Bug 1213920 (CVE-2023-4068) - VUL-0: chromium,ungoogled-chromium: chromium update to 115.0.5790.170
Summary: VUL-0: chromium,ungoogled-chromium: chromium update to 115.0.5790.170
Status: RESOLVED FIXED
Alias: CVE-2023-4068
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/374030/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-08-03 05:30 UTC by Cathy Hu
Modified: 2023-08-07 16:06 UTC (History)
5 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Cathy Hu 2023-08-03 05:30:06 UTC 
The following issues will be fixed with updating chromium to 115.0.5790.170

[1466183] High CVE-2023-4068: Type Confusion in V8
[1465326] High CVE-2023-4069: Type Confusion in V8
[1462951] High CVE-2023-4070: Type Confusion in V8
[1458819] High CVE-2023-4071: Heap buffer overflow in Visuals
[1464038] High CVE-2023-4072: Out of bounds read and write in WebGL
[1456243] High CVE-2023-4073: Out of bounds memory access in ANGLE
[1464113] High CVE-2023-4074: Use after free in Blink Task Scheduling
[1457757] High CVE-2023-4075: Use after free in Cast
[1459124] High CVE-2023-4076: Use after free in WebRTC
[1451146] Medium CVE-2023-4077: Insufficient data validation in Extensions
[1461895] Medium CVE-2023-4078: Inappropriate implementation in Extensions


References:
https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop.html
https://crbug.com/1466183
Comment 1 Andreas Stieger 2023-08-03 06:11:59 UTC 
Michal, over to you to copy for ungoogled-chromium, assign back to security-team@suse.de when done
Comment 2 OBSbugzilla Bot 2023-08-03 06:55:03 UTC 
This is an autogenerated message for OBS integration:
This bug (1213920) was mentioned in
https://build.opensuse.org/request/show/1102107 Factory / chromium
https://build.opensuse.org/request/show/1102108 Backports:SLE-15-SP4+Backports:SLE-15-SP5 / chromium
Comment 3 OBSbugzilla Bot 2023-08-04 17:45:03 UTC 
This is an autogenerated message for OBS integration:
This bug (1213920) was mentioned in
https://build.opensuse.org/request/show/1102416 Factory / ungoogled-chromium
Comment 4 Andreas Stieger 2023-08-04 18:55:36 UTC 
Back to security team
Comment 5 Michał Szczepaniak 2023-08-04 21:37:55 UTC 
It has not been accepted yet
Comment 6 Robert Frohl 2023-08-07 13:08:49 UTC 
released, closing
Comment 7 Marcus Meissner 2023-08-07 16:06:09 UTC 
openSUSE-SU-2023:0216-1: An update that fixes 11 vulnerabilities is now available.

Category: security (important)
Bug References: 1213920
CVE References: CVE-2023-4068,CVE-2023-4069,CVE-2023-4070,CVE-2023-4071,CVE-2023-4072,CVE-2023-4073,CVE-2023-4074,CVE-2023-4075,CVE-2023-4076,CVE-2023-4077,CVE-2023-4078
JIRA References: 
Sources used:
openSUSE Backports SLE-15-SP5 (src):    chromium-115.0.5790.170-bp155.2.16.1
openSUSE Backports SLE-15-SP4 (src):    chromium-115.0.5790.170-bp154.2.102.1