Security update for chromium SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2021:0515-1 Final 1 1 2021-04-07T08:05:14Z current 2021-04-07T08:05:14Z 2021-04-07T08:05:14Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for chromium This update for chromium fixes the following issues: Update to 89.0.4389.114 boo#1184256 - CVE-2021-21194: Use after free in screen capture - CVE-2021-21195: Use after free in V8 - CVE-2021-21196: Heap buffer overflow in TabStrip - CVE-2021-21197: Heap buffer overflow in TabStrip - CVE-2021-21198: Out of bounds read in IPC - CVE-2021-21199: Use Use after free in Aura This update was imported from the openSUSE:Leap:15.2:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2021-515 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/REVRJBO5263D3WBYK2JYYJCS6EALUV7Q/ E-Mail link for openSUSE-SU-2021:0515-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1184256 SUSE Bug 1184256 https://www.suse.com/security/cve/CVE-2021-21194/ SUSE CVE CVE-2021-21194 page https://www.suse.com/security/cve/CVE-2021-21195/ SUSE CVE CVE-2021-21195 page https://www.suse.com/security/cve/CVE-2021-21196/ SUSE CVE CVE-2021-21196 page https://www.suse.com/security/cve/CVE-2021-21197/ SUSE CVE CVE-2021-21197 page https://www.suse.com/security/cve/CVE-2021-21198/ SUSE CVE CVE-2021-21198 page https://www.suse.com/security/cve/CVE-2021-21199/ SUSE CVE CVE-2021-21199 page SUSE Package Hub 15 SP2 chromedriver-89.0.4389.114-bp152.2.68.1 chromium-89.0.4389.114-bp152.2.68.1 chromedriver-89.0.4389.114-bp152.2.68.1 as a component of SUSE Package Hub 15 SP2 chromium-89.0.4389.114-bp152.2.68.1 as a component of SUSE Package Hub 15 SP2 Use after free in screen sharing in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2021-21194 SUSE Package Hub 15 SP2:chromedriver-89.0.4389.114-bp152.2.68.1 SUSE Package Hub 15 SP2:chromium-89.0.4389.114-bp152.2.68.1 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/REVRJBO5263D3WBYK2JYYJCS6EALUV7Q/ https://www.suse.com/security/cve/CVE-2021-21194.html CVE-2021-21194 https://bugzilla.suse.com/1184256 SUSE Bug 1184256 Use after free in V8 in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2021-21195 SUSE Package Hub 15 SP2:chromedriver-89.0.4389.114-bp152.2.68.1 SUSE Package Hub 15 SP2:chromium-89.0.4389.114-bp152.2.68.1 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/REVRJBO5263D3WBYK2JYYJCS6EALUV7Q/ https://www.suse.com/security/cve/CVE-2021-21195.html CVE-2021-21195 https://bugzilla.suse.com/1184256 SUSE Bug 1184256 Heap buffer overflow in TabStrip in Google Chrome on Windows prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2021-21196 SUSE Package Hub 15 SP2:chromedriver-89.0.4389.114-bp152.2.68.1 SUSE Package Hub 15 SP2:chromium-89.0.4389.114-bp152.2.68.1 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/REVRJBO5263D3WBYK2JYYJCS6EALUV7Q/ https://www.suse.com/security/cve/CVE-2021-21196.html CVE-2021-21196 https://bugzilla.suse.com/1184256 SUSE Bug 1184256 Heap buffer overflow in TabStrip in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2021-21197 SUSE Package Hub 15 SP2:chromedriver-89.0.4389.114-bp152.2.68.1 SUSE Package Hub 15 SP2:chromium-89.0.4389.114-bp152.2.68.1 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/REVRJBO5263D3WBYK2JYYJCS6EALUV7Q/ https://www.suse.com/security/cve/CVE-2021-21197.html CVE-2021-21197 https://bugzilla.suse.com/1184256 SUSE Bug 1184256 Out of bounds read in IPC in Google Chrome prior to 89.0.4389.114 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. CVE-2021-21198 SUSE Package Hub 15 SP2:chromedriver-89.0.4389.114-bp152.2.68.1 SUSE Package Hub 15 SP2:chromium-89.0.4389.114-bp152.2.68.1 moderate 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/REVRJBO5263D3WBYK2JYYJCS6EALUV7Q/ https://www.suse.com/security/cve/CVE-2021-21198.html CVE-2021-21198 https://bugzilla.suse.com/1184256 SUSE Bug 1184256 Use after free in Aura in Google Chrome on Linux prior to 89.0.4389.114 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. CVE-2021-21199 SUSE Package Hub 15 SP2:chromedriver-89.0.4389.114-bp152.2.68.1 SUSE Package Hub 15 SP2:chromium-89.0.4389.114-bp152.2.68.1 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/REVRJBO5263D3WBYK2JYYJCS6EALUV7Q/ https://www.suse.com/security/cve/CVE-2021-21199.html CVE-2021-21199 https://bugzilla.suse.com/1184256 SUSE Bug 1184256