Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 868156 (CVE-2022-3075) - <www-client/chromium-105.0.5195.102 <www-client/chromium-bin-105.0.5195.125 <www-client/google-chrome-105.0.5195.102: Insufficient data validation in Mojo
Summary: <www-client/chromium-105.0.5195.102 <www-client/chromium-bin-105.0.5195.125 <...
Status: RESOLVED FIXED
Alias: CVE-2022-3075
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL:
Whiteboard: A2 [glsa+]
Keywords:
Depends on: 868351
Blocks: CVE-2022-3038, CVE-2022-3039, CVE-2022-3040, CVE-2022-3041, CVE-2022-3042, CVE-2022-3043, CVE-2022-3044, CVE-2022-3045, CVE-2022-3046, CVE-2022-3047, CVE-2022-3048, CVE-2022-3049, CVE-2022-3050, CVE-2022-3051, CVE-2022-3052, CVE-2022-3053, CVE-2022-3054, CVE-2022-3055, CVE-2022-3056, CVE-2022-3057, CVE-2022-3058, CVE-2022-3071
  Show dependency tree
 
Reported: 2022-09-03 04:45 UTC by Sam James
Modified: 2022-09-29 14:53 UTC (History)
4 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Comment 1 Larry the Git Cow gentoo-dev 2022-09-04 04:48:14 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c8563a2c9ff1a1e1c4c4f85b72e5e7609a4d5146

commit c8563a2c9ff1a1e1c4c4f85b72e5e7609a4d5146
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2022-09-04 04:46:43 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2022-09-04 04:47:19 +0000

    www-client/chromium: add 105.0.5195.102
    
    Bug: https://bugs.gentoo.org/868156
    Signed-off-by: Sam James <sam@gentoo.org>

 www-client/chromium/Manifest                       |    1 +
 www-client/chromium/chromium-105.0.5195.102.ebuild | 1186 ++++++++++++++++++++
 2 files changed, 1187 insertions(+)
Comment 2 Tim Mohlmann 2022-09-18 11:11:25 UTC 
Is it possible to get a version bump for chromium-bin as well?
Comment 3 diamond 2022-09-19 02:36:54 UTC 
www-client/chromium-105.0.5195.102 is already outdated. See
https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_14.html
The latest security patched stable version is 105.0.5195.125/126/127.
Comment 4 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2022-09-19 02:37:43 UTC 
(In reply to diamond from comment #3)
> www-client/chromium-105.0.5195.102 is already outdated. See
> https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-
> desktop_14.html
> The latest security patched stable version is 105.0.5195.125/126/127.

Then that merits a new bug.
Comment 5 Larry the Git Cow gentoo-dev 2022-09-22 18:14:39 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=cce91c353d53069602554b66b5345199a8d00e61

commit cce91c353d53069602554b66b5345199a8d00e61
Author:     Stephan Hartmann <sultan@gentoo.org>
AuthorDate: 2022-09-22 18:14:05 +0000
Commit:     Stephan Hartmann <sultan@gentoo.org>
CommitDate: 2022-09-22 18:14:23 +0000

    www-client/chromium: drop 105.0.5195.52
    
    Bug: https://bugs.gentoo.org/868156
    Signed-off-by: Stephan Hartmann <sultan@gentoo.org>

 www-client/chromium/Manifest                      |    1 -
 www-client/chromium/chromium-105.0.5195.52.ebuild | 1186 ---------------------
 2 files changed, 1187 deletions(-)
Comment 6 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-09-26 13:48:34 UTC 
GLSA request filed
Comment 7 Larry the Git Cow gentoo-dev 2022-09-29 14:48:20 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=31ae708a90dd2ca9e628226aec8c4362dffb1794

commit 31ae708a90dd2ca9e628226aec8c4362dffb1794
Author:     GLSAMaker <glsamaker@gentoo.org>
AuthorDate: 2022-09-29 14:24:25 +0000
Commit:     John Helmert III <ajak@gentoo.org>
CommitDate: 2022-09-29 14:48:01 +0000

    [ GLSA 202209-23 ] Chromium, Google Chrome, Microsoft Edge: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/868156
    Bug: https://bugs.gentoo.org/868354
    Bug: https://bugs.gentoo.org/870142
    Bug: https://bugs.gentoo.org/872407
    Signed-off-by: GLSAMaker <glsamaker@gentoo.org>
    Signed-off-by: John Helmert III <ajak@gentoo.org>

 glsa-202209-23.xml | 112 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 112 insertions(+)
Comment 8 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-09-29 14:53:39 UTC 
GLSA released, all done!