[Bug 1201216] New: VUL-0: chromium: multiple security issues fixed in 103.0.5060.114
https://bugzilla.suse.com/show_bug.cgi?id=1201216 Bug ID: 1201216 Summary: VUL-0: chromium: multiple security issues fixed in 103.0.5060.114 Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: gmbr3@opensuse.org Reporter: gabriele.sonnu@suse.com QA Contact: security-team@suse.de CC: Andreas.Stieger@gmx.de Found By: --- Blocker: --- This update includes 4 security fixes. Below, we highlight fixes that were contributed by external researchers. Please see the Chrome Security Page for more information. [$TBD][1341043] High CVE-2022-2294: Heap buffer overflow in WebRTC. Reported by Jan Vojtesek from the Avast Threat Intelligence team on 2022-07-01 [$7500][1336869] High CVE-2022-2295: Type Confusion in V8. Reported by avaue and Buff3tts at S.S.L. on 2022-06-16 [$3000][1327087] High CVE-2022-2296: Use after free in Chrome OS Shell. Reported by Khalil Zhani on 2022-05-19 We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel. Google is aware that an exploit for CVE-2022-2294 exists in the wild. As usual, our ongoing internal security work was responsible for a wide range of fixes: [1338205] Various fixes from internal audits, fuzzing and other initiatives -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1201216 Gabriele Sonnu <gabriele.sonnu@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |security-team@suse.de -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1201216 Maintenance Robot <maint-coord+maintenance_robot@suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1201216 Carlos L�pez <carlos.lopez@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- URL| |https://smash.suse.de/issue | |/336273/ CC| |carlos.lopez@suse.com -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1201216 Marcus Meissner <meissner@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |meissner@suse.com -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1201216 https://bugzilla.suse.com/show_bug.cgi?id=1201216#c1 --- Comment #1 from Callum Farmer <gmbr3@opensuse.org> --- cal@localhost:~/home:gmbr3:Chromium/chromium> wget https://commondatastorage.googleapis.com/chromium-browser-official/chromium-... --2022-07-06 14:06:55-- https://commondatastorage.googleapis.com/chromium-browser-official/chromium-... Resolving commondatastorage.googleapis.com (commondatastorage.googleapis.com)... 172.217.16.240, 2a00:1450:4009:821::2010 Connecting to commondatastorage.googleapis.com (commondatastorage.googleapis.com)|172.217.16.240|:443... connected. HTTP request sent, awaiting response... 404 Not Found 2022-07-06 14:06:56 ERROR 404: Not Found. -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1201216 https://bugzilla.suse.com/show_bug.cgi?id=1201216#c2 Gabriele Sonnu <gabriele.sonnu@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(Andreas.Stieger@g | |mx.de) --- Comment #2 from Gabriele Sonnu <gabriele.sonnu@suse.com> --- Callum: https://commondatastorage.googleapis.com/chromium-browser-official seems to contain only up to chromium 101. Not sure where to get the most recent tarballs. Andreas can you help here? -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1201216 https://bugzilla.suse.com/show_bug.cgi?id=1201216#c3 Callum Farmer <gmbr3@opensuse.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(Andreas.Stieger@g | |mx.de) | --- Comment #3 from Callum Farmer <gmbr3@opensuse.org> --- (In reply to Gabriele Sonnu from comment #2)
Callum: https://commondatastorage.googleapis.com/chromium-browser-official seems to contain only up to chromium 101. Not sure where to get the most recent tarballs. Andreas can you help here?
Ignore the data, it is always wrong and getting the current tarball still works. -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1201216 https://bugzilla.suse.com/show_bug.cgi?id=1201216#c4 Gabriele Sonnu <gabriele.sonnu@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo? --- Comment #4 from Gabriele Sonnu <gabriele.sonnu@suse.com> --- I am not able to download the previous release (103.0.5060.66) using that link either. To sum up: - 103.0.5060.114: unavailable - 103.0.5060.66: unavailable - 103.0.5060.53: available Maybe it's a recent change? -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1201216 https://bugzilla.suse.com/show_bug.cgi?id=1201216#c5 --- Comment #5 from Gabriele Sonnu <gabriele.sonnu@suse.com> --- Just to be clear, both .66 and .114 were publicly announced on Chrome release blog: 103.0.5060.66: https://chromereleases.googleblog.com/2022/06/stable-channel-update-for-desk... 103.0.5060.114: https://chromereleases.googleblog.com/2022/07/stable-channel-update-for-desk... -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1201216 https://bugzilla.suse.com/show_bug.cgi?id=1201216#c11 --- Comment #11 from Swamp Workflow Management <swamp@suse.de> --- openSUSE-SU-2022:10055-1: An update that fixes three vulnerabilities is now available. Category: security (important) Bug References: 1201216 CVE References: CVE-2022-2294,CVE-2022-2295,CVE-2022-2296 JIRA References: Sources used: openSUSE Backports SLE-15-SP4 (src): chromium-103.0.5060.114-bp154.2.14.1 openSUSE Backports SLE-15-SP3 (src): chromium-103.0.5060.114-bp153.2.107.1 -- You are receiving this mail because: You are on the CC list for the bug.
participants (1)
-
bugzilla_noreply＠suse.com