Описание
Security update for chromium
This update for chromium fixes the following issues:
-
build with llvm15 on Leap
-
Chromium 113.0.5672.126 (boo#1211442):
- CVE-2023-2721: Use after free in Navigation
- CVE-2023-2722: Use after free in Autofill UI
- CVE-2023-2723: Use after free in DevTools
- CVE-2023-2724: Type Confusion in V8
- CVE-2023-2725: Use after free in Guest View
- CVE-2023-2726: Inappropriate implementation in WebApp Installs
- Various fixes from internal audits, fuzzing and other initiatives
-
Chromium 113.0.5672.92 (boo#1211211)
-
Multiple security fixes (boo#1211036):
- CVE-2023-2459: Inappropriate implementation in Prompts
- CVE-2023-2460: Insufficient validation of untrusted input in Extensions
- CVE-2023-2461: Use after free in OS Inputs
- CVE-2023-2462: Inappropriate implementation in Prompts
- CVE-2023-2463: Inappropriate implementation in Full Screen Mode
- CVE-2023-2464: Inappropriate implementation in PictureInPicture
- CVE-2023-2465: Inappropriate implementation in CORS
- CVE-2023-2466: Inappropriate implementation in Prompts
- CVE-2023-2467: Inappropriate implementation in Prompts
- CVE-2023-2468: Inappropriate implementation in PictureInPicture
Список пакетов
SUSE Package Hub 15 SP4
openSUSE Leap 15.4
Ссылки
- E-Mail link for openSUSE-SU-2023:0117-1
- SUSE Security Ratings
- SUSE Bug 1211036
- SUSE Bug 1211211
- SUSE Bug 1211442
- SUSE CVE CVE-2023-2459 page
- SUSE CVE CVE-2023-2460 page
- SUSE CVE CVE-2023-2461 page
- SUSE CVE CVE-2023-2462 page
- SUSE CVE CVE-2023-2463 page
- SUSE CVE CVE-2023-2464 page
- SUSE CVE CVE-2023-2465 page
- SUSE CVE CVE-2023-2466 page
- SUSE CVE CVE-2023-2467 page
- SUSE CVE CVE-2023-2468 page
- SUSE CVE CVE-2023-2721 page
- SUSE CVE CVE-2023-2722 page
- SUSE CVE CVE-2023-2723 page
- SUSE CVE CVE-2023-2724 page
- SUSE CVE CVE-2023-2725 page
Описание
Inappropriate implementation in Prompts in Google Chrome prior to 113.0.5672.63 allowed a remote attacker to bypass permission restrictions via a crafted HTML page. (Chromium security severity: Medium)
Затронутые продукты
Ссылки
- CVE-2023-2459
- SUSE Bug 1211036
Описание
Insufficient validation of untrusted input in Extensions in Google Chrome prior to 113.0.5672.63 allowed an attacker who convinced a user to install a malicious extension to bypass file access checks via a crafted HTML page. (Chromium security severity: Medium)
Затронутые продукты
Ссылки
- CVE-2023-2460
- SUSE Bug 1211036
Описание
Use after free in OS Inputs in Google Chrome on ChromeOS prior to 113.0.5672.63 allowed a remote attacker who convinced a user to enage in specific UI interaction to potentially exploit heap corruption via crafted UI interaction. (Chromium security severity: Medium)
Затронутые продукты
Ссылки
- CVE-2023-2461
- SUSE Bug 1211036
Описание
Inappropriate implementation in Prompts in Google Chrome prior to 113.0.5672.63 allowed a remote attacker to obfuscate main origin data via a crafted HTML page. (Chromium security severity: Medium)
Затронутые продукты
Ссылки
- CVE-2023-2462
- SUSE Bug 1211036
Описание
Inappropriate implementation in Full Screen Mode in Google Chrome on Android prior to 113.0.5672.63 allowed a remote attacker to hide the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)
Затронутые продукты
Ссылки
- CVE-2023-2463
- SUSE Bug 1211036
Описание
Inappropriate implementation in PictureInPicture in Google Chrome prior to 113.0.5672.63 allowed an attacker who convinced a user to install a malicious extension to perform an origin spoof in the security UI via a crafted HTML page. (Chromium security severity: Medium)
Затронутые продукты
Ссылки
- CVE-2023-2464
- SUSE Bug 1211036
Описание
Inappropriate implementation in CORS in Google Chrome prior to 113.0.5672.63 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Затронутые продукты
Ссылки
- CVE-2023-2465
- SUSE Bug 1211036
Описание
Inappropriate implementation in Prompts in Google Chrome prior to 113.0.5672.63 allowed a remote attacker to spoof the contents of the security UI via a crafted HTML page. (Chromium security severity: Low)
Затронутые продукты
Ссылки
- CVE-2023-2466
- SUSE Bug 1211036
Описание
Inappropriate implementation in Prompts in Google Chrome on Android prior to 113.0.5672.63 allowed a remote attacker to bypass permissions restrictions via a crafted HTML page. (Chromium security severity: Low)
Затронутые продукты
Ссылки
- CVE-2023-2467
- SUSE Bug 1211036
Описание
Inappropriate implementation in PictureInPicture in Google Chrome prior to 113.0.5672.63 allowed a remote attacker who had compromised the renderer process to obfuscate the security UI via a crafted HTML page. (Chromium security severity: Low)
Затронутые продукты
Ссылки
- CVE-2023-2468
- SUSE Bug 1211036
Описание
Use after free in Navigation in Google Chrome prior to 113.0.5672.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
Затронутые продукты
Ссылки
- CVE-2023-2721
- SUSE Bug 1211442
Описание
Use after free in Autofill UI in Google Chrome on Android prior to 113.0.5672.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2023-2722
- SUSE Bug 1211442
Описание
Use after free in DevTools in Google Chrome prior to 113.0.5672.126 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2023-2723
- SUSE Bug 1211442
Описание
Type confusion in V8 in Google Chrome prior to 113.0.5672.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2023-2724
- SUSE Bug 1211442
Описание
Use after free in Guest View in Google Chrome prior to 113.0.5672.126 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2023-2725
- SUSE Bug 1211442
Описание
Inappropriate implementation in WebApp Installs in Google Chrome prior to 113.0.5672.126 allowed an attacker who convinced a user to install a malicious web app to bypass install dialog via a crafted HTML page. (Chromium security severity: Medium)
Затронутые продукты
Ссылки
- CVE-2023-2726
- SUSE Bug 1211442