openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:1020-1 Rating: important References: #1174189 Cross-References: CVE-2020-6510 CVE-2020-6511 CVE-2020-6512 CVE-2020-6513 CVE-2020-6514 CVE-2020-6515 CVE-2020-6516 CVE-2020-6517 CVE-2020-6518 CVE-2020-6519 CVE-2020-6520 CVE-2020-6521 CVE-2020-6522 CVE-2020-6523 CVE-2020-6524 CVE-2020-6525 CVE-2020-6526 CVE-2020-6527 CVE-2020-6528 CVE-2020-6529 CVE-2020-6530 CVE-2020-6531 CVE-2020-6533 CVE-2020-6534 CVE-2020-6535 CVE-2020-6536 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 26 vulnerabilities is now available. Description: This update for chromium fixes the following issues: - Update to 84.0.4147.89 boo#1174189: * Critical CVE-2020-6510: Heap buffer overflow in background fetch. * High CVE-2020-6511: Side-channel information leakage in content security policy. * High CVE-2020-6512: Type Confusion in V8. * High CVE-2020-6513: Heap buffer overflow in PDFium. * High CVE-2020-6514: Inappropriate implementation in WebRTC. * High CVE-2020-6515: Use after free in tab strip. * High CVE-2020-6516: Policy bypass in CORS. * High CVE-2020-6517: Heap buffer overflow in history. * Medium CVE-2020-6518: Use after free in developer tools. * Medium CVE-2020-6519: Policy bypass in CSP. * Medium CVE-2020-6520: Heap buffer overflow in Skia. * Medium CVE-2020-6521: Side-channel information leakage in autofill. * Medium CVE-2020-6522: Inappropriate implementation in external protocol handlers. * Medium CVE-2020-6523: Out of bounds write in Skia. * Medium CVE-2020-6524: Heap buffer overflow in WebAudio. * Medium CVE-2020-6525: Heap buffer overflow in Skia. * Low CVE-2020-6526: Inappropriate implementation in iframe sandbox. * Low CVE-2020-6527: Insufficient policy enforcement in CSP. * Low CVE-2020-6528: Incorrect security UI in basic auth. * Low CVE-2020-6529: Inappropriate implementation in WebRTC. * Low CVE-2020-6530: Out of bounds memory access in developer tools. * Low CVE-2020-6531: Side-channel information leakage in scroll to text. * Low CVE-2020-6533: Type Confusion in V8. * Low CVE-2020-6534: Heap buffer overflow in WebRTC. * Low CVE-2020-6535: Insufficient data validation in WebUI. * Low CVE-2020-6536: Incorrect security UI in PWAs. - Use bundled xcb-proto as we need to generate py2 bindings - Try to fix non-wayland build for Leap builds Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1020=1 Package List: - openSUSE Leap 15.2 (x86_64): chromedriver-84.0.4147.89-lp152.2.6.2 chromedriver-debuginfo-84.0.4147.89-lp152.2.6.2 chromium-84.0.4147.89-lp152.2.6.2 chromium-debuginfo-84.0.4147.89-lp152.2.6.2 chromium-debugsource-84.0.4147.89-lp152.2.6.2 References: https://www.suse.com/security/cve/CVE-2020-6510.html https://www.suse.com/security/cve/CVE-2020-6511.html https://www.suse.com/security/cve/CVE-2020-6512.html https://www.suse.com/security/cve/CVE-2020-6513.html https://www.suse.com/security/cve/CVE-2020-6514.html https://www.suse.com/security/cve/CVE-2020-6515.html https://www.suse.com/security/cve/CVE-2020-6516.html https://www.suse.com/security/cve/CVE-2020-6517.html https://www.suse.com/security/cve/CVE-2020-6518.html https://www.suse.com/security/cve/CVE-2020-6519.html https://www.suse.com/security/cve/CVE-2020-6520.html https://www.suse.com/security/cve/CVE-2020-6521.html https://www.suse.com/security/cve/CVE-2020-6522.html https://www.suse.com/security/cve/CVE-2020-6523.html https://www.suse.com/security/cve/CVE-2020-6524.html https://www.suse.com/security/cve/CVE-2020-6525.html https://www.suse.com/security/cve/CVE-2020-6526.html https://www.suse.com/security/cve/CVE-2020-6527.html https://www.suse.com/security/cve/CVE-2020-6528.html https://www.suse.com/security/cve/CVE-2020-6529.html https://www.suse.com/security/cve/CVE-2020-6530.html https://www.suse.com/security/cve/CVE-2020-6531.html https://www.suse.com/security/cve/CVE-2020-6533.html https://www.suse.com/security/cve/CVE-2020-6534.html https://www.suse.com/security/cve/CVE-2020-6535.html https://www.suse.com/security/cve/CVE-2020-6536.html https://bugzilla.suse.com/1174189 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-security-announce+help@opensuse.org