Recent Features
| ||||||||||||||||||||||
Gentoo alert 201012-01 (chromium)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201012-01 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Chromium: Multiple vulnerabilities Date: December 17, 2010 Bugs: #325451, #326717, #330003, #333559, #335750, #338204, #341797, #344201, #347625, #348651 ID: 201012-01 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been reported in Chromium, some of which may allow user-assisted execution of arbitrary code. Background ========== Chromium is an open-source web browser project. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 www-client/chromium < 8.0.552.224 >= 8.0.552.224 Description =========== Multiple vulnerabilities were found in Chromium. For further information please consult the release notes referenced below. Impact ====== A remote attacker could trick a user to perform a set of UI actions that trigger a possibly exploitable crash, leading to execution of arbitrary code or a Denial of Service. It was also possible for an attacker to entice a user to visit a specially-crafted web page that would trigger one of the vulnerabilities, leading to execution of arbitrary code within the confines of the sandbox, successful Cross-Site Scripting attacks, violation of the same-origin policy, successful website spoofing attacks, information leak, or a Denial of Service. An attacker could also trick a user to perform a set of UI actions that might result in a successful website spoofing attack. Multiple bugs in the sandbox could result in a sandbox escape. Multiple UI bugs could lead to information leak and successful website spoofing attacks. Workaround ========== There is no known workaround at this time. Resolution ========== All Chromium users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=www-client/chromium-8.0.552.224" References ========== [ 1 ] Release Notes 5.0.375.86 http://googlechromereleases.blogspot.com/2010/06/stable-c... [ 2 ] Release Notes 5.0.375.99 http://googlechromereleases.blogspot.com/2010/07/stable-c... [ 3 ] Release Notes 5.0.375.125 http://googlechromereleases.blogspot.com/2010/07/stable-c... [ 4 ] Release Notes 5.0.375.127 http://googlechromereleases.blogspot.com/2010/08/stable-c... [ 5 ] Release Notes 6.0.472.59 http://googlechromereleases.blogspot.com/2010/09/stable-b... [ 6 ] Release Notes 6.0.472.62 http://googlechromereleases.blogspot.com/2010/09/stable-b... [ 7 ] Release Notes 7.0.517.41 http://googlechromereleases.blogspot.com/2010/10/stable-c... [ 8 ] Release Notes 7.0.517.44 http://googlechromereleases.blogspot.com/2010/11/stable-c... [ 9 ] Release Notes 8.0.552.215 http://googlechromereleases.blogspot.com/2010/12/stable-b... [ 10 ] Release Notes 8.0.552.224 http://googlechromereleases.blogspot.com/2010/12/stable-b... Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-201012-01.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2010 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 (Log in to post comments)
|
||||||||||||||||||||||