Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 905620 (CVE-2023-2459, CVE-2023-2460, CVE-2023-2461, CVE-2023-2462, CVE-2023-2463, CVE-2023-2464, CVE-2023-2465, CVE-2023-2466, CVE-2023-2467, CVE-2023-2468) - <www-client/chromium-113.0.5672.63 <www-client/google-chrome-113.0.5672.63 <www-client/microsoft-edge-113.0.1774.35: Multiple vulnerabilities
Summary: <www-client/chromium-113.0.5672.63 <www-client/google-chrome-113.0.5672.63 <w...
Status: IN_PROGRESS
Alias: CVE-2023-2459, CVE-2023-2460, CVE-2023-2461, CVE-2023-2462, CVE-2023-2463, CVE-2023-2464, CVE-2023-2465, CVE-2023-2466, CVE-2023-2467, CVE-2023-2468
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL: https://chromereleases.googleblog.com...
Whiteboard: A2 [glsa cleanup]
Keywords:
Depends on: 906625
Blocks:
  Show dependency tree
 
Reported: 2023-05-02 21:17 UTC by Sam James
Modified: 2023-06-10 05:31 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Sam James archtester Gentoo Infrastructure gentoo-dev Security 2023-05-02 21:17:30 UTC 
https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop.html

[$7500][1423304] Medium CVE-2023-2459: Inappropriate implementation in Prompts. Reported by Rong Jian of VRI on 2023-03-10

[$5000][1419732] Medium CVE-2023-2460: Insufficient validation of untrusted input in Extensions. Reported by Martin Bajanik, Fingerprint[.]com on 2023-02-27

[$4000][1350561] Medium CVE-2023-2461: Use after free in OS Inputs. Reported by @ginggilBesel on 2022-08-06

[$3000][1375133] Medium CVE-2023-2462: Inappropriate implementation in Prompts. Reported by Alesandro Ortiz on 2022-10-17

[$2000][1406120] Medium CVE-2023-2463: Inappropriate implementation in Full Screen Mode. Reported by Irvan Kurniawan (sourc7) on 2023-01-10

[$2000][1418549] Medium CVE-2023-2464: Inappropriate implementation in PictureInPicture. Reported by Thomas Orlita on 2023-02-23

[$1000][1399862] Medium CVE-2023-2465: Inappropriate implementation in CORS. Reported by @kunte_ctf on 2022-12-10

[$3000][1385714] Low CVE-2023-2466: Inappropriate implementation in Prompts. Reported by Jasper Rebane (popstonia) on 2022-11-17

[$2000][1413586] Low CVE-2023-2467: Inappropriate implementation in Prompts. Reported by Thomas Orlita on 2023-02-07

[$1000][1416380] Low CVE-2023-2468: Inappropriate implementation in PictureInPicture. Reported by Alesandro Ortiz on 2023-02-15

We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.As usual, our ongoing internal security work was responsible for a wide range of fixes:

    [1441714] Various fixes from internal audits, fuzzing and other initiatives
Comment 1 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2023-05-30 00:04:48 UTC 
GLSA request filed.
Comment 2 Larry the Git Cow gentoo-dev 2023-06-10 05:31:12 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=ab0da6660785c2f89a93ffda79f5ec7169378003

commit ab0da6660785c2f89a93ffda79f5ec7169378003
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2023-06-10 05:29:57 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2023-06-10 05:30:32 +0000

    www-client/chromium: drop 112.0.5615.165, 113.0.5672.63, 113.0.5672.92
    
    Bug: https://bugs.gentoo.org/906586
    Bug: https://bugs.gentoo.org/905620
    Bug: https://bugs.gentoo.org/904560
    Signed-off-by: Sam James <sam@gentoo.org>

 www-client/chromium/Manifest                       |    4 -
 www-client/chromium/chromium-112.0.5615.165.ebuild | 1261 -------------------
 www-client/chromium/chromium-113.0.5672.63.ebuild  | 1265 --------------------
 www-client/chromium/chromium-113.0.5672.92.ebuild  | 1265 --------------------
 .../chromium/files/chromium-112-compiler.patch     |  256 ----
 .../files/chromium-112-gcc-mno-outline.patch       |   29 -
 .../chromium/files/chromium-112-libstdc++-1.patch  |   59 -
 .../chromium/files/chromium-112-libstdc++.patch    |   63 -
 .../chromium/files/chromium-112-sql-relax.patch    |   46 -
 .../chromium/files/chromium-112-swiftshader.patch  |  122 --
 10 files changed, 4370 deletions(-)