Описание
Security update for chromium
This update for chromium fixes the following issues:
-
Chromium 124.0.6367.201
- CVE-2024-4671: Use after free in Visuals
-
Chromium 124.0.6367.155 (boo#1224045)
- CVE-2024-4558: Use after free in ANGLE
- CVE-2024-4559: Heap buffer overflow in WebAudio
-
Chromium 124.0.6367.118 (boo#1223846)
- CVE-2024-4331: Use after free in Picture In Picture
- CVE-2024-4368: Use after free in Dawn
-
Chromium 124.0.6367.78 (boo#1223845)
- CVE-2024-4058: Type Confusion in ANGLE
- CVE-2024-4059: Out of bounds read in V8 API
- CVE-2024-4060: Use after free in Dawn
-
Chromium 124.0.6367.60 (boo#1222958)
- CVE-2024-3832: Object corruption in V8.
- CVE-2024-3833: Object corruption in WebAssembly.
- CVE-2024-3834: Use after free in Downloads. Reported by ChaobinZhang
- CVE-2024-3837: Use after free in QUIC.
- CVE-2024-3838: Inappropriate implementation in Autofill.
- CVE-2024-3839: Out of bounds read in Fonts.
- CVE-2024-3840: Insufficient policy enforcement in Site Isolation.
- CVE-2024-3841: Insufficient data validation in Browser Switcher.
- CVE-2024-3843: Insufficient data validation in Downloads.
- CVE-2024-3844: Inappropriate implementation in Extensions.
- CVE-2024-3845: Inappropriate implementation in Network.
- CVE-2024-3846: Inappropriate implementation in Prompts.
- CVE-2024-3847: Insufficient policy enforcement in WebUI.
-
Chromium 123.0.6312.122 (boo#1222707)
- CVE-2024-3157: Out of bounds write in Compositing
- CVE-2024-3516: Heap buffer overflow in ANGLE
- CVE-2024-3515: Use after free in Dawn
-
Chromium 123.0.6312.105 (boo#1222260)
- CVE-2024-3156: Inappropriate implementation in V8
- CVE-2024-3158: Use after free in Bookmarks
- CVE-2024-3159: Out of bounds memory access in V8
-
Chromium 123.0.6312.86 (boo#1222035)
- CVE-2024-2883: Use after free in ANGLE
- CVE-2024-2885: Use after free in Dawn
- CVE-2024-2886: Use after free in WebCodecs
- CVE-2024-2887: Type Confusion in WebAssembly
-
Chromium 123.0.6312.58 (boo#1221732)
- CVE-2024-2625: Object lifecycle issue in V8
- CVE-2024-2626: Out of bounds read in Swiftshader
- CVE-2024-2627: Use after free in Canvas
- CVE-2024-2628: Inappropriate implementation in Downloads
Список пакетов
SUSE Package Hub 15 SP5
openSUSE Leap 15.5
Ссылки
- E-Mail link for openSUSE-SU-2024:0123-1
- SUSE Security Ratings
- SUSE Bug 1221732
- SUSE Bug 1222035
- SUSE Bug 1222260
- SUSE Bug 1222707
- SUSE Bug 1222958
- SUSE Bug 1223845
- SUSE Bug 1223846
- SUSE Bug 1224045
- SUSE CVE CVE-2024-2625 page
- SUSE CVE CVE-2024-2626 page
- SUSE CVE CVE-2024-2627 page
- SUSE CVE CVE-2024-2628 page
- SUSE CVE CVE-2024-2883 page
- SUSE CVE CVE-2024-2885 page
- SUSE CVE CVE-2024-2886 page
- SUSE CVE CVE-2024-2887 page
- SUSE CVE CVE-2024-3156 page
- SUSE CVE CVE-2024-3157 page
Описание
Object lifecycle issue in V8 in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2024-2625
- SUSE Bug 1221732
Описание
Out of bounds read in Swiftshader in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium)
Затронутые продукты
Ссылки
- CVE-2024-2626
- SUSE Bug 1221732
Описание
Use after free in Canvas in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
Затронутые продукты
Ссылки
- CVE-2024-2627
- SUSE Bug 1221732
Описание
Inappropriate implementation in Downloads in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform UI spoofing via a crafted URL. (Chromium security severity: Medium)
Затронутые продукты
Ссылки
- CVE-2024-2628
- SUSE Bug 1221732
Описание
Use after free in ANGLE in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
Затронутые продукты
Ссылки
- CVE-2024-2883
- SUSE Bug 1222035
Описание
Use after free in Dawn in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2024-2885
- SUSE Bug 1222035
Описание
Use after free in WebCodecs in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2024-2886
- SUSE Bug 1222035
Описание
Type Confusion in WebAssembly in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2024-2887
- SUSE Bug 1222035
Описание
Inappropriate implementation in V8 in Google Chrome prior to 123.0.6312.105 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2024-3156
- SUSE Bug 1222260
Описание
Out of bounds memory access in Compositing in Google Chrome prior to 123.0.6312.122 allowed a remote attacker who had compromised the GPU process to potentially perform a sandbox escape via specific UI gestures. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2024-3157
- SUSE Bug 1222707
Описание
Use after free in Bookmarks in Google Chrome prior to 123.0.6312.105 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2024-3158
- SUSE Bug 1222260
Описание
Out of bounds memory access in V8 in Google Chrome prior to 123.0.6312.105 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2024-3159
- SUSE Bug 1222260
Описание
Use after free in Dawn in Google Chrome prior to 123.0.6312.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2024-3515
- SUSE Bug 1222707
Описание
Heap buffer overflow in ANGLE in Google Chrome prior to 123.0.6312.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2024-3516
- SUSE Bug 1222707
Описание
Object corruption in V8 in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2024-3832
- SUSE Bug 1222958
Описание
Object corruption in WebAssembly in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2024-3833
- SUSE Bug 1222958
Описание
Use after free in Downloads in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2024-3834
- SUSE Bug 1222958
Описание
Use after free in QUIC in Google Chrome prior to 124.0.6367.60 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
Затронутые продукты
Ссылки
- CVE-2024-3837
- SUSE Bug 1222958
Описание
Inappropriate implementation in Autofill in Google Chrome prior to 124.0.6367.60 allowed an attacker who convinced a user to install a malicious app to perform UI spoofing via a crafted app. (Chromium security severity: Medium)
Затронутые продукты
Ссылки
- CVE-2024-3838
- SUSE Bug 1222958
Описание
Out of bounds read in Fonts in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
Затронутые продукты
Ссылки
- CVE-2024-3839
- SUSE Bug 1222958
Описание
Insufficient policy enforcement in Site Isolation in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
Затронутые продукты
Ссылки
- CVE-2024-3840
- SUSE Bug 1222958
Описание
Insufficient data validation in Browser Switcher in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to inject scripts or HTML into a privileged page via a malicious file. (Chromium security severity: Medium)
Затронутые продукты
Ссылки
- CVE-2024-3841
- SUSE Bug 1222958
Описание
Insufficient data validation in Downloads in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
Затронутые продукты
Ссылки
- CVE-2024-3843
- SUSE Bug 1222958
Описание
Inappropriate implementation in Extensions in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Low)
Затронутые продукты
Ссылки
- CVE-2024-3844
- SUSE Bug 1222958
Описание
Inappropriate implementation in Networks in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass mixed content policy via a crafted HTML page. (Chromium security severity: Low)
Затронутые продукты
Ссылки
- CVE-2024-3845
- SUSE Bug 1222958
Описание
Inappropriate implementation in Prompts in Google Chrome prior to 124.0.6367.60 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
Затронутые продукты
Ссылки
- CVE-2024-3846
- SUSE Bug 1222958
Описание
Insufficient policy enforcement in WebUI in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low)
Затронутые продукты
Ссылки
- CVE-2024-3847
- SUSE Bug 1222958
Описание
Type confusion in ANGLE in Google Chrome prior to 124.0.6367.78 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
Затронутые продукты
Ссылки
- CVE-2024-4058
- SUSE Bug 1223845
Описание
Out of bounds read in V8 API in Google Chrome prior to 124.0.6367.78 allowed a remote attacker to leak cross-site data via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2024-4059
- SUSE Bug 1223845
Описание
Use after free in Dawn in Google Chrome prior to 124.0.6367.78 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2024-4060
- SUSE Bug 1223845
Описание
Use after free in Picture In Picture in Google Chrome prior to 124.0.6367.118 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2024-4331
- SUSE Bug 1223846
Описание
Use after free in Dawn in Google Chrome prior to 124.0.6367.118 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2024-4368
- SUSE Bug 1223846
Описание
Use after free in ANGLE in Google Chrome prior to 124.0.6367.155 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2024-4558
- SUSE Bug 1224045
Описание
Heap buffer overflow in WebAudio in Google Chrome prior to 124.0.6367.155 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2024-4559
- SUSE Bug 1224045
Описание
Use after free in Visuals in Google Chrome prior to 124.0.6367.201 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2024-4671