openSUSE Security Update: update for chromium, v8 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0466-1 Rating: important References: #754456 Cross-References: CVE-2011-3045 CVE-2011-3049 CVE-2011-3050 CVE-2011-3051 CVE-2011-3052 CVE-2011-3053 CVE-2011-3054 CVE-2011-3055 CVE-2011-3056 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: - Update to 19.0.1079 Security Fixes (bnc#754456): * High CVE-2011-3050: Use-after-free with first-letter handling * High CVE-2011-3045: libpng integer issue from upstream * High CVE-2011-3051: Use-after-free in CSS cross-fade handling * High CVE-2011-3052: Memory corruption in WebGL canvas handling * High CVE-2011-3053: Use-after-free in block splitting * Low CVE-2011-3054: Apply additional isolations to webui privileges * Low CVE-2011-3055: Prompt in the browser native UI for unpacked extension installation * High CVE-2011-3056: Cross-origin violation with “magic iframe”. * Low CVE-2011-3049: Extension web request API can interfere with system requests Other Fixes: * The short-cut key for caps lock (Shift + Search) is disabled when an accessibility screen reader is enabled * Fixes an issue with files not being displayed in File Manager when some file names contain UTF-8 characters (generally accented characters) * Fixed dialog boxes in settings. (Issue: 118031) * Fixed flash videos turning white on mac when running with --disable-composited-core-animation-plugins (Issue: 117916) * Change to look for correctly sized favicon when multiple images are provided. (Issue: 118275) * Fixed issues - 116044, 117470, 117068, 117668, 118620 - Update to 19.0.1077 - Update to 19.0.1074 - Build Chromium on openSUSE > 12.1 with the gold linker - Fix build issues with GCC 4.7 - Update to 19.0.1071 * Several fixes and improvements in the new Settings, Extensions, and Help pages. * Fixed the flashing when switched between composited and non-composited mode. [Issue: 116603] * Fixed stability issues 116913, 117217, 117347, 117081 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-207 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): chromium-19.0.1079.0-1.14.1 chromium-debuginfo-19.0.1079.0-1.14.1 chromium-debugsource-19.0.1079.0-1.14.1 chromium-desktop-gnome-19.0.1079.0-1.14.1 chromium-desktop-kde-19.0.1079.0-1.14.1 chromium-suid-helper-19.0.1079.0-1.14.1 chromium-suid-helper-debuginfo-19.0.1079.0-1.14.1 libv8-3-3.9.24.1-1.18.1 libv8-3-debuginfo-3.9.24.1-1.18.1 v8-debugsource-3.9.24.1-1.18.1 v8-devel-3.9.24.1-1.18.1 v8-private-headers-devel-3.9.24.1-1.18.1 References: http://support.novell.com/security/cve/CVE-2011-3045.html http://support.novell.com/security/cve/CVE-2011-3049.html http://support.novell.com/security/cve/CVE-2011-3050.html http://support.novell.com/security/cve/CVE-2011-3051.html http://support.novell.com/security/cve/CVE-2011-3052.html http://support.novell.com/security/cve/CVE-2011-3053.html http://support.novell.com/security/cve/CVE-2011-3054.html http://support.novell.com/security/cve/CVE-2011-3055.html http://support.novell.com/security/cve/CVE-2011-3056.html https://bugzilla.novell.com/754456