Bug 20708 - chromium-browser-stable new security issues fixed in 60.0.3112.78
Summary: chromium-browser-stable new security issues fixed in 60.0.3112.78
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 6
Hardware: All Linux
Priority: Normal critical
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA5TOO mga6-32-ok mga6-64-ok MGA5-64...
Keywords: validated_update
: 21584 (view as bug list)
Depends on:
Blocks:
 
Reported: 2017-04-20 11:59 CEST by David Walser
Modified: 2017-08-29 00:48 CEST (History)
7 users (show)

See Also:
Source RPM: chromium-browser-stable-57.0.2987.133-1.mga5.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2017-04-20 11:59:18 CEST
Upstream has released version 58.0.3029.81 on April 19:
https://chromereleases.googleblog.com/2017/04/stable-channel-update-for-desktop.html

This fixes several new security issues.

This is the current version in the stable channel:
http://googlechromereleases.blogspot.com/search/label/Stable%20updates
Comment 1 David Walser 2017-05-07 19:14:36 CEST
Upstream has released version 58.0.3029.96 on May 2:
https://chromereleases.googleblog.com/2017/05/stable-channel-update-for-desktop.html

This fixes one new security issue.

This is the current version in the stable channel:
http://googlechromereleases.blogspot.com/search/label/Stable%20updates

openSUSE has issued an advisory for this today (May 7):
https://lists.opensuse.org/opensuse-updates/2017-05/msg00010.html

Summary: chromium-browser-stable new security issues fixed in 58.0.3029.81 => chromium-browser-stable new security issues fixed in 58.0.3029.96

Comment 2 David Walser 2017-05-23 04:30:39 CEST
Upstream has released version 58.0.3029.110 on May 9:
https://chromereleases.googleblog.com/2017/05/stable-channel-update-for-desktop_9.html

It is a bugfix release.
Christiaan Welvaart 2017-06-06 01:41:39 CEST

Summary: chromium-browser-stable new security issues fixed in 58.0.3029.96 => chromium-browser-stable new security issues fixed in 59.0.3071.86

Comment 3 David Walser 2017-06-06 02:17:36 CEST
Upstream has released version 59.0.3071.86 today (June 5):
https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop.html

This fixes several new security issues.

This is the current version in the stable channel:
http://googlechromereleases.blogspot.com/search/label/Stable%20updates
Comment 4 David Walser 2017-06-19 12:01:57 CEST
Upstream has released version 59.0.3071.104 on June 15:
https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop_15.html

This fixes a few new security issues.

This is the current version in the stable channel:
http://googlechromereleases.blogspot.com/search/label/Stable%20updates

openSUSE has issued an advisory for this today (June 19):
https://lists.opensuse.org/opensuse-updates/2017-06/msg00058.html

Summary: chromium-browser-stable new security issues fixed in 59.0.3071.86 => chromium-browser-stable new security issues fixed in 59.0.3071.104

Comment 5 David Walser 2017-06-23 22:40:16 CEST
Upstream has released version 59.0.3071.109 on June 20:
https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop_20.html

This is a bug fix release.
David Walser 2017-07-13 12:02:36 CEST

Version: 5 => 6
Whiteboard: (none) => MGA5TOO

Comment 6 David Walser 2017-07-26 12:39:46 CEST
Upstream has released version 59.0.3071.115 on June 26:
https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop_26.html

This is a bug fix release.
Comment 7 David Walser 2017-07-26 12:41:33 CEST
Upstream has released version 60.0.3112.78 on July 25:
https://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html

This fixes several new security issues.

This is the current version in the stable channel:
http://googlechromereleases.blogspot.com/search/label/Stable%20updates

Summary: chromium-browser-stable new security issues fixed in 59.0.3071.104 => chromium-browser-stable new security issues fixed in 60.0.3112.78

Comment 8 David Walser 2017-07-29 16:32:14 CEST
openSUSE has issued an advisory for this on July 28:
https://lists.opensuse.org/opensuse-updates/2017-07/msg00104.html
Comment 9 David Walser 2017-08-09 02:42:05 CEST
Debian has issued an advisory for this on August 4:
https://www.debian.org/security/2017/dsa-3926
Comment 10 Nicolas Lécureuil 2017-08-20 12:24:13 CEST
to update chromium on mga5 and mga6 i need to update libvpx, which means rebuilding: 

$ urpmq --whatrequires lib64vpx4
chromium-browser-stable
firefox
gstreamer1.0-vp8
iceape
lib64avcodec57
lib64mediastreamer7
lib64myth0.28
lib64qt5webenginecore5
lib64qxmpp0
lib64vpx-devel
lib64vpx4
lib64xine2
libvpx-utils
mythtv-plugin-archive
mythtv-plugin-browser
mythtv-plugin-gallery
mythtv-plugin-game
mythtv-plugin-music
mythtv-plugin-netvision
mythtv-plugin-news
mythtv-plugin-weather
mythtv-plugin-zoneminder
php-gd
thunderbird
virtualbox
vlc-plugin-common


i think this is better ( at least for mga5 ) to use bundled vpx.
Wdyt ?

CC: (none) => mageia

Comment 11 David Walser 2017-08-20 15:35:00 CEST
(In reply to Nicolas Lécureuil from comment #10)
> to update chromium on mga5 and mga6 i need to update libvpx
> 
> i think this is better ( at least for mga5 ) to use bundled vpx.
> Wdyt ?

Yes.
Comment 12 David Walser 2017-08-20 22:40:59 CEST
Two additional bugfix releases came out on August 2 and August 14:
https://chromereleases.googleblog.com/2017/08/stable-channel-update-for-desktop.html
https://chromereleases.googleblog.com/2017/08/stable-channel-update-for-desktop_14.html

60.0.3112.101 is now the current stable version.  Cauldron is one behind.
Nicolas Lécureuil 2017-08-21 15:35:32 CEST

Blocks: (none) => 21584

Comment 13 Nicolas Lécureuil 2017-08-21 15:36:42 CEST
pushed in updates_testing:

src.rpm:
        chromium-browser-stable-60.0.3112.101-1.mga6

Assignee: cjw => qa-bugs
Whiteboard: MGA5TOO => (none)

Comment 14 Bill Wilkinson 2017-08-21 21:10:09 CEST
MGa6-64 appears to be working fine. general browsing, Jetstream, youtube video.

I had an issue with Acid3, but it hasn't been hugely troubling in the past.

Whiteboard: (none) => mga6-64-ok
CC: (none) => wrw105

Comment 15 Bill Wilkinson 2017-08-21 21:11:19 CEST
Also, it looks like an old version in the info in the bug page header is showing chromium 57. Not sure if that will bother the scripts or not.
Comment 16 Lewis Smith 2017-08-21 21:33:46 CEST
Testing MGA6 real hardware
Installed from issue repos, updated from Updates Testing to:
 chromium-browser-stable-60.0.3112.101-1.mga6
Tried a couple of slightly fancy sites, notably BBC; videos & sound OK.
For me, MGA6-64-OK; but do Bill W's comments prevent this? If not - please add it to whiteboard.

CC: (none) => lewyssmith

Comment 17 Lewis Smith 2017-08-21 21:43:47 CEST
(continued)
I forgot: under XFCE desktop, it overflows under the bottom taskbar. And does not have the normal window top bar to right-click, resize from. Luckily Alt/left mouse button enables moving the window up to reduce its hight with the now visible bottom window edge. This would not stop the OK from me: it was always thus.

This sort of problem is not Chromium specific (notably also with Gimp single-window; but that has the normal window top-bar which enables resizing).
Nicolas Lécureuil 2017-08-22 01:29:05 CEST

Summary: chromium-browser-stable new security issues fixed in 60.0.3112.78 => chromium-browser-stable new security issues fixed in 60.0.3112.101

Comment 19 William Kenney 2017-08-25 23:03:47 CEST
In VirtualBox, M4, KDE, 32-bit

Package(s) under test:
chromium-browser-stable

default install of chromium-browser-stable

[root@localhost wilcal]# urpmi chromium-browser-stable
Package chromium-browser-stable-57.0.2987.133-6.mga6.i586 is already installed

Chromium works, many websites are accessible, YouTube/Vimeo videos play,
common plugins are active.
http://www.webstandards.org/files/acid2/test.html#top  test ok
http://acid3.acidtests.org/   test ok

install Chromium from updates_testing

[root@localhost wilcal]# urpmi chromium-browser-stable
Package chromium-browser-stable-60.0.3112.101-1.mga6.i586 is already installed

Chromium works, all websites are accessible, YouTube/Vimeo videos play,
common plugins are active. weather.com does work.
http://www.webstandards.org/files/acid2/test.html#top  test ok
http://acid3.acidtests.org/   test ok

CC: (none) => wilcal.int

William Kenney 2017-08-25 23:04:07 CEST

Whiteboard: mga6-64-ok => mga6-32-ok mga6-64-ok

Comment 20 William Kenney 2017-08-25 23:04:48 CEST
This update works fine.
Testing complete for MGA5, 32-bit & 64-bit
Validating the update.
Could someone from the sysadmin team push to updates.
Thanks

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

Comment 21 David Walser 2017-08-28 11:07:16 CEST
*** Bug 21584 has been marked as a duplicate of this bug. ***

Blocks: 21584 => (none)

Comment 22 David Walser 2017-08-28 11:08:20 CEST
Adding Mageia 5 back to this bug.  Package list for Mageia 5:
https://bugs.mageia.org/show_bug.cgi?id=21584#c2

Advisory for this update:
https://bugs.mageia.org/show_bug.cgi?id=21584#c3

Whiteboard: mga6-32-ok mga6-64-ok => MGA5TOO mga6-32-ok mga6-64-ok
Keywords: validated_update => (none)

Comment 23 PC LX 2017-08-28 17:28:44 CEST
Installed and tested without issue. Tested video, audio, WebGL and general sites.

System: Mageia 5, x86_64, Plasma, Intel CPU, nVidia GPU with proprietary driver nvidia 340.

$ uname -a
Linux marte 4.4.82-desktop-1.mga5 #1 SMP Sun Aug 13 18:03:58 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
$ rpm -q chromium-browser-stable
chromium-browser-stable-60.0.3112.101-1.mga5

CC: (none) => mageia

PC LX 2017-08-28 17:29:00 CEST

Whiteboard: MGA5TOO mga6-32-ok mga6-64-ok => MGA5TOO mga6-32-ok mga6-64-ok MGA5-64-OK

Comment 24 Lewis Smith 2017-08-28 20:32:36 CEST
Advisory as advised from:
 https://bugs.mageia.org/show_bug.cgi?id=21584#c3
 https://bugs.mageia.org/show_bug.cgi?id=21584#c2
and this bug Comment 13.
Validating, as it has 3/4 possible OKs.

Whiteboard: MGA5TOO mga6-32-ok mga6-64-ok MGA5-64-OK => MGA5TOO mga6-32-ok mga6-64-ok MGA5-64-OK advisory
Keywords: (none) => validated_update

Comment 25 Mageia Robot 2017-08-29 00:48:45 CEST
An update for this issue has been pushed to the Mageia Updates repository.

http://advisories.mageia.org/MGASA-2017-0317.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED


Note You need to log in before you can comment on or make changes to this bug.