Gentoo Archives: gentoo-announce

From: Sam James <sam@g.o>
To: gentoo-announce@l.g.o
Subject: [gentoo-announce] [ GLSA 202008-10 ] Chromium, Google Chrome: Heap buffer overflow
Date: Tue, 25 Aug 2020 12:57:56
Message-Id: A5F689B9-354F-496D-97EA-92BF48360D70@gentoo.org
1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2 Gentoo Linux Security Advisory GLSA 202008-10
3 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
4 https://security.gentoo.org/
5 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
6
7 Severity: Normal
8 Title: Chromium, Google Chrome: Heap buffer overflow
9 Date: August 25, 2020
10 Bugs: #737942
11 ID: 202008-10
12
13 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
14
15 Synopsis
16 ========
17
18
19 A vulnerablity has been found in Chromium and Google Chrome that could
20 allow a remote attacker to execute arbitrary code.
21
22 Background
23 ==========
24
25
26 Chromium is an open-source browser project that aims to build a safer,
27 faster, and more stable way for all users to experience the web.
28
29 Google Chrome is one fast, simple, and secure browser for all your
30 devices.
31
32 Affected packages
33 =================
34
35 -------------------------------------------------------------------
36 Package / Vulnerable / Unaffected
37 -------------------------------------------------------------------
38 1 www-client/chromium < 84.0.4147.135 >= 84.0.4147.135
39 2 www-client/google-chrome
40 < 84.0.4147.135 >= 84.0.4147.135
41 -------------------------------------------------------------------
42 2 affected packages
43
44 Description
45 ===========
46
47 A buffer overflow has been discovered in Chromium and Google Chrome's
48 SwiftShader component.
49
50 Impact
51 ======
52
53 A remote attacker, by enticing a user to visit a specially crafted
54 website, could execute arbitrary code with the privileges of the
55 process.
56
57 Workaround
58 ==========
59
60 There is no known workaround at this time.
61
62 Resolution
63 ==========
64
65 All Chromium users should upgrade to the latest version:
66
67 # emerge --sync
68 # emerge --ask --oneshot -v ">=www-client/chromium-84.0.4147.135"
69
70 All Google Chrome users should upgrade to the latest version:
71
72 # emerge --sync
73 # emerge -a --oneshot -v ">=www-client/google-chrome-84.0.4147.135"
74
75 References
76 ==========
77
78 [ 1 ] CVE-2020-6556
79 https://nvd.nist.gov/vuln/detail/CVE-2020-6556
80 [ 2 ] Upstream advisory
81 https://chromereleases.googleblog.com/2020/08/stable-channel-update-for-desktop_18.html
82
83 Availability
84 ============
85
86 This GLSA and any updates to it are available for viewing at
87 the Gentoo Security Website:
88
89 https://security.gentoo.org/glsa/202008-10
90
91 Concerns?
92 =========
93
94 Security is a primary focus of Gentoo Linux and ensuring the
95 confidentiality and security of our users' machines is of utmost
96 importance to us. Any security concerns should be addressed to
97 security@g.o or alternatively, you may file a bug at
98 https://bugs.gentoo.org.
99
100 License
101 =======
102
103 Copyright 2020 Gentoo Foundation, Inc; referenced text
104 belongs to its owner(s).
105
106 The contents of this document are licensed under the
107 Creative Commons - Attribution / Share Alike license.
108
109 https://creativecommons.org/licenses/by-sa/2.5

Attachments

File name MIME type
signature.asc application/pgp-signature