1. Forum
  2. Usenet
  3. LINUX.DEBIAN.ANNOUNCE.SEC

  • [SECURITY] [DSA 2797-1] chromium-browser security update

    From Michael Gilbert@1:229/2 to All on Sun Nov 17 16:50:01 2013
    From: [email protected]

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA512

    - ------------------------------------------------------------------------- Debian Security Advisory DSA-2797-1 [email protected] http://www.debian.org/security/ Michael Gilbert November 16, 2013 http://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package : chromium-browser
    Vulnerability : several
    Problem type : remote
    Debian-specific: no
    CVE ID : CVE-2013-2931 CVE-2013-6621 CVE-2013-6622 CVE-2013-6623
    CVE-2013-6624 CVE-2013-6625 CVE-2013-6626 CVE-2013-6627
    CVE-2013-6628 CVE-2013-6629 CVE-2013-6630 CVE-2013-6631
    CVE-2013-6632

    Several vulnerabilities have been discovered in the chromium web browser.

    CVE-2013-2931

    The chrome 31 development team found various issues from internal
    fuzzing, audits, and other studies.

    CVE-2013-6621

    Khalil Zhani discovered a use-after-free issue in speech input
    handling.

    CVE-2013-6622

    cloudfuzzer discovered a use-after-free issue in HTMLMediaElement.

    CVE-2013-6623

    miaubiz discovered an out-of-bounds read in the Blink/Webkit SVG
    implementation.

    CVE-2013-6624

    Jon Butler discovered a use-after-free issue in id attribute strings.

    CVE-2013-6625

    cloudfuzzer discovered a use-after-free issue in the Blink/Webkit
    DOM implementation.

    CVE-2013-6626

    Chamal de Silva discovered an address bar spoofing issue.

    CVE-2013-6627

    skylined discovered an out-of-bounds read in the HTTP stream parser.

    CVE-2013-6628

    Antoine Delignat-Lavaud and Karthikeyan Bhargavan of INRIA Paris
    discovered that a different (unverified) certificate could be used
    after successful TLS renegotiation with a valid certificate.

    CVE-2013-6629

    Michal Zalewski discovered an uninitialized memory read in the
    libjpeg and libjpeg-turbo libraries.

    CVE-2013-6630

    Michal Zalewski discovered another uninitialized memory read in
    the libjpeg and libjpeg-turbo libraries.

    CVE-2013-6631

    Patrik Höglund discovered a use-free issue in the libjingle library.

    CVE-2013-6632

    Pinkie Pie discovered multiple memory corruption issues.

    For the stable distribution (wheezy), these problems have been fixed in
    version 31.0.1650.57-1~deb7u1.

    For the testing distribution (jessie), these problems will be fixed soon.

    For the unstable distribution (sid), these problems have been fixed in
    version 31.0.1650.57-1.

    We recommend that you upgrade your chromium-browser packages.

    Further information about Debian Security Advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: http://www.debian.org/security/

    Mailing list: [email protected]
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.4.15 (GNU/Linux)

    iQQcBAEBCgAGBQJSiChzAAoJELjWss0C1vRzU4Qf/RvGDovXCQzKN1JKFWr+VDhu OfwJAd5DZUd/EAe8ZgfTrmivl6gTYYLI6ulRcyhlQyDXuQcg7+pz33/97Q/At77f nm6jfo1eZQN674NZ+H5lL3ZcVmnxubXGa0Ro+Q5QghS6lcvQ3G684j+t8wnyAu9s IYcwxgjVlIUvHMa6j4jep6x/hL3UWEnWNGBx6FtL9vR+832BRU9L9ngZsy7BLsKy gAn2XvU2R1GUkPfwG0gu0dXSHG0DTYeDSGdcAblFgnDUgcZLr1VXfNqRv3y47LVS npL/a4HWqqFBbEsa4Pho1zepADs5RRgnOple90xIsCIcmq+YZ/AvDP0N+AFOY4FV 0NNOWOwfsVhcSengrJmsc6+W5RX1VtDVzhrtkQYD+dEgVj2HLdRKzju7qLMj2sJz nzzVGMcZ8Gz3CnR31mEioeE9fj8DzRXPMf+6oyqpfzttprGg6F3s7elVEFjKfRbf crxjm1Rok9g4vGNFEfNPFEqzFvjgzd7zkT6Xrd2HPqOSrnWjAWOxhdaBQmtuUmYt QqkJWLUREWwqXLYE6PMSmLO6dAO1z8DU25R37TdD3aa5U2qzabAxwsUCQ2iLt9W8 /xY8RTdR/L28wa0zC1xEWdObdgAj5+B8ZAw8sbENlVytLV8o4GlfDaX7PaC8YYAn 0/N+CjDWS2QEnQgBuL8pNpbFc1cyEpLqmboE4k5Vg4hAjUsAvE+KimTv/pdmfEwU D9qzA37NM17hfU7KOMBtYLJ5pQLS5JnyHVDwy8iCQUP72HS8dvc4nvrW6feTE7w3 jseUvtwG2MLdp/lUXDzGw8Vr60wXmAMFU298jOb8d38YajzMdSbkihNDq1OWCZ+v lvFBjfOlxZtR+xIYJjrfe41oAD84Dk7j31o9o4OHelCP0Ur7o49PlFWkaRegMeyL /F82W1oyKNKaoiAGenlRBJFwmqKlC4uebkYL2juRuRcTd0D4tNKmlFK04LlGkTMG RzfO20owjh2e4CQYbf96zXod0MurhbzdBIzEEQDhxSAQJHFmzO9zKa0opsVteXNU egcxdp7xTk744q9uyb9mJOyswer6YyYiRxT9I5Je3+DCJcQVnoZZICV4cqZ020hj yNJjepdJgNg48fg5HwpVJYx7BFdmU4DFga0zcr22r0oCw0Ywnbnq9ePvjX2ZUsfM QVXeh6oGz8u2+9su5uDvba+r3gEg+pxhMFp1Ce4gvBISdzvydpPERN5mqA5QVGSE +B1NwTdf9UzJ/CbA4seh03Kq+CYxmnNzekTIa6kTX49xkuroV/bAkU4UuZqdYORE m7onNL073yMBpS4jfPgq0zEFIohseX0m8+Cdd1maCV819HeopjTaajY94DL2Hrk=
    =jrjN
    -----END PGP SIGNATURE-----


    --
    To UNSUBSCRIBE, email to [email protected]
    with a subject of "unsubscribe". Trouble? Contact [email protected] Archive: http://lists.debian.org/[email protected]

    --- SoupGate-Win32 v1.05
    * Origin: you cannot sedate... all the things you hate (1:229/2)