Описание
Security update for chromium
This update for chromium fixes the following issues:
- Chromium 128.0.6613.84 (boo#1229591)
- CVE-2024-7964: Use after free in Passwords
- CVE-2024-7965: Inappropriate implementation in V8
- CVE-2024-7966: Out of bounds memory access in Skia
- CVE-2024-7967: Heap buffer overflow in Fonts
- CVE-2024-7968: Use after free in Autofill
- CVE-2024-7969: Type Confusion in V8
- CVE-2024-7971: Type confusion in V8
- CVE-2024-7972: Inappropriate implementation in V8
- CVE-2024-7973: Heap buffer overflow in PDFium
- CVE-2024-7974: Insufficient data validation in V8 API
- CVE-2024-7975: Inappropriate implementation in Permissions
- CVE-2024-7976: Inappropriate implementation in FedCM
- CVE-2024-7977: Insufficient data validation in Installer
- CVE-2024-7978: Insufficient policy enforcement in Data Transfer
- CVE-2024-7979: Insufficient data validation in Installer
- CVE-2024-7980: Insufficient data validation in Installer
- CVE-2024-7981: Inappropriate implementation in Views
- CVE-2024-8033: Inappropriate implementation in WebApp Installs
- CVE-2024-8034: Inappropriate implementation in Custom Tabs
- CVE-2024-8035: Inappropriate implementation in Extensions
- Various fixes from internal audits, fuzzing and other initiatives
Список пакетов
SUSE Package Hub 15 SP5
SUSE Package Hub 15 SP6
openSUSE Leap 15.5
openSUSE Leap 15.6
Ссылки
- E-Mail link for openSUSE-SU-2024:0258-2
- SUSE Security Ratings
- SUSE Bug 1229426
- SUSE Bug 1229591
- SUSE CVE CVE-2024-7964 page
- SUSE CVE CVE-2024-7965 page
- SUSE CVE CVE-2024-7966 page
- SUSE CVE CVE-2024-7967 page
- SUSE CVE CVE-2024-7968 page
- SUSE CVE CVE-2024-7969 page
- SUSE CVE CVE-2024-7971 page
- SUSE CVE CVE-2024-7972 page
- SUSE CVE CVE-2024-7973 page
- SUSE CVE CVE-2024-7974 page
- SUSE CVE CVE-2024-7975 page
- SUSE CVE CVE-2024-7976 page
- SUSE CVE CVE-2024-7977 page
- SUSE CVE CVE-2024-7978 page
- SUSE CVE CVE-2024-7979 page
- SUSE CVE CVE-2024-7980 page
Описание
Use after free in Passwords in Google Chrome on Android prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2024-7964
- SUSE Bug 1229591
Описание
Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2024-7965
- SUSE Bug 1229591
Описание
Out of bounds memory access in Skia in Google Chrome prior to 128.0.6613.84 allowed a remote attacker who had compromised the renderer process to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2024-7966
- SUSE Bug 1229591
Описание
Heap buffer overflow in Fonts in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2024-7967
- SUSE Bug 1229591
Описание
Use after free in Autofill in Google Chrome prior to 128.0.6613.84 allowed a remote attacker who had convinced the user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2024-7968
- SUSE Bug 1229591
Описание
Type Confusion in V8 in Google Chrome prior to 128.0.6613.113 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2024-7969
- SUSE Bug 1229591
- SUSE Bug 1229897
Описание
Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2024-7971
- SUSE Bug 1229591
Описание
Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium)
Затронутые продукты
Ссылки
- CVE-2024-7972
- SUSE Bug 1229591
Описание
Heap buffer overflow in PDFium in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file. (Chromium security severity: Medium)
Затронутые продукты
Ссылки
- CVE-2024-7973
- SUSE Bug 1229591
Описание
Insufficient data validation in V8 API in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: Medium)
Затронутые продукты
Ссылки
- CVE-2024-7974
- SUSE Bug 1229591
Описание
Inappropriate implementation in Permissions in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
Затронутые продукты
Ссылки
- CVE-2024-7975
- SUSE Bug 1229591
Описание
Inappropriate implementation in FedCM in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
Затронутые продукты
Ссылки
- CVE-2024-7976
- SUSE Bug 1229591
Описание
Insufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker to perform privilege escalation via a malicious file. (Chromium security severity: Medium)
Затронутые продукты
Ссылки
- CVE-2024-7977
- SUSE Bug 1229591
Описание
Insufficient policy enforcement in Data Transfer in Google Chrome prior to 128.0.6613.84 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Затронутые продукты
Ссылки
- CVE-2024-7978
- SUSE Bug 1229591
Описание
Insufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker to perform privilege escalation via a crafted symbolic link. (Chromium security severity: Medium)
Затронутые продукты
Ссылки
- CVE-2024-7979
- SUSE Bug 1229591
Описание
Insufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker to perform privilege escalation via a crafted symbolic link. (Chromium security severity: Medium)
Затронутые продукты
Ссылки
- CVE-2024-7980
- SUSE Bug 1229591
Описание
Inappropriate implementation in Views in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
Затронутые продукты
Ссылки
- CVE-2024-7981
- SUSE Bug 1229591
Описание
Inappropriate implementation in WebApp Installs in Google Chrome on Windows prior to 128.0.6613.84 allowed an attacker who convinced a user to install a malicious application to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
Затронутые продукты
Ссылки
- CVE-2024-8033
- SUSE Bug 1229591
Описание
Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
Затронутые продукты
Ссылки
- CVE-2024-8034
- SUSE Bug 1229591
Описание
Inappropriate implementation in Extensions in Google Chrome on Windows prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
Затронутые продукты
Ссылки
- CVE-2024-8035
- SUSE Bug 1229591