Security update for chromium SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2022:0133-1 Final 1 1 2022-05-16T15:40:09Z current 2022-05-16T15:40:09Z 2022-05-16T15:40:09Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for chromium This update for chromium fixes the following issues: Chromium was updated to 101.0.4951.64 (boo#1199409) * CVE-2022-1633: Use after free in Sharesheet * CVE-2022-1634: Use after free in Browser UI * CVE-2022-1635: Use after free in Permission Prompts * CVE-2022-1636: Use after free in Performance APIs * CVE-2022-1637: Inappropriate implementation in Web Contents * CVE-2022-1638: Heap buffer overflow in V8 Internationalization * CVE-2022-1639: Use after free in ANGLE * CVE-2022-1640: Use after free in Sharing * CVE-2022-1641: Use after free in Web UI Diagnostics The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2022-133 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HZUMF5ZF6ZMVTBWA23ERPOPX2IWSXJYS/ E-Mail link for openSUSE-SU-2022:0133-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1199409 SUSE Bug 1199409 https://www.suse.com/security/cve/CVE-2022-1633/ SUSE CVE CVE-2022-1633 page https://www.suse.com/security/cve/CVE-2022-1634/ SUSE CVE CVE-2022-1634 page https://www.suse.com/security/cve/CVE-2022-1635/ SUSE CVE CVE-2022-1635 page https://www.suse.com/security/cve/CVE-2022-1636/ SUSE CVE CVE-2022-1636 page https://www.suse.com/security/cve/CVE-2022-1637/ SUSE CVE CVE-2022-1637 page https://www.suse.com/security/cve/CVE-2022-1638/ SUSE CVE CVE-2022-1638 page https://www.suse.com/security/cve/CVE-2022-1639/ SUSE CVE CVE-2022-1639 page https://www.suse.com/security/cve/CVE-2022-1640/ SUSE CVE CVE-2022-1640 page https://www.suse.com/security/cve/CVE-2022-1641/ SUSE CVE CVE-2022-1641 page SUSE Package Hub 15 SP3 openSUSE Leap 15.3 chromedriver-101.0.4951.64-bp153.2.91.1 chromium-101.0.4951.64-bp153.2.91.1 chromedriver-101.0.4951.64-bp153.2.91.1 as a component of SUSE Package Hub 15 SP3 chromium-101.0.4951.64-bp153.2.91.1 as a component of SUSE Package Hub 15 SP3 chromedriver-101.0.4951.64-bp153.2.91.1 as a component of openSUSE Leap 15.3 chromium-101.0.4951.64-bp153.2.91.1 as a component of openSUSE Leap 15.3 Use after free in Sharesheet in Google Chrome on Chrome OS prior to 101.0.4951.64 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via specific user interactions. CVE-2022-1633 SUSE Package Hub 15 SP3:chromedriver-101.0.4951.64-bp153.2.91.1 SUSE Package Hub 15 SP3:chromium-101.0.4951.64-bp153.2.91.1 openSUSE Leap 15.3:chromedriver-101.0.4951.64-bp153.2.91.1 openSUSE Leap 15.3:chromium-101.0.4951.64-bp153.2.91.1 important 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HZUMF5ZF6ZMVTBWA23ERPOPX2IWSXJYS/ https://www.suse.com/security/cve/CVE-2022-1633.html CVE-2022-1633 https://bugzilla.suse.com/1199409 SUSE Bug 1199409 Use after free in Browser UI in Google Chrome prior to 101.0.4951.64 allowed a remote attacker who had convinced a user to engage in specific UI interaction to potentially exploit heap corruption via specific user interactions. CVE-2022-1634 SUSE Package Hub 15 SP3:chromedriver-101.0.4951.64-bp153.2.91.1 SUSE Package Hub 15 SP3:chromium-101.0.4951.64-bp153.2.91.1 openSUSE Leap 15.3:chromedriver-101.0.4951.64-bp153.2.91.1 openSUSE Leap 15.3:chromium-101.0.4951.64-bp153.2.91.1 important 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HZUMF5ZF6ZMVTBWA23ERPOPX2IWSXJYS/ https://www.suse.com/security/cve/CVE-2022-1634.html CVE-2022-1634 https://bugzilla.suse.com/1199409 SUSE Bug 1199409 Use after free in Permission Prompts in Google Chrome prior to 101.0.4951.64 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via specific user interactions. CVE-2022-1635 SUSE Package Hub 15 SP3:chromedriver-101.0.4951.64-bp153.2.91.1 SUSE Package Hub 15 SP3:chromium-101.0.4951.64-bp153.2.91.1 openSUSE Leap 15.3:chromedriver-101.0.4951.64-bp153.2.91.1 openSUSE Leap 15.3:chromium-101.0.4951.64-bp153.2.91.1 important 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HZUMF5ZF6ZMVTBWA23ERPOPX2IWSXJYS/ https://www.suse.com/security/cve/CVE-2022-1635.html CVE-2022-1635 https://bugzilla.suse.com/1199409 SUSE Bug 1199409 Use after free in Performance APIs in Google Chrome prior to 101.0.4951.64 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2022-1636 SUSE Package Hub 15 SP3:chromedriver-101.0.4951.64-bp153.2.91.1 SUSE Package Hub 15 SP3:chromium-101.0.4951.64-bp153.2.91.1 openSUSE Leap 15.3:chromedriver-101.0.4951.64-bp153.2.91.1 openSUSE Leap 15.3:chromium-101.0.4951.64-bp153.2.91.1 important 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HZUMF5ZF6ZMVTBWA23ERPOPX2IWSXJYS/ https://www.suse.com/security/cve/CVE-2022-1636.html CVE-2022-1636 https://bugzilla.suse.com/1199409 SUSE Bug 1199409 Inappropriate implementation in Web Contents in Google Chrome prior to 101.0.4951.64 allowed a remote attacker to leak cross-origin data via a crafted HTML page. CVE-2022-1637 SUSE Package Hub 15 SP3:chromedriver-101.0.4951.64-bp153.2.91.1 SUSE Package Hub 15 SP3:chromium-101.0.4951.64-bp153.2.91.1 openSUSE Leap 15.3:chromedriver-101.0.4951.64-bp153.2.91.1 openSUSE Leap 15.3:chromium-101.0.4951.64-bp153.2.91.1 important 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HZUMF5ZF6ZMVTBWA23ERPOPX2IWSXJYS/ https://www.suse.com/security/cve/CVE-2022-1637.html CVE-2022-1637 https://bugzilla.suse.com/1199409 SUSE Bug 1199409 Heap buffer overflow in V8 Internationalization in Google Chrome prior to 101.0.4951.64 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2022-1638 SUSE Package Hub 15 SP3:chromedriver-101.0.4951.64-bp153.2.91.1 SUSE Package Hub 15 SP3:chromium-101.0.4951.64-bp153.2.91.1 openSUSE Leap 15.3:chromedriver-101.0.4951.64-bp153.2.91.1 openSUSE Leap 15.3:chromium-101.0.4951.64-bp153.2.91.1 important 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HZUMF5ZF6ZMVTBWA23ERPOPX2IWSXJYS/ https://www.suse.com/security/cve/CVE-2022-1638.html CVE-2022-1638 https://bugzilla.suse.com/1199409 SUSE Bug 1199409 Use after free in ANGLE in Google Chrome prior to 101.0.4951.64 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2022-1639 SUSE Package Hub 15 SP3:chromedriver-101.0.4951.64-bp153.2.91.1 SUSE Package Hub 15 SP3:chromium-101.0.4951.64-bp153.2.91.1 openSUSE Leap 15.3:chromedriver-101.0.4951.64-bp153.2.91.1 openSUSE Leap 15.3:chromium-101.0.4951.64-bp153.2.91.1 important 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HZUMF5ZF6ZMVTBWA23ERPOPX2IWSXJYS/ https://www.suse.com/security/cve/CVE-2022-1639.html CVE-2022-1639 https://bugzilla.suse.com/1199409 SUSE Bug 1199409 Use after free in Sharing in Google Chrome prior to 101.0.4951.64 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. CVE-2022-1640 SUSE Package Hub 15 SP3:chromedriver-101.0.4951.64-bp153.2.91.1 SUSE Package Hub 15 SP3:chromium-101.0.4951.64-bp153.2.91.1 openSUSE Leap 15.3:chromedriver-101.0.4951.64-bp153.2.91.1 openSUSE Leap 15.3:chromium-101.0.4951.64-bp153.2.91.1 important 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HZUMF5ZF6ZMVTBWA23ERPOPX2IWSXJYS/ https://www.suse.com/security/cve/CVE-2022-1640.html CVE-2022-1640 https://bugzilla.suse.com/1199409 SUSE Bug 1199409 Use after free in Web UI Diagnostics in Google Chrome on Chrome OS prior to 101.0.4951.64 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via specific user interaction. CVE-2022-1641 SUSE Package Hub 15 SP3:chromedriver-101.0.4951.64-bp153.2.91.1 SUSE Package Hub 15 SP3:chromium-101.0.4951.64-bp153.2.91.1 openSUSE Leap 15.3:chromedriver-101.0.4951.64-bp153.2.91.1 openSUSE Leap 15.3:chromium-101.0.4951.64-bp153.2.91.1 important 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HZUMF5ZF6ZMVTBWA23ERPOPX2IWSXJYS/ https://www.suse.com/security/cve/CVE-2022-1641.html CVE-2022-1641 https://bugzilla.suse.com/1199409 SUSE Bug 1199409