| Summary: | <www-client/chromium-124.0.6367.60, <www-client/google-chrome-124.0.6367.60, <www-client/microsoft-edge-124.0.2478.51, <www-client/opera-110.0.5130.23: multiple vulnerabilities | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Matt Jolly <kangie> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | normal | CC: | chromium, kangie |
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_16.html | ||
| Whiteboard: | A2 [glsa+] | ||
| Package list: | Runtime testing required: | --- | |
| Bug Depends on: | 930125 | ||
| Bug Blocks: | |||
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=40822ba9283c9cb5b111cbf4b56ec3b3a044e76e commit 40822ba9283c9cb5b111cbf4b56ec3b3a044e76e Author: Matt Jolly <kangie@gentoo.org> AuthorDate: 2024-04-17 03:30:21 +0000 Commit: Matt Jolly <kangie@gentoo.org> CommitDate: 2024-04-17 03:30:21 +0000 www-client/chromium: promote 124.0.6367.60 to stable subslot Bug: https://bugs.gentoo.org/930124 Signed-off-by: Matt Jolly <kangie@gentoo.org> www-client/chromium/chromium-124.0.6367.60.ebuild | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=84013f1575b514c0104a0c87d7e12821223b8c3a commit 84013f1575b514c0104a0c87d7e12821223b8c3a Author: Matt Jolly <kangie@gentoo.org> AuthorDate: 2024-04-17 04:25:15 +0000 Commit: Matt Jolly <kangie@gentoo.org> CommitDate: 2024-04-17 04:53:54 +0000 www-client/google-chrome: automated update (124.0.6367.60) Bug: https://bugs.gentoo.org/930124 Signed-off-by: Matt Jolly <kangie@gentoo.org> www-client/google-chrome/Manifest | 2 +- ...-chrome-123.0.6312.122.ebuild => google-chrome-124.0.6367.60.ebuild} | 0 2 files changed, 1 insertion(+), 1 deletion(-) The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/data/glsa.git/commit/?id=309ab763e094d02598a970a50a7f0836699fd887 commit 309ab763e094d02598a970a50a7f0836699fd887 Author: GLSAMaker <glsamaker@gentoo.org> AuthorDate: 2024-12-07 10:13:10 +0000 Commit: Hans de Graaff <graaff@gentoo.org> CommitDate: 2024-12-07 10:13:37 +0000 [ GLSA 202412-05 ] Chromium, Google Chrome, Microsoft Edge. Opera: Multiple Vulnerabilities Bug: https://bugs.gentoo.org/924450 Bug: https://bugs.gentoo.org/925161 Bug: https://bugs.gentoo.org/925666 Bug: https://bugs.gentoo.org/926230 Bug: https://bugs.gentoo.org/926869 Bug: https://bugs.gentoo.org/927312 Bug: https://bugs.gentoo.org/927928 Bug: https://bugs.gentoo.org/928462 Bug: https://bugs.gentoo.org/929112 Bug: https://bugs.gentoo.org/930124 Bug: https://bugs.gentoo.org/930647 Bug: https://bugs.gentoo.org/930994 Bug: https://bugs.gentoo.org/931548 Signed-off-by: GLSAMaker <glsamaker@gentoo.org> Signed-off-by: Hans de Graaff <graaff@gentoo.org> glsa-202412-05.xml | 121 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 121 insertions(+) |
The Stable channel has been updated to 124.0.6367.60 for Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log. Security Fixes and Rewards This update includes 22 security fixes. Below, we highlight fixes that were contributed by external researchers. Please see the Chrome Security Page for more information. [$20000][331358160] High CVE-2024-3832: Object corruption in V8. Reported by Man Yue Mo of GitHub Security Lab on 2024-03-27 [$10000][331383939] High CVE-2024-3833: Object corruption in WebAssembly. Reported by Man Yue Mo of GitHub Security Lab on 2024-03-27 [$3000][326607008] High CVE-2024-3834: Use after free in Downloads. Reported by ChaobinZhang on 2024-02-24 [$7000][41491379] Medium CVE-2024-3837: Use after free in QUIC. Reported by {rotiple, dch3ck} of CW Research Inc. on 2024-01-15 [$5000][328278717] Medium CVE-2024-3838: Inappropriate implementation in Autofill. Reported by Ardyan Vicky Ramadhan on 2024-03-06 [$5000][41491859] Medium CVE-2024-3839: Out of bounds read in Fonts. Reported by Ronald Crane (Zippenhop LLC) on 2024-01-16 [$3000][41493458] Medium CVE-2024-3840: Insufficient policy enforcement in Site Isolation. Reported by Ahmed ElMasry on 2024-01-22 [$1000][330376742] Medium CVE-2024-3841: Insufficient data validation in Browser Switcher. Reported by Oleg on 2024-03-19 [$TBD][41486690] Medium CVE-2024-3843: Insufficient data validation in Downloads. Reported by Azur on 2023-12-24 [$5000][40058873] Low CVE-2024-3844: Inappropriate implementation in Extensions. Reported by Alesandro Ortiz on 2022-02-23 [$3000][323583084] Low CVE-2024-3845: Inappropriate implementation in Network. Reported by Daniel Baulig on 2024-02-03 [$2000][40064754] Low CVE-2024-3846: Inappropriate implementation in Prompts. Reported by Ahmed ElMasry on 2023-05-23 [$1000][328690293] Low CVE-2024-3847: Insufficient policy enforcement in WebUI. Reported by Yan Zhu on 2024-03-08