[Bug 1227979] New: VUL-0: chromium,ungoogled-chromium: multiple vulnerabilities fixed in 126.0.6478.182
https://bugzilla.suse.com/show_bug.cgi?id=1227979 Bug ID: 1227979 Summary: VUL-0: chromium,ungoogled-chromium: multiple vulnerabilities fixed in 126.0.6478.182 Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: gmbr3@opensuse.org Reporter: rfrohl@suse.com QA Contact: qa-bugs@suse.de CC: Andreas.Stieger@gmx.de, m.szczepaniak.000@gmail.com Target Milestone: --- Found By: --- Blocker: --- The Stable channel has been updated to 126.0.6478.182/183 for Windows, Mac and 126.0.6478.182 for Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log. - High CVE-2024-6772: Inappropriate implementation in V8. Reported by 5fceb6172bbf7e2c5a948183b53565b9 on 2024-06-12 - High CVE-2024-6773: Type Confusion in V8. Reported by 2ourc3 | Salim Largo on 2024-06-17 - High CVE-2024-6774: Use after free in Screen Capture. Reported by lime(@limeSec_) and fmyy(@binary_fmyy) From TIANGONG Team of Legendsec at QI-ANXIN Group on 2024-06-13 - High CVE-2024-6775: Use after free in Media Stream. Reported by Anonymous on 2024-06-15 - High CVE-2024-6776: Use after free in Audio. Reported by lime(@limeSec_) and fmyy(@binary_fmyy) From TIANGONG Team of Legendsec at QI-ANXIN Group on 2024-06-12 - High CVE-2024-6777: Use after free in Navigation. Reported by Sven Dysthe (@svn-dys) on 2024-06-07 - High CVE-2024-6778: Race in DevTools. Reported by Allen Ding on 2024-05-16 - High CVE-2024-6779: Out of bounds memory access in V8. Reported by Seunghyun Lee (@0x10n) on 2024-07-06 https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desk... -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1227979 SMASH SMASH <smash_bz@suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1227979 Robert Frohl <rfrohl@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- URL| |https://smash.suse.de/issue | |/414437/ -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1227979 Michał Szczepaniak <m.szczepaniak.000@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC|m.szczepaniak.000@gmail.com | -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1227979 https://bugzilla.suse.com/show_bug.cgi?id=1227979#c2 Ruediger Oertel <ro@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |ro@suse.com --- Comment #2 from Ruediger Oertel <ro@suse.com> --- hm updated to a 126b based build and ... just saw a segfault again in slack, I guess I will have to bring back the removed bad-font-gc patches or is anyone already working on this ? -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1227979 https://bugzilla.suse.com/show_bug.cgi?id=1227979#c3 --- Comment #3 from Callum Farmer <gmbr3@opensuse.org> --- (In reply to Ruediger Oertel from comment #2)
hm updated to a 126b based build and ... just saw a segfault again in slack, I guess I will have to bring back the removed bad-font-gc patches or is anyone already working on this ?
They looked part merged (hence removal) Work in progress bsc#1227739 -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1227979 https://bugzilla.suse.com/show_bug.cgi?id=1227979#c4 --- Comment #4 from Ruediger Oertel <ro@suse.com> --- nope, different issue, I think: Stack trace of thread 4: #0 0x000056350f8ad994 _ZN7sandbox19CrashSIGSYS_HandlerERK17arch_seccomp_dataPv (chrome + 0xae0e994) #1 0x000056350f8b4012 _ZN7sandbox4Trap6SigSysEiP9siginfo_tP10ucontext_t (chrome + 0xae15012) #2 0x00007ff60f457980 __restore_rt (libc.so.6 + 0x57980) #3 0x00007ff60f4f61b7 alarm (libc.so.6 + 0xf61b7) #4 0x000056350dc06e58 _ZN4base5debug12_GLOBAL__N_122StackDumpSignalHandlerEiP9siginfo_tPv (chrome + 0x9167e58) #5 0x00007ff60f457980 __restore_rt (libc.so.6 + 0x57980) #6 0x000056350e2ce6d4 _ZN4mojo8internal15SendMojoMessageERNS_15MessageReceiverERNS_7MessageE (chrome + 0x982f6d4) #7 0x00005635095ebd53 _ZN7network5mojom14URLLoaderProxy24ResumeReadingBodyFromNetEv (chrome + 0x4b4cd53) #8 0x000056350a55f579 _ZN7content5mojom24ChildProcessStubDispatch6AcceptEPNS0_12ChildProcessEPN4mojo7MessageE (chrome + 0x5ac0579) #9 0x000056350e2b4b4e _ZN4mojo23InterfaceEndpointClient22HandleValidatedMessageEPNS_7MessageE (chrome + 0x9815b4e) #10 0x000056350e2bc25d _ZN4mojo17MessageDispatcher6AcceptEPNS_7MessageE (chrome + 0x981d25d) #11 0x000056350e2b63cc _ZN4mojo23InterfaceEndpointClient21HandleIncomingMessageEPNS_7MessageE (chrome + 0x98173cc) #12 0x000056350e2bfbf8 _ZN4mojo8internal15MultiplexRouter22ProcessIncomingMessageEPNS1_14MessageWrapperENS1_18ClientCallBehaviorEPN4base19SequencedTaskRun> #13 0x000056350e2bf2ed _ZN4mojo8internal15MultiplexRouter6AcceptEPNS_7MessageE (chrome + 0x98202ed) #14 0x000056350e2bc25d _ZN4mojo17MessageDispatcher6AcceptEPNS_7MessageE (chrome + 0x981d25d) #15 0x000056350e2b2799 _ZN4mojo9Connector15DispatchMessageENS_16ScopedHandleBaseINS_13MessageHandleEEE (chrome + 0x9813799) #16 0x000056350e2b2f60 _ZN4mojo9Connector24ReadAllAvailableMessagesEv (chrome + 0x9813f60) #17 0x000056350e2b2db2 _ZN4mojo9Connector20OnWatcherHandleReadyEPKcj (chrome + 0x9813db2) #18 0x00005635099fdd86 _ZNKR4base17RepeatingCallbackIFvN2ui15ClipboardBufferEEE3RunES2_ (chrome + 0x4f5ed86) #19 0x00005635091c59b0 _ZNKR4base17RepeatingCallbackIFvN3net15MDnsTransaction6ResultEPKNS1_12RecordParsedEEE3RunES3_S6_ (chrome + 0x47269b0) #20 0x000056350e2d3e96 _ZN4mojo13SimpleWatcher13OnHandleReadyEijRKNS_18HandleSignalsStateE (chrome + 0x9834e96) #21 0x000056350e2d4053 _ZN4mojo13SimpleWatcher7Context6NotifyEj22MojoHandleSignalsStatej (chrome + 0x9835053) #22 0x000056350e2d33d0 _ZN4mojo13SimpleWatcher7Context10CallNotifyEPK13MojoTrapEvent (chrome + 0x98343d0) #23 0x000056350920b2de _ZN4mojo4core11ipcz_driver8MojoTrap20DispatchOrQueueEventERNS2_7TriggerERK13MojoTrapEvent (chrome + 0x476c2de) #24 0x000056350920bc3c _ZN4mojo4core11ipcz_driver8MojoTrap11HandleEventERK13IpczTrapEvent (chrome + 0x476cc3c) #25 0x000056350925aad6 _ZN4ipcz19TrapEventDispatcherD2Ev (chrome + 0x47bbad6) #26 0x0000563509252e6a _ZN4ipcz6Router19AcceptInboundParcelERKNS_16OperationContextESt10unique_ptrINS_6ParcelESt14default_deleteIS5_EE (chrome + 0x47b3e6a) #27 0x000056350924556f _ZN4ipcz8NodeLink20AcceptCompleteParcelENS_11StrongAliasINS_12SublinkIdTagEmEESt10unique_ptrINS_6ParcelESt14default_deleteIS5_EE (c> #28 0x0000563509244b81 _ZN4ipcz8NodeLink14OnAcceptParcelERNS_3msg12AcceptParcelE (chrome + 0x47a5b81) #29 0x000056350924d31b _ZN4ipcz3msg19NodeMessageListener18OnTransportMessageERKNS_15DriverTransport10RawMessageERKS2_ (chrome + 0x47ae31b) #30 0x0000563509232ea5 _ZN4ipcz12_GLOBAL__N_115NotifyTransportEmPKvmPKmmjS2_ (chrome + 0x4793ea5) #31 0x0000563509210ddc _ZN4mojo4core11ipcz_driver9Transport16OnChannelMessageEPKvmSt6vectorINS_14PlatformHandleESaIS6_EE (chrome + 0x4771ddc) #32 0x00005635091f4c41 _ZN4mojo4core7Channel18TryDispatchMessageEN4base4spanIKcLm18446744073709551615EPS4_EEPm (chrome + 0x4755c41) #33 0x00005635091f4a26 _ZN4mojo4core7Channel14OnReadCompleteEmPm (chrome + 0x4755a26) #34 0x0000563509229890 _ZN4mojo4core12ChannelPosix28OnFileCanReadWithoutBlockingEi (chrome + 0x478a890) #35 0x000056350dc17b76 _ZN4base16MessagePumpEpoll11HandleEventEibbPNS_19MessagePumpLibevent17FdWatchControllerE (chrome + 0x9178b76) #36 0x000056350dc1780e _ZN4base16MessagePumpEpoll12OnEpollEventERNS0_15EpollEventEntryEj (chrome + 0x917880e) #37 0x000056350dc17358 _ZN4base16MessagePumpEpoll18WaitForEpollEventsENS_9TimeDeltaE (chrome + 0x9178358) #38 0x000056350dc16f6a _ZN4base16MessagePumpEpoll3RunEPNS_11MessagePump8DelegateE (chrome + 0x9177f6a) #39 0x000056350dbb1f2f _ZN4base16sequence_manager8internal35ThreadControllerWithMessagePumpImpl3RunEbNS_9TimeDeltaE (chrome + 0x9112f2f) #40 0x000056350db75ba9 _ZN4base7RunLoop3RunERKNS_8LocationE (chrome + 0x90d6ba9) #41 0x000056350dbd4165 _ZN4base6Thread3RunEPNS_7RunLoopE (chrome + 0x9135165) #42 0x0000563510f204ed _ZN7content12_GLOBAL__N_113ChildIOThread3RunEPN4base7RunLoopE (chrome + 0xc4814ed) #43 0x000056350dbd437f _ZN4base6Thread10ThreadMainEv (chrome + 0x913537f) #44 0x000056350dbe96fa _ZN4base12_GLOBAL__N_110ThreadFuncEPv (chrome + 0x914a6fa) #45 0x00007ff60f4a761c start_thread (libc.so.6 + 0xa761c) #46 0x00007ff60f52e8f0 __clone (libc.so.6 + 0x12e8f0) -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1227979 https://bugzilla.suse.com/show_bug.cgi?id=1227979#c5 --- Comment #5 from Ruediger Oertel <ro@suse.com> ---
Work in progress bsc#1227739
thanks, looks like the same thing. -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1227979 https://bugzilla.suse.com/show_bug.cgi?id=1227979#c6 --- Comment #6 from Marcus Meissner <meissner@suse.com> --- openSUSE-SU-2024:0212-1: An update that fixes 8 vulnerabilities is now available. Category: security (important) Bug References: 1227979 CVE References: CVE-2024-6772,CVE-2024-6773,CVE-2024-6774,CVE-2024-6775,CVE-2024-6776,CVE-2024-6777,CVE-2024-6778,CVE-2024-6779 JIRA References: Sources used: openSUSE Backports SLE-15-SP5 (src): chromium-126.0.6478.182-bp155.2.99.1 -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1227979 https://bugzilla.suse.com/show_bug.cgi?id=1227979#c8 --- Comment #8 from Marcus Meissner <meissner@suse.com> --- openSUSE-SU-2024:0212-2: An update that fixes 8 vulnerabilities is now available. Category: security (important) Bug References: 1227979 CVE References: CVE-2024-6772,CVE-2024-6773,CVE-2024-6774,CVE-2024-6775,CVE-2024-6776,CVE-2024-6777,CVE-2024-6778,CVE-2024-6779 JIRA References: Sources used: openSUSE Backports SLE-15-SP6 (src): chromium-126.0.6478.182-bp156.2.11.1 -- You are receiving this mail because: You are on the CC list for the bug.
participants (1)
-
bugzilla_noreply＠suse.com