openSUSE 13.1/12.3: 2014:1151-1 Important: Remote Code Execution

Chromium was updated to 37.0.2062.94 containing security Fixes

(bnc#893720).

A full list of changes is available in the log:

.

0?pretty=full

This update includes 50 security fixes. Below, we highlight fixes that

were either contributed by external researchers or particularly

interesting. Please see the Chromium security page for more information.

Critical CVE-2014-3176, CVE-2014-3177: A special reward to lokihardt@asrt

for a combination of bugs in V8, IPC, sync, and extensions that can lead

to remote code execution outside of the sandbox.

High CVE-2014-3168: Use-after-free in SVG. Credit to cloudfuzzer. High

CVE-2014-3169: Use-after-free in DOM. Credit to Andrzej Dyjak. High

CVE-2014-3170: Extension permission dialog spoofing. Credit to Rob Wu.

High CVE-2014-3171: Use-after-free in bindings. Credit to cloudfuzzer.

Medium CVE-2014-3172: Issue related to extension debugging. Credit to Eli

Grey. Medium CVE-2014-3173: Uninitialized...