[ GLSA 202208-35 ] Chromium, Google Chrome, Microsoft Edge: Multiple Vulnerabilities

[email protected] Sun, 21 Aug 2022 06:12:38 -0000
Newsgroups	gmane.linux.gentoo.announce
Message-ID	<166106235848.12.11430112748457443005@7b72ab9f548d>
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 202208-35
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                           https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Severity: High
    Title: Chromium, Google Chrome, Microsoft Edge: Multiple Vulnerabilities
     Date: August 21, 2022
     Bugs: #858104, #859442, #863512, #865501, #864723
       ID: 202208-35

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Multiple vulnerabilities have been found in Chromium and its
derivatives, the worst of which could result in remote code execution.

Background
==========

Chromium is an open-source browser project that aims to build a safer,
faster, and more stable way for all users to experience the web.

Google Chrome is one fast, simple, and secure browser for all your
devices.

Microsoft Edge is a browser that combines a minimal design with
sophisticated technology to make the web faster, safer, and easier.

Affected packages
=================

    -------------------------------------------------------------------
     Package              /     Vulnerable     /            Unaffected
    -------------------------------------------------------------------
  1  www-client/chromium        < 104.0.5112.101    >= 104.0.5112.101
  2  www-client/chromium-bin    < 104.0.5112.101    >= 104.0.5112.101
  3  www-client/google-chrome   < 104.0.5112.101    >= 104.0.5112.101
  4  www-client/microsoft-edge  < 104.0.1293.63      >= 104.0.1293.63

Description
===========

Multiple vulnerabilities have been discovered in Chromium and its
derivatives. Please review the CVE identifiers referenced below for
details.

Impact
======

Please review the referenced CVE identifiers for details.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All Chromium users should upgrade to the latest version:

  # emerge --sync
  # emerge --ask --oneshot --verbose ">=www-client/chromium-104.0.5112.101"

All Chromium binary users should upgrade to the latest version:

  # emerge --sync
  # emerge --ask --oneshot --verbose ">=www-client/chromium-bin-104.0.5112.101"

All Google Chrome users should upgrade to tha latest version:

  # emerge --sync
  # emerge --ask --oneshot --verbose ">=www-client/google-chrome-104.0.5112.101"

All Microsoft Edge users should upgrade to tha latest version:

  # emerge --sync
  # emerge --ask --oneshot --verbose ">=www-client/microsoft-edge-104.0.1293.63"

References
==========

[ 1 ] CVE-2022-2163
      https://nvd.nist.gov/vuln/detail/CVE-2022-2163
[ 2 ] CVE-2022-2294
      https://nvd.nist.gov/vuln/detail/CVE-2022-2294
[ 3 ] CVE-2022-2295
      https://nvd.nist.gov/vuln/detail/CVE-2022-2295
[ 4 ] CVE-2022-2296
      https://nvd.nist.gov/vuln/detail/CVE-2022-2296
[ 5 ] CVE-2022-2477
      https://nvd.nist.gov/vuln/detail/CVE-2022-2477
[ 6 ] CVE-2022-2478
      https://nvd.nist.gov/vuln/detail/CVE-2022-2478
[ 7 ] CVE-2022-2479
      https://nvd.nist.gov/vuln/detail/CVE-2022-2479
[ 8 ] CVE-2022-2480
      https://nvd.nist.gov/vuln/detail/CVE-2022-2480
[ 9 ] CVE-2022-2481
      https://nvd.nist.gov/vuln/detail/CVE-2022-2481
[ 10 ] CVE-2022-2603
      https://nvd.nist.gov/vuln/detail/CVE-2022-2603
[ 11 ] CVE-2022-2604
      https://nvd.nist.gov/vuln/detail/CVE-2022-2604
[ 12 ] CVE-2022-2605
      https://nvd.nist.gov/vuln/detail/CVE-2022-2605
[ 13 ] CVE-2022-2606
      https://nvd.nist.gov/vuln/detail/CVE-2022-2606
[ 14 ] CVE-2022-2607
      https://nvd.nist.gov/vuln/detail/CVE-2022-2607
[ 15 ] CVE-2022-2608
      https://nvd.nist.gov/vuln/detail/CVE-2022-2608
[ 16 ] CVE-2022-2609
      https://nvd.nist.gov/vuln/detail/CVE-2022-2609
[ 17 ] CVE-2022-2610
      https://nvd.nist.gov/vuln/detail/CVE-2022-2610
[ 18 ] CVE-2022-2611
      https://nvd.nist.gov/vuln/detail/CVE-2022-2611
[ 19 ] CVE-2022-2612
      https://nvd.nist.gov/vuln/detail/CVE-2022-2612
[ 20 ] CVE-2022-2613
      https://nvd.nist.gov/vuln/detail/CVE-2022-2613
[ 21 ] CVE-2022-2614
      https://nvd.nist.gov/vuln/detail/CVE-2022-2614
[ 22 ] CVE-2022-2615
      https://nvd.nist.gov/vuln/detail/CVE-2022-2615
[ 23 ] CVE-2022-2616
      https://nvd.nist.gov/vuln/detail/CVE-2022-2616
[ 24 ] CVE-2022-2617
      https://nvd.nist.gov/vuln/detail/CVE-2022-2617
[ 25 ] CVE-2022-2618
      https://nvd.nist.gov/vuln/detail/CVE-2022-2618
[ 26 ] CVE-2022-2619
      https://nvd.nist.gov/vuln/detail/CVE-2022-2619
[ 27 ] CVE-2022-2620
      https://nvd.nist.gov/vuln/detail/CVE-2022-2620
[ 28 ] CVE-2022-2621
      https://nvd.nist.gov/vuln/detail/CVE-2022-2621
[ 29 ] CVE-2022-2622
      https://nvd.nist.gov/vuln/detail/CVE-2022-2622
[ 30 ] CVE-2022-2623
      https://nvd.nist.gov/vuln/detail/CVE-2022-2623
[ 31 ] CVE-2022-2624
      https://nvd.nist.gov/vuln/detail/CVE-2022-2624
[ 32 ] CVE-2022-2852
      https://nvd.nist.gov/vuln/detail/CVE-2022-2852
[ 33 ] CVE-2022-2853
      https://nvd.nist.gov/vuln/detail/CVE-2022-2853
[ 34 ] CVE-2022-2854
      https://nvd.nist.gov/vuln/detail/CVE-2022-2854
[ 35 ] CVE-2022-2855
      https://nvd.nist.gov/vuln/detail/CVE-2022-2855
[ 36 ] CVE-2022-2856
      https://nvd.nist.gov/vuln/detail/CVE-2022-2856
[ 37 ] CVE-2022-2857
      https://nvd.nist.gov/vuln/detail/CVE-2022-2857
[ 38 ] CVE-2022-2858
      https://nvd.nist.gov/vuln/detail/CVE-2022-2858
[ 39 ] CVE-2022-2859
      https://nvd.nist.gov/vuln/detail/CVE-2022-2859
[ 40 ] CVE-2022-2860
      https://nvd.nist.gov/vuln/detail/CVE-2022-2860
[ 41 ] CVE-2022-2861
      https://nvd.nist.gov/vuln/detail/CVE-2022-2861
[ 42 ] CVE-2022-33636
      https://nvd.nist.gov/vuln/detail/CVE-2022-33636
[ 43 ] CVE-2022-33649
      https://nvd.nist.gov/vuln/detail/CVE-2022-33649
[ 44 ] CVE-2022-35796
      https://nvd.nist.gov/vuln/detail/CVE-2022-35796

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

 https://security.gentoo.org/glsa/202208-35

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
[email protected] or alternatively, you may file a bug at
https://bugs.gentoo.org.

License
=======

Copyright 2022 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5
signature.asc (application/pgp-signature, 833 B)