Bug 1214487 (CVE-2023-4427) - VUL-0: CVE-2023-4427: chromium,ungoogled-chromium: chromium update to 116.0.5845.110
Summary: VUL-0: CVE-2023-4427: chromium,ungoogled-chromium: chromium update to 116.0.5...
Status: RESOLVED FIXED
Alias: CVE-2023-4427
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Major
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-08-23 06:09 UTC by Alexander Bergmann
Modified: 2023-08-28 21:14 UTC (History)
4 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Bergmann 2023-08-23 06:09:34 UTC 
The Stable and Extended stable channels has been updated to 116.0.5845.110 for Mac and Linux and 116.0.5845.110/.111 for Windows, which will roll out over the coming days/weeks. A full list of changes in this build is available in the log.

[1470668] High CVE-2023-4427: Out of bounds memory access in V8.
[1470477] High CVE-2023-4428: Out of bounds memory access in CSS.
[1469754] High CVE-2023-4429: Use after free in Loader.
[1469542] High CVE-2023-4430: Use after free in Vulkan.
[1469348] Medium CVE-2023-4431: Out of bounds memory access in Fonts.

References:
https://chromereleases.googleblog.com/2023/08/chrome-desktop-stable-update.html
Comment 1 Andreas Stieger 2023-08-23 08:10:48 UTC 
chromium submitted
Comment 2 OBSbugzilla Bot 2023-08-23 08:55:02 UTC 
This is an autogenerated message for OBS integration:
This bug (1214487) was mentioned in
https://build.opensuse.org/request/show/1105427 Factory / chromium
https://build.opensuse.org/request/show/1105428 Backports:SLE-15-SP4+Backports:SLE-15-SP5 / chromium
Comment 3 Andreas Stieger 2023-08-23 14:58:36 UTC 
team, could you check openSUSE:Maintenance:18045/patchinfo please?
Comment 4 Andreas Stieger 2023-08-28 17:19:49 UTC 
openSUSE:Factory/ungoogled-chromium still behind. All others are in.
Comment 5 Michał Szczepaniak 2023-08-28 17:21:05 UTC 
I wanted to update it right when obs went to maintenance so gimme some time
Comment 6 Marcus Meissner 2023-08-28 19:15:22 UTC 
openSUSE-SU-2023:0237-1: An update that fixes 5 vulnerabilities is now available.

Category: security (important)
Bug References: 1214487
CVE References: CVE-2023-4427,CVE-2023-4428,CVE-2023-4429,CVE-2023-4430,CVE-2023-4431
JIRA References: 
Sources used:
openSUSE Backports SLE-15-SP5 (src):    chromium-116.0.5845.110-bp155.2.22.1
openSUSE Backports SLE-15-SP4 (src):    chromium-116.0.5845.110-bp154.2.108.1
Comment 7 OBSbugzilla Bot 2023-08-28 19:35:03 UTC 
This is an autogenerated message for OBS integration:
This bug (1214487) was mentioned in
https://build.opensuse.org/request/show/1107812 Factory / ungoogled-chromium
Comment 8 Andreas Stieger 2023-08-28 21:14:02 UTC 
Done