Lucene search

K
osvGoogleOSV:OPENSUSE-SU-2024:0204-1
HistoryJul 18, 2024 - 6:10 p.m.

Security update for chromium

2024-07-1818:10:25
Google
osv.dev
1
chromium
update
cve-2024-6290
dawn
swiftshader
v8
webassembly
memory allocator
cors
widevine
arm64
security

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.1

Confidence

High

This update for chromium fixes the following issues:

Chromium 126.0.6478.126 (boo#1226504, boo#1226205, boo#1226933)

  • CVE-2024-6290: Use after free in Dawn
  • CVE-2024-6291: Use after free in Swiftshader
  • CVE-2024-6292: Use after free in Dawn
  • CVE-2024-6293: Use after free in Dawn
  • CVE-2024-6100: Type Confusion in V8
  • CVE-2024-6101: Inappropriate implementation in WebAssembly
  • CVE-2024-6102: Out of bounds memory access in Dawn
  • CVE-2024-6103: Use after free in Dawn
  • CVE-2024-5830: Type Confusion in V8
  • CVE-2024-5831: Use after free in Dawn
  • CVE-2024-5832: Use after free in Dawn
  • CVE-2024-5833: Type Confusion in V8
  • CVE-2024-5834: Inappropriate implementation in Dawn
  • CVE-2024-5835: Heap buffer overflow in Tab Groups
  • CVE-2024-5836: Inappropriate Implementation in DevTools
  • CVE-2024-5837: Type Confusion in V8
  • CVE-2024-5838: Type Confusion in V8
  • CVE-2024-5839: Inappropriate Implementation in Memory Allocator
  • CVE-2024-5840: Policy Bypass in CORS
  • CVE-2024-5841: Use after free in V8
  • CVE-2024-5842: Use after free in Browser UI
  • CVE-2024-5843: Inappropriate implementation in Downloads
  • CVE-2024-5844: Heap buffer overflow in Tab Strip
  • CVE-2024-5845: Use after free in Audio
  • CVE-2024-5846: Use after free in PDFium
  • CVE-2024-5847: Use after free in PDFium
  • Amend fix_building_widevinecdm_with_chromium.patch to allow
    Widevine on ARM64 (boo#1226170)

References

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.1

Confidence

High