Bug 3321 - chromium-browser-stable security update to version 15.0.874.120
Summary: chromium-browser-stable security update to version 15.0.874.120
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 1
Hardware: i586 Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact:
URL: http://www.h-online.com/security/news...
Whiteboard:
Keywords: Triaged, validated_update
Depends on:
Blocks:
 
Reported: 2011-11-11 22:09 CET by Dave Hodgins
Modified: 2011-12-07 18:41 CET (History)
4 users (show)

See Also:
Source RPM: chromium-browser-stable
CVE:
Status comment:


Attachments

Description Dave Hodgins 2011-11-11 22:09:49 CET
From the www.h-online.com site ...
The Stable channel update fixes a total of five "high-risk" bugs: a heap overflow in the Ogg Vorbis decoder, a double free issue in the Theora decoder and a memory corruption regression in VP8 decoding, as well as a use-after-free error and a buffer overflow in shader variable mapping. Two medium-risk out of bounds reads in MKV and Ogg vorbis media handlers, and a low-risk issue that caused JRE7 to fail to ask for permission to run applets have also been fixed. Further details of the vulnerabilities are being withheld until "a majority of users are up-to-date with the fix"
Comment 1 Manuel Hiebel 2011-11-11 23:59:43 CET
Hi, thanks for reporting this bug.
Assigned to the package maintainer.

Keywords: (none) => Triaged
Assignee: bugsquad => dmorganec

Comment 2 D Morgan 2011-11-15 09:26:25 CET
Just pushed in update_testing. Please test
Comment 3 Manuel Hiebel 2011-11-15 16:36:27 CET
Thanks reassign to the QA.

CC: (none) => dmorganec
Assignee: dmorganec => qa-bugs

Comment 4 Dave Hodgins 2011-11-15 20:41:56 CET
No poc for the security bugs, so just testing that the program "works".

Testing complete on i586 for the srpm
chromium-browser-stable-15.0.874.120-0.1.mga1.src.rpm

Testing done with
http://www.adobe.com/software/flash/about/
http://javatester.org/version.html
youtube.com, and some general browsing.
Comment 5 Dave Hodgins 2011-11-17 22:56:50 CET
Still waiting for x86-64 testing.

Note that 15.0.874.121 was released today for a high-risk
out-of-bounds write vulnerability in the V8 JavaScript engine.
http://www.h-online.com/security/news/item/Chrome-15-update-fixes-high-risk-vulnerability-1380555.html

Should we skip pushing this update and wait for the 121 version?
Comment 6 D Morgan 2011-11-17 23:14:48 CET
i think yes, this will avoid to do a new update in some days.

i will take care of this update.
Comment 7 David GEIGER 2011-11-19 09:03:53 CET
Tested on Mageia release 1 (Official) for x86_64 ,for me it's Ok. 

Nothing to report, everything seems work very well.

CC: (none) => geiger.david68210

Comment 8 Manuel Hiebel 2011-12-06 02:02:14 CET
Any news ?

Assignee: qa-bugs => dmorganec

Comment 9 Dave Hodgins 2011-12-06 02:21:06 CET
Sorry. Validating the update.

Could someone from the sysadmin team push the srpm
chromium-browser-stable-15.0.874.120-0.1.mga1.src.rpm
from Core Updates Testing to Core Updates

Advisory: This security update for chromium-browser fixes a total of five
"high-risk" bugs: a heap overflow in the Ogg Vorbis decoder, a double free
issue in the Theora decoder and a memory corruption regression in VP8
decoding, as well as a use-after-free error and a buffer overflow in shader
variable mapping. Two medium-risk out of bounds reads in MKV and Ogg vorbis
media handlers, and a low-risk issue that caused JRE7 to fail to ask for
permission to run applets have also been fixed.
Further details of the vulnerabilities are being withheld until "a majority
of users are up-to-date with the fix"

https://bugs.mageia.org/show_bug.cgi?id=3321

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

Comment 10 Manuel Hiebel 2011-12-06 02:34:24 CET
I was asking for 
In reply to comment #6)
> i think yes, this will avoid to do a new update in some days.
> 
> i will take care of this update.
but well let's go for update

Assignee: dmorganec => qa-bugs

Comment 11 Thomas Backlund 2011-12-07 18:07:54 CET
Ummm, comment 5 stated that a 15.0.874.121 with a high-risk fix was released, and comment 6 stated it will be done in a few days...

but then comment 9 states to push the .120 one...

... confused ...

CC: (none) => tmb

Comment 12 D Morgan 2011-12-07 18:19:15 CET
please push .120, i have some stuffs to finish and i will work on 121.

I would not like to see this sec update delayed for too long.
Comment 13 Thomas Backlund 2011-12-07 18:41:58 CET
Update pushed.

Status: NEW => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.