openSUSE Security Update: Security update for chromium
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2020:1206-1
Rating:             important
References:         #1174497 #1175044 #1175085 
Cross-References:   CVE-2020-6542 CVE-2020-6543 CVE-2020-6544
                    CVE-2020-6545 CVE-2020-6546 CVE-2020-6547
                    CVE-2020-6548 CVE-2020-6549 CVE-2020-6550
                    CVE-2020-6551 CVE-2020-6552 CVE-2020-6553
                    CVE-2020-6554 CVE-2020-6555
Affected Products:
                    openSUSE Leap 15.2
                    openSUSE Leap 15.1
______________________________________________________________________________

   An update that fixes 14 vulnerabilities is now available.

Description:

   This update for chromium fixes the following issues:

   - Chromium updated to 84.0.4147.125 (boo#1175085)
     * CVE-2020-6542: Use after free in ANGLE
     * CVE-2020-6543: Use after free in task scheduling
     * CVE-2020-6544: Use after free in media
     * CVE-2020-6545: Use after free in audio
     * CVE-2020-6546: Inappropriate implementation in installer
     * CVE-2020-6547: Incorrect security UI in media
     * CVE-2020-6548: Heap buffer overflow in Skia
     * CVE-2020-6549: Use after free in media
     * CVE-2020-6550: Use after free in IndexedDB
     * CVE-2020-6551: Use after free in WebXR
     * CVE-2020-6552: Use after free in Blink
     * CVE-2020-6553: Use after free in offline mode
     * CVE-2020-6554: Use after free in extensions
     * CVE-2020-6555: Out of bounds read in WebGL
     * Various fixes from internal audits, fuzzing and other initiatives

   - Disable wayland everywhere as it breaks headless and middle mouse copy
     everywhere: boo#1174497 boo#1175044


Patch Instructions:

   To install this openSUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Leap 15.2:

      zypper in -t patch openSUSE-2020-1206=1

   - openSUSE Leap 15.1:

      zypper in -t patch openSUSE-2020-1206=1



Package List:

   - openSUSE Leap 15.2 (x86_64):

      chromedriver-84.0.4147.125-lp152.2.12.2
      chromedriver-debuginfo-84.0.4147.125-lp152.2.12.2
      chromium-84.0.4147.125-lp152.2.12.2
      chromium-debuginfo-84.0.4147.125-lp152.2.12.2
      chromium-debugsource-84.0.4147.125-lp152.2.12.2

   - openSUSE Leap 15.1 (x86_64):

      chromedriver-84.0.4147.125-lp151.2.115.1
      chromedriver-debuginfo-84.0.4147.125-lp151.2.115.1
      chromium-84.0.4147.125-lp151.2.115.1
      chromium-debuginfo-84.0.4147.125-lp151.2.115.1
      chromium-debugsource-84.0.4147.125-lp151.2.115.1


References:

   https://www.suse.com/security/cve/CVE-2020-6542.html
   https://www.suse.com/security/cve/CVE-2020-6543.html
   https://www.suse.com/security/cve/CVE-2020-6544.html
   https://www.suse.com/security/cve/CVE-2020-6545.html
   https://www.suse.com/security/cve/CVE-2020-6546.html
   https://www.suse.com/security/cve/CVE-2020-6547.html
   https://www.suse.com/security/cve/CVE-2020-6548.html
   https://www.suse.com/security/cve/CVE-2020-6549.html
   https://www.suse.com/security/cve/CVE-2020-6550.html
   https://www.suse.com/security/cve/CVE-2020-6551.html
   https://www.suse.com/security/cve/CVE-2020-6552.html
   https://www.suse.com/security/cve/CVE-2020-6553.html
   https://www.suse.com/security/cve/CVE-2020-6554.html
   https://www.suse.com/security/cve/CVE-2020-6555.html
   https://bugzilla.suse.com/1174497
   https://bugzilla.suse.com/1175044
   https://bugzilla.suse.com/1175085

--

openSUSE: 2020:1206-1: important: chromium

August 14, 2020
An update that fixes 14 vulnerabilities is now available.

Description

This update for chromium fixes the following issues: - Chromium updated to 84.0.4147.125 (boo#1175085) * CVE-2020-6542: Use after free in ANGLE * CVE-2020-6543: Use after free in task scheduling * CVE-2020-6544: Use after free in media * CVE-2020-6545: Use after free in audio * CVE-2020-6546: Inappropriate implementation in installer * CVE-2020-6547: Incorrect security UI in media * CVE-2020-6548: Heap buffer overflow in Skia * CVE-2020-6549: Use after free in media * CVE-2020-6550: Use after free in IndexedDB * CVE-2020-6551: Use after free in WebXR * CVE-2020-6552: Use after free in Blink * CVE-2020-6553: Use after free in offline mode * CVE-2020-6554: Use after free in extensions * CVE-2020-6555: Out of bounds read in WebGL * Various fixes from internal audits, fuzzing and other initiatives - Disable wayland everywhere as it breaks headless and middle mouse copy everywhere: boo#1174497 boo#1175044

 

Patch

Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-1206=1 - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-1206=1


Package List

- openSUSE Leap 15.2 (x86_64): chromedriver-84.0.4147.125-lp152.2.12.2 chromedriver-debuginfo-84.0.4147.125-lp152.2.12.2 chromium-84.0.4147.125-lp152.2.12.2 chromium-debuginfo-84.0.4147.125-lp152.2.12.2 chromium-debugsource-84.0.4147.125-lp152.2.12.2 - openSUSE Leap 15.1 (x86_64): chromedriver-84.0.4147.125-lp151.2.115.1 chromedriver-debuginfo-84.0.4147.125-lp151.2.115.1 chromium-84.0.4147.125-lp151.2.115.1 chromium-debuginfo-84.0.4147.125-lp151.2.115.1 chromium-debugsource-84.0.4147.125-lp151.2.115.1


References

https://www.suse.com/security/cve/CVE-2020-6542.html https://www.suse.com/security/cve/CVE-2020-6543.html https://www.suse.com/security/cve/CVE-2020-6544.html https://www.suse.com/security/cve/CVE-2020-6545.html https://www.suse.com/security/cve/CVE-2020-6546.html https://www.suse.com/security/cve/CVE-2020-6547.html https://www.suse.com/security/cve/CVE-2020-6548.html https://www.suse.com/security/cve/CVE-2020-6549.html https://www.suse.com/security/cve/CVE-2020-6550.html https://www.suse.com/security/cve/CVE-2020-6551.html https://www.suse.com/security/cve/CVE-2020-6552.html https://www.suse.com/security/cve/CVE-2020-6553.html https://www.suse.com/security/cve/CVE-2020-6554.html https://www.suse.com/security/cve/CVE-2020-6555.html https://bugzilla.suse.com/1174497 https://bugzilla.suse.com/1175044 https://bugzilla.suse.com/1175085--


Severity
Announcement ID: openSUSE-SU-2020:1206-1
Rating: important
Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1

Related News

28.Lock Globe Esm H320
1 - 2 min read
A resurgence of cyberattacks targeting Linux systems in Asian campaigns through the utilization of the Pupy Remote Access Trojan (RAT) has been
27.Tablet Connections Blocks Lock Esm H320
2 - 4 min read
Canonical has recently announced the Beta release of Ubuntu Linux 24.04 LTS , codenamed "Noble Numbat." This release aims to continue Ubuntu's
21.Globe RadiatingCode Esm H320
2 - 3 min read
The open-source movement has come a long way, from its origins in the 1960s and 1970s to becoming an integral part of organizations worldwide.
13.Lock StylizedMotherboard Esm H320
2 - 3 min read
The Rust-based Edera project demonstrates a unique approach to container security that addresses cloud-native computing challenges. Let's examine
8.Locks HexConnections CodeGlobe Esm H320
2 - 3 min read
Canonical has launched Ubuntu Pro for Devices , a comprehensive offering emphasizing security and compliance for IoT device deployments. This
2.Motherboard Esm H320
2 - 3 min read
The recently uncovered "Native Branch History Injection (BHI)" exploit against the Linux kernel marks a significant milestone in the ongoing battle
1.Penguin Landscape Esm H320
1 - 2 min read
There are compelling arguments in favor of Linux over Windows for desktop usage. Let's explore some advantages of choosing Linux over Windows for
4.Lock AbstractDigital Esm H320
2 - 3 min read
Canonical , the company behind Ubuntu , has introduced Netplan 1.0 , a network configuration tool that simplifies networking configuration on Linux

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved