Security update for chromium SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2023:0032-1 Final 1 1 2023-01-27T07:40:01Z current 2023-01-27T07:40:01Z 2023-01-27T07:40:01Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for chromium This update for chromium fixes the following issues: Chromium 109.0.5414.119 (boo#1207512): * CVE-2023-0471: Use after free in WebTransport * CVE-2023-0472: Use after free in WebRTC * CVE-2023-0473: Type Confusion in ServiceWorker API * CVE-2023-0474: Use after free in GuestView * Various fixes from internal audits, fuzzing and other initiatives The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2023-32 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RMPIZT2V3OZTRMXES23LJX7XCSXFYL6Y/ E-Mail link for openSUSE-SU-2023:0032-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1207512 SUSE Bug 1207512 https://www.suse.com/security/cve/CVE-2023-0471/ SUSE CVE CVE-2023-0471 page https://www.suse.com/security/cve/CVE-2023-0472/ SUSE CVE CVE-2023-0472 page https://www.suse.com/security/cve/CVE-2023-0473/ SUSE CVE CVE-2023-0473 page https://www.suse.com/security/cve/CVE-2023-0474/ SUSE CVE CVE-2023-0474 page SUSE Package Hub 15 SP4 openSUSE Leap 15.4 chromedriver-109.0.5414.119-bp154.2.64.1 chromium-109.0.5414.119-bp154.2.64.1 chromedriver-109.0.5414.119-bp154.2.64.1 as a component of SUSE Package Hub 15 SP4 chromium-109.0.5414.119-bp154.2.64.1 as a component of SUSE Package Hub 15 SP4 chromedriver-109.0.5414.119-bp154.2.64.1 as a component of openSUSE Leap 15.4 chromium-109.0.5414.119-bp154.2.64.1 as a component of openSUSE Leap 15.4 Use after free in WebTransport in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) CVE-2023-0471 SUSE Package Hub 15 SP4:chromedriver-109.0.5414.119-bp154.2.64.1 SUSE Package Hub 15 SP4:chromium-109.0.5414.119-bp154.2.64.1 openSUSE Leap 15.4:chromedriver-109.0.5414.119-bp154.2.64.1 openSUSE Leap 15.4:chromium-109.0.5414.119-bp154.2.64.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RMPIZT2V3OZTRMXES23LJX7XCSXFYL6Y/ https://www.suse.com/security/cve/CVE-2023-0471.html CVE-2023-0471 https://bugzilla.suse.com/1207512 SUSE Bug 1207512 Use after free in WebRTC in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) CVE-2023-0472 SUSE Package Hub 15 SP4:chromedriver-109.0.5414.119-bp154.2.64.1 SUSE Package Hub 15 SP4:chromium-109.0.5414.119-bp154.2.64.1 openSUSE Leap 15.4:chromedriver-109.0.5414.119-bp154.2.64.1 openSUSE Leap 15.4:chromium-109.0.5414.119-bp154.2.64.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RMPIZT2V3OZTRMXES23LJX7XCSXFYL6Y/ https://www.suse.com/security/cve/CVE-2023-0472.html CVE-2023-0472 https://bugzilla.suse.com/1207512 SUSE Bug 1207512 Type Confusion in ServiceWorker API in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) CVE-2023-0473 SUSE Package Hub 15 SP4:chromedriver-109.0.5414.119-bp154.2.64.1 SUSE Package Hub 15 SP4:chromium-109.0.5414.119-bp154.2.64.1 openSUSE Leap 15.4:chromedriver-109.0.5414.119-bp154.2.64.1 openSUSE Leap 15.4:chromium-109.0.5414.119-bp154.2.64.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RMPIZT2V3OZTRMXES23LJX7XCSXFYL6Y/ https://www.suse.com/security/cve/CVE-2023-0473.html CVE-2023-0473 https://bugzilla.suse.com/1207512 SUSE Bug 1207512 Use after free in GuestView in Google Chrome prior to 109.0.5414.119 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a Chrome web app. (Chromium security severity: Medium) CVE-2023-0474 SUSE Package Hub 15 SP4:chromedriver-109.0.5414.119-bp154.2.64.1 SUSE Package Hub 15 SP4:chromium-109.0.5414.119-bp154.2.64.1 openSUSE Leap 15.4:chromedriver-109.0.5414.119-bp154.2.64.1 openSUSE Leap 15.4:chromium-109.0.5414.119-bp154.2.64.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RMPIZT2V3OZTRMXES23LJX7XCSXFYL6Y/ https://www.suse.com/security/cve/CVE-2023-0474.html CVE-2023-0474 https://bugzilla.suse.com/1207512 SUSE Bug 1207512