Security update for chromium SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2022:0085-1 Final 1 1 2022-03-20T13:04:05Z current 2022-03-20T13:04:05Z 2022-03-20T13:04:05Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for chromium This update for chromium fixes the following issues: Update to version 99.0.4844.74 (boo#1197163) * CVE-2022-0971: Use after free in Blink Layout * CVE-2022-0972: Use after free in Extensions * CVE-2022-0973: Use after free in Safe Browsing * CVE-2022-0974: Use after free in Splitscreen * CVE-2022-0975: Use after free in ANGLE * CVE-2022-0976: Heap buffer overflow in GPU * CVE-2022-0977: Use after free in Browser UI * CVE-2022-0978: Use after free in ANGLE * CVE-2022-0979: Use after free in Safe Browsing * CVE-2022-0980: Use after free in New Tab Page * Various fixes from internal audits, fuzzing and other initiatives The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2022-85 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4Z4LLOJXXGP4GXUSNG4BEUSYEPI3FBAL/ E-Mail link for openSUSE-SU-2022:0085-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1197163 SUSE Bug 1197163 https://www.suse.com/security/cve/CVE-2022-0971/ SUSE CVE CVE-2022-0971 page https://www.suse.com/security/cve/CVE-2022-0972/ SUSE CVE CVE-2022-0972 page https://www.suse.com/security/cve/CVE-2022-0973/ SUSE CVE CVE-2022-0973 page https://www.suse.com/security/cve/CVE-2022-0974/ SUSE CVE CVE-2022-0974 page https://www.suse.com/security/cve/CVE-2022-0975/ SUSE CVE CVE-2022-0975 page https://www.suse.com/security/cve/CVE-2022-0976/ SUSE CVE CVE-2022-0976 page https://www.suse.com/security/cve/CVE-2022-0977/ SUSE CVE CVE-2022-0977 page https://www.suse.com/security/cve/CVE-2022-0978/ SUSE CVE CVE-2022-0978 page https://www.suse.com/security/cve/CVE-2022-0979/ SUSE CVE CVE-2022-0979 page https://www.suse.com/security/cve/CVE-2022-0980/ SUSE CVE CVE-2022-0980 page SUSE Package Hub 15 SP3 openSUSE Leap 15.3 chromedriver-99.0.4844.74-bp153.2.69.1 chromium-99.0.4844.74-bp153.2.69.1 chromedriver-99.0.4844.74-bp153.2.69.1 as a component of SUSE Package Hub 15 SP3 chromium-99.0.4844.74-bp153.2.69.1 as a component of SUSE Package Hub 15 SP3 chromedriver-99.0.4844.74-bp153.2.69.1 as a component of openSUSE Leap 15.3 chromium-99.0.4844.74-bp153.2.69.1 as a component of openSUSE Leap 15.3 Use after free in Blink Layout in Google Chrome on Android prior to 99.0.4844.74 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. CVE-2022-0971 SUSE Package Hub 15 SP3:chromedriver-99.0.4844.74-bp153.2.69.1 SUSE Package Hub 15 SP3:chromium-99.0.4844.74-bp153.2.69.1 openSUSE Leap 15.3:chromedriver-99.0.4844.74-bp153.2.69.1 openSUSE Leap 15.3:chromium-99.0.4844.74-bp153.2.69.1 critical 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4Z4LLOJXXGP4GXUSNG4BEUSYEPI3FBAL/ https://www.suse.com/security/cve/CVE-2022-0971.html CVE-2022-0971 https://bugzilla.suse.com/1197163 SUSE Bug 1197163 Use after free in Extensions in Google Chrome prior to 99.0.4844.74 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. CVE-2022-0972 SUSE Package Hub 15 SP3:chromedriver-99.0.4844.74-bp153.2.69.1 SUSE Package Hub 15 SP3:chromium-99.0.4844.74-bp153.2.69.1 openSUSE Leap 15.3:chromedriver-99.0.4844.74-bp153.2.69.1 openSUSE Leap 15.3:chromium-99.0.4844.74-bp153.2.69.1 critical 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4Z4LLOJXXGP4GXUSNG4BEUSYEPI3FBAL/ https://www.suse.com/security/cve/CVE-2022-0972.html CVE-2022-0972 https://bugzilla.suse.com/1197163 SUSE Bug 1197163 Use after free in Safe Browsing in Google Chrome prior to 99.0.4844.74 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2022-0973 SUSE Package Hub 15 SP3:chromedriver-99.0.4844.74-bp153.2.69.1 SUSE Package Hub 15 SP3:chromium-99.0.4844.74-bp153.2.69.1 openSUSE Leap 15.3:chromedriver-99.0.4844.74-bp153.2.69.1 openSUSE Leap 15.3:chromium-99.0.4844.74-bp153.2.69.1 critical 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4Z4LLOJXXGP4GXUSNG4BEUSYEPI3FBAL/ https://www.suse.com/security/cve/CVE-2022-0973.html CVE-2022-0973 https://bugzilla.suse.com/1197163 SUSE Bug 1197163 Use after free in Splitscreen in Google Chrome on Chrome OS prior to 99.0.4844.74 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page. CVE-2022-0974 SUSE Package Hub 15 SP3:chromedriver-99.0.4844.74-bp153.2.69.1 SUSE Package Hub 15 SP3:chromium-99.0.4844.74-bp153.2.69.1 openSUSE Leap 15.3:chromedriver-99.0.4844.74-bp153.2.69.1 openSUSE Leap 15.3:chromium-99.0.4844.74-bp153.2.69.1 critical 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4Z4LLOJXXGP4GXUSNG4BEUSYEPI3FBAL/ https://www.suse.com/security/cve/CVE-2022-0974.html CVE-2022-0974 https://bugzilla.suse.com/1197163 SUSE Bug 1197163 Use after free in ANGLE in Google Chrome prior to 99.0.4844.74 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2022-0975 SUSE Package Hub 15 SP3:chromedriver-99.0.4844.74-bp153.2.69.1 SUSE Package Hub 15 SP3:chromium-99.0.4844.74-bp153.2.69.1 openSUSE Leap 15.3:chromedriver-99.0.4844.74-bp153.2.69.1 openSUSE Leap 15.3:chromium-99.0.4844.74-bp153.2.69.1 critical 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4Z4LLOJXXGP4GXUSNG4BEUSYEPI3FBAL/ https://www.suse.com/security/cve/CVE-2022-0975.html CVE-2022-0975 https://bugzilla.suse.com/1197163 SUSE Bug 1197163 Heap buffer overflow in GPU in Google Chrome prior to 99.0.4844.74 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2022-0976 SUSE Package Hub 15 SP3:chromedriver-99.0.4844.74-bp153.2.69.1 SUSE Package Hub 15 SP3:chromium-99.0.4844.74-bp153.2.69.1 openSUSE Leap 15.3:chromedriver-99.0.4844.74-bp153.2.69.1 openSUSE Leap 15.3:chromium-99.0.4844.74-bp153.2.69.1 critical 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4Z4LLOJXXGP4GXUSNG4BEUSYEPI3FBAL/ https://www.suse.com/security/cve/CVE-2022-0976.html CVE-2022-0976 https://bugzilla.suse.com/1197163 SUSE Bug 1197163 Use after free in Browser UI in Google Chrome on Chrome OS prior to 99.0.4844.74 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page. CVE-2022-0977 SUSE Package Hub 15 SP3:chromedriver-99.0.4844.74-bp153.2.69.1 SUSE Package Hub 15 SP3:chromium-99.0.4844.74-bp153.2.69.1 openSUSE Leap 15.3:chromedriver-99.0.4844.74-bp153.2.69.1 openSUSE Leap 15.3:chromium-99.0.4844.74-bp153.2.69.1 critical 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4Z4LLOJXXGP4GXUSNG4BEUSYEPI3FBAL/ https://www.suse.com/security/cve/CVE-2022-0977.html CVE-2022-0977 https://bugzilla.suse.com/1197163 SUSE Bug 1197163 Use after free in ANGLE in Google Chrome prior to 99.0.4844.74 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2022-0978 SUSE Package Hub 15 SP3:chromedriver-99.0.4844.74-bp153.2.69.1 SUSE Package Hub 15 SP3:chromium-99.0.4844.74-bp153.2.69.1 openSUSE Leap 15.3:chromedriver-99.0.4844.74-bp153.2.69.1 openSUSE Leap 15.3:chromium-99.0.4844.74-bp153.2.69.1 critical 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4Z4LLOJXXGP4GXUSNG4BEUSYEPI3FBAL/ https://www.suse.com/security/cve/CVE-2022-0978.html CVE-2022-0978 https://bugzilla.suse.com/1197163 SUSE Bug 1197163 Use after free in Safe Browsing in Google Chrome on Android prior to 99.0.4844.74 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page. CVE-2022-0979 SUSE Package Hub 15 SP3:chromedriver-99.0.4844.74-bp153.2.69.1 SUSE Package Hub 15 SP3:chromium-99.0.4844.74-bp153.2.69.1 openSUSE Leap 15.3:chromedriver-99.0.4844.74-bp153.2.69.1 openSUSE Leap 15.3:chromium-99.0.4844.74-bp153.2.69.1 critical 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4Z4LLOJXXGP4GXUSNG4BEUSYEPI3FBAL/ https://www.suse.com/security/cve/CVE-2022-0979.html CVE-2022-0979 https://bugzilla.suse.com/1197163 SUSE Bug 1197163 Use after free in New Tab Page in Google Chrome prior to 99.0.4844.74 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via specific user interactions. CVE-2022-0980 SUSE Package Hub 15 SP3:chromedriver-99.0.4844.74-bp153.2.69.1 SUSE Package Hub 15 SP3:chromium-99.0.4844.74-bp153.2.69.1 openSUSE Leap 15.3:chromedriver-99.0.4844.74-bp153.2.69.1 openSUSE Leap 15.3:chromium-99.0.4844.74-bp153.2.69.1 critical 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4Z4LLOJXXGP4GXUSNG4BEUSYEPI3FBAL/ https://www.suse.com/security/cve/CVE-2022-0980.html CVE-2022-0980 https://bugzilla.suse.com/1197163 SUSE Bug 1197163