Security update for nodejs-electron SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2022:0070-1 Final 1 1 2022-03-03T12:42:04Z current 2022-03-03T12:42:04Z 2022-03-03T12:42:04Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for nodejs-electron This update for nodejs-electron fixes the following issues: - Fix webpack-4 with OpenSSL 3.0 Update to version 16.0.9 * https://github.com/electron/electron/releases/tag/v16.0.9 Update to version 16.0.8 * https://github.com/electron/electron/releases/tag/v16.0.8 - Add devel package with node headers (e.g. for node-gyp) - Update to version 16.0.7 * https://github.com/electron/electron/releases/tag/v16.0.7 - Update to version 15.3.3 * https://github.com/electron/electron/releases/tag/v15.3.3 - Update to version 13.6.3 https://github.com/electron/electron/releases/tag/v13.6.3 - Update to version 13.6.2 https://github.com/electron/electron/releases/tag/v13.6.2 - Fix for CVE-2021-37998 - Fix for CVE-2021-38001 - Fix for CVE-2021-38002 - Fix for CVE-2021-38003 - Do not build with H264 - Update to version 13.6.1 https://github.com/electron/electron/releases/tag/v13.6.1 - Fix for CVE-2021-37981 - Fix for CVE-2021-37984 - Fix for CVE-2021-37987 - Fix for CVE-2021-37989 - Fix for CVE-2021-37992 - Fix for CVE-2021-37996 - Update to version 13.5.1 https://github.com/electron/electron/releases/tag/v13.5.1 - Update to version 13.5.0 https://github.com/electron/electron/releases/tag/v13.5.0 - Fix for CVE-2021-30627 - Fix for CVE-2021-30631 - Fix for CVE-2021-30632 - Fix for CVE-2021-30625 - Fix for CVE-2021-30626 - Fix for CVE-2021-30628 - Fix for CVE-2021-30630 - Fix for CVE-2021-30633 - Version 13.4.0 - Update to version 13.1.8 * https://github.com/electron/electron/releases/tag/v13.1.8 - Update to version 13.1.7 * https://github.com/electron/electron/releases/tag/v13.1.7 - Update to version 13.1.6 * https://github.com/electron/electron/releases/tag/v13.1.6 * https://github.com/electron/electron/releases/tag/v13.1.5 - Update to version 13.1.4 * https://github.com/electron/electron/releases/tag/v13.1.4 * https://github.com/electron/electron/releases/tag/v13.1.3 - Build with vaapi support - Install missing vk_swiftshader_icd.json - Update to version 13.1.2 * https://github.com/electron/electron/releases/tag/v13.1.2 The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2022-70 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/G2JZKFAH5MWINMQLTSYZ2GQCLX5UGIGE/ E-Mail link for openSUSE-SU-2022:0070-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2021-30625/ SUSE CVE CVE-2021-30625 page https://www.suse.com/security/cve/CVE-2021-30626/ SUSE CVE CVE-2021-30626 page https://www.suse.com/security/cve/CVE-2021-30627/ SUSE CVE CVE-2021-30627 page https://www.suse.com/security/cve/CVE-2021-30628/ SUSE CVE CVE-2021-30628 page https://www.suse.com/security/cve/CVE-2021-30630/ SUSE CVE CVE-2021-30630 page https://www.suse.com/security/cve/CVE-2021-30631/ SUSE CVE CVE-2021-30631 page https://www.suse.com/security/cve/CVE-2021-30632/ SUSE CVE CVE-2021-30632 page https://www.suse.com/security/cve/CVE-2021-30633/ SUSE CVE CVE-2021-30633 page https://www.suse.com/security/cve/CVE-2021-37981/ SUSE CVE CVE-2021-37981 page https://www.suse.com/security/cve/CVE-2021-37984/ SUSE CVE CVE-2021-37984 page https://www.suse.com/security/cve/CVE-2021-37987/ SUSE CVE CVE-2021-37987 page https://www.suse.com/security/cve/CVE-2021-37989/ SUSE CVE CVE-2021-37989 page https://www.suse.com/security/cve/CVE-2021-37992/ SUSE CVE CVE-2021-37992 page https://www.suse.com/security/cve/CVE-2021-37996/ SUSE CVE CVE-2021-37996 page https://www.suse.com/security/cve/CVE-2021-37998/ SUSE CVE CVE-2021-37998 page https://www.suse.com/security/cve/CVE-2021-38001/ SUSE CVE CVE-2021-38001 page https://www.suse.com/security/cve/CVE-2021-38002/ SUSE CVE CVE-2021-38002 page https://www.suse.com/security/cve/CVE-2021-38003/ SUSE CVE CVE-2021-38003 page SUSE Package Hub 15 SP3 openSUSE Leap 15.3 nodejs-electron-16.0.9-bp153.2.1 nodejs-electron-devel-16.0.9-bp153.2.1 nodejs-electron-16.0.9-bp153.2.1 as a component of SUSE Package Hub 15 SP3 nodejs-electron-devel-16.0.9-bp153.2.1 as a component of SUSE Package Hub 15 SP3 nodejs-electron-16.0.9-bp153.2.1 as a component of openSUSE Leap 15.3 nodejs-electron-devel-16.0.9-bp153.2.1 as a component of openSUSE Leap 15.3 Use after free in Selection API in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who convinced the user the visit a malicious website to potentially exploit heap corruption via a crafted HTML page. CVE-2021-30625 SUSE Package Hub 15 SP3:nodejs-electron-16.0.9-bp153.2.1 SUSE Package Hub 15 SP3:nodejs-electron-devel-16.0.9-bp153.2.1 openSUSE Leap 15.3:nodejs-electron-16.0.9-bp153.2.1 openSUSE Leap 15.3:nodejs-electron-devel-16.0.9-bp153.2.1 critical 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/G2JZKFAH5MWINMQLTSYZ2GQCLX5UGIGE/ https://www.suse.com/security/cve/CVE-2021-30625.html CVE-2021-30625 https://bugzilla.suse.com/1190476 SUSE Bug 1190476 Out of bounds memory access in ANGLE in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2021-30626 SUSE Package Hub 15 SP3:nodejs-electron-16.0.9-bp153.2.1 SUSE Package Hub 15 SP3:nodejs-electron-devel-16.0.9-bp153.2.1 openSUSE Leap 15.3:nodejs-electron-16.0.9-bp153.2.1 openSUSE Leap 15.3:nodejs-electron-devel-16.0.9-bp153.2.1 critical 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/G2JZKFAH5MWINMQLTSYZ2GQCLX5UGIGE/ https://www.suse.com/security/cve/CVE-2021-30626.html CVE-2021-30626 https://bugzilla.suse.com/1190476 SUSE Bug 1190476 Type confusion in Blink layout in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2021-30627 SUSE Package Hub 15 SP3:nodejs-electron-16.0.9-bp153.2.1 SUSE Package Hub 15 SP3:nodejs-electron-devel-16.0.9-bp153.2.1 openSUSE Leap 15.3:nodejs-electron-16.0.9-bp153.2.1 openSUSE Leap 15.3:nodejs-electron-devel-16.0.9-bp153.2.1 critical 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/G2JZKFAH5MWINMQLTSYZ2GQCLX5UGIGE/ https://www.suse.com/security/cve/CVE-2021-30627.html CVE-2021-30627 https://bugzilla.suse.com/1190476 SUSE Bug 1190476 Stack buffer overflow in ANGLE in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit stack corruption via a crafted HTML page. CVE-2021-30628 SUSE Package Hub 15 SP3:nodejs-electron-16.0.9-bp153.2.1 SUSE Package Hub 15 SP3:nodejs-electron-devel-16.0.9-bp153.2.1 openSUSE Leap 15.3:nodejs-electron-16.0.9-bp153.2.1 openSUSE Leap 15.3:nodejs-electron-devel-16.0.9-bp153.2.1 critical 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/G2JZKFAH5MWINMQLTSYZ2GQCLX5UGIGE/ https://www.suse.com/security/cve/CVE-2021-30628.html CVE-2021-30628 https://bugzilla.suse.com/1190476 SUSE Bug 1190476 Inappropriate implementation in Blink in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. CVE-2021-30630 SUSE Package Hub 15 SP3:nodejs-electron-16.0.9-bp153.2.1 SUSE Package Hub 15 SP3:nodejs-electron-devel-16.0.9-bp153.2.1 openSUSE Leap 15.3:nodejs-electron-16.0.9-bp153.2.1 openSUSE Leap 15.3:nodejs-electron-devel-16.0.9-bp153.2.1 critical 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/G2JZKFAH5MWINMQLTSYZ2GQCLX5UGIGE/ https://www.suse.com/security/cve/CVE-2021-30630.html CVE-2021-30630 https://bugzilla.suse.com/1190476 SUSE Bug 1190476 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. CVE-2021-30631 SUSE Package Hub 15 SP3:nodejs-electron-16.0.9-bp153.2.1 SUSE Package Hub 15 SP3:nodejs-electron-devel-16.0.9-bp153.2.1 openSUSE Leap 15.3:nodejs-electron-16.0.9-bp153.2.1 openSUSE Leap 15.3:nodejs-electron-devel-16.0.9-bp153.2.1 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/G2JZKFAH5MWINMQLTSYZ2GQCLX5UGIGE/ https://www.suse.com/security/cve/CVE-2021-30631.html CVE-2021-30631 https://bugzilla.suse.com/1190476 SUSE Bug 1190476 Out of bounds write in V8 in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2021-30632 SUSE Package Hub 15 SP3:nodejs-electron-16.0.9-bp153.2.1 SUSE Package Hub 15 SP3:nodejs-electron-devel-16.0.9-bp153.2.1 openSUSE Leap 15.3:nodejs-electron-16.0.9-bp153.2.1 openSUSE Leap 15.3:nodejs-electron-devel-16.0.9-bp153.2.1 critical 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/G2JZKFAH5MWINMQLTSYZ2GQCLX5UGIGE/ https://www.suse.com/security/cve/CVE-2021-30632.html CVE-2021-30632 https://bugzilla.suse.com/1190476 SUSE Bug 1190476 Use after free in Indexed DB API in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. CVE-2021-30633 SUSE Package Hub 15 SP3:nodejs-electron-16.0.9-bp153.2.1 SUSE Package Hub 15 SP3:nodejs-electron-devel-16.0.9-bp153.2.1 openSUSE Leap 15.3:nodejs-electron-16.0.9-bp153.2.1 openSUSE Leap 15.3:nodejs-electron-devel-16.0.9-bp153.2.1 critical 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/G2JZKFAH5MWINMQLTSYZ2GQCLX5UGIGE/ https://www.suse.com/security/cve/CVE-2021-30633.html CVE-2021-30633 https://bugzilla.suse.com/1190476 SUSE Bug 1190476 Heap buffer overflow in Skia in Google Chrome prior to 95.0.4638.54 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. CVE-2021-37981 SUSE Package Hub 15 SP3:nodejs-electron-16.0.9-bp153.2.1 SUSE Package Hub 15 SP3:nodejs-electron-devel-16.0.9-bp153.2.1 openSUSE Leap 15.3:nodejs-electron-16.0.9-bp153.2.1 openSUSE Leap 15.3:nodejs-electron-devel-16.0.9-bp153.2.1 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/G2JZKFAH5MWINMQLTSYZ2GQCLX5UGIGE/ https://www.suse.com/security/cve/CVE-2021-37981.html CVE-2021-37981 https://bugzilla.suse.com/1191844 SUSE Bug 1191844 Heap buffer overflow in PDFium in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2021-37984 SUSE Package Hub 15 SP3:nodejs-electron-16.0.9-bp153.2.1 SUSE Package Hub 15 SP3:nodejs-electron-devel-16.0.9-bp153.2.1 openSUSE Leap 15.3:nodejs-electron-16.0.9-bp153.2.1 openSUSE Leap 15.3:nodejs-electron-devel-16.0.9-bp153.2.1 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/G2JZKFAH5MWINMQLTSYZ2GQCLX5UGIGE/ https://www.suse.com/security/cve/CVE-2021-37984.html CVE-2021-37984 https://bugzilla.suse.com/1191844 SUSE Bug 1191844 Use after free in Network APIs in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2021-37987 SUSE Package Hub 15 SP3:nodejs-electron-16.0.9-bp153.2.1 SUSE Package Hub 15 SP3:nodejs-electron-devel-16.0.9-bp153.2.1 openSUSE Leap 15.3:nodejs-electron-16.0.9-bp153.2.1 openSUSE Leap 15.3:nodejs-electron-devel-16.0.9-bp153.2.1 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/G2JZKFAH5MWINMQLTSYZ2GQCLX5UGIGE/ https://www.suse.com/security/cve/CVE-2021-37987.html CVE-2021-37987 https://bugzilla.suse.com/1191844 SUSE Bug 1191844 Inappropriate implementation in Blink in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to abuse content security policy via a crafted HTML page. CVE-2021-37989 SUSE Package Hub 15 SP3:nodejs-electron-16.0.9-bp153.2.1 SUSE Package Hub 15 SP3:nodejs-electron-devel-16.0.9-bp153.2.1 openSUSE Leap 15.3:nodejs-electron-16.0.9-bp153.2.1 openSUSE Leap 15.3:nodejs-electron-devel-16.0.9-bp153.2.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/G2JZKFAH5MWINMQLTSYZ2GQCLX5UGIGE/ https://www.suse.com/security/cve/CVE-2021-37989.html CVE-2021-37989 https://bugzilla.suse.com/1191844 SUSE Bug 1191844 Out of bounds read in WebAudio in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2021-37992 SUSE Package Hub 15 SP3:nodejs-electron-16.0.9-bp153.2.1 SUSE Package Hub 15 SP3:nodejs-electron-devel-16.0.9-bp153.2.1 openSUSE Leap 15.3:nodejs-electron-16.0.9-bp153.2.1 openSUSE Leap 15.3:nodejs-electron-devel-16.0.9-bp153.2.1 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/G2JZKFAH5MWINMQLTSYZ2GQCLX5UGIGE/ https://www.suse.com/security/cve/CVE-2021-37992.html CVE-2021-37992 https://bugzilla.suse.com/1191844 SUSE Bug 1191844 Insufficient validation of untrusted input Downloads in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to bypass navigation restrictions via a malicious file. CVE-2021-37996 SUSE Package Hub 15 SP3:nodejs-electron-16.0.9-bp153.2.1 SUSE Package Hub 15 SP3:nodejs-electron-devel-16.0.9-bp153.2.1 openSUSE Leap 15.3:nodejs-electron-16.0.9-bp153.2.1 openSUSE Leap 15.3:nodejs-electron-devel-16.0.9-bp153.2.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/G2JZKFAH5MWINMQLTSYZ2GQCLX5UGIGE/ https://www.suse.com/security/cve/CVE-2021-37996.html CVE-2021-37996 https://bugzilla.suse.com/1191844 SUSE Bug 1191844 Use after free in Garbage Collection in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2021-37998 SUSE Package Hub 15 SP3:nodejs-electron-16.0.9-bp153.2.1 SUSE Package Hub 15 SP3:nodejs-electron-devel-16.0.9-bp153.2.1 openSUSE Leap 15.3:nodejs-electron-16.0.9-bp153.2.1 openSUSE Leap 15.3:nodejs-electron-devel-16.0.9-bp153.2.1 critical 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/G2JZKFAH5MWINMQLTSYZ2GQCLX5UGIGE/ https://www.suse.com/security/cve/CVE-2021-37998.html CVE-2021-37998 https://bugzilla.suse.com/1192184 SUSE Bug 1192184 Type confusion in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2021-38001 SUSE Package Hub 15 SP3:nodejs-electron-16.0.9-bp153.2.1 SUSE Package Hub 15 SP3:nodejs-electron-devel-16.0.9-bp153.2.1 openSUSE Leap 15.3:nodejs-electron-16.0.9-bp153.2.1 openSUSE Leap 15.3:nodejs-electron-devel-16.0.9-bp153.2.1 critical 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/G2JZKFAH5MWINMQLTSYZ2GQCLX5UGIGE/ https://www.suse.com/security/cve/CVE-2021-38001.html CVE-2021-38001 https://bugzilla.suse.com/1192184 SUSE Bug 1192184 Use after free in Web Transport in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. CVE-2021-38002 SUSE Package Hub 15 SP3:nodejs-electron-16.0.9-bp153.2.1 SUSE Package Hub 15 SP3:nodejs-electron-devel-16.0.9-bp153.2.1 openSUSE Leap 15.3:nodejs-electron-16.0.9-bp153.2.1 openSUSE Leap 15.3:nodejs-electron-devel-16.0.9-bp153.2.1 critical 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/G2JZKFAH5MWINMQLTSYZ2GQCLX5UGIGE/ https://www.suse.com/security/cve/CVE-2021-38002.html CVE-2021-38002 https://bugzilla.suse.com/1192184 SUSE Bug 1192184 Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2021-38003 SUSE Package Hub 15 SP3:nodejs-electron-16.0.9-bp153.2.1 SUSE Package Hub 15 SP3:nodejs-electron-devel-16.0.9-bp153.2.1 openSUSE Leap 15.3:nodejs-electron-16.0.9-bp153.2.1 openSUSE Leap 15.3:nodejs-electron-devel-16.0.9-bp153.2.1 critical 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/G2JZKFAH5MWINMQLTSYZ2GQCLX5UGIGE/ https://www.suse.com/security/cve/CVE-2021-38003.html CVE-2021-38003 https://bugzilla.suse.com/1192184 SUSE Bug 1192184