[prev in list] [next in list] [prev in thread] [next in thread] 

List:       suse-security-announce
Subject:    [security-announce] openSUSE-SU-2016:2296-1: important: Security update for Chromium
From:       opensuse-security () opensuse ! org
Date:       2016-09-13 11:09:18
Message-ID: 20160913110918.0BB27FC43 () maintenance ! suse ! de
[Download RAW message or body]

   openSUSE Security Update: Security update for Chromium
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2016:2296-1
Rating:             important
References:         #969732 #995932 #996032 #99606 #996648 #998328 
                    
Cross-References:   CVE-2016-5147 CVE-2016-5148 CVE-2016-5149
                    CVE-2016-5150 CVE-2016-5151 CVE-2016-5152
                    CVE-2016-5153 CVE-2016-5154 CVE-2016-5155
                    CVE-2016-5156 CVE-2016-5157 CVE-2016-5158
                    CVE-2016-5159 CVE-2016-5160 CVE-2016-5161
                    CVE-2016-5162 CVE-2016-5163 CVE-2016-5164
                    CVE-2016-5165 CVE-2016-5166
Affected Products:
                    openSUSE 13.2
______________________________________________________________________________

   An update that fixes 20 vulnerabilities is now available.

Description:

   Chromium was updated to 53.0.2785.101 to fix a number of security issues
   and bugs.

   The following vulnerabilities were fixed: (boo#996648)

   - CVE-2016-5147: Universal XSS in Blink.
   - CVE-2016-5148: Universal XSS in Blink.
   - CVE-2016-5149: Script injection in extensions.
   - CVE-2016-5150: Use after free in Blink.
   - CVE-2016-5151: Use after free in PDFium.
   - CVE-2016-5152: Heap overflow in PDFium.
   - CVE-2016-5153: Use after destruction in Blink.
   - CVE-2016-5154: Heap overflow in PDFium.
   - CVE-2016-5155: Address bar spoofing.
   - CVE-2016-5156: Use after free in event bindings.
   - CVE-2016-5157: Heap overflow in PDFium.
   - CVE-2016-5158: Heap overflow in PDFium.
   - CVE-2016-5159: Heap overflow in PDFium.
   - CVE-2016-5161: Type confusion in Blink.
   - CVE-2016-5162: Extensions web accessible resources bypass.
   - CVE-2016-5163: Address bar spoofing.
   - CVE-2016-5164: Universal XSS using DevTools.
   - CVE-2016-5165: Script injection in DevTools.
   - CVE-2016-5166: SMB Relay Attack via Save Page As.
   - CVE-2016-5160: Extensions web accessible resources bypass.

   The following upstream fixes are included:

   - SPDY crasher fixes
   - Disable NV12 DXGI video on AMD
   - Forward --password-store switch to os_crypt
   - Tell the kernel to discard USB requests when they time out.
   - disallow WKBackForwardListItem navigations for pushState pages
   - arc: bluetooth: Fix advertised uuid
   - fix conflicting PendingIntent for stop button and swipe away

   A number of tracked build system fixes are included. (boo#996032,
   boo#99606, boo#995932)

   The following tracked regression fix is included: - Re-enable widevine
   plugin (boo#998328)

   rpmlint and rpmlint-mini were updated to work around a memory exhaustion
   problem with this package on 32 bit (boo#969732).


Patch Instructions:

   To install this openSUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - openSUSE 13.2:

      zypper in -t patch openSUSE-2016-1080=1

   To bring your system up-to-date, use "zypper patch".


Package List:

   - openSUSE 13.2 (i586 x86_64):

      chromedriver-53.0.2785.101-120.1
      chromedriver-debuginfo-53.0.2785.101-120.1
      chromium-53.0.2785.101-120.1
      chromium-debuginfo-53.0.2785.101-120.1
      chromium-desktop-gnome-53.0.2785.101-120.1
      chromium-desktop-kde-53.0.2785.101-120.1
      chromium-ffmpegsumo-53.0.2785.101-120.1
      chromium-ffmpegsumo-debuginfo-53.0.2785.101-120.1
      rpmlint-mini-1.5-8.7.2
      rpmlint-mini-debuginfo-1.5-8.7.2
      rpmlint-mini-debugsource-1.5-8.7.2

   - openSUSE 13.2 (noarch):

      rpmlint-1.5-39.4.1


References:

   https://www.suse.com/security/cve/CVE-2016-5147.html
   https://www.suse.com/security/cve/CVE-2016-5148.html
   https://www.suse.com/security/cve/CVE-2016-5149.html
   https://www.suse.com/security/cve/CVE-2016-5150.html
   https://www.suse.com/security/cve/CVE-2016-5151.html
   https://www.suse.com/security/cve/CVE-2016-5152.html
   https://www.suse.com/security/cve/CVE-2016-5153.html
   https://www.suse.com/security/cve/CVE-2016-5154.html
   https://www.suse.com/security/cve/CVE-2016-5155.html
   https://www.suse.com/security/cve/CVE-2016-5156.html
   https://www.suse.com/security/cve/CVE-2016-5157.html
   https://www.suse.com/security/cve/CVE-2016-5158.html
   https://www.suse.com/security/cve/CVE-2016-5159.html
   https://www.suse.com/security/cve/CVE-2016-5160.html
   https://www.suse.com/security/cve/CVE-2016-5161.html
   https://www.suse.com/security/cve/CVE-2016-5162.html
   https://www.suse.com/security/cve/CVE-2016-5163.html
   https://www.suse.com/security/cve/CVE-2016-5164.html
   https://www.suse.com/security/cve/CVE-2016-5165.html
   https://www.suse.com/security/cve/CVE-2016-5166.html
   https://bugzilla.suse.com/969732
   https://bugzilla.suse.com/995932
   https://bugzilla.suse.com/996032
   https://bugzilla.suse.com/99606
   https://bugzilla.suse.com/996648
   https://bugzilla.suse.com/998328

-- 
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-security-announce+help@opensuse.org

[prev in list] [next in list] [prev in thread] [next in thread]