Security update for chromium, gn
This update for chromium, gn fixes the following issues: chromium was updated to 86.0.4240.183 boo#1178375 - CVE-2020-16004: Use after free in user interface. - CVE-2020-16005: Insufficient policy enforcement in ANGLE. - CVE-2020-16006: Inappropriate implementation in V8 - CVE-2020-16007: Insufficient data validation in installer. - CVE-2020-16008: Stack buffer overflow in WebRTC. - CVE-2020-16009: Inappropriate implementation in V8. - CVE-2020-16011: Heap buffer overflow in UI on Windows. Update to 86.0.4240.111 boo#1177936 - CVE-2020-16000: Inappropriate implementation in Blink. - CVE-2020-16001: Use after free in media. - CVE-2020-16002: Use after free in PDFium. - CVE-2020-15999: Heap buffer overflow in Freetype. - CVE-2020-16003: Use after free in printing. - chromium-86-f_seal.patch: F_SEAL* definitions added for leap 15.1 and 15.2 - Remove vdpau->vaapi bridge as it breaks a lot: (fixes welcome by someone else than me) - Fix cookiemonster: Update to 86.0.4240.75 boo#1177408: * CVE-2020-15967: Use after free in payments. * CVE-2020-15968: Use after free in Blink. * CVE-2020-15969: Use after free in WebRTC. * CVE-2020-15970: Use after free in NFC. * CVE-2020-15971: Use after free in printing. * CVE-2020-15972: Use after free in audio. * CVE-2020-15990: Use after free in autofill. * CVE-2020-15991: Use after free in password manager. * CVE-2020-15973: Insufficient policy enforcement in extensions. * CVE-2020-15974: Integer overflow in Blink. * CVE-2020-15975: Integer overflow in SwiftShader. * CVE-2020-15976: Use after free in WebXR. * CVE-2020-6557: Inappropriate implementation in networking. * CVE-2020-15977: Insufficient data validation in dialogs. * CVE-2020-15978: Insufficient data validation in navigation. * CVE-2020-15979: Inappropriate implementation in V8. * CVE-2020-15980: Insufficient policy enforcement in Intents. * CVE-2020-15981: Out of bounds read in audio. * CVE-2020-15982: Side-channel information leakage in cache. * CVE-2020-15983: Insufficient data validation in webUI. * CVE-2020-15984: Insufficient policy enforcement in Omnibox. * CVE-2020-15985: Inappropriate implementation in Blink. * CVE-2020-15986: Integer overflow in media. * CVE-2020-15987: Use after free in WebRTC. * CVE-2020-15992: Insufficient policy enforcement in networking. * CVE-2020-15988: Insufficient policy enforcement in downloads. * CVE-2020-15989: Uninitialized Use in PDFium. - Update to 0.1807: * no upstream changelog
02 / AFFECTED SOFTWARE
Affected packages
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
This update for chromium, gn fixes the following issues: chromium was updated to 86.0.4240.183 boo#1178375 - CVE-2020-16004: Use after free in user interface. - CVE-2020-16005: Insufficient policy enforcement in ANGLE. - CVE-2020-16006: Inappropriate implementation in V8 - CVE-2020-16007: Insufficient data validation in installer. - CVE-2020-16008: Stack buffer overflow in WebRTC. - CVE-2020-16009: Inappropriate implementation in V8. - CVE-2020-16011: Heap buffer overflow in UI on Windows. Update to 86.0.4240.111 boo#1177936 - CVE-2020-16000: Inappropriate implementation in Blink. - CVE-2020-16001: Use after free in media. - CVE-2020-16002: Use after free in PDFium. - CVE-2020-15999: Heap buffer overflow in Freetype. - CVE-2020-16003: Use after free in printing. - chromium-86-f_seal.patch: F_SEAL* definitions added for leap 15.1 and 15.2 - Remove vdpau->vaapi bridge as it breaks a lot: (fixes welcome by someone else than me) - Fix cookiemonster: Update to 86.0.4240.75 boo#1177408: * CVE-2020-15967: Use after free in payments. * CVE-2020-15968: Use after free in Blink. * CVE-2020-15969: Use after free in WebRTC. * CVE-2020-15970: Use after free in NFC. * CVE-2020-15971: Use after free in printing. * CVE-2020-15972: Use after free in audio. * CVE-2020-15990: Use after free in autofill. * CVE-2020-15991: Use after free in password manager. * CVE-2020-15973: Insufficient policy enforcement in extensions. * CVE-2020-15974: Integer overflow in Blink. * CVE-2020-15975: Integer overflow in SwiftShader. * CVE-2020-15976: Use after free in WebXR. * CVE-2020-6557: Inappropriate implementation in networking. * CVE-2020-15977: Insufficient data validation in dialogs. * CVE-2020-15978: Insufficient data validation in navigation. * CVE-2020-15979: Inappropriate implementation in V8. * CVE-2020-15980: Insufficient policy enforcement in Intents. * CVE-2020-15981: Out of bounds read in audio. * CVE-2020-15982: Side-channel information leakage in cache. * CVE-2020-15983: Insufficient data validation in webUI. * CVE-2020-15984: Insufficient policy enforcement in Omnibox. * CVE-2020-15985: Inappropriate implementation in Blink. * CVE-2020-15986: Integer overflow in media. * CVE-2020-15987: Use after free in WebRTC. * CVE-2020-15992: Insufficient policy enforcement in networking. * CVE-2020-15988: Insufficient policy enforcement in downloads. * CVE-2020-15989: Uninitialized Use in PDFium. - Update to 0.1807: * no upstream changelog
05 / REFERENCES
Further evidence
- https://bugzilla.suse.com/1177408
- https://bugzilla.suse.com/1177936
- https://bugzilla.suse.com/1178375
- https://lists.opensuse.org/archives/list/[email protected]/thread/3H3IAURHPZWH2LAQL44ANHYEB6AFWZGW/
- https://www.suse.com/security/cve/CVE-2020-15967
- https://www.suse.com/security/cve/CVE-2020-15968
- https://www.suse.com/security/cve/CVE-2020-15969
- https://www.suse.com/security/cve/CVE-2020-15970
- https://www.suse.com/security/cve/CVE-2020-15971
- https://www.suse.com/security/cve/CVE-2020-15972
- https://www.suse.com/security/cve/CVE-2020-15973
- https://www.suse.com/security/cve/CVE-2020-15974
- https://www.suse.com/security/cve/CVE-2020-15975
- https://www.suse.com/security/cve/CVE-2020-15976
- https://www.suse.com/security/cve/CVE-2020-15977
- https://www.suse.com/security/cve/CVE-2020-15978
- https://www.suse.com/security/cve/CVE-2020-15979
- https://www.suse.com/security/cve/CVE-2020-15980
- https://www.suse.com/security/cve/CVE-2020-15981
- https://www.suse.com/security/cve/CVE-2020-15982
- https://www.suse.com/security/cve/CVE-2020-15983
- https://www.suse.com/security/cve/CVE-2020-15984
- https://www.suse.com/security/cve/CVE-2020-15985
- https://www.suse.com/security/cve/CVE-2020-15986
- https://www.suse.com/security/cve/CVE-2020-15987
- https://www.suse.com/security/cve/CVE-2020-15988
- https://www.suse.com/security/cve/CVE-2020-15989
- https://www.suse.com/security/cve/CVE-2020-15990
- https://www.suse.com/security/cve/CVE-2020-15991
- https://www.suse.com/security/cve/CVE-2020-15992
- https://www.suse.com/security/cve/CVE-2020-15999
- https://www.suse.com/security/cve/CVE-2020-16000
- https://www.suse.com/security/cve/CVE-2020-16001
- https://www.suse.com/security/cve/CVE-2020-16002
- https://www.suse.com/security/cve/CVE-2020-16003
- https://www.suse.com/security/cve/CVE-2020-16004
- https://www.suse.com/security/cve/CVE-2020-16005
- https://www.suse.com/security/cve/CVE-2020-16006
- https://www.suse.com/security/cve/CVE-2020-16007
- https://www.suse.com/security/cve/CVE-2020-16008
- https://www.suse.com/security/cve/CVE-2020-16009
- https://www.suse.com/security/cve/CVE-2020-16011
- https://www.suse.com/security/cve/CVE-2020-6557