bugtraq - [SECURITY] [DSA 2797-1] chromium-browser security update

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <E1Vi4Ug-0007Ww-1l@alpha.psidef.org>
Date: Sun, 17 Nov 2013 10:42:38 -0500
From: Michael Gilbert <mgilbert@...ian.org>
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA 2797-1] chromium-browser security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2797-1                   security@...ian.org
http://www.debian.org/security/                           Michael Gilbert
November 16, 2013                      http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : chromium-browser
Vulnerability  : several
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2013-2931 CVE-2013-6621 CVE-2013-6622 CVE-2013-6623 
                 CVE-2013-6624 CVE-2013-6625 CVE-2013-6626 CVE-2013-6627
                 CVE-2013-6628 CVE-2013-6629 CVE-2013-6630 CVE-2013-6631
                 CVE-2013-6632

Several vulnerabilities have been discovered in the chromium web browser.

CVE-2013-2931

    The chrome 31 development team found various issues from internal
    fuzzing, audits, and other studies.

CVE-2013-6621

    Khalil Zhani discovered a use-after-free issue in speech input
    handling.

CVE-2013-6622

    cloudfuzzer discovered a use-after-free issue in HTMLMediaElement.

CVE-2013-6623

    miaubiz discovered an out-of-bounds read in the Blink/Webkit SVG
    implementation.

CVE-2013-6624

    Jon Butler discovered a use-after-free issue in id attribute strings.

CVE-2013-6625

    cloudfuzzer discovered a use-after-free issue in the Blink/Webkit
    DOM implementation.

CVE-2013-6626

    Chamal de Silva discovered an address bar spoofing issue.

CVE-2013-6627

    skylined discovered an out-of-bounds read in the HTTP stream parser.

CVE-2013-6628

    Antoine Delignat-Lavaud and Karthikeyan Bhargavan of INRIA Paris
    discovered that a different (unverified) certificate could be used
    after successful TLS renegotiation with a valid certificate.

CVE-2013-6629

    Michal Zalewski discovered an uninitialized memory read in the
    libjpeg and libjpeg-turbo libraries.

CVE-2013-6630

    Michal Zalewski discovered another uninitialized memory read in
    the libjpeg and libjpeg-turbo libraries.

CVE-2013-6631

    Patrik Höglund discovered a use-free issue in the libjingle library.

CVE-2013-6632

    Pinkie Pie discovered multiple memory corruption issues.

For the stable distribution (wheezy), these problems have been fixed in
version 31.0.1650.57-1~deb7u1.

For the testing distribution (jessie), these problems will be fixed soon.

For the unstable distribution (sid), these problems have been fixed in
version 31.0.1650.57-1.

We recommend that you upgrade your chromium-browser packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/

Mailing list: debian-security-announce@...ts.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.15 (GNU/Linux)

iQQcBAEBCgAGBQJSiChzAAoJELjWss0C1vRzU4Qf/RvGDovXCQzKN1JKFWr+VDhu
OfwJAd5DZUd/EAe8ZgfTrmivl6gTYYLI6ulRcyhlQyDXuQcg7+pz33/97Q/At77f
nm6jfo1eZQN674NZ+H5lL3ZcVmnxubXGa0Ro+Q5QghS6lcvQ3G684j+t8wnyAu9s
IYcwxgjVlIUvHMa6j4jep6x/hL3UWEnWNGBx6FtL9vR+832BRU9L9ngZsy7BLsKy
gAn2XvU2R1GUkPfwG0gu0dXSHG0DTYeDSGdcAblFgnDUgcZLr1VXfNqRv3y47LVS
npL/a4HWqqFBbEsa4Pho1zepADs5RRgnOple90xIsCIcmq+YZ/AvDP0N+AFOY4FV
0NNOWOwfsVhcSengrJmsc6+W5RX1VtDVzhrtkQYD+dEgVj2HLdRKzju7qLMj2sJz
nzzVGMcZ8Gz3CnR31mEioeE9fj8DzRXPMf+6oyqpfzttprGg6F3s7elVEFjKfRbf
crxjm1Rok9g4vGNFEfNPFEqzFvjgzd7zkT6Xrd2HPqOSrnWjAWOxhdaBQmtuUmYt
QqkJWLUREWwqXLYE6PMSmLO6dAO1z8DU25R37TdD3aa5U2qzabAxwsUCQ2iLt9W8
/xY8RTdR/L28wa0zC1xEWdObdgAj5+B8ZAw8sbENlVytLV8o4GlfDaX7PaC8YYAn
0/N+CjDWS2QEnQgBuL8pNpbFc1cyEpLqmboE4k5Vg4hAjUsAvE+KimTv/pdmfEwU
D9qzA37NM17hfU7KOMBtYLJ5pQLS5JnyHVDwy8iCQUP72HS8dvc4nvrW6feTE7w3
jseUvtwG2MLdp/lUXDzGw8Vr60wXmAMFU298jOb8d38YajzMdSbkihNDq1OWCZ+v
lvFBjfOlxZtR+xIYJjrfe41oAD84Dk7j31o9o4OHelCP0Ur7o49PlFWkaRegMeyL
/F82W1oyKNKaoiAGenlRBJFwmqKlC4uebkYL2juRuRcTd0D4tNKmlFK04LlGkTMG
RzfO20owjh2e4CQYbf96zXod0MurhbzdBIzEEQDhxSAQJHFmzO9zKa0opsVteXNU
egcxdp7xTk744q9uyb9mJOyswer6YyYiRxT9I5Je3+DCJcQVnoZZICV4cqZ020hj
yNJjepdJgNg48fg5HwpVJYx7BFdmU4DFga0zcr22r0oCw0Ywnbnq9ePvjX2ZUsfM
QVXeh6oGz8u2+9su5uDvba+r3gEg+pxhMFp1Ce4gvBISdzvydpPERN5mqA5QVGSE
+B1NwTdf9UzJ/CbA4seh03Kq+CYxmnNzekTIa6kTX49xkuroV/bAkU4UuZqdYORE
m7onNL073yMBpS4jfPgq0zEFIohseX0m8+Cdd1maCV819HeopjTaajY94DL2Hrk=
=jrjN
-----END PGP SIGNATURE-----