Security update for chromium SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2022:10146-1 Final 1 1 2022-10-13T13:33:51Z current 2022-10-13T13:33:51Z 2022-10-13T13:33:51Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for chromium This update for chromium fixes the following issues: Chromium 106.0.5249.119 (boo#1204223): * CVE-2022-3445: Use after free in Skia * CVE-2022-3446: Heap buffer overflow in WebSQL * CVE-2022-3447: Inappropriate implementation in Custom Tabs * CVE-2022-3448: Use after free in Permissions API * CVE-2022-3449: Use after free in Safe Browsing * CVE-2022-3450: Use after free in Peer Connection The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2022-10146 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NJWEEFPIGYBU2QS5FM2VA25YMZLEGXGF/ E-Mail link for openSUSE-SU-2022:10146-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1204223 SUSE Bug 1204223 https://www.suse.com/security/cve/CVE-2022-3445/ SUSE CVE CVE-2022-3445 page https://www.suse.com/security/cve/CVE-2022-3446/ SUSE CVE CVE-2022-3446 page https://www.suse.com/security/cve/CVE-2022-3447/ SUSE CVE CVE-2022-3447 page https://www.suse.com/security/cve/CVE-2022-3448/ SUSE CVE CVE-2022-3448 page https://www.suse.com/security/cve/CVE-2022-3449/ SUSE CVE CVE-2022-3449 page https://www.suse.com/security/cve/CVE-2022-3450/ SUSE CVE CVE-2022-3450 page SUSE Package Hub 15 SP4 openSUSE Leap 15.4 chromedriver-106.0.5249.119-bp154.2.35.1 chromium-106.0.5249.119-bp154.2.35.1 chromedriver-106.0.5249.119-bp154.2.35.1 as a component of SUSE Package Hub 15 SP4 chromium-106.0.5249.119-bp154.2.35.1 as a component of SUSE Package Hub 15 SP4 chromedriver-106.0.5249.119-bp154.2.35.1 as a component of openSUSE Leap 15.4 chromium-106.0.5249.119-bp154.2.35.1 as a component of openSUSE Leap 15.4 Use after free in Skia in Google Chrome prior to 106.0.5249.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) CVE-2022-3445 SUSE Package Hub 15 SP4:chromedriver-106.0.5249.119-bp154.2.35.1 SUSE Package Hub 15 SP4:chromium-106.0.5249.119-bp154.2.35.1 openSUSE Leap 15.4:chromedriver-106.0.5249.119-bp154.2.35.1 openSUSE Leap 15.4:chromium-106.0.5249.119-bp154.2.35.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NJWEEFPIGYBU2QS5FM2VA25YMZLEGXGF/ https://www.suse.com/security/cve/CVE-2022-3445.html CVE-2022-3445 https://bugzilla.suse.com/1204223 SUSE Bug 1204223 Heap buffer overflow in WebSQL in Google Chrome prior to 106.0.5249.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) CVE-2022-3446 SUSE Package Hub 15 SP4:chromedriver-106.0.5249.119-bp154.2.35.1 SUSE Package Hub 15 SP4:chromium-106.0.5249.119-bp154.2.35.1 openSUSE Leap 15.4:chromedriver-106.0.5249.119-bp154.2.35.1 openSUSE Leap 15.4:chromium-106.0.5249.119-bp154.2.35.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NJWEEFPIGYBU2QS5FM2VA25YMZLEGXGF/ https://www.suse.com/security/cve/CVE-2022-3446.html CVE-2022-3446 https://bugzilla.suse.com/1204223 SUSE Bug 1204223 Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 106.0.5249.119 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: High) CVE-2022-3447 SUSE Package Hub 15 SP4:chromedriver-106.0.5249.119-bp154.2.35.1 SUSE Package Hub 15 SP4:chromium-106.0.5249.119-bp154.2.35.1 openSUSE Leap 15.4:chromedriver-106.0.5249.119-bp154.2.35.1 openSUSE Leap 15.4:chromium-106.0.5249.119-bp154.2.35.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NJWEEFPIGYBU2QS5FM2VA25YMZLEGXGF/ https://www.suse.com/security/cve/CVE-2022-3447.html CVE-2022-3447 https://bugzilla.suse.com/1204223 SUSE Bug 1204223 Use after free in Permissions API in Google Chrome prior to 106.0.5249.119 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) CVE-2022-3448 SUSE Package Hub 15 SP4:chromedriver-106.0.5249.119-bp154.2.35.1 SUSE Package Hub 15 SP4:chromium-106.0.5249.119-bp154.2.35.1 openSUSE Leap 15.4:chromedriver-106.0.5249.119-bp154.2.35.1 openSUSE Leap 15.4:chromium-106.0.5249.119-bp154.2.35.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NJWEEFPIGYBU2QS5FM2VA25YMZLEGXGF/ https://www.suse.com/security/cve/CVE-2022-3448.html CVE-2022-3448 https://bugzilla.suse.com/1204223 SUSE Bug 1204223 Use after free in Safe Browsing in Google Chrome prior to 106.0.5249.119 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High) CVE-2022-3449 SUSE Package Hub 15 SP4:chromedriver-106.0.5249.119-bp154.2.35.1 SUSE Package Hub 15 SP4:chromium-106.0.5249.119-bp154.2.35.1 openSUSE Leap 15.4:chromedriver-106.0.5249.119-bp154.2.35.1 openSUSE Leap 15.4:chromium-106.0.5249.119-bp154.2.35.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NJWEEFPIGYBU2QS5FM2VA25YMZLEGXGF/ https://www.suse.com/security/cve/CVE-2022-3449.html CVE-2022-3449 https://bugzilla.suse.com/1204223 SUSE Bug 1204223 Use after free in Peer Connection in Google Chrome prior to 106.0.5249.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) CVE-2022-3450 SUSE Package Hub 15 SP4:chromedriver-106.0.5249.119-bp154.2.35.1 SUSE Package Hub 15 SP4:chromium-106.0.5249.119-bp154.2.35.1 openSUSE Leap 15.4:chromedriver-106.0.5249.119-bp154.2.35.1 openSUSE Leap 15.4:chromium-106.0.5249.119-bp154.2.35.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NJWEEFPIGYBU2QS5FM2VA25YMZLEGXGF/ https://www.suse.com/security/cve/CVE-2022-3450.html CVE-2022-3450 https://bugzilla.suse.com/1204223 SUSE Bug 1204223