One of the issues listed is:
CVE-2015-1258: Negative-size parameter in Libvpx

We'll likely need to address that in our libvpx package.

Thanks for the bugreport. Locally I build chromium dev versions against a recent system libvpx so I should update my local build.

Maybe mga4 libvpx does not support vp9? No clue about the cauldron libvpx package. Unfortunately the major library version changed earlier this year so we can't simply update libvpx to the latest revision.

For cauldron (MGA5) a freeze push request has been sent.

For MGA4, updated packages are available for testing:

MGA4
SRPM:
chromium-browser-stable-43.0.2357.65-1.mga4.src.rpm

RPMS:
chromium-browser-stable-43.0.2357.65-1.mga4.i586.rpm
chromium-browser-43.0.2357.65-1.mga4.i586.rpm
chromium-browser-stable-43.0.2357.65-1.mga4.x86_64.rpm
chromium-browser-43.0.2357.65-1.mga4.x86_64.rpm



Proposed advisory:


Chromium-browser 43.0.2357.65 fixes a number of security issues:

Use-after-free vulnerability in the SpeechRecognitionClient implementation in the Speech subsystem in Google Chrome before 43.0.2357.65 allows remote attackers to execute arbitrary code via a crafted document. (CVE-2015-1251)

common/partial_circular_buffer.cc in Google Chrome before 43.0.2357.65 does not properly handle wraps, which allows remote attackers to bypass a sandbox protection mechanism or cause a denial of service (out-of-bounds write) via vectors that trigger a write operation with a large amount of data, related to the PartialCircularBuffer::Write and PartialCircularBuffer::DoWrite functions. (CVE-2015-1252)

core/html/parser/HTMLConstructionSite.cpp in the DOM implementation in Blink, as used in Google Chrome before 43.0.2357.65, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code that appends a child to a SCRIPT element, related to the insert and executeReparentTask functions. (CVE-2015-1253)

core/dom/Document.cpp in Blink, as used in Google Chrome before 43.0.2357.65, enables the inheritance of the designMode attribute, which allows remote attackers to bypass the Same Origin Policy by leveraging the availability of editing. (CVE-2015-1254)

Use-after-free vulnerability in content/renderer/media/webaudio_capturer_source.cc in the WebAudio implementation in Google Chrome before 43.0.2357.65 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by leveraging improper handling of a stop action for an audio track. (CVE-2015-1255)

Use-after-free vulnerability in the SVG implementation in Blink, as used in Google Chrome before 43.0.2357.65, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document that leverages improper handling of a shadow tree for a use element. (CVE-2015-1256)

platform/graphics/filters/FEColorMatrix.cpp in the SVG implementation in Blink, as used in Google Chrome before 43.0.2357.65, does not properly handle an insufficient number of values in an feColorMatrix filter, which allows remote attackers to cause a denial of service (container overflow) or possibly have unspecified other impact via a crafted document. (CVE-2015-1257)

Google Chrome before 43.0.2357.65 relies on libvpx code that was not built with an appropriate --size-limit value, which allows remote attackers to trigger a negative value for a size field, and consequently cause a denial of service or possibly have unspecified other impact, via a crafted frame size in VP9 video data. (CVE-2015-1258)

PDFium, as used in Google Chrome before 43.0.2357.65, does not properly initialize memory, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors. (CVE-2015-1259)

Multiple use-after-free vulnerabilities in content/renderer/media/user_media_client_impl.cc in the WebRTC implementation in Google Chrome before 43.0.2357.65 allow remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that executes upon completion of a getUserMedia request. (CVE-2015-1260)

platform/fonts/shaping/HarfBuzzShaper.cpp in Blink, as used in Google Chrome before 43.0.2357.65, does not initialize a certain width field, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted Unicode text. (CVE-2015-1262)

The Spellcheck API implementation in Google Chrome before 43.0.2357.65 does not use an HTTPS session for downloading a Hunspell dictionary, which allows man-in-the-middle attackers to deliver incorrect spelling suggestions or possibly have unspecified other impact via a crafted file. (CVE-2015-1263)

Cross-site scripting (XSS) vulnerability in Google Chrome before 43.0.2357.65 allows user-assisted remote attackers to inject arbitrary web script or HTML via crafted data that is improperly handled by the Bookmarks feature. (CVE-2015-1264)

Multiple unspecified vulnerabilities in Google Chrome before 43.0.2357.65 allow attackers to cause a denial of service or possibly have other impact via unknown vectors. (CVE-2015-1265)

Multiple vulnerabilities in V8 have been fixed at the tip of the 4.3 branch (currently 4.3.61.21).


References:
http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1251
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1252
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1253
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1254
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1255
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1256
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1257
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1258
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1259
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1260
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1262
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1263
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1264
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1265

CC: (none) => cjw
Version: Cauldron => 4
Assignee: cjw => qa-bugs

tested mga4-64 with general browsing, acid3, sunspider.  All OK

CC: (none) => wrw105
Whiteboard: MGA5TOO, MGA4TOO => MGA5TOO, MGA4TOO, mga4-64-ok

MGA4-32-OKing it because general browsing , Acid3, etc. are fine there. in a VBox i586 VM.

CC: (none) => shlomif
Whiteboard: MGA5TOO, MGA4TOO, mga4-64-ok => MGA5TOO, MGA4TOO, mga4-64-ok, mga4-32-ok

Thanks Christiaan!  It's being uploaded in Cauldron now.

Adding feedback for the moment so libvpx can be investigated.

Whiteboard: MGA5TOO, MGA4TOO, mga4-64-ok, mga4-32-ok => mga4-64-ok mga4-32-ok feedback

The bundled libvpx (which our Chromium uses) was fixed by updating it to 1.4.0, which is binary incompatible.  They also used a size-limit build option:
https://codereview.chromium.org/1106303002

libvpx bug filed as Bug 16019.  Removing feedback.

Whiteboard: mga4-64-ok mga4-32-ok feedback => mga4-64-ok mga4-32-ok

Looks like CVE-2015-3910 is fixed too:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3910

from http://lwn.net/Vulnerabilities/645635/

Also for CVE-2015-1262 (already in our advisory):
http://lwn.net/Vulnerabilities/645631/

CVE-2015-1261 looks right to have been left out, it's for Android.

The other LWN reference for the rest of the issues in in the URL.

URL: (none) => http://lwn.net/Vulnerabilities/645629/

Thanks guys

Validating. Advisory uploaded.

Please push to 4 updates

Thanks

Keywords: (none) => validated_update
Whiteboard: mga4-64-ok mga4-32-ok => has_procedure advisory mga4-64-ok mga4-32-ok
CC: (none) => sysadmin-bugs

An update for this issue has been pushed to Mageia Updates repository.

http://advisories.mageia.org/MGASA-2015-0235.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED