[security-announce] openSUSE-SU-2016:2296-1: important: Security update for Chromium

[news 28]

openSUSE Security Update: Security update for Chromium

______________________________________________________________________________

 

Announcement ID: openSUSE-SU-2016:2296-1

Rating: important

References: #969732 #995932 #996032 #99606 #996648 #998328

 

Cross-References: CVE-2016-5147 CVE-2016-5148 CVE-2016-5149

CVE-2016-5150 CVE-2016-5151 CVE-2016-5152

CVE-2016-5153 CVE-2016-5154 CVE-2016-5155

CVE-2016-5156 CVE-2016-5157 CVE-2016-5158

CVE-2016-5159 CVE-2016-5160 CVE-2016-5161

CVE-2016-5162 CVE-2016-5163 CVE-2016-5164

CVE-2016-5165 CVE-2016-5166

Affected Products:

openSUSE 13.2

______________________________________________________________________________

 

An update that fixes 20 vulnerabilities is now available.

 

Description:

 

Chromium was updated to 53.0.2785.101 to fix a number of security issues

and bugs.

 

The following vulnerabilities were fixed: (boo#996648)

 

- CVE-2016-5147: Universal XSS in Blink.

- CVE-2016-5148: Universal XSS in Blink.

- CVE-2016-5149: Script injection in extensions.

- CVE-2016-5150: Use after free in Blink.

- CVE-2016-5151: Use after free in PDFium.

- CVE-2016-5152: Heap overflow in PDFium.

- CVE-2016-5153: Use after destruction in Blink.

- CVE-2016-5154: Heap overflow in PDFium.

- CVE-2016-5155: Address bar spoofing.

- CVE-2016-5156: Use after free in event bindings.

- CVE-2016-5157: Heap overflow in PDFium.

- CVE-2016-5158: Heap overflow in PDFium.

- CVE-2016-5159: Heap overflow in PDFium.

- CVE-2016-5161: Type confusion in Blink.

- CVE-2016-5162: Extensions web accessible resources bypass.

- CVE-2016-5163: Address bar spoofing.

- CVE-2016-5164: Universal XSS using DevTools.

- CVE-2016-5165: Script injection in DevTools.

- CVE-2016-5166: SMB Relay Attack via Save Page As.

- CVE-2016-5160: Extensions web accessible resources bypass.

 

The following upstream fixes are included:

 

- SPDY crasher fixes

- Disable NV12 DXGI video on AMD

- Forward --password-store switch to os_crypt

- Tell the kernel to discard USB requests when they time out.

- disallow WKBackForwardListItem navigations for pushState pages

- arc: bluetooth: Fix advertised uuid

- fix conflicting PendingIntent for stop button and swipe away

 

A number of tracked build system fixes are included. (boo#996032,

boo#99606, boo#995932)

 

The following tracked regression fix is included: - Re-enable widevine

plugin (boo#998328)

 

rpmlint and rpmlint-mini were updated to work around a memory exhaustion

problem with this package on 32 bit (boo#969732).

 

 

Patch Instructions:

 

To install this openSUSE Security Update use YaST online_update.

Alternatively you can run the command listed for your product:

 

- openSUSE 13.2:

 

zypper in -t patch openSUSE-2016-1080=1

 

To bring your system up-to-date, use "zypper patch".

 

 

Package List:

 

- openSUSE 13.2 (i586 x86_64):

 

chromedriver-53.0.2785.101-120.1

chromedriver-debuginfo-53.0.2785.101-120.1

chromium-53.0.2785.101-120.1

chromium-debuginfo-53.0.2785.101-120.1

chromium-desktop-gnome-53.0.2785.101-120.1

chromium-desktop-kde-53.0.2785.101-120.1

chromium-ffmpegsumo-53.0.2785.101-120.1

chromium-ffmpegsumo-debuginfo-53.0.2785.101-120.1

rpmlint-mini-1.5-8.7.2

rpmlint-mini-debuginfo-1.5-8.7.2

rpmlint-mini-debugsource-1.5-8.7.2

 

- openSUSE 13.2 (noarch):

 

rpmlint-1.5-39.4.1

 

 

References:

 

https://www.suse.com/security/cve/CVE-2016-5147.html

https://www.suse.com/security/cve/CVE-2016-5148.html

https://www.suse.com/security/cve/CVE-2016-5149.html

https://www.suse.com/security/cve/CVE-2016-5150.html

https://www.suse.com/security/cve/CVE-2016-5151.html

https://www.suse.com/security/cve/CVE-2016-5152.html

https://www.suse.com/security/cve/CVE-2016-5153.html

https://www.suse.com/security/cve/CVE-2016-5154.html

https://www.suse.com/security/cve/CVE-2016-5155.html

https://www.suse.com/security/cve/CVE-2016-5156.html

https://www.suse.com/security/cve/CVE-2016-5157.html

https://www.suse.com/security/cve/CVE-2016-5158.html

https://www.suse.com/security/cve/CVE-2016-5159.html

https://www.suse.com/security/cve/CVE-2016-5160.html

https://www.suse.com/security/cve/CVE-2016-5161.html

https://www.suse.com/security/cve/CVE-2016-5162.html

https://www.suse.com/security/cve/CVE-2016-5163.html

https://www.suse.com/security/cve/CVE-2016-5164.html

https://www.suse.com/security/cve/CVE-2016-5165.html

https://www.suse.com/security/cve/CVE-2016-5166.html

https://bugzilla.suse.com/969732

https://bugzilla.suse.com/995932

https://bugzilla.suse.com/996032

https://bugzilla.suse.com/99606

https://bugzilla.suse.com/996648

https://bugzilla.suse.com/998328

 

--

To unsubscribe, e-mail: opensuse-security-announce+unsubscribe ( -at -) opensuse.org

For additional commands, e-mail: opensuse-security-announce+help ( -at -) opensuse.org