Bug 23558 - chromium-browser-stable new security issues fixed in 77.0.3865.75
Summary: chromium-browser-stable new security issues fixed in 77.0.3865.75
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 7
Hardware: All Linux
Priority: Normal critical
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA7-64-OK,MGA7-32-OK
Keywords: advisory, validated_update
Depends on:
Blocks: 24835 26042
  Show dependency treegraph
 
Reported: 2018-09-11 23:05 CEST by David Walser
Modified: 2020-01-09 12:40 CET (History)
6 users (show)

See Also:
Source RPM: chromium-browser-stable-68.0.3440.106-1.mga6.src.rpm
CVE:
Status comment:


Attachments
draft specfile for gcc8 needed to build chromium on mga6 (91.16 KB, text/plain)
2019-02-19 21:42 CET, Christiaan Welvaart
Details
draft specfile for gcc8 needed to build chromium on mga6 (91.16 KB, text/plain)
2019-03-11 09:11 CET, Christiaan Welvaart
Details
draft specfile for gcc8 needed to build chromium on mga6 (92.27 KB, text/plain)
2019-03-11 09:12 CET, Christiaan Welvaart
Details

Description David Walser 2018-09-11 23:05:37 CEST
Upstream has released version 69.0.3497.92 today (September 11):
https://chromereleases.googleblog.com/2018/09/stable-channel-update-for-desktop_11.html

They also released version 69.0.3497.81 on September 4:
https://chromereleases.googleblog.com/2018/09/stable-channel-update-for-desktop.html

They fix several new security issues.

This is the current version in the stable channel:
http://googlechromereleases.blogspot.com/search/label/Stable%20updates

There were also two bugfix releases since our last update:
https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop_31.html
https://chromereleases.googleblog.com/2018/08/stable-channel-update-for-desktop.html

Debian has issued an advisory for this on September 7:
https://www.debian.org/security/2018/dsa-4289
Comment 1 David Walser 2018-09-11 23:10:23 CEST
openSUSE has issued an advisory for this on September 8:
https://lists.opensuse.org/opensuse-updates/2018-09/msg00040.html
David Walser 2018-09-11 23:33:37 CEST

Depends on: (none) => 23554

Comment 2 David Walser 2018-10-12 23:14:39 CEST
Upstream has released version 69.0.3497.100 on September 17:
https://chromereleases.googleblog.com/2018/09/stable-channel-update-for-desktop_17.html

It fixes one new security issue.

This is the current version in the stable channel:
http://googlechromereleases.blogspot.com/search/label/Stable%20updates

openSUSE has issued an advisory for this on September 20:
https://lists.opensuse.org/opensuse-updates/2018-09/msg00081.html

Summary: chromium-browser-stable new security issues fixed in 69.0.3497.92 => chromium-browser-stable new security issues fixed in 69.0.3497.100

Comment 3 David Walser 2018-10-17 20:45:17 CEST
Upstream has released version 70.0.3538.67 on October 16:
https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.html

It fixes several new security issues.

This is the current version in the stable channel:
http://googlechromereleases.blogspot.com/search/label/Stable%20updates

Summary: chromium-browser-stable new security issues fixed in 69.0.3497.100 => chromium-browser-stable new security issues fixed in 70.0.3538.67

Comment 4 David Walser 2018-10-23 17:00:36 CEST
openSUSE has issued an advisory for this on October 22:
https://lists.opensuse.org/opensuse-updates/2018-10/msg00115.html
Comment 5 David Walser 2018-10-26 18:57:57 CEST
Upstream has released version 70.0.3538.77 on October 24:
https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop_24.html

It is a bugfix release.

This is the current version in the stable channel:
http://googlechromereleases.blogspot.com/search/label/Stable%20updates
Comment 6 David Walser 2018-11-20 23:08:48 CET
Upstream has released version 70.0.3538.102 on November 9:
https://chromereleases.googleblog.com/2018/11/stable-channel-update-for-desktop.html

Upstream has released version 70.0.3538.110 on November 19:
https://chromereleases.googleblog.com/2018/11/stable-channel-update-for-desktop_19.html

They each fix one new security issue.

This is the current version in the stable channel:
http://googlechromereleases.blogspot.com/search/label/Stable%20updates

Debian and openSUSE have issued advisories for the first issue on November 18/19:
https://www.debian.org/security/2018/dsa-4340
https://lists.opensuse.org/opensuse-updates/2018-11/msg00093.html

Summary: chromium-browser-stable new security issues fixed in 70.0.3538.67 => chromium-browser-stable new security issues fixed in 70.0.3538.110

Comment 7 David Walser 2018-12-05 19:14:39 CET
Upstream has released version 71.0.3578.80 on September 17:
https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html

It fixes several new security issues.

This is the current version in the stable channel:
http://googlechromereleases.blogspot.com/search/label/Stable%20updates

Summary: chromium-browser-stable new security issues fixed in 70.0.3538.110 => chromium-browser-stable new security issues fixed in 71.0.3578.80

Comment 8 David Walser 2018-12-26 02:22:37 CET
Advisories for the newer stuff from openSUSE (November 23 and December 8):
https://lists.opensuse.org/opensuse-updates/2018-11/msg00109.html
https://lists.opensuse.org/opensuse-updates/2018-12/msg00041.html
Comment 9 David Walser 2018-12-26 02:23:22 CET
Debian advisory for the same from December 7:
https://www.debian.org/security/2018/dsa-4352
Comment 10 David Walser 2018-12-26 02:24:44 CET
Upstream has released version 71.0.3578.98 on December 12:
https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop_12.html

It fixes one new security issue.

This is the current version in the stable channel:
http://googlechromereleases.blogspot.com/search/label/Stable%20updates

openSUSE has issued an advisory for this on December 14:
https://lists.opensuse.org/opensuse-updates/2018-12/msg00066.html

Summary: chromium-browser-stable new security issues fixed in 71.0.3578.80 => chromium-browser-stable new security issues fixed in 71.0.3578.98

Comment 11 David Walser 2019-02-01 18:45:05 CET
Upstream has released version 72.0.3626.81 on January 29:
https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.html

It fixes several new security issues.

This is the current version in the stable channel:
http://googlechromereleases.blogspot.com/search/label/Stable%20updates

Summary: chromium-browser-stable new security issues fixed in 71.0.3578.98 => chromium-browser-stable new security issues fixed in 72.0.3626.81

Comment 12 David Walser 2019-02-11 23:20:01 CET
Upstream has released version 72.0.3626.96 on February 6:
https://chromereleases.googleblog.com/2019/02/stable-channel-update-for-desktop.html

It fixes one new security issue.

This is the current version in the stable channel:
http://googlechromereleases.blogspot.com/search/label/Stable%20updates

Summary: chromium-browser-stable new security issues fixed in 72.0.3626.81 => chromium-browser-stable new security issues fixed in 72.0.3626.96

Comment 13 David Walser 2019-02-19 00:22:00 CET
Upstream has released version 72.0.3626.109 on February 13:
https://chromereleases.googleblog.com/2019/02/stable-channel-update-for-desktop_13.html

It is a bugfix release.

This is the current version in the stable channel:
http://googlechromereleases.blogspot.com/search/label/Stable%20updates
Comment 14 David Walser 2019-02-19 00:48:58 CET
openSUSE has issued an advisory for this today (February 18):
https://lists.opensuse.org/opensuse-updates/2019-02/msg00095.html
Comment 15 Christiaan Welvaart 2019-02-19 21:42:30 CET
Created attachment 10756 [details]
draft specfile for gcc8 needed to build chromium on mga6

I couldn't build M69 with gcc or clang in MGA6 so I'm quite sure M72 won't build either. With the packages listed below from attached gcc8 SPEC file installed, I did manage to build M69.

gcc8
gcc8-cpp
gcc8-c++
libstdc++-static-devel <= this package needs to be renamed

CC: (none) => cjw

Comment 16 David Walser 2019-02-20 23:41:54 CET
Debian advisory for this from February 18:
https://www.debian.org/security/2019/dsa-4395

CC'ing Thomas because of gcc and Comment 15.

CC: (none) => tmb

Comment 17 David Walser 2019-03-07 03:37:28 CET
Upstream has released version 72.0.3626.121 on March 1:
https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop.html

It fixes one new security issue.

This is the current version in the stable channel:
http://googlechromereleases.blogspot.com/search/label/Stable%20updates

There have also been a couple bugfix releases before this update, one in Comment 13 and one here:
https://chromereleases.googleblog.com/2019/02/stable-channel-update-for-desktop_21.html

As for the latest security update, as it says, it is being exploited in the wild.  It has hit the press and someone from Google quoted as saying that people should update immediately.  We really have to find a way to get this package updated.

Summary: chromium-browser-stable new security issues fixed in 72.0.3626.96 => chromium-browser-stable new security issues fixed in 72.0.3626.121

Comment 18 Christiaan Welvaart 2019-03-07 20:55:59 CET
Next problem for mga6, I guess nodejs is too old:

RuntimeError: /usr/bin/node ../../third_party/node/node_modules/polymer-css-build/bin/polymer-css-build --polymer-version 1 --no-inline-includes -f /home/cjw/rpm/BUILD/chromium-72.0.3626.109/out/Release/gen/chrome/browser/resources/md_history/bundled/app.vulcanized.html /home/cjw/rpm/BUILD/chromium-72.0.3626.109/out/Release/gen/chrome/browser/resources/md_history/bundled/lazy_load.vulcanized.html -o /home/cjw/rpm/BUILD/chromium-72.0.3626.109/out/Release/gen/chrome/browser/resources/md_history/app.vulcanized.html /home/cjw/rpm/BUILD/chromium-72.0.3626.109/out/Release/gen/chrome/browser/resources/md_history/lazy_load.vulcanized.html failed: /home/cjw/rpm/BUILD/chromium-72.0.3626.109/third_party/node/node_modules/polymer-css-build/index.js:301
async function polymerCssBuild(paths, options = {}) {
      ^^^^^^^^
SyntaxError: Unexpected token function
    at createScript (vm.js:56:10)
    at Object.runInThisContext (vm.js:97:10)
    at Module._compile (module.js:542:28)
    at Object.Module._extensions..js (module.js:579:10)
    at Module.load (module.js:487:32)
    at tryModuleLoad (module.js:446:12)
    at Function.Module._load (module.js:438:3)
    at Module.require (module.js:497:17)
    at require (internal/module.js:20:19)
    at Object.<anonymous> (/home/cjw/rpm/BUILD/chromium-72.0.3626.109/third_party/node/node_modules/polymer-css-build/bin/polymer-css-build:11:31)
Comment 19 David Walser 2019-03-07 21:19:06 CET
I think Nicolas was thinking about upgrading nodejs to a newer branch.

CC: (none) => mageia

Comment 20 David Walser 2019-03-08 22:21:42 CET
openSUSE has issued an advisory for this today (March 8):
https://lists.opensuse.org/opensuse-updates/2019-03/msg00029.html
Comment 21 Christiaan Welvaart 2019-03-09 19:31:11 CET
I think I managed to build the nodejs version in cauldron as part of the mga6 chromium package build (as was done for mga5 earlier).

Next problem for mga6: apparently closure-compiler is too old as well:

../../third_party/closure_compiler/externs/polymer-1.0.js:37: WARNING - Parse error. unknown @suppress parameter: strictMissingProperties
 * @suppress {strictMissingProperties}
              ^

../../third_party/closure_compiler/externs/mojo_core.js:5: ERROR - this language feature is only supported in es6 mode: const declarations. Use --language_in=ECMASCRIPT6 or ECMASCRIPT6_STRICT to enable ES6 features.
const Mojo = {};
      ^

etc.

Adding --language_in=ECMASCRIPT6 does not help:

com.google.javascript.jscomp.CompilerOptionsPreprocessor$InvalidOptionsException: ES6 is only supported for transpilation to a lower ECMAScript version. Set --language_out to ES3, ES5, or ES5_strict.
Comment 22 Christiaan Welvaart 2019-03-10 10:27:57 CET
And another build problem for mga6:

../../v8/src/objects/intl-objects.cc:42:28: error: static assertion failed: v8 is required to build with ICU 63 and up
     V8_MINIMUM_ICU_VERSION <= U_ICU_VERSION_MAJOR_NUM,

I guess I should try to build it with the bundled icu.
Comment 23 Christiaan Welvaart 2019-03-11 09:11:05 CET
Created attachment 10861 [details]
draft specfile for gcc8 needed to build chromium on mga6

Attachment 10756 is obsolete: 0 => 1

Comment 24 Christiaan Welvaart 2019-03-11 09:12:59 CET
Created attachment 10862 [details]
draft specfile for gcc8 needed to build chromium on mga6

Attachment 10861 is obsolete: 0 => 1

Comment 25 Christiaan Welvaart 2019-03-11 21:35:15 CET
I have a working chromium-browser-stable mga6 package (x86-64), but how do I get the build dependencies uploaded?

gcc8: fork from cauldron gcc in svn, or use putsrpm?

closure-compiler: I think this package can simply be updated to the version in cauldron, as chromium-browser-stable is apparently the only package with a build dependency on it. Or will that break nodejs-closure-compiler?

guava20 (needed for updated closure-compiler): this is a compatibility package in cauldron, so I think it won't break anything in mga6, but again: copy from cauldron svn or import using putsrpm somehow?
Comment 26 David Walser 2019-03-11 21:44:42 CET
Doing svn cp is probably better, as it preserves SVN history, rather than just the changelog.  All those things sound fine to me.  If any package is really only used by chromium, we could consider bundling it in the future and dropping the external package.
Comment 27 Christiaan Welvaart 2019-03-11 22:05:09 CET
I said build dep. One package does have a regular dependency on "closure-compiler" -- "nodejs-closure-compiler", which has not been updated since mga6.
Comment 28 Thomas Backlund 2019-03-11 22:28:49 CET
Um, nope... we dont want gcc 8 in Mga6 ... it will create a support mess we can live without...

Why isnt gcc 5.5 enough ?
Comment 29 David Walser 2019-03-11 22:35:46 CET
Fortunately we haven't had that many security issues hit GCC (3 in the last 5 years if my search was correct).  At my work, many of the developers we support have needed GCC 8 too for various reasons, as the 4.8.x from RHEL 7 isn't sufficient (luckily 8 is provided through RHSCL), so it would probably be a valuable addition, though admittedly we don't want to make a habit of shipping multiple GCC versions.  It's probably unavoidable in this case, we just need to make sure it uses GCC's version suffix support and is parallel installable.
Comment 30 Christiaan Welvaart 2019-03-11 23:58:28 CET
To be clear, what I'm working on is a minimal gcc8 package with only support for C and C++, and without any shared libraries.

As explained in an earlier comment, a recent gcc is needed because I could not build a working chromium M69 with gcc 5 nor with clang/llvm, see also https://bugs.mageia.org/show_bug.cgi?id=23554#c3 . I have not tried using gcc 5 again with chromium M72, probably because I never found out why M69 built with gcc 5 didn't work while with gcc 8 it works fine.
Comment 31 David Walser 2019-03-13 18:46:04 CET
Upstream has released version 73.0.3683.75 on March 12:
https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html

It fixes several new security issues.

This is the current version in the stable channel:
http://googlechromereleases.blogspot.com/search/label/Stable%20updates

Summary: chromium-browser-stable new security issues fixed in 72.0.3626.121 => chromium-browser-stable new security issues fixed in 73.0.3683.75

Comment 32 Thomas Backlund 2019-03-15 09:11:10 CET
ok, will take a look on the proposed gcc8 package
Comment 33 David Walser 2019-03-18 23:23:10 CET
(In reply to David Walser from comment #31)
> Upstream has released version 73.0.3683.75 on March 12:
> https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-
> desktop_12.html

openSUSE has issued an advisory for this on March 17:
https://lists.opensuse.org/opensuse-updates/2019-03/msg00072.html
Comment 34 David Walser 2019-04-25 13:21:05 CEST
Upstream has released version 74.0.3729.108 on April 23:
https://chromereleases.googleblog.com/2019/04/stable-channel-update-for-desktop_23.html

It fixes several new security issues.

This is the current version in the stable channel:
http://googlechromereleases.blogspot.com/search/label/Stable%20updates

There were also two bugfix releases since the last security update:
https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_20.html
https://chromereleases.googleblog.com/2019/04/stable-channel-update-for-desktop.html

Summary: chromium-browser-stable new security issues fixed in 73.0.3683.75 => chromium-browser-stable new security issues fixed in 74.0.3729.108

Comment 35 David Walser 2019-06-06 14:25:24 CEST
Upstream has released multiple security updates, most recently on June 4:
https://chromereleases.googleblog.com/2019/04/stable-channel-update-for-desktop_30.html
https://chromereleases.googleblog.com/2019/05/stable-channel-update-for-desktop.html
https://chromereleases.googleblog.com/2019/05/stable-channel-update-for-desktop_21.html
https://chromereleases.googleblog.com/2019/06/stable-channel-update-for-desktop.html

The latest version is currently 75.0.3770.80:
http://googlechromereleases.blogspot.com/search/label/Stable%20updates

Whiteboard: (none) => MGA6TOO
Version: 6 => 7
Summary: chromium-browser-stable new security issues fixed in 74.0.3729.108 => chromium-browser-stable new security issues fixed in 75.0.3770.80

katnatek 2019-06-06 20:05:47 CEST

Blocks: (none) => 24835

Comment 36 Christiaan Welvaart 2019-06-11 21:35:48 CEST
M75 crashed on startup, so I built it with clang which fixed the crash.

With both M74 and M75, chromium has problems loading web pages, apparently related to DNS queries -- when I use a proxy the problem goes away.

I disabled most patches and all 'unbundling' of system libraries, and now chromium seems to work (still built with clang), so I need to find out what exactly is causing the problem.

Version: 7 => 6

Christiaan Welvaart 2019-06-11 21:37:31 CEST

Version: 6 => 7

Comment 37 katnatek 2019-06-12 00:33:25 CEST
(In reply to Christiaan Welvaart from comment #36)

I see arch linux (https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=chromium-dev ) build with bundled icu due a bug https://bugs.chromium.org/p/chromium/issues/detail?id=678661

i bit by some like this building moonchild's browsers , they need versions more recent than in mga6 of some libraries, the rpms build well with mga6 icu but the navigation was slow until i switch to use the bundled icu
Comment 39 David Walser 2019-09-13 22:16:17 CEST
Upstream has released version 77.0.3865.75 on September 10:
https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html

It fixes several new security issues.

This is the current version in the stable channel:
http://googlechromereleases.blogspot.com/search/label/Stable%20updates

Summary: chromium-browser-stable new security issues fixed in 76.0.3809.132 => chromium-browser-stable new security issues fixed in 77.0.3865.75

Comment 40 Christiaan Welvaart 2019-09-15 00:28:17 CEST
For MGA6, a newer clang version would apparently be needed, so I only built packages for mga7. Because of this, I removed the MGA6TOO tag -- if mga6 is still considered relevant, please file a separate bug for mga6.


Updated packages are ready for testing.

MGA7
SRPM:
chromium-browser-stable-77.0.3865.75-1.mga7.src.rpm
RPMS:
chromium-browser-77.0.3865.75-1.mga7.i586.rpm
chromium-browser-stable-77.0.3865.75-1.mga7.i586.rpm
chromium-browser-77.0.3865.75-1.mga7.x86_64.rpm
chromium-browser-stable-77.0.3865.75-1.mga7.x86_64.rpm


Advisory:



Chromium-browser 77.0.3865.75 fixes security issues:

Multiple flaws were found in the way Chromium 73.0.3683.103 processes various types of web content, where loading a web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information. (CVE-2019-5805, CVE-2019-5806, CVE-2019-5807, CVE-2019-5808, CVE-2019-5809, CVE-2019-5810, CVE-2019-5811, CVE-2019-5812, CVE-2019-5813, CVE-2019-5814, CVE-2019-5815, CVE-2019-5816, CVE-2019-5817, CVE-2019-5818, CVE-2019-5819, CVE-2019-5820, CVE-2019-5821, CVE-2019-5822, CVE-2019-5823, CVE-2019-5824, CVE-2019-5825, CVE-2019-5826, CVE-2019-5827, CVE-2019-5828, CVE-2019-5829, CVE-2019-5830, CVE-2019-5831, CVE-2019-5832, CVE-2019-5833, CVE-2019-5834, CVE-2019-5835, CVE-2019-5836, CVE-2019-5837, CVE-2019-5838, CVE-2019-5839, CVE-2019-5840, CVE-2019-5842, CVE-2019-5847, CVE-2019-5848, CVE-2019-5849, CVE-2019-5850, CVE-2019-5851, CVE-2019-5852, CVE-2019-5853, CVE-2019-5854, CVE-2019-5855, CVE-2019-5856, CVE-2019-5857, CVE-2019-5858, CVE-2019-5859, CVE-2019-5860, CVE-2019-5861, CVE-2019-5862, CVE-2019-5863, CVE-2019-5864, CVE-2019-5865, CVE-2019-5866, CVE-2019-5867, CVE-2019-5868, CVE-2019-5869, CVE-2019-5870, CVE-2019-5871, CVE-2019-5872, CVE-2019-5873, CVE-2019-5874, CVE-2019-5875, CVE-2019-5876, CVE-2019-5877, CVE-2019-5878, CVE-2019-5879, CVE-2019-5880, CVE-2019-5881, CVE-2019-13659, CVE-2019-13660, CVE-2019-13661, CVE-2019-13662, CVE-2019-13663, CVE-2019-13664, CVE-2019-13665, CVE-2019-13666, CVE-2019-13667, CVE-2019-13668, CVE-2019-13669, CVE-2019-13670, CVE-2019-13671, CVE-2019-13673, CVE-2019-13674, CVE-2019-13675, CVE-2019-13676, CVE-2019-13677, CVE-2019-13678, CVE-2019-13679, CVE-2019-13680, CVE-2019-13681, CVE-2019-13682, CVE-2019-13683)



References:

https://chromereleases.googleblog.com/2019/04/stable-channel-update-for-desktop_23.html
https://chromereleases.googleblog.com/2019/04/stable-channel-update-for-desktop_30.html
https://chromereleases.googleblog.com/2019/05/stable-channel-update-for-desktop.html
https://chromereleases.googleblog.com/2019/05/stable-channel-update-for-desktop_21.html
https://chromereleases.googleblog.com/2019/06/stable-channel-update-for-desktop.html
https://chromereleases.googleblog.com/2019/06/stable-channel-update-for-desktop_13.html
https://chromereleases.googleblog.com/2019/06/stable-channel-update-for-desktop_18.html
https://chromereleases.googleblog.com/2019/07/stable-channel-update-for-desktop.html
https://chromereleases.googleblog.com/2019/07/stable-channel-update-for-desktop_30.html
https://chromereleases.googleblog.com/2019/08/stable-channel-update-for-desktop.html
https://chromereleases.googleblog.com/2019/08/stable-channel-update-for-desktop_26.html
https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5805
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5806
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5807
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5808
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5809
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5810
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5811
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5812
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5813
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5814
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5815
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5816
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5817
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5818
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5819
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5820
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5821
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5822
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5823
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5824
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5825
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5826
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5827
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5828
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5829
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5830
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5831
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5832
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5833
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5834
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5835
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5836
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5837
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5838
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5839
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5840
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5842
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5847
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5848
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5849
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5850
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5851
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5852
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5853
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5854
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5855
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5856
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5857
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5858
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5859
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5860
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5861
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5862
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5863
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5864
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5865
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5866
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5867
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5868
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5869
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5870
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5871
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5872
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5873
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5874
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5875
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5876
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5877
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5878
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5879
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5880
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5881
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13659
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13660
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13661
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13662
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13663
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13664
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13665
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13666
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13667
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13668
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13669
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13670
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13671
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13673
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13674
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13675
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13676
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13677
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13678
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13679
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13680
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13681
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13682
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13683

Assignee: cjw => qa-bugs
Depends on: 23554 => (none)
Whiteboard: MGA6TOO => (none)

Comment 41 Herman Viaene 2019-09-17 11:21:52 CEST
MGA7-64 Plasma on Lenovo B50
No installation issues
From CLI:
$ chromium-browser 
[26842:26842:0917/111107.371297:ERROR:sandbox_linux.cc(369)] InitializeSandbox() called with multiple threads in process gpu-process.
[26842:26842:0917/111107.551106:ERROR:buffer_manager.cc(488)] [.DisplayCompositor]GL ERROR :GL_INVALID_OPERATION : glBufferData: <- error from previous GL command
[1:1:0917/111109.002195:ERROR:child_process_sandbox_support_impl_linux.cc(81)] FontService unique font name matching request did not receive a response.
loads of those ......
But browser works OK on my newspaper with text, images, sound and video.
OK for me.

Whiteboard: (none) => MGA7-64-OK
CC: (none) => herman.viaene

Comment 42 katnatek 2019-09-17 20:07:51 CEST
Tested on MGA 7 Xfce i586

Videos Work
DRM Videos on https://demo.castlabs.com Work so i think you could close bug#24835 also

Whiteboard: MGA7-64-OK => MGA7-64-OK,MGA7-32-OK

Comment 43 Thomas Andrews 2019-09-19 18:33:49 CEST
Validating. Advisory in Comment 40.

CC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => validated_update

Comment 44 Rémi Verschelde 2019-09-20 11:02:46 CEST
Advisory uploaded.

Keywords: (none) => advisory

Comment 45 Mageia Robot 2019-09-21 13:08:50 CEST
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2019-0283.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED

Christian Lohmaier 2020-01-09 12:40:26 CET

Blocks: (none) => 26042


Note You need to log in before you can comment on or make changes to this bug.