openSUSE Security Update: chromium to 32.0.1700.102 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0243-1 Rating: important References: #861013 Cross-References: CVE-2013-6641 CVE-2013-6643 CVE-2013-6644 CVE-2013-6645 CVE-2013-6646 CVE-2013-6649 CVE-2013-6650 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: Chromium was updated to version 32.0.1700.102: Stable channel update: - Security Fixes: * CVE-2013-6649: Use-after-free in SVG images * CVE-2013-6650: Memory corruption in V8 * and 12 other fixes - Other: * Mouse Pointer disappears after exiting full-screen mode * Drag and drop files into Chromium may not work properly * Quicktime Plugin crashes in Chromium * Chromium becomes unresponsive * Trackpad users may not be able to scroll horizontally * Scrolling does not work in combo box * Chromium does not work with all CSS minifiers such as whitespace around a media query's `and` keyword - Update to Chromium 32.0.1700.77 Stable channel update: - Security fixes: * CVE-2013-6646: Use-after-free in web workers * CVE-2013-6641: Use-after-free related to forms * CVE-2013-6643: Unprompted sync with an attacker’s Google account * CVE-2013-6645: Use-after-free related to speech input elements * CVE-2013-6644: Various fixes from internal audits, fuzzing and other initiatives - Other: * Tab indicators for sound, webcam and casting * Automatically blocking malware files * Lots of under the hood changes for stability and performance - Remove patch chromium-fix-chromedriver-build.diff as that chromedriver is fixed upstream - Updated ExcludeArch to exclude aarch64, ppc, ppc64 and ppc64le. This is based on missing build requires (valgrind, v8, etc) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-135 - openSUSE 12.3: zypper in -t patch openSUSE-2014-135 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): chromedriver-32.0.1700.102-17.2 chromedriver-debuginfo-32.0.1700.102-17.2 chromium-32.0.1700.102-17.2 chromium-debuginfo-32.0.1700.102-17.2 chromium-debugsource-32.0.1700.102-17.2 chromium-desktop-gnome-32.0.1700.102-17.2 chromium-desktop-kde-32.0.1700.102-17.2 chromium-ffmpegsumo-32.0.1700.102-17.2 chromium-ffmpegsumo-debuginfo-32.0.1700.102-17.2 chromium-suid-helper-32.0.1700.102-17.2 chromium-suid-helper-debuginfo-32.0.1700.102-17.2 - openSUSE 12.3 (i586 x86_64): chromedriver-32.0.1700.102-1.25.2 chromedriver-debuginfo-32.0.1700.102-1.25.2 chromium-32.0.1700.102-1.25.2 chromium-debuginfo-32.0.1700.102-1.25.2 chromium-debugsource-32.0.1700.102-1.25.2 chromium-desktop-gnome-32.0.1700.102-1.25.2 chromium-desktop-kde-32.0.1700.102-1.25.2 chromium-ffmpegsumo-32.0.1700.102-1.25.2 chromium-ffmpegsumo-debuginfo-32.0.1700.102-1.25.2 chromium-suid-helper-32.0.1700.102-1.25.2 chromium-suid-helper-debuginfo-32.0.1700.102-1.25.2 References: http://support.novell.com/security/cve/CVE-2013-6641.html http://support.novell.com/security/cve/CVE-2013-6643.html http://support.novell.com/security/cve/CVE-2013-6644.html http://support.novell.com/security/cve/CVE-2013-6645.html http://support.novell.com/security/cve/CVE-2013-6646.html http://support.novell.com/security/cve/CVE-2013-6649.html http://support.novell.com/security/cve/CVE-2013-6650.html https://bugzilla.novell.com/861013