-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-4020-1 security@xxxxxxxxxx https://www.debian.org/security/ Michael Gilbert November 05, 2017 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : chromium-browser CVE ID : CVE-2017-5124 CVE-2017-5125 CVE-2017-5126 CVE-2017-5127 CVE-2017-5128 CVE-2017-5129 CVE-2017-5131 CVE-2017-5132 CVE-2017-5133 CVE-2017-15386 CVE-2017-15387 CVE-2017-15388 CVE-2017-15389 CVE-2017-15390 CVE-2017-15391 CVE-2017-15392 CVE-2017-15393 CVE-2017-15394 CVE-2017-15395 CVE-2017-15396 Several vulnerabilities have been discovered in the chromium web browser. In addition, this message serves as an annoucment that security support for chromium in the oldstable release (jessie), Debian 8, is now discontinued. Debian 8 chromium users that desire continued security updates are strongly encouraged to upgrade now to the current stable release (stretch), Debian 9. An alternative is to switch to the firefox browser, which will continue to receive security updates in jessie for some time. CVE-2017-5124 A cross-site scripting issue was discovered in MHTML. CVE-2017-5125 A heap overflow issue was discovered in the skia library. CVE-2017-5126 Luat Nguyen discovered a use-after-free issue in the pdfium library. CVE-2017-5127 Luat Nguyen discovered another use-after-free issue in the pdfium library. CVE-2017-5128 Omair discovered a heap overflow issue in the WebGL implementation. CVE-2017-5129 Omair discovered a use-after-free issue in the WebAudio implementation. CVE-2017-5131 An out-of-bounds write issue was discovered in the skia library. CVE-2017-5132 Guarav Dewan discovered an error in the WebAssembly implementation. CVE-2017-5133 Aleksandar Nikolic discovered an out-of-bounds write issue in the skia library. CVE-2017-15386 WenXu Wu discovered a user interface spoofing issue. CVE-2017-15387 Jun Kokatsu discovered a way to bypass the content security policy. CVE-2017-15388 Kushal Arvind Shah discovered an out-of-bounds read issue in the skia library. CVE-2017-15389 xisigr discovered a URL spoofing issue. CVE-2017-15390 Haosheng Wang discovered a URL spoofing issue. CVE-2017-15391 Joao Lucas Melo Brasio discovered a way for an extension to bypass its limitations. CVE-2017-15392 Xiaoyin Liu discovered an error the implementation of registry keys. CVE-2017-15393 Svyat Mitin discovered an issue in the devtools. CVE-2017-15394 Sam discovered a URL spoofing issue. CVE-2017-15395 Johannes Bergman discovered a null pointer dereference issue. CVE-2017-15396 Yuan Deng discovered a stack overflow issue in the v8 javascript library. For the oldstable distribution (jessie), security support for chromium has been discontinued. For the stable distribution (stretch), these problems have been fixed in version 62.0.3202.75-1~deb9u1. For the testing distribution (buster), these problems will be fixed soon. For the unstable distribution (sid), these problems have been fixed in version 62.0.3202.75-1. We recommend that you upgrade your chromium-browser packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@xxxxxxxxxxxxxxxx -----BEGIN PGP SIGNATURE----- iQQzBAEBCgAdFiEEluhy7ASCBulP9FUWuNayzQLW9HMFAln/kmQACgkQuNayzQLW 9HM/ESAApOvH0EduB5iNIPY4t2r7ST8O32mk5tONAg3nkG+UuU7yk4E5RZ4JbZGV 7LN5rkuqXqszSJKza9jGpqbSBMI/6AourLOIunSS0WrhGjLQh+Bq6bOCD4rFH0g5 30n4IIJs8MZ4isCmcr6+ag5DgF1Ay1BbT81yEaYUY8PbWN2mSllLXTtRhfyTal7D GtsTaqk02uX/WJIg0lShQ+YqJUcwv//ALUuxJKoKd6/KpXy42tro7ANqtZZQn8lq r+OlkdKfpPaQw7TwEpRXxfcm1lNaCi/fRmPBWZZEG3LEvsF/X8oUhgm+mN018vDU meuPn108C73nXZ4zSeHynnL4xtNKnjXaQb0b54/z+j09IWLB/yFuf7etsx2dO2Sf hjdi5VTlHn/EaQNjhmM/oER7aqmsDkBPdNgWC8Bge+Bpcj3Ylgrs1t4Mt6JE47sK 6FEmUlv11KXXF4oNASjwOnmkVIfw0M3HtDrfaVGqd09NMlLztJgzqO0HyjX1tCj6 yo1+6rlDD3Ej+r+iIoA2xCW3GK/SDdtljKzjKjFXd5FvgHmqgwMG1aMF5lJJZGj8 X0SUJMU+HVP2nWioy8nrBlIRjLAy7jLLMWcqE1YPFLuQ/ABm4rcLj2JzGz/EmBDi JTPvgICi194ME6YkicKn4s/gOzEwbZzFxK3hlAKcy15LSvtFvT4QWgsQ/ZkkYBO+ 7hYHTv24spX/SbDl07gp8dpjXNisH9zTrfvxRz6lI0LoMq8RSPsyy2NcEeuxEh0G I7OESR0LAbUdJeLOhLGxfKWCnukbNmNS26HCtyT0h816DpSJ88B7IrYCa5J5T49o B7H/tZuxPhU8hdBidV5eSFj1fDxO3xLuA7edWTiH5VEs7z7LkXqJ7TiqVOk3cdzZ stCgXE5vyat8WWCpagLiCAJ8MolANHPiZ1Ig5V/iBALlGD26AwGoU/2g41wfmq/B e+67Nmg2/TSN222m5Htsf+fxBb7PBmhruWpaq1K1uJXXR87qcByCJI6+eWUXOV97 /7EONDt2teFubm3w+7H4Mz4E3aujEWXPyDcjNAKdsIJzWfofcfgXeYAXIk4Aj/Uv /U2a0HGHmEpDoRwppgUqb8oMk+S+YpFubpZmtgX2p5eT4iC4QVgQoXp4Z4c9c91K 9FYRfb/qGtqo07AXc9VUKBAkgueapjgQ1DZSwBaly1rQzVVUaI5vwl2GpoReqaKe AXDu08orySnjzjkMhE9otWIgERlJ4xDZrXVPGM6NkfRoepOn3t/qVvFxLU/PJUBP eqsfbZPgQhhAt+x/OOhI5ApCmGL1uteiSxNg3J3AXz66rMQ06uDQ1rDr0KhoDyfT A0nROwxkD0GTjYpVY3+mLSNY/w7+Kg== =Eua2 -----END PGP SIGNATURE-----
