openSUSE-SU-2023:0092-1: important: Security update for chromium
openSUSE Security Update: Security update for chromium
______________________________________________________________________________
Announcement ID: openSUSE-SU-2023:0092-1
Rating: important
References: #1210126 #1210478
Cross-References: CVE-2023-1810 CVE-2023-1811 CVE-2023-1812
CVE-2023-1813 CVE-2023-1814 CVE-2023-1815
CVE-2023-1816 CVE-2023-1817 CVE-2023-1818
CVE-2023-1819 CVE-2023-1820 CVE-2023-1821
CVE-2023-1822 CVE-2023-1823 CVE-2023-2033
CVSS scores:
CVE-2023-1810 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2023-1811 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2023-1812 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2023-1813 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVE-2023-1814 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVE-2023-1815 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2023-1816 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVE-2023-1817 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVE-2023-1818 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2023-1819 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVE-2023-1820 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2023-1821 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVE-2023-1822 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVE-2023-1823 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVE-2023-2033 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products:
openSUSE Backports SLE-15-SP4
______________________________________________________________________________
An update that fixes 15 vulnerabilities is now available.
Description:
This update for chromium fixes the following issues:
- Chromium 112.0.5615.121:
* CVE-2023-2033: Type Confusion in V8 (boo#1210478)
- Chromium 112.0.5615.49
* CSS now supports nesting rules.
* The algorithm to set the initial focus on elements was
updated.
* No-op fetch() handlers on service workers are skipped from now on to
make navigations faster
* The setter for document.domain is now deprecated.
* The recorder in devtools can now record with pierce selectors.
* Security fixes (boo#1210126):
* CVE-2023-1810: Heap buffer overflow in Visuals
* CVE-2023-1811: Use after free in Frames
* CVE-2023-1812: Out of bounds memory access in DOM Bindings
* CVE-2023-1813: Inappropriate implementation in Extensions
* CVE-2023-1814: Insufficient validation of untrusted input in Safe
Browsing
* CVE-2023-1815: Use after free in Networking APIs
* CVE-2023-1816: Incorrect security UI in Picture In Picture
* CVE-2023-1817: Insufficient policy enforcement in Intents
* CVE-2023-1818: Use after free in Vulkan
* CVE-2023-1819: Out of bounds read in Accessibility
* CVE-2023-1820: Heap buffer overflow in Browser History
* CVE-2023-1821: Inappropriate implementation in WebShare
* CVE-2023-1822: Incorrect security UI in Navigation
* CVE-2023-1823: Inappropriate implementation in FedCM
- Chromium 111.0.5563.147:
* nth-child() validation performance regression for SAP apps
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Backports SLE-15-SP4:
zypper in -t patch openSUSE-2023-92=1
Package List:
- openSUSE Backports SLE-15-SP4 (aarch64 x86_64):
chromedriver-112.0.5615.121-bp154.2.79.1
chromium-112.0.5615.121-bp154.2.79.1
References:
https://www.suse.com/security/cve/CVE-2023-1810.html
https://www.suse.com/security/cve/CVE-2023-1811.html
https://www.suse.com/security/cve/CVE-2023-1812.html
https://www.suse.com/security/cve/CVE-2023-1813.html
https://www.suse.com/security/cve/CVE-2023-1814.html
https://www.suse.com/security/cve/CVE-2023-1815.html
https://www.suse.com/security/cve/CVE-2023-1816.html
https://www.suse.com/security/cve/CVE-2023-1817.html
https://www.suse.com/security/cve/CVE-2023-1818.html
https://www.suse.com/security/cve/CVE-2023-1819.html
https://www.suse.com/security/cve/CVE-2023-1820.html
https://www.suse.com/security/cve/CVE-2023-1821.html
https://www.suse.com/security/cve/CVE-2023-1822.html
https://www.suse.com/security/cve/CVE-2023-1823.html
https://www.suse.com/security/cve/CVE-2023-2033.html
https://bugzilla.suse.com/1210126
https://bugzilla.suse.com/1210478
A chromium security update has been released for SUSE Linux Enterprise 15 SP4.
