Bug 859442 (CVE-2022-2477, CVE-2022-2478, CVE-2022-2479, CVE-2022-2480, CVE-2022-2481) – <www-client/chromium-103.0.5060.134 <www-client/google-chrome-103.0.5060.134: Multiple vulnerabilities

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description Sam James 2022-07-20 03:51:17 UTC]

https://chromereleases.googleblog.com/2022/07/stable-channel-update-for-desktop_19.html

[$16000][1336266] High CVE-2022-2477 : Use after free in Guest View. Reported by anonymous on 2022-06-14

[$7500][1335861] High CVE-2022-2478 : Use after free in PDF. Reported by triplepwns on 2022-06-13

[$3000][1329987] High CVE-2022-2479 : Insufficient validation of untrusted input in File. Reported by anonymous on 2022-05-28

[$NA][1339844] High CVE-2022-2480 : Use after free in Service Worker API. Reported by Sergei Glazunov of Google Project Zero on 2022-06-27

[$TBD][1341603] High CVE-2022-2481: Use after free in Views. Reported by YoungJoo Lee(@ashuu_lee) of CompSecLab at Seoul National University on 2022-07-04

[$7000][1308341] Low CVE-2022-2163: Use after free in Cast UI and Toolbar. Reported by Chaoyuan Peng (@ret2happy) on 2022-03-21

[Comment 1 Larry the Git Cow 2022-07-20 22:53:33 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=560b6d5c3a83a94e81615a8d96b37c3a109bb21e

commit 560b6d5c3a83a94e81615a8d96b37c3a109bb21e
Author:     Sam James <[e-mail]>
AuthorDate: 2022-07-20 22:51:31 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2022-07-20 22:52:56 +0000

    www-client/chromium: add 103.0.5060.134
    
    Bug: https://bugs.gentoo.org/859442
    Signed-off-by: Sam James <[e-mail]>

 www-client/chromium/Manifest                       |    1 +
 www-client/chromium/chromium-103.0.5060.134.ebuild | 1114 ++++++++++++++++++++
 2 files changed, 1115 insertions(+)

[Comment 2 Larry the Git Cow 2022-08-20 08:50:04 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=49353047fddb4a1aa158cf5f881ba78a8a9899c7

commit 49353047fddb4a1aa158cf5f881ba78a8a9899c7
Author:     Stephan Hartmann <[e-mail]>
AuthorDate: 2022-08-20 08:49:47 +0000
Commit:     Stephan Hartmann <[e-mail]>
CommitDate: 2022-08-20 08:49:53 +0000

    www-client/chromium: drop 103.0.5060.114
    
    Bug: https://bugs.gentoo.org/859442
    Signed-off-by: Stephan Hartmann <[e-mail]>

 www-client/chromium/Manifest                       |    1 -
 www-client/chromium/chromium-103.0.5060.114.ebuild | 1114 --------------------
 2 files changed, 1115 deletions(-)

[Comment 3 Larry the Git Cow 2022-08-21 06:12:58 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=cc821fda3ee186d2bcc82c6163599beb50f2302d

commit cc821fda3ee186d2bcc82c6163599beb50f2302d
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2022-08-21 06:11:41 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2022-08-21 06:12:55 +0000

    [ GLSA 202208-35 ] Chromium, Google Chrome, Microsoft Edge: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/858104
    Bug: https://bugs.gentoo.org/859442
    Bug: https://bugs.gentoo.org/863512
    Bug: https://bugs.gentoo.org/864723
    Bug: https://bugs.gentoo.org/865501
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: Sam James <[e-mail]>

 glsa-202208-35.xml | 126 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 126 insertions(+)

[Comment 4 Sam James 2022-08-21 06:14:43 UTC]

GLSA done, all done.