[security-announce] openSUSE-SU-2016:1865-1: important: Security update for Chromium

[news 28]

openSUSE Security Update: Security update for Chromium

______________________________________________________________________________

 

Announcement ID: openSUSE-SU-2016:1865-1

Rating: important

References: #989901

Cross-References: CVE-2016-1705 CVE-2016-1706 CVE-2016-1707

CVE-2016-1708 CVE-2016-1709 CVE-2016-1710

CVE-2016-1711 CVE-2016-5127 CVE-2016-5128

CVE-2016-5129 CVE-2016-5130 CVE-2016-5131

CVE-2016-5132 CVE-2016-5133 CVE-2016-5134

CVE-2016-5135 CVE-2016-5136 CVE-2016-5137

 

Affected Products:

openSUSE 13.2

______________________________________________________________________________

 

An update that fixes 18 vulnerabilities is now available.

 

Description:

 

Chromium was updated to 52.0.2743.82 to fix the following security issues

(boo#989901):

 

- CVE-2016-1706: Sandbox escape in PPAPI

- CVE-2016-1707: URL spoofing on iOS

- CVE-2016-1708: Use-after-free in Extensions

- CVE-2016-1709: Heap-buffer-overflow in sfntly

- CVE-2016-1710: Same-origin bypass in Blink

- CVE-2016-1711: Same-origin bypass in Blink

- CVE-2016-5127: Use-after-free in Blink

- CVE-2016-5128: Same-origin bypass in V8

- CVE-2016-5129: Memory corruption in V8

- CVE-2016-5130: URL spoofing

- CVE-2016-5131: Use-after-free in libxml

- CVE-2016-5132: Limited same-origin bypass in Service Workers

- CVE-2016-5133: Origin confusion in proxy authentication

- CVE-2016-5134: URL leakage via PAC script

- CVE-2016-5135: Content-Security-Policy bypass

- CVE-2016-5136: Use after free in extensions

- CVE-2016-5137: History sniffing with HSTS and CSP

- CVE-2016-1705: Various fixes from internal audits, fuzzing and other

initiatives

 

 

Patch Instructions:

 

To install this openSUSE Security Update use YaST online_update.

Alternatively you can run the command listed for your product:

 

- openSUSE 13.2:

 

zypper in -t patch openSUSE-2016-901=1

 

To bring your system up-to-date, use "zypper patch".

 

 

Package List:

 

- openSUSE 13.2 (i586 x86_64):

 

chromedriver-52.0.2743.82-111.1

chromium-52.0.2743.82-111.1

chromium-desktop-gnome-52.0.2743.82-111.1

chromium-desktop-kde-52.0.2743.82-111.1

chromium-ffmpegsumo-52.0.2743.82-111.1

 

- openSUSE 13.2 (x86_64):

 

chromedriver-debuginfo-52.0.2743.82-111.1

chromium-debuginfo-52.0.2743.82-111.1

chromium-debugsource-52.0.2743.82-111.1

chromium-ffmpegsumo-debuginfo-52.0.2743.82-111.1

 

 

References:

 

https://www.suse.com/security/cve/CVE-2016-1705.html

https://www.suse.com/security/cve/CVE-2016-1706.html

https://www.suse.com/security/cve/CVE-2016-1707.html

https://www.suse.com/security/cve/CVE-2016-1708.html

https://www.suse.com/security/cve/CVE-2016-1709.html

https://www.suse.com/security/cve/CVE-2016-1710.html

https://www.suse.com/security/cve/CVE-2016-1711.html

https://www.suse.com/security/cve/CVE-2016-5127.html

https://www.suse.com/security/cve/CVE-2016-5128.html

https://www.suse.com/security/cve/CVE-2016-5129.html

https://www.suse.com/security/cve/CVE-2016-5130.html

https://www.suse.com/security/cve/CVE-2016-5131.html

https://www.suse.com/security/cve/CVE-2016-5132.html

https://www.suse.com/security/cve/CVE-2016-5133.html

https://www.suse.com/security/cve/CVE-2016-5134.html

https://www.suse.com/security/cve/CVE-2016-5135.html

https://www.suse.com/security/cve/CVE-2016-5136.html

https://www.suse.com/security/cve/CVE-2016-5137.html

https://bugzilla.suse.com/989901

 

--

To unsubscribe, e-mail: opensuse-security-announce+unsubscribe ( -at -) opensuse.org

For additional commands, e-mail: opensuse-security-announce+help ( -at -) opensuse.org