Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 741312 (CVE-2020-15959, CVE-2020-6573, CVE-2020-6575, CVE-2020-6576)

Summary: <www-client/{chromium,google-chrome}-85.0.4183.102: Multiple vulnerabilities (CVE-2020-{6573,6575,6576,15959})
Product: Gentoo Security Reporter: Stephan Hartmann <sultan>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: RESOLVED FIXED    
Severity: major CC: chromium
Priority: Normal Flags: nattka: sanity-check+
Version: unspecified   
Hardware: All   
OS: Linux   
URL: https://chromereleases.googleblog.com/2020/09/stable-channel-update-for-desktop.html
Whiteboard: A2 [glsa+ cve]
Package list:
www-client/chromium-85.0.4183.102
Runtime testing required: ---

Description Stephan Hartmann gentoo-dev 2020-09-08 18:23:14 UTC
See ${URL}.

Tarball for chromium not available yet.

CVE-2020-6574 is for installer, that we don't use.
Comment 1 Larry the Git Cow gentoo-dev 2020-09-09 17:28:26 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=42507bb9f07946e3288ac8596aae3c25310907ed

commit 42507bb9f07946e3288ac8596aae3c25310907ed
Author:     Stephan Hartmann <sultan@gentoo.org>
AuthorDate: 2020-09-09 17:18:41 +0000
Commit:     Stephan Hartmann <sultan@gentoo.org>
CommitDate: 2020-09-09 17:27:47 +0000

    www-client/chromium: stable channel bump to 85.0.4183.102
    
    Bug: https://bugs.gentoo.org/741312
    Package-Manager: Portage-3.0.4, Repoman-3.0.1
    Signed-off-by: Stephan Hartmann <sultan@gentoo.org>

 www-client/chromium/Manifest                      |   1 +
 www-client/chromium/chromium-85.0.4183.102.ebuild | 867 ++++++++++++++++++++++
 www-client/chromium/metadata.xml                  |   2 +-
 3 files changed, 869 insertions(+), 1 deletion(-)
Comment 2 Sam James archtester gentoo-dev Security 2020-09-09 20:40:14 UTC
amd64 done
Comment 3 GLSAMaker/CVETool Bot gentoo-dev 2020-09-10 00:05:00 UTC
This issue was resolved and addressed in
 GLSA 202009-03 at https://security.gentoo.org/glsa/202009-03
by GLSA coordinator Thomas Deutschmann (whissi).
Comment 4 Thomas Deutschmann gentoo-dev Security 2020-09-10 00:05:28 UTC
Re-opening for remaining architecture(s).
Comment 5 Sam James archtester gentoo-dev Security 2020-09-10 00:45:44 UTC
arm64 stable. I'll cleanup.
Comment 6 Larry the Git Cow gentoo-dev 2020-09-10 02:57:03 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=16abd224ecd93f6561e969c7f662deeb45c93f84

commit 16abd224ecd93f6561e969c7f662deeb45c93f84
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2020-09-10 02:56:59 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2020-09-10 02:56:59 +0000

    www-client/chromium: security cleanup
    
    Bug: https://bugs.gentoo.org/741312
    Package-Manager: Portage-3.0.4, Repoman-3.0.1
    Signed-off-by: Sam James <sam@gentoo.org>

 www-client/chromium/Manifest                     |   1 -
 www-client/chromium/chromium-85.0.4183.83.ebuild | 865 -----------------------
 2 files changed, 866 deletions(-)
Comment 7 Sam James archtester gentoo-dev Security 2020-09-10 02:57:18 UTC
All done, thanks! Closing.