Security update for chromium SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2022:10099-1 Final 1 1 2022-08-25T07:19:44Z current 2022-08-25T07:19:44Z 2022-08-25T07:19:44Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for chromium This update for chromium fixes the following issues: Chromium 104.0.5112.101 (boo#1202509): * CVE-2022-2852: Use after free in FedCM * CVE-2022-2854: Use after free in SwiftShader * CVE-2022-2855: Use after free in ANGLE * CVE-2022-2857: Use after free in Blink * CVE-2022-2858: Use after free in Sign-In Flow * CVE-2022-2853: Heap buffer overflow in Downloads * CVE-2022-2856: Insufficient validation of untrusted input in Intents * CVE-2022-2859: Use after free in Chrome OS Shell * CVE-2022-2860: Insufficient policy enforcement in Cookies * CVE-2022-2861: Inappropriate implementation in Extensions API - Re-enable our version of chrome-wrapper - Set no sandbox if root is being used (https://crbug.com/638180) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2022-10099 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KPLXDXLKSIMQN4L3UUXMVBTXFIP5Y7BC/ E-Mail link for openSUSE-SU-2022:10099-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1202509 SUSE Bug 1202509 https://www.suse.com/security/cve/CVE-2022-2852/ SUSE CVE CVE-2022-2852 page https://www.suse.com/security/cve/CVE-2022-2853/ SUSE CVE CVE-2022-2853 page https://www.suse.com/security/cve/CVE-2022-2854/ SUSE CVE CVE-2022-2854 page https://www.suse.com/security/cve/CVE-2022-2855/ SUSE CVE CVE-2022-2855 page https://www.suse.com/security/cve/CVE-2022-2856/ SUSE CVE CVE-2022-2856 page https://www.suse.com/security/cve/CVE-2022-2857/ SUSE CVE CVE-2022-2857 page https://www.suse.com/security/cve/CVE-2022-2858/ SUSE CVE CVE-2022-2858 page https://www.suse.com/security/cve/CVE-2022-2859/ SUSE CVE CVE-2022-2859 page https://www.suse.com/security/cve/CVE-2022-2860/ SUSE CVE CVE-2022-2860 page https://www.suse.com/security/cve/CVE-2022-2861/ SUSE CVE CVE-2022-2861 page SUSE Package Hub 15 SP3 SUSE Package Hub 15 SP4 openSUSE Leap 15.3 openSUSE Leap 15.4 chromedriver-104.0.5112.101-bp154.2.23.1 chromium-104.0.5112.101-bp154.2.23.1 chromedriver-104.0.5112.101-bp154.2.23.1 as a component of SUSE Package Hub 15 SP3 chromium-104.0.5112.101-bp154.2.23.1 as a component of SUSE Package Hub 15 SP3 chromedriver-104.0.5112.101-bp154.2.23.1 as a component of SUSE Package Hub 15 SP4 chromium-104.0.5112.101-bp154.2.23.1 as a component of SUSE Package Hub 15 SP4 chromedriver-104.0.5112.101-bp154.2.23.1 as a component of openSUSE Leap 15.3 chromium-104.0.5112.101-bp154.2.23.1 as a component of openSUSE Leap 15.3 chromedriver-104.0.5112.101-bp154.2.23.1 as a component of openSUSE Leap 15.4 chromium-104.0.5112.101-bp154.2.23.1 as a component of openSUSE Leap 15.4 Use after free in FedCM in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2022-2852 SUSE Package Hub 15 SP3:chromedriver-104.0.5112.101-bp154.2.23.1 SUSE Package Hub 15 SP3:chromium-104.0.5112.101-bp154.2.23.1 SUSE Package Hub 15 SP4:chromedriver-104.0.5112.101-bp154.2.23.1 SUSE Package Hub 15 SP4:chromium-104.0.5112.101-bp154.2.23.1 openSUSE Leap 15.3:chromedriver-104.0.5112.101-bp154.2.23.1 openSUSE Leap 15.3:chromium-104.0.5112.101-bp154.2.23.1 openSUSE Leap 15.4:chromedriver-104.0.5112.101-bp154.2.23.1 openSUSE Leap 15.4:chromium-104.0.5112.101-bp154.2.23.1 important 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KPLXDXLKSIMQN4L3UUXMVBTXFIP5Y7BC/ https://www.suse.com/security/cve/CVE-2022-2852.html CVE-2022-2852 https://bugzilla.suse.com/1202509 SUSE Bug 1202509 Heap buffer overflow in Downloads in Google Chrome on Android prior to 104.0.5112.101 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. CVE-2022-2853 SUSE Package Hub 15 SP3:chromedriver-104.0.5112.101-bp154.2.23.1 SUSE Package Hub 15 SP3:chromium-104.0.5112.101-bp154.2.23.1 SUSE Package Hub 15 SP4:chromedriver-104.0.5112.101-bp154.2.23.1 SUSE Package Hub 15 SP4:chromium-104.0.5112.101-bp154.2.23.1 openSUSE Leap 15.3:chromedriver-104.0.5112.101-bp154.2.23.1 openSUSE Leap 15.3:chromium-104.0.5112.101-bp154.2.23.1 openSUSE Leap 15.4:chromedriver-104.0.5112.101-bp154.2.23.1 openSUSE Leap 15.4:chromium-104.0.5112.101-bp154.2.23.1 important 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KPLXDXLKSIMQN4L3UUXMVBTXFIP5Y7BC/ https://www.suse.com/security/cve/CVE-2022-2853.html CVE-2022-2853 https://bugzilla.suse.com/1202509 SUSE Bug 1202509 Use after free in SwiftShader in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2022-2854 SUSE Package Hub 15 SP3:chromedriver-104.0.5112.101-bp154.2.23.1 SUSE Package Hub 15 SP3:chromium-104.0.5112.101-bp154.2.23.1 SUSE Package Hub 15 SP4:chromedriver-104.0.5112.101-bp154.2.23.1 SUSE Package Hub 15 SP4:chromium-104.0.5112.101-bp154.2.23.1 openSUSE Leap 15.3:chromedriver-104.0.5112.101-bp154.2.23.1 openSUSE Leap 15.3:chromium-104.0.5112.101-bp154.2.23.1 openSUSE Leap 15.4:chromedriver-104.0.5112.101-bp154.2.23.1 openSUSE Leap 15.4:chromium-104.0.5112.101-bp154.2.23.1 important 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KPLXDXLKSIMQN4L3UUXMVBTXFIP5Y7BC/ https://www.suse.com/security/cve/CVE-2022-2854.html CVE-2022-2854 https://bugzilla.suse.com/1202509 SUSE Bug 1202509 Use after free in ANGLE in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2022-2855 SUSE Package Hub 15 SP3:chromedriver-104.0.5112.101-bp154.2.23.1 SUSE Package Hub 15 SP3:chromium-104.0.5112.101-bp154.2.23.1 SUSE Package Hub 15 SP4:chromedriver-104.0.5112.101-bp154.2.23.1 SUSE Package Hub 15 SP4:chromium-104.0.5112.101-bp154.2.23.1 openSUSE Leap 15.3:chromedriver-104.0.5112.101-bp154.2.23.1 openSUSE Leap 15.3:chromium-104.0.5112.101-bp154.2.23.1 openSUSE Leap 15.4:chromedriver-104.0.5112.101-bp154.2.23.1 openSUSE Leap 15.4:chromium-104.0.5112.101-bp154.2.23.1 important 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KPLXDXLKSIMQN4L3UUXMVBTXFIP5Y7BC/ https://www.suse.com/security/cve/CVE-2022-2855.html CVE-2022-2855 https://bugzilla.suse.com/1202509 SUSE Bug 1202509 Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 104.0.5112.101 allowed a remote attacker to arbitrarily browse to a malicious website via a crafted HTML page. CVE-2022-2856 SUSE Package Hub 15 SP3:chromedriver-104.0.5112.101-bp154.2.23.1 SUSE Package Hub 15 SP3:chromium-104.0.5112.101-bp154.2.23.1 SUSE Package Hub 15 SP4:chromedriver-104.0.5112.101-bp154.2.23.1 SUSE Package Hub 15 SP4:chromium-104.0.5112.101-bp154.2.23.1 openSUSE Leap 15.3:chromedriver-104.0.5112.101-bp154.2.23.1 openSUSE Leap 15.3:chromium-104.0.5112.101-bp154.2.23.1 openSUSE Leap 15.4:chromedriver-104.0.5112.101-bp154.2.23.1 openSUSE Leap 15.4:chromium-104.0.5112.101-bp154.2.23.1 important 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KPLXDXLKSIMQN4L3UUXMVBTXFIP5Y7BC/ https://www.suse.com/security/cve/CVE-2022-2856.html CVE-2022-2856 https://bugzilla.suse.com/1202509 SUSE Bug 1202509 Use after free in Blink in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2022-2857 SUSE Package Hub 15 SP3:chromedriver-104.0.5112.101-bp154.2.23.1 SUSE Package Hub 15 SP3:chromium-104.0.5112.101-bp154.2.23.1 SUSE Package Hub 15 SP4:chromedriver-104.0.5112.101-bp154.2.23.1 SUSE Package Hub 15 SP4:chromium-104.0.5112.101-bp154.2.23.1 openSUSE Leap 15.3:chromedriver-104.0.5112.101-bp154.2.23.1 openSUSE Leap 15.3:chromium-104.0.5112.101-bp154.2.23.1 openSUSE Leap 15.4:chromedriver-104.0.5112.101-bp154.2.23.1 openSUSE Leap 15.4:chromium-104.0.5112.101-bp154.2.23.1 important 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KPLXDXLKSIMQN4L3UUXMVBTXFIP5Y7BC/ https://www.suse.com/security/cve/CVE-2022-2857.html CVE-2022-2857 https://bugzilla.suse.com/1202509 SUSE Bug 1202509 Use after free in Sign-In Flow in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to potentially exploit heap corruption via specific UI interaction. CVE-2022-2858 SUSE Package Hub 15 SP3:chromedriver-104.0.5112.101-bp154.2.23.1 SUSE Package Hub 15 SP3:chromium-104.0.5112.101-bp154.2.23.1 SUSE Package Hub 15 SP4:chromedriver-104.0.5112.101-bp154.2.23.1 SUSE Package Hub 15 SP4:chromium-104.0.5112.101-bp154.2.23.1 openSUSE Leap 15.3:chromedriver-104.0.5112.101-bp154.2.23.1 openSUSE Leap 15.3:chromium-104.0.5112.101-bp154.2.23.1 openSUSE Leap 15.4:chromedriver-104.0.5112.101-bp154.2.23.1 openSUSE Leap 15.4:chromium-104.0.5112.101-bp154.2.23.1 important 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KPLXDXLKSIMQN4L3UUXMVBTXFIP5Y7BC/ https://www.suse.com/security/cve/CVE-2022-2858.html CVE-2022-2858 https://bugzilla.suse.com/1202509 SUSE Bug 1202509 Use after free in Chrome OS Shell in Google Chrome prior to 104.0.5112.101 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via specific UI interactions. CVE-2022-2859 SUSE Package Hub 15 SP3:chromedriver-104.0.5112.101-bp154.2.23.1 SUSE Package Hub 15 SP3:chromium-104.0.5112.101-bp154.2.23.1 SUSE Package Hub 15 SP4:chromedriver-104.0.5112.101-bp154.2.23.1 SUSE Package Hub 15 SP4:chromium-104.0.5112.101-bp154.2.23.1 openSUSE Leap 15.3:chromedriver-104.0.5112.101-bp154.2.23.1 openSUSE Leap 15.3:chromium-104.0.5112.101-bp154.2.23.1 openSUSE Leap 15.4:chromedriver-104.0.5112.101-bp154.2.23.1 openSUSE Leap 15.4:chromium-104.0.5112.101-bp154.2.23.1 important 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KPLXDXLKSIMQN4L3UUXMVBTXFIP5Y7BC/ https://www.suse.com/security/cve/CVE-2022-2859.html CVE-2022-2859 https://bugzilla.suse.com/1202509 SUSE Bug 1202509 Insufficient policy enforcement in Cookies in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to bypass cookie prefix restrictions via a crafted HTML page. CVE-2022-2860 SUSE Package Hub 15 SP3:chromedriver-104.0.5112.101-bp154.2.23.1 SUSE Package Hub 15 SP3:chromium-104.0.5112.101-bp154.2.23.1 SUSE Package Hub 15 SP4:chromedriver-104.0.5112.101-bp154.2.23.1 SUSE Package Hub 15 SP4:chromium-104.0.5112.101-bp154.2.23.1 openSUSE Leap 15.3:chromedriver-104.0.5112.101-bp154.2.23.1 openSUSE Leap 15.3:chromium-104.0.5112.101-bp154.2.23.1 openSUSE Leap 15.4:chromedriver-104.0.5112.101-bp154.2.23.1 openSUSE Leap 15.4:chromium-104.0.5112.101-bp154.2.23.1 important 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KPLXDXLKSIMQN4L3UUXMVBTXFIP5Y7BC/ https://www.suse.com/security/cve/CVE-2022-2860.html CVE-2022-2860 https://bugzilla.suse.com/1202509 SUSE Bug 1202509 Inappropriate implementation in Extensions API in Google Chrome prior to 104.0.5112.101 allowed an attacker who convinced a user to install a malicious extension to inject arbitrary scripts into WebUI via a crafted HTML page. CVE-2022-2861 SUSE Package Hub 15 SP3:chromedriver-104.0.5112.101-bp154.2.23.1 SUSE Package Hub 15 SP3:chromium-104.0.5112.101-bp154.2.23.1 SUSE Package Hub 15 SP4:chromedriver-104.0.5112.101-bp154.2.23.1 SUSE Package Hub 15 SP4:chromium-104.0.5112.101-bp154.2.23.1 openSUSE Leap 15.3:chromedriver-104.0.5112.101-bp154.2.23.1 openSUSE Leap 15.3:chromium-104.0.5112.101-bp154.2.23.1 openSUSE Leap 15.4:chromedriver-104.0.5112.101-bp154.2.23.1 openSUSE Leap 15.4:chromium-104.0.5112.101-bp154.2.23.1 important 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KPLXDXLKSIMQN4L3UUXMVBTXFIP5Y7BC/ https://www.suse.com/security/cve/CVE-2022-2861.html CVE-2022-2861 https://bugzilla.suse.com/1202509 SUSE Bug 1202509