Bug 25655 - chromium-browser-stable security issues fixed in 78.0.3904.87
Summary: chromium-browser-stable security issues fixed in 78.0.3904.87
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 7
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA7-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2019-11-04 21:46 CET by Christiaan Welvaart
Modified: 2019-11-08 00:38 CET (History)
5 users (show)

See Also:
Source RPM: chromium-browser-stable-77.0.3865.120-1.mga7.src.rpm
CVE:
Status comment:


Attachments

Description Christiaan Welvaart 2019-11-04 21:46:25 CET
Upstream released 78.0.3904.70 and 78.0.3904.87 with several security fixes:
https://chromereleases.googleblog.com/2019/10/stable-channel-update-for-desktop_22.html
https://chromereleases.googleblog.com/2019/10/stable-channel-update-for-desktop_31.html
Comment 1 Christiaan Welvaart 2019-11-04 21:51:44 CET
Updated packages are available for testing:

MGA7
SRPM:
chromium-browser-stable-78.0.3904.87-1.mga7.src.rpm
RPMS:
chromium-browser-78.0.3904.87-1.mga7.i586.rpm
chromium-browser-stable-78.0.3904.87-1.mga7.i586.rpm
chromium-browser-78.0.3904.87-1.mga7.x86_64.rpm
chromium-browser-stable-78.0.3904.87-1.mga7.x86_64.rpm


Advisory:



Chromium-browser 78.0.3904.87 fixes security issues:

Multiple flaws were found in the way Chromium 77.0.3865.120 processes various types of web content, where loading a web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information. (CVE-2019-13699, CVE-2019-13700, CVE-2019-13701, CVE-2019-13702, CVE-2019-13703, CVE-2019-13704, CVE-2019-13705, CVE-2019-13706, CVE-2019-13707, CVE-2019-13708, CVE-2019-13709, CVE-2019-13710, CVE-2019-13711, CVE-2019-13713, CVE-2019-13714, CVE-2019-13715, CVE-2019-13716, CVE-2019-13717, CVE-2019-13718, CVE-2019-13719, CVE-2019-15903, CVE-2019-13720, CVE-2019-13721)



References:

https://chromereleases.googleblog.com/2019/10/stable-channel-update-for-desktop_22.html
https://chromereleases.googleblog.com/2019/10/stable-channel-update-for-desktop_31.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13699
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13700
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13701
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13702
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13703
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13704
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13705
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13706
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13707
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13708
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13709
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13710
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13711
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13713
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13714
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13715
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13716
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13717
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13718
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13719
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15903
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13720
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13721

Assignee: cjw => qa-bugs
CC: (none) => cjw

Comment 2 David Walser 2019-11-05 03:06:12 CET
Fixing CVE-2019-15903 will require updating expat.

Keywords: (none) => feedback

Comment 3 Christiaan Welvaart 2019-11-05 20:30:48 CET
Oops, I did not see that.


Updated advisory:


Chromium-browser 78.0.3904.87 fixes security issues:

Multiple flaws were found in the way Chromium 77.0.3865.120 processes various types of web content, where loading a web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information. (CVE-2019-13699, CVE-2019-13700, CVE-2019-13701, CVE-2019-13702, CVE-2019-13703, CVE-2019-13704, CVE-2019-13705, CVE-2019-13706, CVE-2019-13707, CVE-2019-13708, CVE-2019-13709, CVE-2019-13710, CVE-2019-13711, CVE-2019-13713, CVE-2019-13714, CVE-2019-13715, CVE-2019-13716, CVE-2019-13717, CVE-2019-13718, CVE-2019-13719, CVE-2019-13720, CVE-2019-13721)



References:

https://chromereleases.googleblog.com/2019/10/stable-channel-update-for-desktop_22.html
https://chromereleases.googleblog.com/2019/10/stable-channel-update-for-desktop_31.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13699
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13700
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13701
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13702
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13703
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13704
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13705
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13706
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13707
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13708
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13709
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13710
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13711
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13713
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13714
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13715
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13716
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13717
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13718
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13719
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13720
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13721
Comment 4 Christiaan Welvaart 2019-11-05 20:31:40 CET
Is there no mga bug report for expat yet?
Comment 5 David Walser 2019-11-05 21:18:46 CET
I did not file a separate bug.
Comment 6 Christiaan Welvaart 2019-11-05 21:33:02 CET
AFAICT chromium bundled expat was updated to 2.2.8, which AFAIK we should not do, so I filed a separate bug for the expat security issue: #25661 .
Christiaan Welvaart 2019-11-06 00:14:05 CET

Keywords: feedback => (none)

Comment 7 Herman Viaene 2019-11-06 15:45:03 CET
MGA7-64 Plasma on Lenovo B50
No installation issues.
Usual surfing operations all OK.
Ref to bug25580 Comment 2: succeeded in syncing with Google device and importing exported Firefox bookmarks .
OK for me.

CC: (none) => herman.viaene
Whiteboard: (none) => MGA7-64-OK

Comment 8 Thomas Andrews 2019-11-07 16:26:45 CET
OK by me. Validating. Advisory information in Comments 1 and 3.

The expat update is my next stop.

CC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => validated_update

Thomas Backlund 2019-11-07 22:29:54 CET

Keywords: (none) => advisory
CC: (none) => tmb

Comment 9 Mageia Robot 2019-11-08 00:38:43 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2019-0320.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.