Bug 33345 - chromium-browser-stable new security issues CVE-2024-629[0-3] fixed in 126.0.6478.126
Summary: chromium-browser-stable new security issues CVE-2024-629[0-3] fixed in 126.0....
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 9
Hardware: x86_64 Linux
Priority: Normal major
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA9-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2024-07-01 09:59 CEST by Nicolas Salguero
Modified: 2024-07-04 18:48 CEST (History)
4 users (show)

See Also:
Source RPM: chromium-browser-stable-126.0.6478.114-1.mga9.tainted.src.rpm
CVE: CVE-2024-6290, CVE-2024-6291, CVE-2024-6292, CVE-2024-6293
Status comment: Fixed upstream in 126.0.6478.126


Attachments

Description Nicolas Salguero 2024-07-01 09:59:00 CEST
Upstream has issued an advisory on June 24:
https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop_24.html
Nicolas Salguero 2024-07-01 09:59:48 CEST

CVE: (none) => CVE-2024-6290, CVE-2024-6291, CVE-2024-6292, CVE-2024-6293
Source RPM: (none) => chromium-browser-stable-126.0.6478.114-1.mga9.tainted.src.rpm
Whiteboard: (none) => MGA9TOO
Status comment: (none) => Fixed upstream in 126.0.6478.126

Nicolas Salguero 2024-07-01 10:03:27 CEST

Severity: normal => major

Nicolas Salguero 2024-07-01 15:46:24 CEST

Assignee: bugsquad => nicolas.salguero

Comment 1 Nicolas Salguero 2024-07-02 14:44:47 CEST
For the moment, it is only built for Mageia 9.

Suggested advisory:
========================

The updated packages fix security vulnerabilities:

Use after free in Dawn. (CVE-2024-6290, CVE-2024-6292, CVE-2024-6293)

Use after free in Swiftshader. (CVE-2024-6291)

References:
https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop_24.html
========================

Updated packages in core/updates_testing:
========================
chromium-browser-126.0.6478.126-1.mga9.tainted
chromium-browser-stable-126.0.6478.126-1.mga9.tainted

from SRPM:
chromium-browser-stable-126.0.6478.126-1.mga9.tainted.src.rpm

Status: NEW => ASSIGNED

Comment 2 Morgan Leijström 2024-07-02 16:59:43 CEST
mga9-64 OK here

Plasma on X11.
nvidia470-470.256.02-1 on GTX750 with 4K screen.
kernel desktop 6.6.36-3 on ASRock P55 Pro with Intel Core i7 870.

Swedish localisation.
Restored tabs opened in previous version.
Banking sites, shops, video sites.
Download file.
Open saved pdf file and print to network printer.
Printing this bug on Boomaga.
Writing this Comment.

--

Thank you for taking on this package.

I think this is good you push mga9 before Cauldron as compile time is long and security updates should go out quickly. QA take typically longer time than compiling.

CC: (none) => fri

Comment 3 Morgan Leijström 2024-07-02 17:12:39 CEST
mga9 ready for QA

Assignee: nicolas.salguero => qa-bugs

katnatek 2024-07-02 18:55:29 CEST

Version: Cauldron => 9
Whiteboard: MGA9TOO => (none)

katnatek 2024-07-02 19:11:52 CEST

Keywords: (none) => advisory

Comment 4 Morgan Leijström 2024-07-02 19:43:53 CEST
@katnatek: We use to keep it set to Cauldron with MGA9TOO until it is successfully built for Cauldron.  It is still building.
Comment 5 katnatek 2024-07-03 00:36:15 CEST
(In reply to Morgan Leijström from comment #4)
> @katnatek: We use to keep it set to Cauldron with MGA9TOO until it is
> successfully built for Cauldron.  It is still building.

The packaging policy is build first in cauldron, so I did assume that
Comment 6 Morgan Leijström 2024-07-03 01:32:56 CEST
Build have currently failed for Cauldron.
We also had a period where a browser was impossible to build on Cauldron.

It is mga9 our users use, so it is there it is most important to update quickly and it would be stupid if Cauldron problems held that back.

We should generally not have newer versions in elder Mageia release (for smooth upgrade, but IMO we should not guarantee n upgrade to Cauldron to always work anyway) but QA take time anyway before package is moved to updates repo, a delay Cauldron do not have.
Comment 7 katnatek 2024-07-03 01:34:29 CEST
Plasma Wayland

 LC_ALL=C urpmi --auto --auto-update
medium "QA Testing (32-bit)" is up-to-date
medium "QA Testing (64-bit)" is up-to-date
medium "Core Release (distrib1)" is up-to-date
medium "Core Updates (distrib3)" is up-to-date
medium "Nonfree Release (distrib11)" is up-to-date
medium "Nonfree Updates (distrib13)" is up-to-date
medium "Tainted Release (distrib21)" is up-to-date
medium "Tainted Updates (distrib23)" is up-to-date
medium "Core 32bit Release (distrib31)" is up-to-date
medium "Core 32bit Updates (distrib32)" is up-to-date
medium "Nonfree 32bit Release (distrib36)" is up-to-date
medium "Tainted 32bit Release (distrib41)" is up-to-date
medium "Tainted 32bit Updates (distrib42)" is up-to-date

installing chromium-browser-stable-126.0.6478.126-1.mga9.tainted.x86_64.rpm from //home/katnatek/qa-testing/x86_64
Preparing...                     ##################################################################################################
      1/1: chromium-browser-stable
                                 ##################################################################################################
      1/1: removing chromium-browser-stable-126.0.6478.114-1.mga9.tainted.x86_64
                                 ##################################################################################################

Ozone plataform set in wayland
Yooutube OK
mail.com OK
facebook OK

Post this comment from chromium
Comment 8 katnatek 2024-07-03 01:37:09 CEST
(In reply to katnatek from comment #5)
> (In reply to Morgan Leijström from comment #4)
> > @katnatek: We use to keep it set to Cauldron with MGA9TOO until it is
> > successfully built for Cauldron.  It is still building.
> 
> The packaging policy is build first in cauldron, so I did assume that

I wait a few more next time but some times the packages forget to change some fields in bug
katnatek 2024-07-03 01:37:26 CEST

Hardware: All => x86_64

Comment 9 Herman Viaene 2024-07-03 10:13:40 CEST
MGA9-64 Plasma Wayland on HP-Pavillion
No installation issues.
Cann't find anything wrong with it.

CC: (none) => herman.viaene

Comment 10 Brian Rockwell 2024-07-03 20:41:51 CEST
MGA9-64, Xfce, Asus Laptop

AMD A6-9225 RADEON R4

Installed latest chromium, this is an upgrade.

I've been a few hours with Chromium (audio, video, email), it is working as expected.

CC: (none) => brtians1

Comment 11 Brian Rockwell 2024-07-03 23:09:30 CEST
MGA9-64, Xfce, Intel celeron

----

email
sites work
wimbledon radio working as expected
Comment 12 Morgan Leijström 2024-07-04 00:16:38 CEST
Also OK on my Thinkpad T510; Plasma, X11, modesetting driver on nvidia GPU

I see Cauldron version is still building.

As I said before I dont think a delay in Cauldron should delay security updates for our users.
-> Validating.

CC: (none) => sysadmin-bugs
Whiteboard: (none) => MGA9-64-OK
Keywords: (none) => validated_update

Comment 13 Mageia Robot 2024-07-04 18:48:54 CEST
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2024-0254.html

Resolution: (none) => FIXED
Status: ASSIGNED => RESOLVED


Note You need to log in before you can comment on or make changes to this bug.