https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop.html [$7500][1423304] Medium CVE-2023-2459: Inappropriate implementation in Prompts. Reported by Rong Jian of VRI on 2023-03-10 [$5000][1419732] Medium CVE-2023-2460: Insufficient validation of untrusted input in Extensions. Reported by Martin Bajanik, Fingerprint[.]com on 2023-02-27 [$4000][1350561] Medium CVE-2023-2461: Use after free in OS Inputs. Reported by @ginggilBesel on 2022-08-06 [$3000][1375133] Medium CVE-2023-2462: Inappropriate implementation in Prompts. Reported by Alesandro Ortiz on 2022-10-17 [$2000][1406120] Medium CVE-2023-2463: Inappropriate implementation in Full Screen Mode. Reported by Irvan Kurniawan (sourc7) on 2023-01-10 [$2000][1418549] Medium CVE-2023-2464: Inappropriate implementation in PictureInPicture. Reported by Thomas Orlita on 2023-02-23 [$1000][1399862] Medium CVE-2023-2465: Inappropriate implementation in CORS. Reported by @kunte_ctf on 2022-12-10 [$3000][1385714] Low CVE-2023-2466: Inappropriate implementation in Prompts. Reported by Jasper Rebane (popstonia) on 2022-11-17 [$2000][1413586] Low CVE-2023-2467: Inappropriate implementation in Prompts. Reported by Thomas Orlita on 2023-02-07 [$1000][1416380] Low CVE-2023-2468: Inappropriate implementation in PictureInPicture. Reported by Alesandro Ortiz on 2023-02-15 We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.As usual, our ongoing internal security work was responsible for a wide range of fixes: [1441714] Various fixes from internal audits, fuzzing and other initiatives
GLSA request filed.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=ab0da6660785c2f89a93ffda79f5ec7169378003 commit ab0da6660785c2f89a93ffda79f5ec7169378003 Author: Sam James <sam@gentoo.org> AuthorDate: 2023-06-10 05:29:57 +0000 Commit: Sam James <sam@gentoo.org> CommitDate: 2023-06-10 05:30:32 +0000 www-client/chromium: drop 112.0.5615.165, 113.0.5672.63, 113.0.5672.92 Bug: https://bugs.gentoo.org/906586 Bug: https://bugs.gentoo.org/905620 Bug: https://bugs.gentoo.org/904560 Signed-off-by: Sam James <sam@gentoo.org> www-client/chromium/Manifest | 4 - www-client/chromium/chromium-112.0.5615.165.ebuild | 1261 ------------------- www-client/chromium/chromium-113.0.5672.63.ebuild | 1265 -------------------- www-client/chromium/chromium-113.0.5672.92.ebuild | 1265 -------------------- .../chromium/files/chromium-112-compiler.patch | 256 ---- .../files/chromium-112-gcc-mno-outline.patch | 29 - .../chromium/files/chromium-112-libstdc++-1.patch | 59 - .../chromium/files/chromium-112-libstdc++.patch | 63 - .../chromium/files/chromium-112-sql-relax.patch | 46 - .../chromium/files/chromium-112-swiftshader.patch | 122 -- 10 files changed, 4370 deletions(-)
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/data/glsa.git/commit/?id=de793de405f9e13d0d29d94de3f236ce0b5b3338 commit de793de405f9e13d0d29d94de3f236ce0b5b3338 Author: GLSAMaker <glsamaker@gentoo.org> AuthorDate: 2023-09-30 08:56:23 +0000 Commit: Hans de Graaff <graaff@gentoo.org> CommitDate: 2023-09-30 08:57:27 +0000 [ GLSA 202309-17 ] Chromium, Google Chrome, Microsoft Edge: Multiple Vulnerabilities Bug: https://bugs.gentoo.org/893660 Bug: https://bugs.gentoo.org/904252 Bug: https://bugs.gentoo.org/904394 Bug: https://bugs.gentoo.org/904560 Bug: https://bugs.gentoo.org/905297 Bug: https://bugs.gentoo.org/905620 Bug: https://bugs.gentoo.org/905883 Bug: https://bugs.gentoo.org/906586 Signed-off-by: GLSAMaker <glsamaker@gentoo.org> Signed-off-by: Hans de Graaff <graaff@gentoo.org> glsa-202309-17.xml | 152 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 152 insertions(+)
