Security update for chromium SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2022:10073-1 Final 1 1 2022-08-01T06:43:27Z current 2022-08-01T06:43:27Z 2022-08-01T06:43:27Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for chromium This update for chromium fixes the following issues: Chromium was updated to 103.0.5060.134 (boo#1201679): * CVE-2022-2477 : Use after free in Guest View * CVE-2022-2478 : Use after free in PDF * CVE-2022-2479 : Insufficient validation of untrusted input in File * CVE-2022-2480 : Use after free in Service Worker API * CVE-2022-2481: Use after free in Views * CVE-2022-2163: Use after free in Cast UI and Toolbar * Various fixes from internal audits, fuzzing and other initiatives The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2022-10073 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/32RZRSVM5BTCD25ZWPF7FIV6VKPYNU5E/ E-Mail link for openSUSE-SU-2022:10073-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1201679 SUSE Bug 1201679 https://www.suse.com/security/cve/CVE-2022-2163/ SUSE CVE CVE-2022-2163 page https://www.suse.com/security/cve/CVE-2022-2477/ SUSE CVE CVE-2022-2477 page https://www.suse.com/security/cve/CVE-2022-2478/ SUSE CVE CVE-2022-2478 page https://www.suse.com/security/cve/CVE-2022-2479/ SUSE CVE CVE-2022-2479 page https://www.suse.com/security/cve/CVE-2022-2480/ SUSE CVE CVE-2022-2480 page https://www.suse.com/security/cve/CVE-2022-2481/ SUSE CVE CVE-2022-2481 page SUSE Package Hub 15 SP3 SUSE Package Hub 15 SP4 openSUSE Leap 15.3 openSUSE Leap 15.4 chromedriver-103.0.5060.134-bp154.2.17.2 chromium-103.0.5060.134-bp154.2.17.2 chromedriver-103.0.5060.134-bp154.2.17.2 as a component of SUSE Package Hub 15 SP3 chromium-103.0.5060.134-bp154.2.17.2 as a component of SUSE Package Hub 15 SP3 chromedriver-103.0.5060.134-bp154.2.17.2 as a component of SUSE Package Hub 15 SP4 chromium-103.0.5060.134-bp154.2.17.2 as a component of SUSE Package Hub 15 SP4 chromedriver-103.0.5060.134-bp154.2.17.2 as a component of openSUSE Leap 15.3 chromium-103.0.5060.134-bp154.2.17.2 as a component of openSUSE Leap 15.3 chromedriver-103.0.5060.134-bp154.2.17.2 as a component of openSUSE Leap 15.4 chromium-103.0.5060.134-bp154.2.17.2 as a component of openSUSE Leap 15.4 Use after free in Cast UI and Toolbar in Google Chrome prior to 103.0.5060.134 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via UI interaction. CVE-2022-2163 SUSE Package Hub 15 SP3:chromedriver-103.0.5060.134-bp154.2.17.2 SUSE Package Hub 15 SP3:chromium-103.0.5060.134-bp154.2.17.2 SUSE Package Hub 15 SP4:chromedriver-103.0.5060.134-bp154.2.17.2 SUSE Package Hub 15 SP4:chromium-103.0.5060.134-bp154.2.17.2 openSUSE Leap 15.3:chromedriver-103.0.5060.134-bp154.2.17.2 openSUSE Leap 15.3:chromium-103.0.5060.134-bp154.2.17.2 openSUSE Leap 15.4:chromedriver-103.0.5060.134-bp154.2.17.2 openSUSE Leap 15.4:chromium-103.0.5060.134-bp154.2.17.2 important 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/32RZRSVM5BTCD25ZWPF7FIV6VKPYNU5E/ https://www.suse.com/security/cve/CVE-2022-2163.html CVE-2022-2163 https://bugzilla.suse.com/1200783 SUSE Bug 1200783 https://bugzilla.suse.com/1201679 SUSE Bug 1201679 Use after free in Guest View in Google Chrome prior to 103.0.5060.134 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. CVE-2022-2477 SUSE Package Hub 15 SP3:chromedriver-103.0.5060.134-bp154.2.17.2 SUSE Package Hub 15 SP3:chromium-103.0.5060.134-bp154.2.17.2 SUSE Package Hub 15 SP4:chromedriver-103.0.5060.134-bp154.2.17.2 SUSE Package Hub 15 SP4:chromium-103.0.5060.134-bp154.2.17.2 openSUSE Leap 15.3:chromedriver-103.0.5060.134-bp154.2.17.2 openSUSE Leap 15.3:chromium-103.0.5060.134-bp154.2.17.2 openSUSE Leap 15.4:chromedriver-103.0.5060.134-bp154.2.17.2 openSUSE Leap 15.4:chromium-103.0.5060.134-bp154.2.17.2 important 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/32RZRSVM5BTCD25ZWPF7FIV6VKPYNU5E/ https://www.suse.com/security/cve/CVE-2022-2477.html CVE-2022-2477 https://bugzilla.suse.com/1201679 SUSE Bug 1201679 Use after free in PDF in Google Chrome prior to 103.0.5060.134 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2022-2478 SUSE Package Hub 15 SP3:chromedriver-103.0.5060.134-bp154.2.17.2 SUSE Package Hub 15 SP3:chromium-103.0.5060.134-bp154.2.17.2 SUSE Package Hub 15 SP4:chromedriver-103.0.5060.134-bp154.2.17.2 SUSE Package Hub 15 SP4:chromium-103.0.5060.134-bp154.2.17.2 openSUSE Leap 15.3:chromedriver-103.0.5060.134-bp154.2.17.2 openSUSE Leap 15.3:chromium-103.0.5060.134-bp154.2.17.2 openSUSE Leap 15.4:chromedriver-103.0.5060.134-bp154.2.17.2 openSUSE Leap 15.4:chromium-103.0.5060.134-bp154.2.17.2 important 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/32RZRSVM5BTCD25ZWPF7FIV6VKPYNU5E/ https://www.suse.com/security/cve/CVE-2022-2478.html CVE-2022-2478 https://bugzilla.suse.com/1201679 SUSE Bug 1201679 Insufficient validation of untrusted input in File in Google Chrome on Android prior to 103.0.5060.134 allowed an attacker who convinced a user to install a malicious app to obtain potentially sensitive information from internal file directories via a crafted HTML page. CVE-2022-2479 SUSE Package Hub 15 SP3:chromedriver-103.0.5060.134-bp154.2.17.2 SUSE Package Hub 15 SP3:chromium-103.0.5060.134-bp154.2.17.2 SUSE Package Hub 15 SP4:chromedriver-103.0.5060.134-bp154.2.17.2 SUSE Package Hub 15 SP4:chromium-103.0.5060.134-bp154.2.17.2 openSUSE Leap 15.3:chromedriver-103.0.5060.134-bp154.2.17.2 openSUSE Leap 15.3:chromium-103.0.5060.134-bp154.2.17.2 openSUSE Leap 15.4:chromedriver-103.0.5060.134-bp154.2.17.2 openSUSE Leap 15.4:chromium-103.0.5060.134-bp154.2.17.2 important 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/32RZRSVM5BTCD25ZWPF7FIV6VKPYNU5E/ https://www.suse.com/security/cve/CVE-2022-2479.html CVE-2022-2479 https://bugzilla.suse.com/1201679 SUSE Bug 1201679 Use after free in Service Worker API in Google Chrome prior to 103.0.5060.134 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2022-2480 SUSE Package Hub 15 SP3:chromedriver-103.0.5060.134-bp154.2.17.2 SUSE Package Hub 15 SP3:chromium-103.0.5060.134-bp154.2.17.2 SUSE Package Hub 15 SP4:chromedriver-103.0.5060.134-bp154.2.17.2 SUSE Package Hub 15 SP4:chromium-103.0.5060.134-bp154.2.17.2 openSUSE Leap 15.3:chromedriver-103.0.5060.134-bp154.2.17.2 openSUSE Leap 15.3:chromium-103.0.5060.134-bp154.2.17.2 openSUSE Leap 15.4:chromedriver-103.0.5060.134-bp154.2.17.2 openSUSE Leap 15.4:chromium-103.0.5060.134-bp154.2.17.2 important 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/32RZRSVM5BTCD25ZWPF7FIV6VKPYNU5E/ https://www.suse.com/security/cve/CVE-2022-2480.html CVE-2022-2480 https://bugzilla.suse.com/1201679 SUSE Bug 1201679 Use after free in Views in Google Chrome prior to 103.0.5060.134 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via UI interaction. CVE-2022-2481 SUSE Package Hub 15 SP3:chromedriver-103.0.5060.134-bp154.2.17.2 SUSE Package Hub 15 SP3:chromium-103.0.5060.134-bp154.2.17.2 SUSE Package Hub 15 SP4:chromedriver-103.0.5060.134-bp154.2.17.2 SUSE Package Hub 15 SP4:chromium-103.0.5060.134-bp154.2.17.2 openSUSE Leap 15.3:chromedriver-103.0.5060.134-bp154.2.17.2 openSUSE Leap 15.3:chromium-103.0.5060.134-bp154.2.17.2 openSUSE Leap 15.4:chromedriver-103.0.5060.134-bp154.2.17.2 openSUSE Leap 15.4:chromium-103.0.5060.134-bp154.2.17.2 important 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/32RZRSVM5BTCD25ZWPF7FIV6VKPYNU5E/ https://www.suse.com/security/cve/CVE-2022-2481.html CVE-2022-2481 https://bugzilla.suse.com/1201679 SUSE Bug 1201679