Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 859442 (CVE-2022-2477, CVE-2022-2478, CVE-2022-2479, CVE-2022-2480, CVE-2022-2481)

Summary: <www-client/chromium-103.0.5060.134 <www-client/google-chrome-103.0.5060.134: Multiple vulnerabilities
Product: Gentoo Security Reporter: Sam James <sam>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: RESOLVED FIXED    
Severity: normal CC: chromium
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
See Also: https://bugs.gentoo.org/show_bug.cgi?id=866332
Whiteboard: B2 [glsa+]
Package list:
Runtime testing required: ---
Bug Depends on:    
Bug Blocks: 859445    

Description Sam James archtester Gentoo Infrastructure gentoo-dev Security 2022-07-20 03:51:17 UTC
https://chromereleases.googleblog.com/2022/07/stable-channel-update-for-desktop_19.html

[$16000][1336266] High CVE-2022-2477 : Use after free in Guest View. Reported by anonymous on 2022-06-14

[$7500][1335861] High CVE-2022-2478 : Use after free in PDF. Reported by triplepwns on 2022-06-13

[$3000][1329987] High CVE-2022-2479 : Insufficient validation of untrusted input in File. Reported by anonymous on 2022-05-28

[$NA][1339844] High CVE-2022-2480 : Use after free in Service Worker API. Reported by Sergei Glazunov of Google Project Zero on 2022-06-27

[$TBD][1341603] High CVE-2022-2481: Use after free in Views. Reported by YoungJoo Lee(@ashuu_lee) of CompSecLab at Seoul National University on 2022-07-04

[$7000][1308341] Low CVE-2022-2163: Use after free in Cast UI and Toolbar. Reported by Chaoyuan Peng (@ret2happy) on 2022-03-21
Comment 1 Larry the Git Cow gentoo-dev 2022-07-20 22:53:33 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=560b6d5c3a83a94e81615a8d96b37c3a109bb21e

commit 560b6d5c3a83a94e81615a8d96b37c3a109bb21e
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2022-07-20 22:51:31 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2022-07-20 22:52:56 +0000

    www-client/chromium: add 103.0.5060.134
    
    Bug: https://bugs.gentoo.org/859442
    Signed-off-by: Sam James <sam@gentoo.org>

 www-client/chromium/Manifest                       |    1 +
 www-client/chromium/chromium-103.0.5060.134.ebuild | 1114 ++++++++++++++++++++
 2 files changed, 1115 insertions(+)
Comment 2 Larry the Git Cow gentoo-dev 2022-08-20 08:50:04 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=49353047fddb4a1aa158cf5f881ba78a8a9899c7

commit 49353047fddb4a1aa158cf5f881ba78a8a9899c7
Author:     Stephan Hartmann <sultan@gentoo.org>
AuthorDate: 2022-08-20 08:49:47 +0000
Commit:     Stephan Hartmann <sultan@gentoo.org>
CommitDate: 2022-08-20 08:49:53 +0000

    www-client/chromium: drop 103.0.5060.114
    
    Bug: https://bugs.gentoo.org/859442
    Signed-off-by: Stephan Hartmann <sultan@gentoo.org>

 www-client/chromium/Manifest                       |    1 -
 www-client/chromium/chromium-103.0.5060.114.ebuild | 1114 --------------------
 2 files changed, 1115 deletions(-)
Comment 3 Larry the Git Cow gentoo-dev 2022-08-21 06:12:58 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=cc821fda3ee186d2bcc82c6163599beb50f2302d

commit cc821fda3ee186d2bcc82c6163599beb50f2302d
Author:     GLSAMaker <glsamaker@gentoo.org>
AuthorDate: 2022-08-21 06:11:41 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2022-08-21 06:12:55 +0000

    [ GLSA 202208-35 ] Chromium, Google Chrome, Microsoft Edge: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/858104
    Bug: https://bugs.gentoo.org/859442
    Bug: https://bugs.gentoo.org/863512
    Bug: https://bugs.gentoo.org/864723
    Bug: https://bugs.gentoo.org/865501
    Signed-off-by: GLSAMaker <glsamaker@gentoo.org>
    Signed-off-by: Sam James <sam@gentoo.org>

 glsa-202208-35.xml | 126 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 126 insertions(+)
Comment 4 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2022-08-21 06:14:43 UTC
GLSA done, all done.