Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 951155 (CVE-2025-1920, CVE-2025-2135, CVE-2025-2136, CVE-2025-2137) - <www-client/chromium-134.0.6998.88, <www-client/google-chrome-134.0.6998.88, www-client/microsoft-edge, www-client/opera: Multiple vulnerabilities
Summary: <www-client/chromium-134.0.6998.88, <www-client/google-chrome-134.0.6998.88, ...
Status: UNCONFIRMED
Alias: CVE-2025-1920, CVE-2025-2135, CVE-2025-2136, CVE-2025-2137
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal
Assignee: Gentoo Security
URL: https://chromereleases.googleblog.com...
Whiteboard: A2 [glsa? cleanup]
Keywords:
Depends on: 951156 951689
Blocks:
  Show dependency tree
 
Reported: 2025-03-11 09:49 UTC by akane
Modified: 2025-03-25 03:39 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description akane 2025-03-11 09:49:19 UTC 
Chrome 134.0.6998.88 has been released and includes the following security fixes:

[$7000][398065918] High CVE-2025-1920: Type Confusion in V8. 
Reported by Excello s.r.o. on 2025-02-21

[TBD][400052777] High CVE-2025-2135: Type Confusion in V8. 
Reported by Zhenghang Xiao (@Kipreyyy) on 2025-03-02

[NA][401059730] High CVE-TBD: Out of bounds write in GPU. 
Reported on 2025-03-05

[$3000][395032416] Medium CVE-2025-2136: Use after free in Inspector. 
Reported by Sakana.S on 2025-02-10

[$2000][398999390] Medium CVE-2025-2137: Out of bounds read in V8. 
Reported by zeroxiaobai@ on 2025-02-25
Comment 1 Larry the Git Cow gentoo-dev 2025-03-11 12:49:24 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f08febbd1ba522226bf6dc47551e5a7987ab97f8

commit f08febbd1ba522226bf6dc47551e5a7987ab97f8
Author:     FoldCat <akane@maidagency.org>
AuthorDate: 2025-03-11 05:52:47 +0000
Commit:     Matt Jolly <kangie@gentoo.org>
CommitDate: 2025-03-11 12:48:39 +0000

    www-client/chromium: add 134.0.6998.88
    
    Signed-off-by: FoldCat <akane@maidagency.org>
    Closes: https://github.com/gentoo/gentoo/pull/41009
    Bug: https://bugs.gentoo.org/951155
    Signed-off-by: Matt Jolly <kangie@gentoo.org>

 www-client/chromium/Manifest                      |    2 +
 www-client/chromium/chromium-134.0.6998.88.ebuild | 1535 +++++++++++++++++++++
 2 files changed, 1537 insertions(+)
Comment 2 Larry the Git Cow gentoo-dev 2025-03-11 13:06:50 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=742314b966e4b5e6f7294a70ee89ff33b1ca5243

commit 742314b966e4b5e6f7294a70ee89ff33b1ca5243
Author:     Matt Jolly <kangie@gentoo.org>
AuthorDate: 2025-03-11 12:51:50 +0000
Commit:     Matt Jolly <kangie@gentoo.org>
CommitDate: 2025-03-11 13:06:40 +0000

    www-client/google-chrome: automated update (134.0.6998.88)
    
    Bug: https://bugs.gentoo.org/951155
    Signed-off-by: Matt Jolly <kangie@gentoo.org>

 www-client/google-chrome/Manifest                                       | 2 +-
 ...hrome-134.0.6998.35-r1.ebuild => google-chrome-134.0.6998.88.ebuild} | 0
 2 files changed, 1 insertion(+), 1 deletion(-)
Comment 3 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2025-03-25 03:39:07 UTC 
That TBD CVE ended up being CVE-2025-24201 (bug 951739) which is only for macOS.