Security update for chromium SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2022:10119-1 Final 1 1 2022-09-12T14:03:27Z current 2022-09-12T14:03:27Z 2022-09-12T14:03:27Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for chromium This update for chromium fixes the following issues: Chromium 105.0.5195.102 (boo#1203102): * CVE-2022-3075: Insufficient data validation in Mojo Chromium 105.0.5195.52 (boo#1202964): * CVE-2022-3038: Use after free in Network Service * CVE-2022-3039: Use after free in WebSQL * CVE-2022-3040: Use after free in Layout * CVE-2022-3041: Use after free in WebSQL * CVE-2022-3042: Use after free in PhoneHub * CVE-2022-3043: Heap buffer overflow in Screen Capture * CVE-2022-3044: Inappropriate implementation in Site Isolation * CVE-2022-3045: Insufficient validation of untrusted input in V8 * CVE-2022-3046: Use after free in Browser Tag * CVE-2022-3071: Use after free in Tab Strip * CVE-2022-3047: Insufficient policy enforcement in Extensions API * CVE-2022-3048: Inappropriate implementation in Chrome OS lockscreen * CVE-2022-3049: Use after free in SplitScreen * CVE-2022-3050: Heap buffer overflow in WebUI * CVE-2022-3051: Heap buffer overflow in Exosphere * CVE-2022-3052: Heap buffer overflow in Window Manager * CVE-2022-3053: Inappropriate implementation in Pointer Lock * CVE-2022-3054: Insufficient policy enforcement in DevTools * CVE-2022-3055: Use after free in Passwords * CVE-2022-3056: Insufficient policy enforcement in Content Security Policy * CVE-2022-3057: Inappropriate implementation in iframe Sandbox * CVE-2022-3058: Use after free in Sign-In Flow - Update chromium-symbolic.svg: this fixes boo#1202403. - Fix quoting in chrome-wrapper, don't put cwd on LD_LIBRARY_PATH The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2022-10119 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GAVZ7A2NRXHLI7C5TFF7GQHYKEGQIQRR/ E-Mail link for openSUSE-SU-2022:10119-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1202403 SUSE Bug 1202403 https://bugzilla.suse.com/1202964 SUSE Bug 1202964 https://bugzilla.suse.com/1203102 SUSE Bug 1203102 https://www.suse.com/security/cve/CVE-2022-3038/ SUSE CVE CVE-2022-3038 page https://www.suse.com/security/cve/CVE-2022-3039/ SUSE CVE CVE-2022-3039 page https://www.suse.com/security/cve/CVE-2022-3040/ SUSE CVE CVE-2022-3040 page https://www.suse.com/security/cve/CVE-2022-3041/ SUSE CVE CVE-2022-3041 page https://www.suse.com/security/cve/CVE-2022-3042/ SUSE CVE CVE-2022-3042 page https://www.suse.com/security/cve/CVE-2022-3043/ SUSE CVE CVE-2022-3043 page https://www.suse.com/security/cve/CVE-2022-3044/ SUSE CVE CVE-2022-3044 page https://www.suse.com/security/cve/CVE-2022-3045/ SUSE CVE CVE-2022-3045 page https://www.suse.com/security/cve/CVE-2022-3046/ SUSE CVE CVE-2022-3046 page https://www.suse.com/security/cve/CVE-2022-3047/ SUSE CVE CVE-2022-3047 page https://www.suse.com/security/cve/CVE-2022-3048/ SUSE CVE CVE-2022-3048 page https://www.suse.com/security/cve/CVE-2022-3049/ SUSE CVE CVE-2022-3049 page https://www.suse.com/security/cve/CVE-2022-3050/ SUSE CVE CVE-2022-3050 page https://www.suse.com/security/cve/CVE-2022-3051/ SUSE CVE CVE-2022-3051 page https://www.suse.com/security/cve/CVE-2022-3052/ SUSE CVE CVE-2022-3052 page https://www.suse.com/security/cve/CVE-2022-3053/ SUSE CVE CVE-2022-3053 page https://www.suse.com/security/cve/CVE-2022-3054/ SUSE CVE CVE-2022-3054 page https://www.suse.com/security/cve/CVE-2022-3055/ SUSE CVE CVE-2022-3055 page https://www.suse.com/security/cve/CVE-2022-3056/ SUSE CVE CVE-2022-3056 page https://www.suse.com/security/cve/CVE-2022-3057/ SUSE CVE CVE-2022-3057 page https://www.suse.com/security/cve/CVE-2022-3058/ SUSE CVE CVE-2022-3058 page https://www.suse.com/security/cve/CVE-2022-3071/ SUSE CVE CVE-2022-3071 page https://www.suse.com/security/cve/CVE-2022-3075/ SUSE CVE CVE-2022-3075 page SUSE Package Hub 15 SP4 openSUSE Leap 15.4 chromedriver-105.0.5195.102-bp154.2.26.1 chromium-105.0.5195.102-bp154.2.26.1 chromedriver-105.0.5195.102-bp154.2.26.1 as a component of SUSE Package Hub 15 SP4 chromium-105.0.5195.102-bp154.2.26.1 as a component of SUSE Package Hub 15 SP4 chromedriver-105.0.5195.102-bp154.2.26.1 as a component of openSUSE Leap 15.4 chromium-105.0.5195.102-bp154.2.26.1 as a component of openSUSE Leap 15.4 Use after free in Network Service in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2022-3038 SUSE Package Hub 15 SP4:chromedriver-105.0.5195.102-bp154.2.26.1 SUSE Package Hub 15 SP4:chromium-105.0.5195.102-bp154.2.26.1 openSUSE Leap 15.4:chromedriver-105.0.5195.102-bp154.2.26.1 openSUSE Leap 15.4:chromium-105.0.5195.102-bp154.2.26.1 important 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GAVZ7A2NRXHLI7C5TFF7GQHYKEGQIQRR/ https://www.suse.com/security/cve/CVE-2022-3038.html CVE-2022-3038 https://bugzilla.suse.com/1202964 SUSE Bug 1202964 Use after free in WebSQL in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2022-3039 SUSE Package Hub 15 SP4:chromedriver-105.0.5195.102-bp154.2.26.1 SUSE Package Hub 15 SP4:chromium-105.0.5195.102-bp154.2.26.1 openSUSE Leap 15.4:chromedriver-105.0.5195.102-bp154.2.26.1 openSUSE Leap 15.4:chromium-105.0.5195.102-bp154.2.26.1 important 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GAVZ7A2NRXHLI7C5TFF7GQHYKEGQIQRR/ https://www.suse.com/security/cve/CVE-2022-3039.html CVE-2022-3039 https://bugzilla.suse.com/1202964 SUSE Bug 1202964 Use after free in Layout in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2022-3040 SUSE Package Hub 15 SP4:chromedriver-105.0.5195.102-bp154.2.26.1 SUSE Package Hub 15 SP4:chromium-105.0.5195.102-bp154.2.26.1 openSUSE Leap 15.4:chromedriver-105.0.5195.102-bp154.2.26.1 openSUSE Leap 15.4:chromium-105.0.5195.102-bp154.2.26.1 important 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GAVZ7A2NRXHLI7C5TFF7GQHYKEGQIQRR/ https://www.suse.com/security/cve/CVE-2022-3040.html CVE-2022-3040 https://bugzilla.suse.com/1202964 SUSE Bug 1202964 Use after free in WebSQL in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2022-3041 SUSE Package Hub 15 SP4:chromedriver-105.0.5195.102-bp154.2.26.1 SUSE Package Hub 15 SP4:chromium-105.0.5195.102-bp154.2.26.1 openSUSE Leap 15.4:chromedriver-105.0.5195.102-bp154.2.26.1 openSUSE Leap 15.4:chromium-105.0.5195.102-bp154.2.26.1 important 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GAVZ7A2NRXHLI7C5TFF7GQHYKEGQIQRR/ https://www.suse.com/security/cve/CVE-2022-3041.html CVE-2022-3041 https://bugzilla.suse.com/1202964 SUSE Bug 1202964 Use after free in PhoneHub in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2022-3042 SUSE Package Hub 15 SP4:chromedriver-105.0.5195.102-bp154.2.26.1 SUSE Package Hub 15 SP4:chromium-105.0.5195.102-bp154.2.26.1 openSUSE Leap 15.4:chromedriver-105.0.5195.102-bp154.2.26.1 openSUSE Leap 15.4:chromium-105.0.5195.102-bp154.2.26.1 important 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GAVZ7A2NRXHLI7C5TFF7GQHYKEGQIQRR/ https://www.suse.com/security/cve/CVE-2022-3042.html CVE-2022-3042 https://bugzilla.suse.com/1202964 SUSE Bug 1202964 Heap buffer overflow in Screen Capture in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. CVE-2022-3043 SUSE Package Hub 15 SP4:chromedriver-105.0.5195.102-bp154.2.26.1 SUSE Package Hub 15 SP4:chromium-105.0.5195.102-bp154.2.26.1 openSUSE Leap 15.4:chromedriver-105.0.5195.102-bp154.2.26.1 openSUSE Leap 15.4:chromium-105.0.5195.102-bp154.2.26.1 important 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GAVZ7A2NRXHLI7C5TFF7GQHYKEGQIQRR/ https://www.suse.com/security/cve/CVE-2022-3043.html CVE-2022-3043 https://bugzilla.suse.com/1202964 SUSE Bug 1202964 Inappropriate implementation in Site Isolation in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. CVE-2022-3044 SUSE Package Hub 15 SP4:chromedriver-105.0.5195.102-bp154.2.26.1 SUSE Package Hub 15 SP4:chromium-105.0.5195.102-bp154.2.26.1 openSUSE Leap 15.4:chromedriver-105.0.5195.102-bp154.2.26.1 openSUSE Leap 15.4:chromium-105.0.5195.102-bp154.2.26.1 important 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GAVZ7A2NRXHLI7C5TFF7GQHYKEGQIQRR/ https://www.suse.com/security/cve/CVE-2022-3044.html CVE-2022-3044 https://bugzilla.suse.com/1202964 SUSE Bug 1202964 Insufficient validation of untrusted input in V8 in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2022-3045 SUSE Package Hub 15 SP4:chromedriver-105.0.5195.102-bp154.2.26.1 SUSE Package Hub 15 SP4:chromium-105.0.5195.102-bp154.2.26.1 openSUSE Leap 15.4:chromedriver-105.0.5195.102-bp154.2.26.1 openSUSE Leap 15.4:chromium-105.0.5195.102-bp154.2.26.1 important 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GAVZ7A2NRXHLI7C5TFF7GQHYKEGQIQRR/ https://www.suse.com/security/cve/CVE-2022-3045.html CVE-2022-3045 https://bugzilla.suse.com/1202964 SUSE Bug 1202964 Use after free in Browser Tag in Google Chrome prior to 105.0.5195.52 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. CVE-2022-3046 SUSE Package Hub 15 SP4:chromedriver-105.0.5195.102-bp154.2.26.1 SUSE Package Hub 15 SP4:chromium-105.0.5195.102-bp154.2.26.1 openSUSE Leap 15.4:chromedriver-105.0.5195.102-bp154.2.26.1 openSUSE Leap 15.4:chromium-105.0.5195.102-bp154.2.26.1 important 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GAVZ7A2NRXHLI7C5TFF7GQHYKEGQIQRR/ https://www.suse.com/security/cve/CVE-2022-3046.html CVE-2022-3046 https://bugzilla.suse.com/1202964 SUSE Bug 1202964 Insufficient policy enforcement in Extensions API in Google Chrome prior to 105.0.5195.52 allowed an attacker who convinced a user to install a malicious extension to bypass downloads policy via a crafted HTML page. CVE-2022-3047 SUSE Package Hub 15 SP4:chromedriver-105.0.5195.102-bp154.2.26.1 SUSE Package Hub 15 SP4:chromium-105.0.5195.102-bp154.2.26.1 openSUSE Leap 15.4:chromedriver-105.0.5195.102-bp154.2.26.1 openSUSE Leap 15.4:chromium-105.0.5195.102-bp154.2.26.1 important 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GAVZ7A2NRXHLI7C5TFF7GQHYKEGQIQRR/ https://www.suse.com/security/cve/CVE-2022-3047.html CVE-2022-3047 https://bugzilla.suse.com/1202964 SUSE Bug 1202964 Inappropriate implementation in Chrome OS lockscreen in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a local attacker to bypass lockscreen navigation restrictions via physical access to the device. CVE-2022-3048 SUSE Package Hub 15 SP4:chromedriver-105.0.5195.102-bp154.2.26.1 SUSE Package Hub 15 SP4:chromium-105.0.5195.102-bp154.2.26.1 openSUSE Leap 15.4:chromedriver-105.0.5195.102-bp154.2.26.1 openSUSE Leap 15.4:chromium-105.0.5195.102-bp154.2.26.1 important 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GAVZ7A2NRXHLI7C5TFF7GQHYKEGQIQRR/ https://www.suse.com/security/cve/CVE-2022-3048.html CVE-2022-3048 https://bugzilla.suse.com/1202964 SUSE Bug 1202964 Use after free in SplitScreen in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. CVE-2022-3049 SUSE Package Hub 15 SP4:chromedriver-105.0.5195.102-bp154.2.26.1 SUSE Package Hub 15 SP4:chromium-105.0.5195.102-bp154.2.26.1 openSUSE Leap 15.4:chromedriver-105.0.5195.102-bp154.2.26.1 openSUSE Leap 15.4:chromium-105.0.5195.102-bp154.2.26.1 important 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GAVZ7A2NRXHLI7C5TFF7GQHYKEGQIQRR/ https://www.suse.com/security/cve/CVE-2022-3049.html CVE-2022-3049 https://bugzilla.suse.com/1202964 SUSE Bug 1202964 Heap buffer overflow in WebUI in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interactions. CVE-2022-3050 SUSE Package Hub 15 SP4:chromedriver-105.0.5195.102-bp154.2.26.1 SUSE Package Hub 15 SP4:chromium-105.0.5195.102-bp154.2.26.1 openSUSE Leap 15.4:chromedriver-105.0.5195.102-bp154.2.26.1 openSUSE Leap 15.4:chromium-105.0.5195.102-bp154.2.26.1 important 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GAVZ7A2NRXHLI7C5TFF7GQHYKEGQIQRR/ https://www.suse.com/security/cve/CVE-2022-3050.html CVE-2022-3050 https://bugzilla.suse.com/1202964 SUSE Bug 1202964 Heap buffer overflow in Exosphere in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interactions. CVE-2022-3051 SUSE Package Hub 15 SP4:chromedriver-105.0.5195.102-bp154.2.26.1 SUSE Package Hub 15 SP4:chromium-105.0.5195.102-bp154.2.26.1 openSUSE Leap 15.4:chromedriver-105.0.5195.102-bp154.2.26.1 openSUSE Leap 15.4:chromium-105.0.5195.102-bp154.2.26.1 important 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GAVZ7A2NRXHLI7C5TFF7GQHYKEGQIQRR/ https://www.suse.com/security/cve/CVE-2022-3051.html CVE-2022-3051 https://bugzilla.suse.com/1202964 SUSE Bug 1202964 Heap buffer overflow in Window Manager in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interactions. CVE-2022-3052 SUSE Package Hub 15 SP4:chromedriver-105.0.5195.102-bp154.2.26.1 SUSE Package Hub 15 SP4:chromium-105.0.5195.102-bp154.2.26.1 openSUSE Leap 15.4:chromedriver-105.0.5195.102-bp154.2.26.1 openSUSE Leap 15.4:chromium-105.0.5195.102-bp154.2.26.1 important 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GAVZ7A2NRXHLI7C5TFF7GQHYKEGQIQRR/ https://www.suse.com/security/cve/CVE-2022-3052.html CVE-2022-3052 https://bugzilla.suse.com/1202964 SUSE Bug 1202964 Inappropriate implementation in Pointer Lock in Google Chrome on Mac prior to 105.0.5195.52 allowed a remote attacker to restrict user navigation via a crafted HTML page. CVE-2022-3053 SUSE Package Hub 15 SP4:chromedriver-105.0.5195.102-bp154.2.26.1 SUSE Package Hub 15 SP4:chromium-105.0.5195.102-bp154.2.26.1 openSUSE Leap 15.4:chromedriver-105.0.5195.102-bp154.2.26.1 openSUSE Leap 15.4:chromium-105.0.5195.102-bp154.2.26.1 important 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GAVZ7A2NRXHLI7C5TFF7GQHYKEGQIQRR/ https://www.suse.com/security/cve/CVE-2022-3053.html CVE-2022-3053 https://bugzilla.suse.com/1202964 SUSE Bug 1202964 Insufficient policy enforcement in DevTools in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2022-3054 SUSE Package Hub 15 SP4:chromedriver-105.0.5195.102-bp154.2.26.1 SUSE Package Hub 15 SP4:chromium-105.0.5195.102-bp154.2.26.1 openSUSE Leap 15.4:chromedriver-105.0.5195.102-bp154.2.26.1 openSUSE Leap 15.4:chromium-105.0.5195.102-bp154.2.26.1 important 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GAVZ7A2NRXHLI7C5TFF7GQHYKEGQIQRR/ https://www.suse.com/security/cve/CVE-2022-3054.html CVE-2022-3054 https://bugzilla.suse.com/1202964 SUSE Bug 1202964 Use after free in Passwords in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. CVE-2022-3055 SUSE Package Hub 15 SP4:chromedriver-105.0.5195.102-bp154.2.26.1 SUSE Package Hub 15 SP4:chromium-105.0.5195.102-bp154.2.26.1 openSUSE Leap 15.4:chromedriver-105.0.5195.102-bp154.2.26.1 openSUSE Leap 15.4:chromium-105.0.5195.102-bp154.2.26.1 important 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GAVZ7A2NRXHLI7C5TFF7GQHYKEGQIQRR/ https://www.suse.com/security/cve/CVE-2022-3055.html CVE-2022-3055 https://bugzilla.suse.com/1202964 SUSE Bug 1202964 Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to bypass content security policy via a crafted HTML page. CVE-2022-3056 SUSE Package Hub 15 SP4:chromedriver-105.0.5195.102-bp154.2.26.1 SUSE Package Hub 15 SP4:chromium-105.0.5195.102-bp154.2.26.1 openSUSE Leap 15.4:chromedriver-105.0.5195.102-bp154.2.26.1 openSUSE Leap 15.4:chromium-105.0.5195.102-bp154.2.26.1 important 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GAVZ7A2NRXHLI7C5TFF7GQHYKEGQIQRR/ https://www.suse.com/security/cve/CVE-2022-3056.html CVE-2022-3056 https://bugzilla.suse.com/1202964 SUSE Bug 1202964 Inappropriate implementation in iframe Sandbox in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to leak cross-origin data via a crafted HTML page. CVE-2022-3057 SUSE Package Hub 15 SP4:chromedriver-105.0.5195.102-bp154.2.26.1 SUSE Package Hub 15 SP4:chromium-105.0.5195.102-bp154.2.26.1 openSUSE Leap 15.4:chromedriver-105.0.5195.102-bp154.2.26.1 openSUSE Leap 15.4:chromium-105.0.5195.102-bp154.2.26.1 important 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GAVZ7A2NRXHLI7C5TFF7GQHYKEGQIQRR/ https://www.suse.com/security/cve/CVE-2022-3057.html CVE-2022-3057 https://bugzilla.suse.com/1202964 SUSE Bug 1202964 Use after free in Sign-In Flow in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interaction. CVE-2022-3058 SUSE Package Hub 15 SP4:chromedriver-105.0.5195.102-bp154.2.26.1 SUSE Package Hub 15 SP4:chromium-105.0.5195.102-bp154.2.26.1 openSUSE Leap 15.4:chromedriver-105.0.5195.102-bp154.2.26.1 openSUSE Leap 15.4:chromium-105.0.5195.102-bp154.2.26.1 important 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GAVZ7A2NRXHLI7C5TFF7GQHYKEGQIQRR/ https://www.suse.com/security/cve/CVE-2022-3058.html CVE-2022-3058 https://bugzilla.suse.com/1202964 SUSE Bug 1202964 Use after free in Tab Strip in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interaction. CVE-2022-3071 SUSE Package Hub 15 SP4:chromedriver-105.0.5195.102-bp154.2.26.1 SUSE Package Hub 15 SP4:chromium-105.0.5195.102-bp154.2.26.1 openSUSE Leap 15.4:chromedriver-105.0.5195.102-bp154.2.26.1 openSUSE Leap 15.4:chromium-105.0.5195.102-bp154.2.26.1 low 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GAVZ7A2NRXHLI7C5TFF7GQHYKEGQIQRR/ https://www.suse.com/security/cve/CVE-2022-3071.html CVE-2022-3071 Insufficient data validation in Mojo in Google Chrome prior to 105.0.5195.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. CVE-2022-3075 SUSE Package Hub 15 SP4:chromedriver-105.0.5195.102-bp154.2.26.1 SUSE Package Hub 15 SP4:chromium-105.0.5195.102-bp154.2.26.1 openSUSE Leap 15.4:chromedriver-105.0.5195.102-bp154.2.26.1 openSUSE Leap 15.4:chromium-105.0.5195.102-bp154.2.26.1 critical 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GAVZ7A2NRXHLI7C5TFF7GQHYKEGQIQRR/ https://www.suse.com/security/cve/CVE-2022-3075.html CVE-2022-3075 https://bugzilla.suse.com/1203102 SUSE Bug 1203102