Mailinglist Archive: opensuse-security-announce (38 mails)

< Previous Next >
[security-announce] openSUSE-SU-2016:2296-1: important: Security update for Chromium
openSUSE Security Update: Security update for Chromium

Announcement ID: openSUSE-SU-2016:2296-1
Rating: important
References: #969732 #995932 #996032 #99606 #996648 #998328

Cross-References: CVE-2016-5147 CVE-2016-5148 CVE-2016-5149
CVE-2016-5150 CVE-2016-5151 CVE-2016-5152
CVE-2016-5153 CVE-2016-5154 CVE-2016-5155
CVE-2016-5156 CVE-2016-5157 CVE-2016-5158
CVE-2016-5159 CVE-2016-5160 CVE-2016-5161
CVE-2016-5162 CVE-2016-5163 CVE-2016-5164
CVE-2016-5165 CVE-2016-5166
Affected Products:
openSUSE 13.2

An update that fixes 20 vulnerabilities is now available.


Chromium was updated to 53.0.2785.101 to fix a number of security issues
and bugs.

The following vulnerabilities were fixed: (boo#996648)

- CVE-2016-5147: Universal XSS in Blink.
- CVE-2016-5148: Universal XSS in Blink.
- CVE-2016-5149: Script injection in extensions.
- CVE-2016-5150: Use after free in Blink.
- CVE-2016-5151: Use after free in PDFium.
- CVE-2016-5152: Heap overflow in PDFium.
- CVE-2016-5153: Use after destruction in Blink.
- CVE-2016-5154: Heap overflow in PDFium.
- CVE-2016-5155: Address bar spoofing.
- CVE-2016-5156: Use after free in event bindings.
- CVE-2016-5157: Heap overflow in PDFium.
- CVE-2016-5158: Heap overflow in PDFium.
- CVE-2016-5159: Heap overflow in PDFium.
- CVE-2016-5161: Type confusion in Blink.
- CVE-2016-5162: Extensions web accessible resources bypass.
- CVE-2016-5163: Address bar spoofing.
- CVE-2016-5164: Universal XSS using DevTools.
- CVE-2016-5165: Script injection in DevTools.
- CVE-2016-5166: SMB Relay Attack via Save Page As.
- CVE-2016-5160: Extensions web accessible resources bypass.

The following upstream fixes are included:

- SPDY crasher fixes
- Disable NV12 DXGI video on AMD
- Forward --password-store switch to os_crypt
- Tell the kernel to discard USB requests when they time out.
- disallow WKBackForwardListItem navigations for pushState pages
- arc: bluetooth: Fix advertised uuid
- fix conflicting PendingIntent for stop button and swipe away

A number of tracked build system fixes are included. (boo#996032,
boo#99606, boo#995932)

The following tracked regression fix is included: - Re-enable widevine
plugin (boo#998328)

rpmlint and rpmlint-mini were updated to work around a memory exhaustion
problem with this package on 32 bit (boo#969732).

Patch Instructions:

To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:

- openSUSE 13.2:

zypper in -t patch openSUSE-2016-1080=1

To bring your system up-to-date, use "zypper patch".

Package List:

- openSUSE 13.2 (i586 x86_64):


- openSUSE 13.2 (noarch):



To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@xxxxxxxxxxxx
For additional commands, e-mail: opensuse-security-announce+help@xxxxxxxxxxxx

< Previous Next >
This Thread
  • No further messages