Security update for chromium
This update for chromium fixes the following issues: - Update to 84.0.4147.89 boo#1174189: * Critical CVE-2020-6510: Heap buffer overflow in background fetch. * High CVE-2020-6511: Side-channel information leakage in content security policy. * High CVE-2020-6512: Type Confusion in V8. * High CVE-2020-6513: Heap buffer overflow in PDFium. * High CVE-2020-6514: Inappropriate implementation in WebRTC. * High CVE-2020-6515: Use after free in tab strip. * High CVE-2020-6516: Policy bypass in CORS. * High CVE-2020-6517: Heap buffer overflow in history. * Medium CVE-2020-6518: Use after free in developer tools. * Medium CVE-2020-6519: Policy bypass in CSP. * Medium CVE-2020-6520: Heap buffer overflow in Skia. * Medium CVE-2020-6521: Side-channel information leakage in autofill. * Medium CVE-2020-6522: Inappropriate implementation in external protocol handlers. * Medium CVE-2020-6523: Out of bounds write in Skia. * Medium CVE-2020-6524: Heap buffer overflow in WebAudio. * Medium CVE-2020-6525: Heap buffer overflow in Skia. * Low CVE-2020-6526: Inappropriate implementation in iframe sandbox. * Low CVE-2020-6527: Insufficient policy enforcement in CSP. * Low CVE-2020-6528: Incorrect security UI in basic auth. * Low CVE-2020-6529: Inappropriate implementation in WebRTC. * Low CVE-2020-6530: Out of bounds memory access in developer tools. * Low CVE-2020-6531: Side-channel information leakage in scroll to text. * Low CVE-2020-6533: Type Confusion in V8. * Low CVE-2020-6534: Heap buffer overflow in WebRTC. * Low CVE-2020-6535: Insufficient data validation in WebUI. * Low CVE-2020-6536: Incorrect security UI in PWAs. - Use bundled xcb-proto as we need to generate py2 bindings - Try to fix non-wayland build for Leap builds
02 / AFFECTED SOFTWARE
Affected packages
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
This update for chromium fixes the following issues: - Update to 84.0.4147.89 boo#1174189: * Critical CVE-2020-6510: Heap buffer overflow in background fetch. * High CVE-2020-6511: Side-channel information leakage in content security policy. * High CVE-2020-6512: Type Confusion in V8. * High CVE-2020-6513: Heap buffer overflow in PDFium. * High CVE-2020-6514: Inappropriate implementation in WebRTC. * High CVE-2020-6515: Use after free in tab strip. * High CVE-2020-6516: Policy bypass in CORS. * High CVE-2020-6517: Heap buffer overflow in history. * Medium CVE-2020-6518: Use after free in developer tools. * Medium CVE-2020-6519: Policy bypass in CSP. * Medium CVE-2020-6520: Heap buffer overflow in Skia. * Medium CVE-2020-6521: Side-channel information leakage in autofill. * Medium CVE-2020-6522: Inappropriate implementation in external protocol handlers. * Medium CVE-2020-6523: Out of bounds write in Skia. * Medium CVE-2020-6524: Heap buffer overflow in WebAudio. * Medium CVE-2020-6525: Heap buffer overflow in Skia. * Low CVE-2020-6526: Inappropriate implementation in iframe sandbox. * Low CVE-2020-6527: Insufficient policy enforcement in CSP. * Low CVE-2020-6528: Incorrect security UI in basic auth. * Low CVE-2020-6529: Inappropriate implementation in WebRTC. * Low CVE-2020-6530: Out of bounds memory access in developer tools. * Low CVE-2020-6531: Side-channel information leakage in scroll to text. * Low CVE-2020-6533: Type Confusion in V8. * Low CVE-2020-6534: Heap buffer overflow in WebRTC. * Low CVE-2020-6535: Insufficient data validation in WebUI. * Low CVE-2020-6536: Incorrect security UI in PWAs. - Use bundled xcb-proto as we need to generate py2 bindings - Try to fix non-wayland build for Leap builds
05 / REFERENCES
Further evidence
- https://bugzilla.suse.com/1174189
- https://lists.opensuse.org/archives/list/[email protected]/thread/Q55W7KZFLR3UGN4DZTG2DV3E64K6CNP6/
- https://www.suse.com/security/cve/CVE-2020-6510
- https://www.suse.com/security/cve/CVE-2020-6511
- https://www.suse.com/security/cve/CVE-2020-6512
- https://www.suse.com/security/cve/CVE-2020-6513
- https://www.suse.com/security/cve/CVE-2020-6514
- https://www.suse.com/security/cve/CVE-2020-6515
- https://www.suse.com/security/cve/CVE-2020-6516
- https://www.suse.com/security/cve/CVE-2020-6517
- https://www.suse.com/security/cve/CVE-2020-6518
- https://www.suse.com/security/cve/CVE-2020-6519
- https://www.suse.com/security/cve/CVE-2020-6520
- https://www.suse.com/security/cve/CVE-2020-6521
- https://www.suse.com/security/cve/CVE-2020-6522
- https://www.suse.com/security/cve/CVE-2020-6523
- https://www.suse.com/security/cve/CVE-2020-6524
- https://www.suse.com/security/cve/CVE-2020-6525
- https://www.suse.com/security/cve/CVE-2020-6526
- https://www.suse.com/security/cve/CVE-2020-6527
- https://www.suse.com/security/cve/CVE-2020-6528
- https://www.suse.com/security/cve/CVE-2020-6529
- https://www.suse.com/security/cve/CVE-2020-6530
- https://www.suse.com/security/cve/CVE-2020-6531
- https://www.suse.com/security/cve/CVE-2020-6533
- https://www.suse.com/security/cve/CVE-2020-6534
- https://www.suse.com/security/cve/CVE-2020-6535
- https://www.suse.com/security/cve/CVE-2020-6536