Security update for chromium SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2023:0117-1 Final 1 1 2023-05-31T14:40:39Z current 2023-05-31T14:40:39Z 2023-05-31T14:40:39Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for chromium This update for chromium fixes the following issues: - build with llvm15 on Leap - Chromium 113.0.5672.126 (boo#1211442): * CVE-2023-2721: Use after free in Navigation * CVE-2023-2722: Use after free in Autofill UI * CVE-2023-2723: Use after free in DevTools * CVE-2023-2724: Type Confusion in V8 * CVE-2023-2725: Use after free in Guest View * CVE-2023-2726: Inappropriate implementation in WebApp Installs * Various fixes from internal audits, fuzzing and other initiatives - Chromium 113.0.5672.92 (boo#1211211) - Multiple security fixes (boo#1211036): * CVE-2023-2459: Inappropriate implementation in Prompts * CVE-2023-2460: Insufficient validation of untrusted input in Extensions * CVE-2023-2461: Use after free in OS Inputs * CVE-2023-2462: Inappropriate implementation in Prompts * CVE-2023-2463: Inappropriate implementation in Full Screen Mode * CVE-2023-2464: Inappropriate implementation in PictureInPicture * CVE-2023-2465: Inappropriate implementation in CORS * CVE-2023-2466: Inappropriate implementation in Prompts * CVE-2023-2467: Inappropriate implementation in Prompts * CVE-2023-2468: Inappropriate implementation in PictureInPicture The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2023-117 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/O7WSJFJTBCMXOOKGPURTAJETTJFNN6NP/ E-Mail link for openSUSE-SU-2023:0117-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1211036 SUSE Bug 1211036 https://bugzilla.suse.com/1211211 SUSE Bug 1211211 https://bugzilla.suse.com/1211442 SUSE Bug 1211442 https://www.suse.com/security/cve/CVE-2023-2459/ SUSE CVE CVE-2023-2459 page https://www.suse.com/security/cve/CVE-2023-2460/ SUSE CVE CVE-2023-2460 page https://www.suse.com/security/cve/CVE-2023-2461/ SUSE CVE CVE-2023-2461 page https://www.suse.com/security/cve/CVE-2023-2462/ SUSE CVE CVE-2023-2462 page https://www.suse.com/security/cve/CVE-2023-2463/ SUSE CVE CVE-2023-2463 page https://www.suse.com/security/cve/CVE-2023-2464/ SUSE CVE CVE-2023-2464 page https://www.suse.com/security/cve/CVE-2023-2465/ SUSE CVE CVE-2023-2465 page https://www.suse.com/security/cve/CVE-2023-2466/ SUSE CVE CVE-2023-2466 page https://www.suse.com/security/cve/CVE-2023-2467/ SUSE CVE CVE-2023-2467 page https://www.suse.com/security/cve/CVE-2023-2468/ SUSE CVE CVE-2023-2468 page https://www.suse.com/security/cve/CVE-2023-2721/ SUSE CVE CVE-2023-2721 page https://www.suse.com/security/cve/CVE-2023-2722/ SUSE CVE CVE-2023-2722 page https://www.suse.com/security/cve/CVE-2023-2723/ SUSE CVE CVE-2023-2723 page https://www.suse.com/security/cve/CVE-2023-2724/ SUSE CVE CVE-2023-2724 page https://www.suse.com/security/cve/CVE-2023-2725/ SUSE CVE CVE-2023-2725 page https://www.suse.com/security/cve/CVE-2023-2726/ SUSE CVE CVE-2023-2726 page SUSE Package Hub 15 SP4 openSUSE Leap 15.4 chromedriver-113.0.5672.126-bp154.2.87.1 chromium-113.0.5672.126-bp154.2.87.1 chromedriver-113.0.5672.126-bp154.2.87.1 as a component of SUSE Package Hub 15 SP4 chromium-113.0.5672.126-bp154.2.87.1 as a component of SUSE Package Hub 15 SP4 chromedriver-113.0.5672.126-bp154.2.87.1 as a component of openSUSE Leap 15.4 chromium-113.0.5672.126-bp154.2.87.1 as a component of openSUSE Leap 15.4 Inappropriate implementation in Prompts in Google Chrome prior to 113.0.5672.63 allowed a remote attacker to bypass permission restrictions via a crafted HTML page. (Chromium security severity: Medium) CVE-2023-2459 SUSE Package Hub 15 SP4:chromedriver-113.0.5672.126-bp154.2.87.1 SUSE Package Hub 15 SP4:chromium-113.0.5672.126-bp154.2.87.1 openSUSE Leap 15.4:chromedriver-113.0.5672.126-bp154.2.87.1 openSUSE Leap 15.4:chromium-113.0.5672.126-bp154.2.87.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/O7WSJFJTBCMXOOKGPURTAJETTJFNN6NP/ https://www.suse.com/security/cve/CVE-2023-2459.html CVE-2023-2459 https://bugzilla.suse.com/1211036 SUSE Bug 1211036 Insufficient validation of untrusted input in Extensions in Google Chrome prior to 113.0.5672.63 allowed an attacker who convinced a user to install a malicious extension to bypass file access checks via a crafted HTML page. (Chromium security severity: Medium) CVE-2023-2460 SUSE Package Hub 15 SP4:chromedriver-113.0.5672.126-bp154.2.87.1 SUSE Package Hub 15 SP4:chromium-113.0.5672.126-bp154.2.87.1 openSUSE Leap 15.4:chromedriver-113.0.5672.126-bp154.2.87.1 openSUSE Leap 15.4:chromium-113.0.5672.126-bp154.2.87.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/O7WSJFJTBCMXOOKGPURTAJETTJFNN6NP/ https://www.suse.com/security/cve/CVE-2023-2460.html CVE-2023-2460 https://bugzilla.suse.com/1211036 SUSE Bug 1211036 Use after free in OS Inputs in Google Chrome on ChromeOS prior to 113.0.5672.63 allowed a remote attacker who convinced a user to enage in specific UI interaction to potentially exploit heap corruption via crafted UI interaction. (Chromium security severity: Medium) CVE-2023-2461 SUSE Package Hub 15 SP4:chromedriver-113.0.5672.126-bp154.2.87.1 SUSE Package Hub 15 SP4:chromium-113.0.5672.126-bp154.2.87.1 openSUSE Leap 15.4:chromedriver-113.0.5672.126-bp154.2.87.1 openSUSE Leap 15.4:chromium-113.0.5672.126-bp154.2.87.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/O7WSJFJTBCMXOOKGPURTAJETTJFNN6NP/ https://www.suse.com/security/cve/CVE-2023-2461.html CVE-2023-2461 https://bugzilla.suse.com/1211036 SUSE Bug 1211036 Inappropriate implementation in Prompts in Google Chrome prior to 113.0.5672.63 allowed a remote attacker to obfuscate main origin data via a crafted HTML page. (Chromium security severity: Medium) CVE-2023-2462 SUSE Package Hub 15 SP4:chromedriver-113.0.5672.126-bp154.2.87.1 SUSE Package Hub 15 SP4:chromium-113.0.5672.126-bp154.2.87.1 openSUSE Leap 15.4:chromedriver-113.0.5672.126-bp154.2.87.1 openSUSE Leap 15.4:chromium-113.0.5672.126-bp154.2.87.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/O7WSJFJTBCMXOOKGPURTAJETTJFNN6NP/ https://www.suse.com/security/cve/CVE-2023-2462.html CVE-2023-2462 https://bugzilla.suse.com/1211036 SUSE Bug 1211036 Inappropriate implementation in Full Screen Mode in Google Chrome on Android prior to 113.0.5672.63 allowed a remote attacker to hide the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium) CVE-2023-2463 SUSE Package Hub 15 SP4:chromedriver-113.0.5672.126-bp154.2.87.1 SUSE Package Hub 15 SP4:chromium-113.0.5672.126-bp154.2.87.1 openSUSE Leap 15.4:chromedriver-113.0.5672.126-bp154.2.87.1 openSUSE Leap 15.4:chromium-113.0.5672.126-bp154.2.87.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/O7WSJFJTBCMXOOKGPURTAJETTJFNN6NP/ https://www.suse.com/security/cve/CVE-2023-2463.html CVE-2023-2463 https://bugzilla.suse.com/1211036 SUSE Bug 1211036 Inappropriate implementation in PictureInPicture in Google Chrome prior to 113.0.5672.63 allowed an attacker who convinced a user to install a malicious extension to perform an origin spoof in the security UI via a crafted HTML page. (Chromium security severity: Medium) CVE-2023-2464 SUSE Package Hub 15 SP4:chromedriver-113.0.5672.126-bp154.2.87.1 SUSE Package Hub 15 SP4:chromium-113.0.5672.126-bp154.2.87.1 openSUSE Leap 15.4:chromedriver-113.0.5672.126-bp154.2.87.1 openSUSE Leap 15.4:chromium-113.0.5672.126-bp154.2.87.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/O7WSJFJTBCMXOOKGPURTAJETTJFNN6NP/ https://www.suse.com/security/cve/CVE-2023-2464.html CVE-2023-2464 https://bugzilla.suse.com/1211036 SUSE Bug 1211036 Inappropriate implementation in CORS in Google Chrome prior to 113.0.5672.63 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) CVE-2023-2465 SUSE Package Hub 15 SP4:chromedriver-113.0.5672.126-bp154.2.87.1 SUSE Package Hub 15 SP4:chromium-113.0.5672.126-bp154.2.87.1 openSUSE Leap 15.4:chromedriver-113.0.5672.126-bp154.2.87.1 openSUSE Leap 15.4:chromium-113.0.5672.126-bp154.2.87.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/O7WSJFJTBCMXOOKGPURTAJETTJFNN6NP/ https://www.suse.com/security/cve/CVE-2023-2465.html CVE-2023-2465 https://bugzilla.suse.com/1211036 SUSE Bug 1211036 Inappropriate implementation in Prompts in Google Chrome prior to 113.0.5672.63 allowed a remote attacker to spoof the contents of the security UI via a crafted HTML page. (Chromium security severity: Low) CVE-2023-2466 SUSE Package Hub 15 SP4:chromedriver-113.0.5672.126-bp154.2.87.1 SUSE Package Hub 15 SP4:chromium-113.0.5672.126-bp154.2.87.1 openSUSE Leap 15.4:chromedriver-113.0.5672.126-bp154.2.87.1 openSUSE Leap 15.4:chromium-113.0.5672.126-bp154.2.87.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/O7WSJFJTBCMXOOKGPURTAJETTJFNN6NP/ https://www.suse.com/security/cve/CVE-2023-2466.html CVE-2023-2466 https://bugzilla.suse.com/1211036 SUSE Bug 1211036 Inappropriate implementation in Prompts in Google Chrome on Android prior to 113.0.5672.63 allowed a remote attacker to bypass permissions restrictions via a crafted HTML page. (Chromium security severity: Low) CVE-2023-2467 SUSE Package Hub 15 SP4:chromedriver-113.0.5672.126-bp154.2.87.1 SUSE Package Hub 15 SP4:chromium-113.0.5672.126-bp154.2.87.1 openSUSE Leap 15.4:chromedriver-113.0.5672.126-bp154.2.87.1 openSUSE Leap 15.4:chromium-113.0.5672.126-bp154.2.87.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/O7WSJFJTBCMXOOKGPURTAJETTJFNN6NP/ https://www.suse.com/security/cve/CVE-2023-2467.html CVE-2023-2467 https://bugzilla.suse.com/1211036 SUSE Bug 1211036 Inappropriate implementation in PictureInPicture in Google Chrome prior to 113.0.5672.63 allowed a remote attacker who had compromised the renderer process to obfuscate the security UI via a crafted HTML page. (Chromium security severity: Low) CVE-2023-2468 SUSE Package Hub 15 SP4:chromedriver-113.0.5672.126-bp154.2.87.1 SUSE Package Hub 15 SP4:chromium-113.0.5672.126-bp154.2.87.1 openSUSE Leap 15.4:chromedriver-113.0.5672.126-bp154.2.87.1 openSUSE Leap 15.4:chromium-113.0.5672.126-bp154.2.87.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/O7WSJFJTBCMXOOKGPURTAJETTJFNN6NP/ https://www.suse.com/security/cve/CVE-2023-2468.html CVE-2023-2468 https://bugzilla.suse.com/1211036 SUSE Bug 1211036 Use after free in Navigation in Google Chrome prior to 113.0.5672.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical) CVE-2023-2721 SUSE Package Hub 15 SP4:chromedriver-113.0.5672.126-bp154.2.87.1 SUSE Package Hub 15 SP4:chromium-113.0.5672.126-bp154.2.87.1 openSUSE Leap 15.4:chromedriver-113.0.5672.126-bp154.2.87.1 openSUSE Leap 15.4:chromium-113.0.5672.126-bp154.2.87.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/O7WSJFJTBCMXOOKGPURTAJETTJFNN6NP/ https://www.suse.com/security/cve/CVE-2023-2721.html CVE-2023-2721 https://bugzilla.suse.com/1211442 SUSE Bug 1211442 Use after free in Autofill UI in Google Chrome on Android prior to 113.0.5672.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) CVE-2023-2722 SUSE Package Hub 15 SP4:chromedriver-113.0.5672.126-bp154.2.87.1 SUSE Package Hub 15 SP4:chromium-113.0.5672.126-bp154.2.87.1 openSUSE Leap 15.4:chromedriver-113.0.5672.126-bp154.2.87.1 openSUSE Leap 15.4:chromium-113.0.5672.126-bp154.2.87.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/O7WSJFJTBCMXOOKGPURTAJETTJFNN6NP/ https://www.suse.com/security/cve/CVE-2023-2722.html CVE-2023-2722 https://bugzilla.suse.com/1211442 SUSE Bug 1211442 Use after free in DevTools in Google Chrome prior to 113.0.5672.126 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) CVE-2023-2723 SUSE Package Hub 15 SP4:chromedriver-113.0.5672.126-bp154.2.87.1 SUSE Package Hub 15 SP4:chromium-113.0.5672.126-bp154.2.87.1 openSUSE Leap 15.4:chromedriver-113.0.5672.126-bp154.2.87.1 openSUSE Leap 15.4:chromium-113.0.5672.126-bp154.2.87.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/O7WSJFJTBCMXOOKGPURTAJETTJFNN6NP/ https://www.suse.com/security/cve/CVE-2023-2723.html CVE-2023-2723 https://bugzilla.suse.com/1211442 SUSE Bug 1211442 Type confusion in V8 in Google Chrome prior to 113.0.5672.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) CVE-2023-2724 SUSE Package Hub 15 SP4:chromedriver-113.0.5672.126-bp154.2.87.1 SUSE Package Hub 15 SP4:chromium-113.0.5672.126-bp154.2.87.1 openSUSE Leap 15.4:chromedriver-113.0.5672.126-bp154.2.87.1 openSUSE Leap 15.4:chromium-113.0.5672.126-bp154.2.87.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/O7WSJFJTBCMXOOKGPURTAJETTJFNN6NP/ https://www.suse.com/security/cve/CVE-2023-2724.html CVE-2023-2724 https://bugzilla.suse.com/1211442 SUSE Bug 1211442 Use after free in Guest View in Google Chrome prior to 113.0.5672.126 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) CVE-2023-2725 SUSE Package Hub 15 SP4:chromedriver-113.0.5672.126-bp154.2.87.1 SUSE Package Hub 15 SP4:chromium-113.0.5672.126-bp154.2.87.1 openSUSE Leap 15.4:chromedriver-113.0.5672.126-bp154.2.87.1 openSUSE Leap 15.4:chromium-113.0.5672.126-bp154.2.87.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/O7WSJFJTBCMXOOKGPURTAJETTJFNN6NP/ https://www.suse.com/security/cve/CVE-2023-2725.html CVE-2023-2725 https://bugzilla.suse.com/1211442 SUSE Bug 1211442 Inappropriate implementation in WebApp Installs in Google Chrome prior to 113.0.5672.126 allowed an attacker who convinced a user to install a malicious web app to bypass install dialog via a crafted HTML page. (Chromium security severity: Medium) CVE-2023-2726 SUSE Package Hub 15 SP4:chromedriver-113.0.5672.126-bp154.2.87.1 SUSE Package Hub 15 SP4:chromium-113.0.5672.126-bp154.2.87.1 openSUSE Leap 15.4:chromedriver-113.0.5672.126-bp154.2.87.1 openSUSE Leap 15.4:chromium-113.0.5672.126-bp154.2.87.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/O7WSJFJTBCMXOOKGPURTAJETTJFNN6NP/ https://www.suse.com/security/cve/CVE-2023-2726.html CVE-2023-2726 https://bugzilla.suse.com/1211442 SUSE Bug 1211442