Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 831624 (CVE-2022-0289, CVE-2022-0290, CVE-2022-0291, CVE-2022-0292, CVE-2022-0293, CVE-2022-0294, CVE-2022-0295, CVE-2022-0296, CVE-2022-0297, CVE-2022-0298, CVE-2022-0300, CVE-2022-0301, CVE-2022-0302, CVE-2022-0303, CVE-2022-0304, CVE-2022-0305, CVE-2022-0306, CVE-2022-0307, CVE-2022-0308, CVE-2022-0309, CVE-2022-0310, CVE-2022-0311)

Summary: <www-client/chromium-97.0.4692.99 <www-client/google-chrome-97.0.4692.99: Multiple vulnerabilities
Product: Gentoo Security Reporter: Stephan Hartmann (RETIRED) <sultan>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: RESOLVED FIXED    
Severity: major CC: chromium
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
URL: https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html
See Also: https://bugs.gentoo.org/show_bug.cgi?id=835761
Whiteboard: A2 [glsa+]
Package list:
Runtime testing required: ---
Bug Depends on: 831719    
Bug Blocks: 830642    

Description Stephan Hartmann (RETIRED) gentoo-dev 2022-01-20 17:34:37 UTC 
[1284367] Critical CVE-2022-0289: Use after free in Safe browsing. Reported by Sergei Glazunov of Google Project Zero on 2022-01-05

[1260134][1260007] High CVE-2022-0290: Use after free in Site isolation. Reported by Brendon Tiszka and Sergei Glazunov of Google Project Zero on 2021-10-15

[1281084] High CVE-2022-0291: Inappropriate implementation in Storage. Reported by Anonymous on 2021-12-19

[1270358] High CVE-2022-0292: Inappropriate implementation in Fenced Frames. Reported by Brendon Tiszka  on 2021-11-16

[1283371] High CVE-2022-0293: Use after free in Web packaging. Reported by Rong Jian and Guang Gong of 360 Alpha Lab on 2021-12-30

[1273017] High CVE-2022-0294: Inappropriate implementation in Push messaging. Reported by Rong Jian and Guang Gong of 360 Alpha Lab on 2021-11-23

[1278180] High CVE-2022-0295: Use after free in Omnibox. Reported by Weipeng Jiang (@Krace) and Guang Gong of 360 Vulnerability Research Institute on 2021-12-09

[1283375] High CVE-2022-0296: Use after free in Printing. Reported by koocola(@alo_cook) and Guang Gong of 360 Vulnerability Research Institute on 2021-12-30

[1274316] High CVE-2022-0297: Use after free in Vulkan. Reported by Cassidy Kim of Amber Security Lab, OPPO Mobile Telecommunications Corp. Ltd. on 2021-11-28

[1212957] High CVE-2022-0298: Use after free in Scheduling. Reported by Yangkang (@dnpushme) of 360 ATA on 2021-05-25

[1275438] High CVE-2022-0300: Use after free in Text Input Method Editor. Reported by Rong Jian and Guang Gong of 360 Alpha Lab on 2021-12-01

[1276331] High CVE-2022-0301: Heap buffer overflow in DevTools. Reported by Abdulrahman Alqabandi, Microsoft Browser Vulnerability Research on 2021-12-03

[1278613] High CVE-2022-0302: Use after free in Omnibox. Reported by Weipeng Jiang (@Krace) and Guang Gong of 360 Vulnerability Research Institute on 2021-12-10

[1281979] High CVE-2022-0303: Race in GPU Watchdog. Reported by Yiğit Can YILMAZ (@yilmazcanyigit) on 2021-12-22

[1282118] High CVE-2022-0304: Use after free in Bookmarks. Reported by Rong Jian and Guang Gong of 360 Alpha Lab on 2021-12-22

[1282354] High CVE-2022-0305: Inappropriate implementation in Service Worker API. Reported by @uwu7586 on 2021-12-23

[1283198] High CVE-2022-0306: Heap buffer overflow in PDFium. Reported by Sergei Glazunov of Google Project Zero on 2021-12-29

[1281881] Medium CVE-2022-0307: Use after free in Optimization Guide. Reported by Samet Bekmezci @sametbekmezci on 2021-12-21

[1282480] Medium CVE-2022-0308: Use after free in Data Transfer. Reported by @ginggilBesel on 2021-12-24

[1240472] Medium CVE-2022-0309: Inappropriate implementation in Autofill. Reported by Alesandro Ortiz on 2021-08-17

[1283805] Medium CVE-2022-0310: Heap buffer overflow in Task Manager. Reported by Samet Bekmezci @sametbekmezci on 2022-01-03

[1283807] Medium CVE-2022-0311: Heap buffer overflow in Task Manager. Reported by Samet Bekmezci @sametbekmezci on 2022-01-03
Comment 1 Larry the Git Cow gentoo-dev 2022-01-21 10:21:52 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f90757c64dd626e125eda6d53be59d786ce7946f

commit f90757c64dd626e125eda6d53be59d786ce7946f
Author:     Stephan Hartmann <sultan@gentoo.org>
AuthorDate: 2022-01-21 10:21:27 +0000
Commit:     Stephan Hartmann <sultan@gentoo.org>
CommitDate: 2022-01-21 10:21:46 +0000

    www-client/chromium: stable channel bump to 97.0.4692.99
    
    Bug: https://bugs.gentoo.org/831624
    Package-Manager: Portage-3.0.28, Repoman-3.0.3
    Signed-off-by: Stephan Hartmann <sultan@gentoo.org>

 www-client/chromium/Manifest                     |   1 +
 www-client/chromium/chromium-97.0.4692.99.ebuild | 961 +++++++++++++++++++++++
 2 files changed, 962 insertions(+)
Comment 2 Larry the Git Cow gentoo-dev 2022-01-23 18:05:57 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=1f36f78345f36b2a80b882f7b1512f111b9b88dd

commit 1f36f78345f36b2a80b882f7b1512f111b9b88dd
Author:     Stephan Hartmann <sultan@gentoo.org>
AuthorDate: 2022-01-23 18:05:37 +0000
Commit:     Stephan Hartmann <sultan@gentoo.org>
CommitDate: 2022-01-23 18:05:53 +0000

    www-client/chromium: security cleanup
    
    Bug: https://bugs.gentoo.org/831624
    Package-Manager: Portage-3.0.28, Repoman-3.0.3
    Signed-off-by: Stephan Hartmann <sultan@gentoo.org>

 www-client/chromium/Manifest                       |   1 -
 .../chromium/chromium-97.0.4692.71-r1.ebuild       | 963 ---------------------
 .../files/chromium-97-fix-tag-dragging.patch       |  52 --
 3 files changed, 1016 deletions(-)
Comment 3 Larry the Git Cow gentoo-dev 2022-01-31 05:31:37 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=a5cb3b8ed2294fbfe4dfaf3e992220585c749f25

commit a5cb3b8ed2294fbfe4dfaf3e992220585c749f25
Author:     John Helmert III <ajak@gentoo.org>
AuthorDate: 2022-01-31 05:00:26 +0000
Commit:     John Helmert III <ajak@gentoo.org>
CommitDate: 2022-01-31 05:00:26 +0000

    [ GLSA 202201-02 ] Chromium, Google Chrome: Multiple vulnerabilities
    
    Bug: https://bugs.gentoo.org/803167
    Bug: https://bugs.gentoo.org/806223
    Bug: https://bugs.gentoo.org/808715
    Bug: https://bugs.gentoo.org/811348
    Bug: https://bugs.gentoo.org/813035
    Bug: https://bugs.gentoo.org/814221
    Bug: https://bugs.gentoo.org/814617
    Bug: https://bugs.gentoo.org/815673
    Bug: https://bugs.gentoo.org/816984
    Bug: https://bugs.gentoo.org/819054
    Bug: https://bugs.gentoo.org/820689
    Bug: https://bugs.gentoo.org/824274
    Bug: https://bugs.gentoo.org/829190
    Bug: https://bugs.gentoo.org/830642
    Bug: https://bugs.gentoo.org/831624
    Signed-off-by: John Helmert III <ajak@gentoo.org>

 glsa-202201-02.xml | 257 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 257 insertions(+)
Comment 4 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-01-31 05:35:03 UTC 
All done! \o/