Security update for chromium SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2021:0259-1 Final 1 1 2021-02-07T11:12:20Z current 2021-02-07T11:12:20Z 2021-02-07T11:12:20Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for chromium This update for chromium fixes the following issues: - Update to 88.0.4324.146 boo#1181772 - CVE-2021-21142: Use after free in Payments - CVE-2021-21143: Heap buffer overflow in Extensions - CVE-2021-21144: Heap buffer overflow in Tab Groups. - CVE-2021-21145: Use after free in Fonts - CVE-2021-21146: Use after free in Navigation. - CVE-2021-21147: Inappropriate implementation in Skia The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2021-259 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XCYZBSKAQDG7SYKEXASEZQODBJQKCMUZ/ E-Mail link for openSUSE-SU-2021:0259-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1181772 SUSE Bug 1181772 https://www.suse.com/security/cve/CVE-2021-21142/ SUSE CVE CVE-2021-21142 page https://www.suse.com/security/cve/CVE-2021-21143/ SUSE CVE CVE-2021-21143 page https://www.suse.com/security/cve/CVE-2021-21144/ SUSE CVE CVE-2021-21144 page https://www.suse.com/security/cve/CVE-2021-21145/ SUSE CVE CVE-2021-21145 page https://www.suse.com/security/cve/CVE-2021-21146/ SUSE CVE CVE-2021-21146 page https://www.suse.com/security/cve/CVE-2021-21147/ SUSE CVE CVE-2021-21147 page openSUSE Leap 15.2 chromedriver-88.0.4324.146-lp152.2.69.1 chromium-88.0.4324.146-lp152.2.69.1 chromedriver-88.0.4324.146-lp152.2.69.1 as a component of openSUSE Leap 15.2 chromium-88.0.4324.146-lp152.2.69.1 as a component of openSUSE Leap 15.2 Use after free in Payments in Google Chrome on Mac prior to 88.0.4324.146 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. CVE-2021-21142 openSUSE Leap 15.2:chromedriver-88.0.4324.146-lp152.2.69.1 openSUSE Leap 15.2:chromium-88.0.4324.146-lp152.2.69.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XCYZBSKAQDG7SYKEXASEZQODBJQKCMUZ/ https://www.suse.com/security/cve/CVE-2021-21142.html CVE-2021-21142 https://bugzilla.suse.com/1181772 SUSE Bug 1181772 Heap buffer overflow in Extensions in Google Chrome prior to 88.0.4324.146 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. CVE-2021-21143 openSUSE Leap 15.2:chromedriver-88.0.4324.146-lp152.2.69.1 openSUSE Leap 15.2:chromium-88.0.4324.146-lp152.2.69.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XCYZBSKAQDG7SYKEXASEZQODBJQKCMUZ/ https://www.suse.com/security/cve/CVE-2021-21143.html CVE-2021-21143 https://bugzilla.suse.com/1181772 SUSE Bug 1181772 Heap buffer overflow in Tab Groups in Google Chrome prior to 88.0.4324.146 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. CVE-2021-21144 openSUSE Leap 15.2:chromedriver-88.0.4324.146-lp152.2.69.1 openSUSE Leap 15.2:chromium-88.0.4324.146-lp152.2.69.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XCYZBSKAQDG7SYKEXASEZQODBJQKCMUZ/ https://www.suse.com/security/cve/CVE-2021-21144.html CVE-2021-21144 https://bugzilla.suse.com/1181772 SUSE Bug 1181772 Use after free in Fonts in Google Chrome prior to 88.0.4324.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2021-21145 openSUSE Leap 15.2:chromedriver-88.0.4324.146-lp152.2.69.1 openSUSE Leap 15.2:chromium-88.0.4324.146-lp152.2.69.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XCYZBSKAQDG7SYKEXASEZQODBJQKCMUZ/ https://www.suse.com/security/cve/CVE-2021-21145.html CVE-2021-21145 https://bugzilla.suse.com/1181772 SUSE Bug 1181772 Use after free in Navigation in Google Chrome prior to 88.0.4324.146 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. CVE-2021-21146 openSUSE Leap 15.2:chromedriver-88.0.4324.146-lp152.2.69.1 openSUSE Leap 15.2:chromium-88.0.4324.146-lp152.2.69.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XCYZBSKAQDG7SYKEXASEZQODBJQKCMUZ/ https://www.suse.com/security/cve/CVE-2021-21146.html CVE-2021-21146 https://bugzilla.suse.com/1181772 SUSE Bug 1181772 Inappropriate implementation in Skia in Google Chrome prior to 88.0.4324.146 allowed a local attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. CVE-2021-21147 openSUSE Leap 15.2:chromedriver-88.0.4324.146-lp152.2.69.1 openSUSE Leap 15.2:chromium-88.0.4324.146-lp152.2.69.1 important 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XCYZBSKAQDG7SYKEXASEZQODBJQKCMUZ/ https://www.suse.com/security/cve/CVE-2021-21147.html CVE-2021-21147 https://bugzilla.suse.com/1181772 SUSE Bug 1181772