Fedora 35 Update: 2021-5ffabdc080 Moderate: Chromium Use After Free

Chromium is an open-source web browser, powered by WebKit (Blink).

Update to 94.0.4606.81. Built with is_official_build=true, which disables all

sorts of debugging check functions that upstream turned on in 94. These

debugging checks were failing and causing the program to crash in ... fun ways.

It also fixes the usual pile of security issues, most notably: CVE-2021-37974

CVE-2021-37975 CVE-2021-37976 CVE-2021-37977 CVE-2021-37978 CVE-2021-37979

CVE-2021-37980

* Fri Oct 8 2021 Tom Callaway - 94.0.4606.81-1

- update to 94.0.4606.81

* Wed Oct 6 2021 Tom Callaway - 94.0.4606.71-2

- add official_build flag

- apply upstream patch to handle nullptr correctly in PartitionGetSizeEstimate()

* Tue Oct 5 2021 Tom Callaway - 94.0.4606.71-1

- update to 94.0.4606.71

[ 1 ] Bug #2010573 - CVE-2021-37974 chromium-browser: Use after free in Safe Browsing

https://bugzilla.redhat.com/show_bug.cgi?id=2010573

[ 2 ] Bug #2010574 - CVE-2021-37975 chromium-browser: Use after free in V8

https://bugzilla.redhat.com/show_bug.cgi?id=2010574

[ 3 ] Bug #2010575 - CVE-2021-37976 chromium-browser: Information leak in core

https://bugzilla.redhat.com/show_bug.cgi?id=2010575

[ 4 ] Bug #2012660 - CVE-2021-37977 chromium-browser: Use after free in Garbage Collection

https://bugzilla.redhat.com/show_bug.cgi?id=2012660

[ 5 ] Bug #2012661 - CVE-2021-37978 chromium-browser: Heap buffer overflow in Blink

https://bugzilla.redhat.com/show_bug.cgi?id=2012661

[ 6 ] Bug #2012662 - CVE-2021-37979 chromium-browser: Heap buffer overflow in WebRTC

https://bugzilla.redhat.com/show_bug.cgi?id=2012662

[ 7 ] Bug #2012663 - CVE-2021-37980 chromium-browser: Inappropriate implementation in Sandbox

https://bugzilla.redhat.com/show_bug.cgi?id=2012663

su -c 'dnf upgrade --advisory FEDORA-2021-5ffabdc080' at the command

line. For more information, refer to the dnf documentation available at

https://dnf.readthedocs.io/en/latest/command_ref.html

All packages are signed with the Fedora Project GPG key. More details on the

GPG keys used by the Fedora Project can be found at

https://fedoraproject.org/security/

package-announce mailing list -- package-announce@lists.fedoraproject.org

To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org

Fedora Code of Conduct: List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines

List Archives: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/

Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure