Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 859442 (CVE-2022-2477, CVE-2022-2478, CVE-2022-2479, CVE-2022-2480, CVE-2022-2481) - <www-client/chromium-103.0.5060.134 <www-client/google-chrome-103.0.5060.134: Multiple vulnerabilities
Summary: <www-client/chromium-103.0.5060.134 <www-client/google-chrome-103.0.5060.134:...
Status: RESOLVED FIXED
Alias: CVE-2022-2477, CVE-2022-2478, CVE-2022-2479, CVE-2022-2480, CVE-2022-2481
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL:
Whiteboard: B2 [glsa+]
Keywords:
Depends on:
Blocks: CVE-2022-2163
  Show dependency tree
 
Reported: 2022-07-20 03:51 UTC by Sam James
Modified: 2022-08-24 15:58 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Sam James archtester Gentoo Infrastructure gentoo-dev Security 2022-07-20 03:51:17 UTC 
https://chromereleases.googleblog.com/2022/07/stable-channel-update-for-desktop_19.html

[$16000][1336266] High CVE-2022-2477 : Use after free in Guest View. Reported by anonymous on 2022-06-14

[$7500][1335861] High CVE-2022-2478 : Use after free in PDF. Reported by triplepwns on 2022-06-13

[$3000][1329987] High CVE-2022-2479 : Insufficient validation of untrusted input in File. Reported by anonymous on 2022-05-28

[$NA][1339844] High CVE-2022-2480 : Use after free in Service Worker API. Reported by Sergei Glazunov of Google Project Zero on 2022-06-27

[$TBD][1341603] High CVE-2022-2481: Use after free in Views. Reported by YoungJoo Lee(@ashuu_lee) of CompSecLab at Seoul National University on 2022-07-04

[$7000][1308341] Low CVE-2022-2163: Use after free in Cast UI and Toolbar. Reported by Chaoyuan Peng (@ret2happy) on 2022-03-21
Comment 1 Larry the Git Cow gentoo-dev 2022-07-20 22:53:33 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=560b6d5c3a83a94e81615a8d96b37c3a109bb21e

commit 560b6d5c3a83a94e81615a8d96b37c3a109bb21e
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2022-07-20 22:51:31 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2022-07-20 22:52:56 +0000

    www-client/chromium: add 103.0.5060.134
    
    Bug: https://bugs.gentoo.org/859442
    Signed-off-by: Sam James <sam@gentoo.org>

 www-client/chromium/Manifest                       |    1 +
 www-client/chromium/chromium-103.0.5060.134.ebuild | 1114 ++++++++++++++++++++
 2 files changed, 1115 insertions(+)
Comment 2 Larry the Git Cow gentoo-dev 2022-08-20 08:50:04 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=49353047fddb4a1aa158cf5f881ba78a8a9899c7

commit 49353047fddb4a1aa158cf5f881ba78a8a9899c7
Author:     Stephan Hartmann <sultan@gentoo.org>
AuthorDate: 2022-08-20 08:49:47 +0000
Commit:     Stephan Hartmann <sultan@gentoo.org>
CommitDate: 2022-08-20 08:49:53 +0000

    www-client/chromium: drop 103.0.5060.114
    
    Bug: https://bugs.gentoo.org/859442
    Signed-off-by: Stephan Hartmann <sultan@gentoo.org>

 www-client/chromium/Manifest                       |    1 -
 www-client/chromium/chromium-103.0.5060.114.ebuild | 1114 --------------------
 2 files changed, 1115 deletions(-)
Comment 3 Larry the Git Cow gentoo-dev 2022-08-21 06:12:58 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=cc821fda3ee186d2bcc82c6163599beb50f2302d

commit cc821fda3ee186d2bcc82c6163599beb50f2302d
Author:     GLSAMaker <glsamaker@gentoo.org>
AuthorDate: 2022-08-21 06:11:41 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2022-08-21 06:12:55 +0000

    [ GLSA 202208-35 ] Chromium, Google Chrome, Microsoft Edge: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/858104
    Bug: https://bugs.gentoo.org/859442
    Bug: https://bugs.gentoo.org/863512
    Bug: https://bugs.gentoo.org/864723
    Bug: https://bugs.gentoo.org/865501
    Signed-off-by: GLSAMaker <glsamaker@gentoo.org>
    Signed-off-by: Sam James <sam@gentoo.org>

 glsa-202208-35.xml | 126 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 126 insertions(+)
Comment 4 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2022-08-21 06:14:43 UTC 
GLSA done, all done.