Bug 25733 - chromium-browser-stable security issues fixed in 78.0.3904.108
Summary: chromium-browser-stable security issues fixed in 78.0.3904.108
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 7
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA7-32-OK, MGA7-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2019-11-24 00:33 CET by Christiaan Welvaart
Modified: 2019-11-30 14:07 CET (History)
5 users (show)

See Also:
Source RPM: chromium-browser-stable-78.0.3904.87-1.mga7.src.rpm
CVE:
Status comment:


Attachments

Description Christiaan Welvaart 2019-11-24 00:33:16 CET
Upstream released versions 78.0.3904.97 and 78.0.3904.108 with security fixes:
https://chromereleases.googleblog.com/2019/11/stable-channel-update-for-desktop.html
https://chromereleases.googleblog.com/2019/11/stable-channel-update-for-desktop_18.html
Comment 1 Christiaan Welvaart 2019-11-24 00:36:52 CET
Updated packages are available for testing:

MGA7
SRPM:
chromium-browser-stable-78.0.3904.108-1.mga7.src.rpm
RPMS:
chromium-browser-78.0.3904.108-1.mga7.i586.rpm
chromium-browser-stable-78.0.3904.108-1.mga7.i586.rpm
chromium-browser-78.0.3904.108-1.mga7.x86_64.rpm
chromium-browser-stable-78.0.3904.108-1.mga7.x86_64.rpm


Advisory:



Chromium-browser 78.0.3904.108 fixes security issues:

Multiple flaws were found in the way Chromium 78.0.3904.87 processes various types of web content, where loading a web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information. (CVE-2019-13723, CVE-2019-13724)



References:
https://chromereleases.googleblog.com/2019/11/stable-channel-update-for-desktop.html
https://chromereleases.googleblog.com/2019/11/stable-channel-update-for-desktop_18.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13723
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13724

Assignee: cjw => qa-bugs
CC: (none) => cjw

Comment 2 Brian Rockwell 2019-11-26 22:22:34 CET
To satisfy dependencies, the following package(s) also need to be installed:

- chromium-browser-stable-78.0.3904.108-1.mga7.x86_64
- lib64jsoncpp19-1.8.4-2.mga7.x86_64
- lib64minizip1-1.2.11-7.mga7.x86_64
- lib64snappy1-1.1.7-2.mga7.x86_64

--

installed

browsed some website and watched youtube.  Will keep testing, but looks good to me

CC: (none) => brtians1

Comment 3 Brian Rockwell 2019-11-27 04:36:39 CET
(In reply to Brian Rockwell from comment #2)
> To satisfy dependencies, the following package(s) also need to be installed:
> 
> - chromium-browser-stable-78.0.3904.108-1.mga7.x86_64
> - lib64jsoncpp19-1.8.4-2.mga7.x86_64
> - lib64minizip1-1.2.11-7.mga7.x86_64
> - lib64snappy1-1.1.7-2.mga7.x86_64
> 
> --
> 
> installed
> 
> browsed some website and watched youtube.  Will keep testing, but looks good
> to me

I've used it for several hours on multiple functions.  Seems to be working as deisgned to me  (GNOME desktop).
Comment 4 Brian Rockwell 2019-11-27 19:46:14 CET
$ uname -a
Linux localhost 5.3.11-desktop-1.mga7 #1 SMP Tue Nov 12 23:07:33 UTC 2019 i686 i686 i386 GNU/Linux


The following 4 packages are going to be installed:

- chromium-browser-78.0.3904.108-1.mga7.i586
- chromium-browser-stable-78.0.3904.108-1.mga7.i586
- glibc-2.29-19.mga7.i586
- libjsoncpp19-1.8.4-2.mga7.i586

----

I rebooted because of glibc install.

---

Browsed some websites, including this one, played a video, seems to be working.

Whiteboard: (none) => MGA7-32-OK

Comment 5 Brian Rockwell 2019-11-27 19:46:53 CET
(In reply to Brian Rockwell from comment #4)
> $ uname -a
> Linux localhost 5.3.11-desktop-1.mga7 #1 SMP Tue Nov 12 23:07:33 UTC 2019
> i686 i686 i386 GNU/Linux
> 
> 
> The following 4 packages are going to be installed:
> 
> - chromium-browser-78.0.3904.108-1.mga7.i586
> - chromium-browser-stable-78.0.3904.108-1.mga7.i586
> - glibc-2.29-19.mga7.i586
> - libjsoncpp19-1.8.4-2.mga7.i586
> 
> ----
> 
> I rebooted because of glibc install.
> 
> ---
> 
> Browsed some websites, including this one, played a video, seems to be
> working.

replying has become a bad habit lately

This was on 32-bit Plasma (KDE)
Comment 6 Thomas Andrews 2019-11-29 01:34:44 CET
Adding a 64-bit OK because of Comments 2 and 3. Validating. Advisory in Comment 1.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs
Whiteboard: MGA7-32-OK => MGA7-32-OK, MGA7-64-OK

Thomas Backlund 2019-11-30 12:35:03 CET

Keywords: (none) => advisory
CC: (none) => tmb

Comment 7 Mageia Robot 2019-11-30 14:07:55 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2019-0347.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.