Bug 20187

Summary: chromium-browser-stable new security issues fixed in 57.0.2987.133
Product: Mageia Reporter: David Walser <luigiwalser>
Component: SecurityAssignee: QA Team <qa-bugs>
Status: RESOLVED FIXED QA Contact: Sec team <security>
Severity: critical    
Priority: Normal CC: brtians1, cjw, davidwhodgins, herman.viaene, lewyssmith, sysadmin-bugs
Version: 5Keywords: validated_update
Target Milestone: ---   
Hardware: All   
OS: Linux   
URL: https://lwn.net/Vulnerabilities/712801/
Whiteboard: MGA5-32-OK MGA5-64-OK advisory
Source RPM: chromium-browser-stable-55.0.2883.87-1.1.mga5.src.rpm CVE:
Status comment:

Description David Walser 2017-01-26 22:48:43 CET 
Upstream has released version 56.0.2924.76 on January 25:
https://chromereleases.googleblog.com/2017/01/stable-channel-update-for-desktop.html

This fixes several new security issues.

This is the current version in the stable channel:
http://googlechromereleases.blogspot.com/search/label/Stable%20updates
Comment 1 David Walser 2017-01-27 22:17:42 CET 
RedHat has issued an advisory for this on January 26:
https://rhn.redhat.com/errata/RHSA-2017-0206.html

URL: (none) => https://lwn.net/Vulnerabilities/712801/

Comment 2 David Walser 2017-02-20 00:17:31 CET 
Upstream has released version 56.0.2924.87 on February 1:
https://chromereleases.googleblog.com/2017/02/stable-channel-update-for-desktop.html

It is a bug fix release.
Comment 3 David Walser 2017-03-10 12:04:57 CET 
Upstream has released version 57.0.2987.98 on March 9:
https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html

This fixes several new security issues.

This is the current version in the stable channel:
http://googlechromereleases.blogspot.com/search/label/Stable%20updates


Included is a fix for CVE-2017-5029: Integer overflow in libxslt.  We should include the fix in the system libxslt package, if applicable.

Summary: chromium-browser-stable new security issues fixed in 56.0.2924.76 => chromium-browser-stable new security issues fixed in 57.0.2987.98

Comment 4 David Walser 2017-04-02 18:52:03 CEST 
Upstream has released version 57.0.2987.133 on March 29:
https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop_29.html

This fixes several new security issues.

This is the current version in the stable channel:
http://googlechromereleases.blogspot.com/search/label/Stable%20updates

openSUSE has issued an advisory for this today (April 2):
https://lists.opensuse.org/opensuse-updates/2017-04/msg00003.html

Summary: chromium-browser-stable new security issues fixed in 57.0.2987.98 => chromium-browser-stable new security issues fixed in 57.0.2987.133

Comment 5 Christiaan Welvaart 2017-04-18 06:54:50 CEST 
Updated packages are available for testing:

MGA5
SRPM:
chromium-browser-stable-57.0.2987.133-1.mga5.src.rpm
RPMS:
chromium-browser-stable-57.0.2987.133-1.mga5.i586.rpm
chromium-browser-57.0.2987.133-1.mga5.i586.rpm
chromium-browser-stable-57.0.2987.133-1.mga5.x86_64.rpm
chromium-browser-57.0.2987.133-1.mga5.x86_64.rpm



Proposed advisory:



Chromium-browser 57.0.2987.133 fixes security issues:

Multiple flaws were found in the way Chromium 55 processes various types of web content, where loading a web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information. (CVE-2017-5006, CVE-2017-5007, CVE-2017-5008, CVE-2017-5009, CVE-2017-5010, CVE-2017-5011, CVE-2017-5012, CVE-2017-5013, CVE-2017-5014, CVE-2017-5015, CVE-2017-5016, CVE-2017-5017, CVE-2017-5018, CVE-2017-5019, CVE-2017-5020, CVE-2017-5021, CVE-2017-5022, CVE-2017-5023, CVE-2017-5024, CVE-2017-5025, CVE-2017-5026, CVE-2017-5027, CVE-2017-5029, CVE-2017-5030, CVE-2017-5031, CVE-2017-5032, CVE-2017-5033, CVE-2017-5034, CVE-2017-5035, CVE-2017-5036, CVE-2017-5037, CVE-2017-5038, CVE-2017-5039, CVE-2017-5040, CVE-2017-5041, CVE-2017-5042, CVE-2017-5043, CVE-2017-5044, CVE-2017-5045, CVE-2017-5046, CVE-2017-5052, CVE-2017-5053, CVE-2017-5054, CVE-2017-5055, CVE-2017-5056)


References:
https://chromereleases.googleblog.com/2017/01/stable-channel-update-for-desktop.html
https://chromereleases.googleblog.com/2017/02/stable-channel-update-for-desktop.html
https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html
https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop_16.html
https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop_29.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5006
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5007
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5008
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5009
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5010
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5011
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5012
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5013
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5014
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5015
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5016
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5017
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5018
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5019
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5020
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5021
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5022
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5023
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5024
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5025
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5026
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5027
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5029
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5030
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5031
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5032
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5033
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5034
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5035
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5036
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5037
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5038
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5039
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5040
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5041
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5042
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5043
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5044
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5045
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5046
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5052
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5053
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5054
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5055
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5056

Assignee: cjw => qa-bugs
CC: (none) => cjw

Comment 6 Lewis Smith 2017-04-18 08:46:05 CEST 
Wanting to test this (chromium-browser-stable 64-bit), I could not find it in Updates Testing (core, nonfree, tainted). Perhaps a mirror problem.

CC: (none) => lewyssmith

Comment 7 Herman Viaene 2017-04-18 11:03:51 CEST 
MGA5-32 on AsusA6000VM Xfce
No installation issues.
Tried chromium on some website where Firefox is not 100% correct. All OK here.
Tried also my 2 favorite internet radios: OK.

Whiteboard: (none) => MGA5-32-OK
CC: (none) => herman.viaene

Comment 8 David Walser 2017-04-18 11:32:35 CEST 
Working fine on Mageia 5 x86_64 as well.

Whiteboard: MGA5-32-OK => MGA5-32-OK MGA5-64-OK

Comment 9 Brian Rockwell 2017-04-18 19:16:57 CEST 
tested in Mageia 5 x86_64 (KDE)

No issues.  Tested hangouts phone, etc.  Working as designed.

CC: (none) => brtians1

Dave Hodgins 2017-04-18 22:40:47 CEST

Keywords: (none) => validated_update
Whiteboard: MGA5-32-OK MGA5-64-OK => MGA5-32-OK MGA5-64-OK advisory
CC: (none) => davidwhodgins, sysadmin-bugs

Comment 10 Mageia Robot 2017-04-21 09:25:02 CEST 
An update for this issue has been pushed to the Mageia Updates repository.

http://advisories.mageia.org/MGASA-2017-0111.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED