Bug 25655

Summary:	chromium-browser-stable security issues fixed in 78.0.3904.87
Product:	Mageia	Reporter:	Christiaan Welvaart <cjw>
Component:	Security	Assignee:	QA Team <qa-bugs>
Status:	RESOLVED FIXED	QA Contact:	Sec team <security>
Severity:	normal
Priority:	Normal	CC:	andrewsfarm, cjw, herman.viaene, sysadmin-bugs, tmb
Version:	7	Keywords:	advisory, validated_update
Target Milestone:	---
Hardware:	All
OS:	Linux
Whiteboard:	MGA7-64-OK
Source RPM:	chromium-browser-stable-77.0.3865.120-1.mga7.src.rpm	CVE:
Status comment:

Description Christiaan Welvaart 2019-11-04 21:46:25 CET

Upstream released 78.0.3904.70 and 78.0.3904.87 with several security fixes:
https://chromereleases.googleblog.com/2019/10/stable-channel-update-for-desktop_22.html
https://chromereleases.googleblog.com/2019/10/stable-channel-update-for-desktop_31.html

Comment 1 Christiaan Welvaart 2019-11-04 21:51:44 CET

Updated packages are available for testing:

MGA7
SRPM:
chromium-browser-stable-78.0.3904.87-1.mga7.src.rpm
RPMS:
chromium-browser-78.0.3904.87-1.mga7.i586.rpm
chromium-browser-stable-78.0.3904.87-1.mga7.i586.rpm
chromium-browser-78.0.3904.87-1.mga7.x86_64.rpm
chromium-browser-stable-78.0.3904.87-1.mga7.x86_64.rpm


Advisory:



Chromium-browser 78.0.3904.87 fixes security issues:

Multiple flaws were found in the way Chromium 77.0.3865.120 processes various types of web content, where loading a web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information. (CVE-2019-13699, CVE-2019-13700, CVE-2019-13701, CVE-2019-13702, CVE-2019-13703, CVE-2019-13704, CVE-2019-13705, CVE-2019-13706, CVE-2019-13707, CVE-2019-13708, CVE-2019-13709, CVE-2019-13710, CVE-2019-13711, CVE-2019-13713, CVE-2019-13714, CVE-2019-13715, CVE-2019-13716, CVE-2019-13717, CVE-2019-13718, CVE-2019-13719, CVE-2019-15903, CVE-2019-13720, CVE-2019-13721)



References:

https://chromereleases.googleblog.com/2019/10/stable-channel-update-for-desktop_22.html
https://chromereleases.googleblog.com/2019/10/stable-channel-update-for-desktop_31.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13699
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13700
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13701
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13702
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13703
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13704
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13705
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13706
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13707
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13708
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13709
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13710
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13711
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13713
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13714
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13715
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13716
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13717
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13718
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13719
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15903
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13720
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13721

Assignee: cjw => qa-bugs
CC: (none) => cjw

Comment 2 David Walser 2019-11-05 03:06:12 CET

Fixing CVE-2019-15903 will require updating expat.

Keywords: (none) => feedback

Comment 3 Christiaan Welvaart 2019-11-05 20:30:48 CET

Oops, I did not see that.


Updated advisory:


Chromium-browser 78.0.3904.87 fixes security issues:

Multiple flaws were found in the way Chromium 77.0.3865.120 processes various types of web content, where loading a web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information. (CVE-2019-13699, CVE-2019-13700, CVE-2019-13701, CVE-2019-13702, CVE-2019-13703, CVE-2019-13704, CVE-2019-13705, CVE-2019-13706, CVE-2019-13707, CVE-2019-13708, CVE-2019-13709, CVE-2019-13710, CVE-2019-13711, CVE-2019-13713, CVE-2019-13714, CVE-2019-13715, CVE-2019-13716, CVE-2019-13717, CVE-2019-13718, CVE-2019-13719, CVE-2019-13720, CVE-2019-13721)



References:

https://chromereleases.googleblog.com/2019/10/stable-channel-update-for-desktop_22.html
https://chromereleases.googleblog.com/2019/10/stable-channel-update-for-desktop_31.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13699
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13700
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13701
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13702
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13703
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13704
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13705
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13706
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13707
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13708
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13709
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13710
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13711
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13713
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13714
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13715
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13716
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13717
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13718
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13719
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13720
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13721

Comment 4 Christiaan Welvaart 2019-11-05 20:31:40 CET

Is there no mga bug report for expat yet?

Comment 5 David Walser 2019-11-05 21:18:46 CET

I did not file a separate bug.

Comment 6 Christiaan Welvaart 2019-11-05 21:33:02 CET

AFAICT chromium bundled expat was updated to 2.2.8, which AFAIK we should not do, so I filed a separate bug for the expat security issue: #25661 .

Christiaan Welvaart 2019-11-06 00:14:05 CET

Keywords: feedback => (none)

Comment 7 Herman Viaene 2019-11-06 15:45:03 CET

MGA7-64 Plasma on Lenovo B50
No installation issues.
Usual surfing operations all OK.
Ref to bug25580 Comment 2: succeeded in syncing with Google device and importing exported Firefox bookmarks .
OK for me.

CC: (none) => herman.viaene
Whiteboard: (none) => MGA7-64-OK

Comment 8 Thomas Andrews 2019-11-07 16:26:45 CET

OK by me. Validating. Advisory information in Comments 1 and 3.

The expat update is my next stop.

CC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => validated_update

Thomas Backlund 2019-11-07 22:29:54 CET

Keywords: (none) => advisory
CC: (none) => tmb

Comment 9 Mageia Robot 2019-11-08 00:38:43 CET

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2019-0320.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED