Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 908471 (CVE-2023-3214, CVE-2023-3215, CVE-2023-3216, CVE-2023-3217) - <www-client/chromium-114.0.5735.133, <www-client/google-chrome-114.0.5735.133: Multiple vulnerabilities
Summary: <www-client/chromium-114.0.5735.133, <www-client/google-chrome-114.0.5735.133...
Status: IN_PROGRESS
Alias: CVE-2023-3214, CVE-2023-3215, CVE-2023-3216, CVE-2023-3217
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL: https://chromereleases.googleblog.com...
Whiteboard: A2 [glsa?]
Keywords:
Depends on: 908496 909778
Blocks:
  Show dependency tree
 
Reported: 2023-06-14 03:37 UTC by Sam James
Modified: 2023-07-09 11:48 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Sam James archtester Gentoo Infrastructure gentoo-dev Security 2023-06-14 03:37:50 UTC 
https://chromereleases.googleblog.com/2023/06/stable-channel-update-for-desktop_13.html

[$TBD][1450568] Critical CVE-2023-3214: Use after free in Autofill payments. Reported by Rong Jian of VRI on 2023-06-01

[$3000][1446274] High CVE-2023-3215: Use after free in WebRTC. Reported by asnine on 2023-05-17

[$TBD][1450114] High CVE-2023-3216: Type Confusion in V8. Reported by 5n1p3r0010 from Topsec ChiXiao Lab on 2023-05-31

[$NA][1450601] High CVE-2023-3217: Use after free in WebXR. Reported by Sergei Glazunov of Google Project Zero on 2023-06-01
Comment 1 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2023-06-14 03:38:01 UTC 
Please bump to 114.0.5735.133.
Comment 2 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2023-06-14 15:59:49 UTC 
commit efe7fdf8963a2d184187dbaa8627b581a5a6f291
Author: Matt Jolly <Matt.Jolly@footclan.ninja>
Date:   Wed Jun 14 21:54:41 2023 +1000

    www-client/chromium: add 114.0.5735.133

    update pulseaudio dependency

    Signed-off-by: Matt Jolly <Matt.Jolly@footclan.ninja>
    Closes: https://github.com/gentoo/gentoo/pull/31436
    Signed-off-by: Mike Gilbert <floppym@gentoo.org>
Comment 3 Larry the Git Cow gentoo-dev 2023-06-29 14:55:13 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=8bf54736b16d57e213987afcc79273d9d0e4bcde

commit 8bf54736b16d57e213987afcc79273d9d0e4bcde
Author:     Stephan Hartmann <sultan@gentoo.org>
AuthorDate: 2023-06-29 14:55:05 +0000
Commit:     Stephan Hartmann <sultan@gentoo.org>
CommitDate: 2023-06-29 14:55:05 +0000

    www-client/chromium: drop 114.0.5735.110
    
    Bug: https://bugs.gentoo.org/908471
    Signed-off-by: Stephan Hartmann <sultan@gentoo.org>

 www-client/chromium/Manifest                       |    1 -
 www-client/chromium/chromium-114.0.5735.110.ebuild | 1268 --------------------
 2 files changed, 1269 deletions(-)