Bug 19582

Upstream has released 54.0.2840.71 on October 20:
https://googlechromereleases.blogspot.com/2016/10/stable-channel-update-for-desktop_20.html

It is a bugfix release.

chromium 54 does not compile with ffmpeg 2.8.x. It builds with ffmpeg 3.1.x.

../../media/ffmpeg/ffmpeg_common.cc:772:58: error: âAVCOL_PRI_SMPTEST428_1â was not declared in this scope
../../media/ffmpeg/ffmpeg_common.cc:777:59: error: âAVCOL_TRC_SMPTEST2084â was not declared in this scope
../../media/ffmpeg/ffmpeg_common.cc:777:59: error: âAVCOL_TRC_SMPTEST428_1â was not declared in this scope

We still need to upgrade Cauldron to at least 3.1 (3.2 is out now and should be compatible).  I don't know what to do about Mageia 5.

So far AAC decoding does not work (90% distortion) with ffmpeg 3.1.x and 3.2 . I guess I'll have to check with ffmpeg 2.8.x (the errors I listed may not be hard to fix) and/or a 3.0.x build.

Upstream has released version 54.0.2840.90 on November 1:
https://googlechromereleases.blogspot.com/2016/11/stable-channel-update-for-desktop.html

This fixes one new security issue.

LWN reference:
http://lwn.net/Vulnerabilities/705823/

Summary: chromium-browser-stable new security issues fixed in 54.0.2840.59 => chromium-browser-stable new security issues fixed in 54.0.2840.90

Upstream has released version 54.0.2840.100 on November 9:
https://googlechromereleases.blogspot.com/2016/11/stable-channel-update-for-desktop_9.html

This fixes several new security issues.

Summary: chromium-browser-stable new security issues fixed in 54.0.2840.90 => chromium-browser-stable new security issues fixed in 54.0.2840.100

(In reply to David Walser from comment #6)
> Upstream has released version 54.0.2840.100 on November 9:
> https://googlechromereleases.blogspot.com/2016/11/stable-channel-update-for-
> desktop_9.html
> 
> This fixes several new security issues.

LWN reference:
http://lwn.net/Vulnerabilities/706473/

Updated packages are available for testing:

MGA5
SRPM:
chromium-browser-stable-54.0.2840.100-1.1.mga5.src.rpm
RPMS:
chromium-browser-stable-54.0.2840.100-1.1.mga5.i586.rpm
chromium-browser-54.0.2840.100-1.1.mga5.i586.rpm
chromium-browser-stable-54.0.2840.100-1.1.mga5.x86_64.rpm
chromium-browser-54.0.2840.100-1.1.mga5.x86_64.rpm




Proposed advisory:




Chromium-browser-stable 54.0.2840.100 fixes security issues:

Multiple flaws were found in Chromium's processing of web content where loading a web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information. (CVE-2016-5181, CVE-2016-5182, CVE-2016-5183, CVE-2016-5184, CVE-2016-5185, CVE-2016-5186, CVE-2016-5187, CVE-2016-5188, CVE-2016-5189, CVE-2016-5190, CVE-2016-5191, CVE-2016-5192, CVE-2016-5193, CVE-2016-5194, CVE-2016-5198, CVE-2016-5199, CVE-2016-5200, CVE-2016-5201, CVE-2016-5202)


References:
https://googlechromereleases.blogspot.com/2016/10/stable-channel-update-for-desktop.html
https://googlechromereleases.blogspot.com/2016/10/stable-channel-update-for-desktop_20.html
https://googlechromereleases.blogspot.com/2016/11/stable-channel-update-for-desktop.html
https://googlechromereleases.blogspot.com/2016/11/stable-channel-update-for-desktop_9.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5181
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5182
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5183
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5184
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5185
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5186
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5187
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5188
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5189
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5190
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5191
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5192
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5193
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5194
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5198
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5199
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5200
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5201
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5202

CC: (none) => cjw
Assignee: cjw => qa-bugs

FYI it adds a new dependency libsnappy1.

Working fine on Mageia 5 x86_64.

Whiteboard: (none) => MGA5-64-OK

I had already started testing mga5-64 before I noticed David had tested it, so, I'll chip in that the usual battery, general browsing, jetstream and acid3 are all OK.

CC: (none) => wrw105

this one broke on cauldron 32bit due to sse2...
that needs to be checked in this update too

CC: (none) => tmb

A CPU with SSE2 support being required to run chromium is apparently a known problem so not something to hold up this update for.

Assignee: cjw => qa-bugs

On mga5-32

$ uname -r
4.4.32-desktop-1.mga5

$ rpm -q chromium-browser-stable libsnappy1
chromium-browser-stable-54.0.2840.100-1.1.mga5
libsnappy1-1.1.2-3.mga5

Works fine - no regressions noted

Although it is almost 10 years old this box is 64 bit capable and supports sse2

I believe that there are more than a few Mageia users who run 32 bit Mageia on 64 bit capable systems.

Ok for mga5-32

CC: (none) => jim
Whiteboard: MGA5-64-OK => MGA5-64-OK MGA5-32-OK

Should a comment be added to the advisory that sse2 support is required?

Validated, and advisory from Comment 8 uploaded.

Keywords: (none) => validated_update
Whiteboard: MGA5-64-OK MGA5-32-OK => MGA5-64-OK MGA5-32-OK advisory
CC: (none) => lewyssmith, sysadmin-bugs

An update for this issue has been pushed to the Mageia Updates repository.

http://advisories.mageia.org/MGASA-2016-0403.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED