Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×

Alerts This Week
Warning Icon 1 418
Alerts This Week
Warning Icon 1 418

openSUSE 2023:0277-1 Critical: Chromium Heap Overflow and Use After Free

opensuse
Calendar Grey September 29, 2023
Scroller Opensuse
Urgent patch released for chromium on openSUSE addressing serious heap buffer overflow and use-after-free vulnerabilities. Swift implementation required.
An update that fixes three vulnerabilities is now available

Description

This update for chromium fixes the following issues:

- Chromium 117.0.5938.132 (boo#1215776):

* CVE-2023-5217: Heap buffer overflow in vp8 encoding in libvpx

(boo#1215778)

* CVE-2023-5186: Use after free in Passwords

* CVE-2023-5187: Use after free in Extensions

- Chromium 117.0.5938.92:

* stability improvements

Topics%20covered

Topics Covered

security advisory critical issue software patch heap overflow openSUSE chromium use after free

Patch

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods

like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Backports SLE-15-SP5:

zypper in -t patch openSUSE-2023-277=1

- openSUSE Backports SLE-15-SP4:

zypper in -t patch openSUSE-2023-277=1

Package List

- openSUSE Backports SLE-15-SP5 (aarch64 x86_64):

chromedriver-117.0.5938.132-bp155.2.40.1

chromedriver-debuginfo-117.0.5938.132-bp155.2.40.1

chromium-117.0.5938.132-bp155.2.40.1

chromium-debuginfo-117.0.5938.132-bp155.2.40.1

- openSUSE Backports SLE-15-SP4 (aarch64 x86_64):

chromedriver-117.0.5938.132-bp154.2.126.1

chromium-117.0.5938.132-bp154.2.126.1

References

https://www.suse.com/security/cve/CVE-2023-5186.html

https://www.suse.com/security/cve/CVE-2023-5187.html

https://www.suse.com/security/cve/CVE-2023-5217.html

https://bugzilla.suse.com/1215776

https://bugzilla.suse.com/1215778

Severity
critical
Lowest
Low
Medium
High
Critical

Announcement ID: openSUSE-SU-2023:0277-1
Rating: critical
Affected Products: openSUSE Backports SLE-15-SP4 openSUSE Backports SLE-15-SP5 .

Topics%20covered

Topics Covered

security advisory critical issue software patch heap overflow openSUSE chromium use after free

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.