From c8380359fbe325dee67cb2ce828c854db080a34c Mon Sep 17 00:00:00 2001 From: Rene Ladan Date: Wed, 3 Feb 2021 20:06:09 +0000 Subject: [PATCH] Document new vulnerabilities in www/chromium < 88.0.4324.146 Obtained from: https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-desktop.html --- security/vuxml/vuln.xml | 48 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 48 insertions(+) diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 1068ebe935d3..7d7b48e5c5ff 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -77,6 +77,54 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> + + www/chromium -- multiple vulnerabilities + + + chromium + 88.0.4324.146 + + + + +

Chrome Releases reports:

+
+

This update include 6 security fixes:

+
    +
  • 1169317] Critical CVE-2021-21142: Use after free in Payments. + Reported by Khalil Zhani on 2021-01-21
    • +
  • [1163504] High CVE-2021-21143: Heap buffer overflow in + Extensions. Reported by Allen Parker and Alex Morgan of MU on + 2021-01-06
    • +
  • [1163845] High CVE-2021-21144: Heap buffer overflow in Tab + Groups. Reported by Leecraso and Guang Gong of 360 Alpha Lab on + 2021-01-07
    • +
  • [1154965] High CVE-2021-21145: Use after free in Fonts. Reported + by Anonymous on 2020-12-03
    • +
  • [1161705] High CVE-2021-21146: Use after free in Navigation. + Reported by Alison Huffman and Choongwoo Han of Microsoft Browser + Vulnerability Research on 2020-12-24
    • +
  • [1162942] Medium CVE-2021-21147: Inappropriate implementation in + Skia. Reported by Roman Starkov on 2021-01-04
    • +
+
+ + + + CVE-2021-21142 + CVE-2021-21143 + CVE-2021-21144 + CVE-2021-21145 + CVE-2021-21146 + CVE-2021-21147 + https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-desktop.html + + + 2021-02-02 + 2021-02-03 + + + Gitlab -- Multiple vulnerabilities