninitialized Use in File API. Reported by Mark Brand of Google Project Zero on 2021-11-10 [$TBD][1272250] Medium CVE-2022-0116: Inappropriate implementation in Compositing. Reported by Irvan Kurniawan (sourc7) on 2021-11-20 [$TBD][1115847] Low CVE-2022-0117: Policy bypass in Service Workers. Reported by Dongsung Kim (@kid1ng) on 2020-08-13 [$TBD][1238631] Low CVE-2022-0118: Inappropriate implementation in WebShare. Reported by Alesandro Ortiz on 2021-08-11 [$TBD][1262953] Low CVE-2022-0120: Inappropriate implementation in Passwords. Reported by CHAKRAVARTHI (Ruler96) on 2021-10-25 We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.As usual, our ongoing internal security work was responsible for a wide range of fixes: [1284397] Various fixes from internal audits, fuzzing and other initiatives Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL. Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues. -- You are receiving this mail because: You are on the CC list for the bug.

1 8

[Bug 1195420] New: VUL-0: chromium: multiple security issues fixed in 98.0.4758.80
by bugzilla_noreply＠suse.com 03 Jan '23

03 Jan '23

https://bugzilla.suse.com/show_bug.cgi?id=1195420 Bug ID: 1195420 Summary: VUL-0: chromium: multiple security issues fixed in 98.0.4758.80 Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.3 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: gmbr3(a)opensuse.org Reporter: gianluca.gabrielli(a)suse.com QA Contact: qa-bugs(a)suse.de CC: security-team(a)suse.de Found By: --- Blocker: --- [$20000][1284584] High CVE-2022-0452: Use after free in Safe Browsing. Reported by avaue at S.S.L. on 2022-01-05 [$20000][1284916] High CVE-2022-0453: Use after free in Reader Mode. Reported by Rong Jian of VRI on 2022-01-06 [$12000][1287962] High CVE-2022-0454: Heap buffer overflow in ANGLE. Reported by Seong-Hwan Park (SeHwa) of SecunologyLab on 2022-01-17 [$7500][1270593] High CVE-2022-0455: Inappropriate implementation in Full Screen Mode. Reported by Irvan Kurniawan (sourc7) on 2021-11-16 [$7000][1289523] High CVE-2022-0456: Use after free in Web Search. Reported by Zhihua Yao of KunLun Lab on 2022-01-21 [$5000][1274445] High CVE-2022-0457: Type Confusion in V8. Reported by rax of the Group0x58 on 2021-11-29 [$1000][1267060] High CVE-2022-0458: Use after free in Thumbnail Tab Strip. Reported by Anonymous on 2021-11-05 [$TBD][1244205] High CVE-2022-0459: Use after free in Screen Capture. Reported by raven (@raid_akame) on 2021-08-28 [$7500][1250227] Medium CVE-2022-0460: Use after free in Window Dialog. Reported by 0x74960 on 2021-09-16 [$3000][1256823] Medium CVE-2022-0461: Policy bypass in COOP. Reported by NDevTK on 2021-10-05 [$2000][1270470] Medium CVE-2022-0462: Inappropriate implementation in Scroll. Reported by Youssef Sammouda on 2021-11-16 [$1000][1268240] Medium CVE-2022-0463: Use after free in Accessibility. Reported by Zhihua Yao of KunLun Lab on 2021-11-09 [$1000][1270095] Medium CVE-2022-0464: Use after free in Accessibility. Reported by Zhihua Yao of KunLun Lab on 2021-11-14 [$1000][1281941] Medium CVE-2022-0465: Use after free in Extensions. Reported by Samet Bekmezci @sametbekmezci on 2021-12-22 [$TBD][1115460] Medium CVE-2022-0466: Inappropriate implementation in Extensions Platform. Reported by David Erceg on 2020-08-12 [$TBD][1239496] Medium CVE-2022-0467: Inappropriate implementation in Pointer Lock. Reported by Alesandro Ortiz on 2021-08-13 [$TBD][1252716] Medium CVE-2022-0468: Use after free in Payments. Reported by Krace on 2021-09-24 [$TBD][1279531] Medium CVE-2022-0469: Use after free in Cast. Reported by Thomas Orlita on 2021-12-14 [$TBD][1269225] Low CVE-2022-0470: Out of bounds memory access in V8. Reported by Looben Yang on 2021-11-11 We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.As usual, our ongoing internal security work was responsible for a wide range of fixes: [1293087] Various fixes from internal audits, fuzzing and other initiatives -- You are receiving this mail because: You are on the CC list for the bug.

1 3