Bug 1214487 (CVE-2023-4427)

Summary:	VUL-0: CVE-2023-4427: chromium,ungoogled-chromium: chromium update to 116.0.5845.110
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Alexander Bergmann <abergmann>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	RESOLVED FIXED	QA Contact:	Security Team bot <security-team>
Severity:	Major
Priority:	P3 - Medium	CC:	Andreas.Stieger, gmbr3, m.szczepaniak.000, security-team
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
Whiteboard:
Found By:	---	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description Alexander Bergmann 2023-08-23 06:09:34 UTC

The Stable and Extended stable channels has been updated to 116.0.5845.110 for Mac and Linux and 116.0.5845.110/.111 for Windows, which will roll out over the coming days/weeks. A full list of changes in this build is available in the log.

[1470668] High CVE-2023-4427: Out of bounds memory access in V8.
[1470477] High CVE-2023-4428: Out of bounds memory access in CSS.
[1469754] High CVE-2023-4429: Use after free in Loader.
[1469542] High CVE-2023-4430: Use after free in Vulkan.
[1469348] Medium CVE-2023-4431: Out of bounds memory access in Fonts.

References:
https://chromereleases.googleblog.com/2023/08/chrome-desktop-stable-update.html

Comment 1 Andreas Stieger 2023-08-23 08:10:48 UTC

chromium submitted

Comment 2 OBSbugzilla Bot 2023-08-23 08:55:02 UTC

This is an autogenerated message for OBS integration:
This bug (1214487) was mentioned in
https://build.opensuse.org/request/show/1105427 Factory / chromium
https://build.opensuse.org/request/show/1105428 Backports:SLE-15-SP4+Backports:SLE-15-SP5 / chromium

Comment 3 Andreas Stieger 2023-08-23 14:58:36 UTC

team, could you check openSUSE:Maintenance:18045/patchinfo please?

Comment 4 Andreas Stieger 2023-08-28 17:19:49 UTC

openSUSE:Factory/ungoogled-chromium still behind. All others are in.

Comment 5 Michał Szczepaniak 2023-08-28 17:21:05 UTC

I wanted to update it right when obs went to maintenance so gimme some time

Comment 6 Marcus Meissner 2023-08-28 19:15:22 UTC

openSUSE-SU-2023:0237-1: An update that fixes 5 vulnerabilities is now available.

Category: security (important)
Bug References: 1214487
CVE References: CVE-2023-4427,CVE-2023-4428,CVE-2023-4429,CVE-2023-4430,CVE-2023-4431
JIRA References: 
Sources used:
openSUSE Backports SLE-15-SP5 (src):    chromium-116.0.5845.110-bp155.2.22.1
openSUSE Backports SLE-15-SP4 (src):    chromium-116.0.5845.110-bp154.2.108.1

Comment 7 OBSbugzilla Bot 2023-08-28 19:35:03 UTC

This is an autogenerated message for OBS integration:
This bug (1214487) was mentioned in
https://build.opensuse.org/request/show/1107812 Factory / ungoogled-chromium

Comment 8 Andreas Stieger 2023-08-28 21:14:02 UTC

Done