-
chromium-browser (25.0.1364.160-0ubuntu0.10.04.1) lucid-security; urgency=low
* Disable lintian warnings about outdated autoconf files in source tree.
* New stable version 25.0.1364.160:
- CVE-2013-0912: Type confusion in WebKit.
* New stable version 25.0.1364.152:
- CVE-2013-0902: Use-after-free in frame loader.
- CVE-2013-0903: Use-after-free in browser navigation handling.
- CVE-2013-0904: Memory corruption in Web Audio.
- CVE-2013-0905: Use-after-free with SVG animations.
- CVE-2013-0906: Memory corruption in Indexed DB.
- CVE-2013-0907: Race condition in media thread handling.
- CVE-2013-0908: Incorrect handling of bindings for extension processes.
- CVE-2013-0909: Referer leakage with XSS Auditor.
- CVE-2013-0910: Mediate renderer -> browser plug-in loads more strictly.
- CVE-2013-0911: Possible path traversal in database handling.
* New stable version 25.0.1364.97:
- CVE-2013-0879: Memory corruption with web audio node.
- CVE-2013-0880: Use-after-free in database handling.
- CVE-2013-0881: Bad read in Matroska handling.
- CVE-2013-0882: Bad memory access with excessive SVG parameters.
- CVE-2013-0883: Bad read in Skia.
- CVE-2013-0885: Too many API permissions granted to web store.
- CVE-2013-0887: Developer tools process has too many permissions and
places too much trust in the connected server.
- CVE-2013-0888: Out-of-bounds read in Skia.
- CVE-2013-0889: Tighten user gesture check for dangerous file downloads.
- CVE-2013-0890: Memory safety issues across the IPC layer.
- CVE-2013-0891: Integer overflow in blob handling.
- CVE-2013-0892: Lower severity issues across the IPC layer.
- CVE-2013-0893: Race condition in media handling.
- CVE-2013-0894: Buffer overflow in vorbis decoding.
- CVE-2013-0895: Incorrect path handling in file copying.
- CVE-2013-0896: Memory management issues in plug-in message handling.
- CVE-2013-0897: Off-by-one read in PDF.
- CVE-2013-0898: Use-after-free in URL handling.
- CVE-2013-0899: Integer overflow in Opus handling.
- CVE-2013-0900: Race condition in ICU.
* New stable version 24.0.1312.52:
- CVE-2012-5145: Use-after-free in SVG layout.
- CVE-2012-5146: Same origin policy bypass with malformed URL.
- CVE-2012-5147: Use-after-free in DOM handling.
- CVE-2012-5148: Missing filename sanitization in hyphenation support.
- CVE-2012-5149: Integer overflow in audio IPC handling.
- CVE-2012-5150: Use-after-free when seeking video.
- CVE-2012-5151: Integer overflow in PDF JavaScript.
- CVE-2012-5152: Out-of-bounds read when seeking video.
- CVE-2012-5153: Out-of-bounds stack access in v8.
- CVE-2012-5156: Use-after-free in PDF fields.
- CVE-2012-5157: Out-of-bounds reads in PDF image handling.
- CVE-2013-0828: Bad cast in PDF root handling.
- CVE-2013-0829: Corruption of database metadata leading to incorrect file
access.
- CVE-2013-0830: Missing NUL termination in IPC.
- CVE-2013-0831: Possible path traversal from extension process.
- CVE-2013-0832: Use-after-free with printing.
- CVE-2013-0833: Out-of-bounds read with printing.
- CVE-2013-0834: Out-of-bounds read with glyph handling.
- CVE-2013-0835: Browser crash with geolocation.
- CVE-2013-0836: Crash in v8 garbage collection.
- CVE-2013-0837: Crash in extension tab handling.
- CVE-2013-0838: Tighten permissions on shared memory segments.
* Add libpci-dev to build-deps.
* debian/patches/ffmpeg-gyp-config.
- Renamed from debian/patches/gyp-config-root
- Write includes for more targets in ffmpeg building.
* debian/patches/arm-crypto.patch
- Added patch to distinguish normal ARM and hard-float ARM in crypto
NSS inclusion.
* Put GOOG search credit in a patch so we know when it fails. Also
add credit to the other search idioms for GOOG.
because releases can have any number of updates.
* debian/rules:
- Adopt some ARM build conditions from Debian.
- Clean up. Stop matching Ubuntu versions outside of Ubuntu environments.
Match patterns instead of whole words
- Write REMOVED files in correct place.
- Remove all generated in-tree makefiles at clean and get-source time.
- Move all file-removal lines in get-source inside the condition
for stripping files out of the source.
- Hack in a "clean" rule that implements what src/Makefile should.
-- Chad MILLER <email address hidden> Fri, 08 Mar 2013 09:50:59 -0500
-
chromium-browser (24.0.1312.56-0ubuntu0.10.04.1) lucid-security; urgency=low
* debian/chromium-browser.install
- Install remoting locales
* Disable lintian warnings about outdated autoconf files in source tree.
* New upstream version 24.0.1312.56: (LP: #1099075)
- CVE-2013-0839: Use-after-free in canvas font handling.
- CVE-2013-0840: Missing URL validation when opening new windows.
- CVE-2013-0841: Unchecked array index in content blocking.
- CVE-2013-0842: Problems with NULL characters embedded in paths.
* New upstream version 24.0.1312.52:
- CVE-2012-5145: Use-after-free in SVG layout. Credit to Atte Kettunen of
OUSPG.
- CVE-2012-5146: Same origin policy bypass with malformed URL. Credit to
Erling A Ellingsen and Subodh Iyengar, both of Facebook.
- CVE-2012-5147: Use-after-free in DOM handling. Credit to José A. Vázquez.
- CVE-2012-5148: Missing filename sanitization in hyphenation support.
Credit to Google Chrome Security Team (Justin Schuh).
- CVE-2012-5149: Integer overflow in audio IPC handling. Credit to Google
Chrome Security Team (Chris Evans).
- CVE-2012-5150: Use-after-free when seeking video. Credit to Google Chrome
Security Team (Inferno).
- CVE-2012-5151: Integer overflow in PDF JavaScript. Credit to Mateusz
Jurczyk, with contribution from Gynvael Coldwind, both of Google Security
Team.
- CVE-2012-5152: Out-of-bounds read when seeking video. Credit to Google
Chrome Security Team (Inferno).
- CVE-2012-5153: Out-of-bounds stack access in v8. Credit to Andreas
Rossberg of the Chromium development community.
- CVE-2012-5156: Use-after-free in PDF fields. Credit to Mateusz Jurczyk,
with contribution from Gynvael Coldwind, both of Google Security Team.
- CVE-2012-5157: Out-of-bounds reads in PDF image handling. Credit to
Mateusz Jurczyk, with contribution from Gynvael Coldwind, both of Google
Security Team.
- CVE-2013-0828: Bad cast in PDF root handling. Credit to Mateusz Jurczyk,
with contribution from Gynvael Coldwind, both of Google Security Team.
- CVE-2013-0829: Corruption of database metadata leading to incorrect file
access. Credit to Google Chrome Security Team (Jüri Aedla).
- CVE-2013-0830: Missing NUL termination in IPC. Credit to Google Chrome
Security Team (Justin Schuh).
- CVE-2013-0831: Possible path traversal from extension process. Credit to
Google Chrome Security Team (Tom Sepez).
- CVE-2013-0832: Use-after-free with printing. Credit to Google Chrome
Security Team (Cris Neckar).
- CVE-2013-0833: Out-of-bounds read with printing. Credit to Google Chrome
Security Team (Cris Neckar).
- CVE-2013-0834: Out-of-bounds read with glyph handling. Credit to Google
Chrome Security Team (Cris Neckar).
- CVE-2013-0835: Browser crash with geolocation. Credit to Arthur Gerkis.
- CVE-2013-0836: Crash in v8 garbage collection. Credit to Google Chrome
Security Team (Cris Neckar).
- CVE-2013-0837: Crash in extension tab handling. Credit to Tom Nielsen.
- CVE-2013-0838: Tighten permissions on shared memory segments. Credit to
Google Chrome Security Team (Chris Palmer).
* debian/patches/gyp-config-root.patch
- Added. Avoids compilation bug on (at least) ARM.
* debian/patches/arm-neon.patch
- Added function to determine NEON functionality in ARM at runtime for
WebRt library in WebKit.
-- Chad Miller <email address hidden> Wed, 23 Jan 2013 14:49:29 -0500
-
chromium-browser (23.0.1271.97-0ubuntu0.10.04.1) lucid-security; urgency=low
* Omit resources/extension/demo files from any packaging verification
because they're unwanted.
* Update README.source to include some of these changes.
* Make most patches follow a common format (no timestamps), to avoid
future churn.
* debian/patches/chromium_useragent.patch.in renamed to drop ".in",
OS "Ubuntu" hardcoded with no compilation-release name, and patch
refreshed to follow new location of source.
* In debian/rules, use "-delete" flag on find instead of "-exec rm {} \;",
to be safer and faster.
* Put REMOVED files in parent of "src", to be more certain of avoiding
name collisions.
* Also don't include python bytecode or cache files in orig tarball,
and clean then up on "clean" rule.
* Fix dpkg-source warning: Clean up python cached bytecode files.
* Fix dpkg-source warning: Remove autoconf cache.
* Override lintian complaints ancient-autotools-helper-file and
unused-build-dependency-on-cdbs.
* debian/patches/arm-neon.patch added to get ARM w/o Neon support.
(LP: #1084852)
* In debian/rules, avoid creating invalid subst expression in sed
of DEBIAN* vars into files.
* Remove unnecessary glib-header-single-entry.patch .
* Add patches/struct-siginfo.patch to work around source bug in dereferencing
internal stuct instead of public type.
* New upstream version 23.0.1271.97
- CVE-2012-5139: Use-after-free with visibility events.
- CVE-2012-5140: Use-after-free in URL loader.
- CVE-2012-5141: Limit Chromoting client plug-in instantiation.
- CVE-2012-5142: Crash in history navigation.
- CVE-2012-5143: Integer overflow in PPAPI image buffers.
- CVE-2012-5144: Stack corruption in AAC decoding.
chromium-browser (23.0.1271.95-0ubuntu0.10.04.1) lucid-security; urgency=low
[ Micah Gersten <email address hidden> ]
* New upstream version 23.0.1271.95 (LP: #1086613)
- CVE-2012-5138: Incorrect file path handling.
- CVE-2012-5137: Use-after-free in media source handling.
* Hardcode Ubuntu in Chromium user agent patch; Drop release specific part
similar to what was done with Firefox; Drop from subst_files in rules
- rename debian/patches/chromium_useragent.patch.in => debian/patches/chromium_useragent.patch
- update debian/patches/chromium_useragent.patch
- update debian/rules
* Disable user agent patch for the moment as it doesn't apply cleanly
- update debian/patches/series
* Drop Pre-Depends: lzma since we switched to bzip2 binary compression
- update debian/control
[ Chad Miller <email address hidden> ]
* Add localization support for ast, bs, en-AU, eo, hy, ia, ka, ku, kw, ms.
* No longer include Launchpad-generated translations.
* No longer expect unpacked tarball to contain "build-tree".
* Fix build warning about missing debian/source/format. Set to "3.0
(quilt)".
* Make system-v8 patch use "type none" instead of "type settings".; Leave
Patch disabled
* Manually set DEB_{BUILD,HOST}_ARCH when not already set, like when the
executing program is not dpkg-buildpackage.
* Make rules file generate LASTCHANGE file at new location.
* Switch to bzip2 binary compression
* Change get-sources command to kill script when it fails to disable
gyp-chromium run from DEPS. Never fail silently again.
* Drop SCM revision from the version.
* New upstream version 23.0.1271.91
- CVE-2012-5133: Use-after-free in SVG filters.
- CVE-2012-5130: Out-of-bounds read in Skia.
- CVE-2012-5132: Browser crash with chunked encoding.
- CVE-2012-5134: Buffer underflow in libxml.
- CVE-2012-5135: Use-after-free with printing.
- CVE-2012-5136: Bad cast in input element handling.
* Includes CVE fixes for 23.0.1271.64
- CVE-2012-5127: Integer overflow leading to out-of-bounds read in WebP
handling.
- CVE-2012-5120: Out-of-bounds array access in v8.
- CVE-2012-5116: Use-after-free in SVG filter handling.
- CVE-2012-5121: Use-after-free in video layout.
- CVE-2012-5117: Inappropriate load of SVG subresource in img context.
- CVE-2012-5119: Race condition in Pepper buffer handling.
- CVE-2012-5122: Bad cast in input handling.
- CVE-2012-5123: Out-of-bounds reads in Skia.
- CVE-2012-5124: Memory corruption in texture handling.
- CVE-2012-5125: Use-after-free in extension tab handling.
- CVE-2012-5126: Use-after-free in plug-in placeholder handling.
- CVE-2012-5128: Bad write in v8.
* Includes CVE fixes for 22.0.1229.94
- CVE-2012-5112: SVG use-after-free and IPC arbitrary file write.
* Includes CVE fixes for 22.0.1229.92
- CVE-2012-2900: Crash in Skia text rendering.
- CVE-2012-5108: Race condition in audio device handling.
- CVE-2012-5109: OOB read in ICU regex.
- CVE-2012-5110: Out-of-bounds read in compositor.
- CVE-2012-5111: Plug-in crash monitoring was missing for Pepper plug-ins.
* Includes CVE fixes for 22.0.1229.79
- CVE-2012-2889: UXSS in frame handling.
- CVE-2012-2886: UXSS in v8 bindings.
- CVE-2012-2881: DOM tree corruption with plug-ins.
- CVE-2012-2876: Buffer overflow in SSE2 optimizations.
- CVE-2012-2883: Out-of-bounds write in Skia.
- CVE-2012-2887: Use-after-free in onclick handling.
- CVE-2012-2888: Use-after-free in SVG text references.
- CVE-2012-2894: Crash in graphics context handling.
- CVE-2012-2877: Browser crash with extensions and modal dialogs.
- CVE-2012-2879: DOM topology corruption.
- CVE-2012-2884: Out-of-bounds read in Skia.
- CVE-2012-2874: Out-of-bounds write in Skia.
- CVE-2012-2878: Use-after-free in plug-in handling.
- CVE-2012-2880: Race condition in plug-in paint buffer.
- CVE-2012-2882: Wild pointer in OGG container handling.
- CVE-2012-2885: Possible double free on exit.
- CVE-2012-2891: Address leak over IPC.
- CVE-2012-2892: Pop-up block bypass.
- CVE-2012-2893: Double free in XSL transforms.
* Includes CVE fixes for 21.0.1180.89
- CVE-2012-2865: Out-of-bounds read in line breaking.
- CVE-2012-2866: Bad cast with run-ins.
- CVE-2012-2867: Browser crash with SPDY.
- CVE-2012-2868: Race condition with workers and XHR.
- CVE-2012-2869: Avoid stale buffer in URL loading.
- CVE-2012-2870: Lower severity memory management issues in XPath.
- CVE-2012-2871: Bad cast in XSL transforms.
- CVE-2012-2872: XSS in SSL interstitial.
* Includes CVE fixes for 21.0.1180.57
- CVE-2012-2846: Cross-process interference in renderers.
- CVE-2012-2847: Missing re-prompt to user upon excessive downloads.
- CVE-2012-2848: Overly broad file access granted after drag+drop.
- CVE-2012-2849: Off-by-one read in GIF decoder.
- CVE-2012-2853: webRequest can interfere with the Chrome Web Store.
- CVE-2012-2854: Leak of pointer values to WebUI renderers.
- CVE-2012-2857: Use-after-free in CSS DOM.
- CVE-2012-2858: Buffer overflow in WebP decoder.
- CVE-2012-2859: Crash in tab handling.
- CVE-2012-2860: Out-of-bounds access when clicking in date picker.
* Includes CVE fixes for 20.0.1132.57
- CVE-2012-2842: Use-after-free in counter handling.
- CVE-2012-2843: Use-after-free in layout height tracking.
* Includes CVE fixes for 20.0.1132.43
- CVE-2012-2815: Leak of iframe fragment id.
- CVE-2012-2817: Use-after-free in table section handling.
- CVE-2012-2818: Use-after-free in counter layout.
- CVE-2012-2819: Crash in texture handling.
- CVE-2012-2820: Out-of-bounds read in SVG filter handling.
- CVE-2012-2821: Autofill display problem.
- CVE-2012-2823: Use-after-free in SVG resource handling.
- CVE-2012-2824: Use-after-free in SVG painting.
- CVE-2012-2826: Out-of-bounds read in texture conversion.
- CVE-2012-2829: Use-after-free in first-letter handling
- CVE-2012-2830: Wild pointer in array value setting.
- CVE-2012-2831: Use-after-free in SVG reference handling.
- CVE-2012-2834: Integer overflow in Matroska container.
- CVE-2012-2825: Wild read in XSL handling.
- CVE-2012-2807: Integer overflows in libxml.
* Includes CVE fixes for 19.0.1084.52:
- CVE-2011-3103: Crashes in v8 garbage collection.
- CVE-2011-3104: Out-of-bounds read in Skia.
- CVE-2011-3105: Use-after-free in first-letter handling.
- CVE-2011-3106: Browser memory corruption with websockets over SSL.
- CVE-2011-3107: Crashes in the plug-in JavaScript bindings.
- CVE-2011-3108: Use-after-free in browser cache.
- CVE-2011-3109: Bad cast in GTK UI.
- CVE-2011-3111: Invalid read in v8.
- CVE-2011-3115: Type corruption in v8.
* Includes CVE fixes for initial Chromium 19 release:
- CVE-2011-3083: Browser crash with video + FTP.
- CVE-2011-3084: Load links from internal pages in their own process.
- CVE-2011-3085: UI corruption with long autofilled values.
- CVE-2011-3086: Use-after-free with style element.
- CVE-2011-3087: Incorrect window navigation.
- CVE-2011-3088: Out-of-bounds read in hairline drawing.
- CVE-2011-3089: Use-after-free in table handling.
- CVE-2011-3090: Race condition with workers.
- CVE-2011-3091: Use-after-free with indexed DB.
- CVE-2011-3092: Invalid write in v8 regex.
- CVE-2011-3093: Out-of-bounds read in glyph handling.
- CVE-2011-3094: Out-of-bounds read in Tibetan handling.
- CVE-2011-3095: Out-of-bounds write in OGG container.
- CVE-2011-3096: Use-after-free in GTK omnibox handling.
- CVE-2011-3100: Out-of-bounds read drawing dash paths.
- CVE-2011-3101: Work around Linux Nvidia driver bug.
- CVE-2011-3102: Off-by-one out-of-bounds write in libxml.
-- Chad Miller <email address hidden> Sat, 12 Jan 2013 19:07:36 -0600
-
chromium-browser (18.0.1025.168~r134367-0ubuntu0.10.04.1) lucid-security; urgency=low
* New upstream release from the Stable Channel (LP: #992352)
- [106413] High CVE-2011-3078: Use after free in floats handling. Credit to
Google Chrome Security Team (Marty Barbella) and independent later
discovery by miaubiz.
- [117110] High CVE-2012-1521: Use after free in xml parser. Credit to
Google Chrome Security Team (SkyLined) and independent later discovery by
wushi of team509 reported through iDefense VCP (V-874rcfpq7z).
- [117627] Medium CVE-2011-3079: IPC validation failure. Credit to PinkiePie
- [121726] Medium CVE-2011-3080: Race condition in sandbox IPC. Credit to
Willem Pinckaers of Matasano.
- [121899] High CVE-2011-3081: Use after free in floats handling.
Credit to miaubiz.
-- Micah Gersten <email address hidden> Mon, 30 Apr 2012 22:29:03 -0500
-
chromium-browser (18.0.1025.151~r130497-0ubuntu0.10.04.1) lucid-security; urgency=low
* New upstream release from the Stable Channel (LP: #977502)
- black screen on Hybrid Graphics system with GPU accelerated compositing
enabled (Issue: 117371)
- CSS not applied to <content> element (Issue: 114667)
- Regression rendering a div with background gradient and borders
(Issue: 113726)
- Canvas 2D line drawing bug with GPU acceleration (Issue: 121285)
- Multiple crashes (Issues: 72235, 116825 and 92998)
- Pop-up dialog is at wrong position (Issue: 116045)
- HTML Canvas patterns are broken if you change the transformation matrix
(Issue: 112165)
- SSL interstitial error "proceed anyway" / "back to safety" buttons don't
work (Issue: 119252)
This release fixes the following security issues:
- [106577] Medium CVE-2011-3066: Out-of-bounds read in Skia clipping.
Credit to miaubiz.
- [117583] Medium CVE-2011-3067: Cross-origin iframe replacement. Credit to
Sergey Glazunov.
- [117698] High CVE-2011-3068: Use-after-free in run-in handling. Credit to
miaubiz.
- [117728] High CVE-2011-3069: Use-after-free in line box handling. Credit
to miaubiz.
- [118185] High CVE-2011-3070: Use-after-free in v8 bindings. Credit to
Google Chrome Security Team (SkyLined).
- [118273] High CVE-2011-3071: Use-after-free in HTMLMediaElement. Credit
to pa_kt, reporting through HP TippingPoint ZDI (ZDI-CAN-1528).
- [118467] Low CVE-2011-3072: Cross-origin violation parenting pop-up
window. Credit to Sergey Glazunov.
- [118593] High CVE-2011-3073: Use-after-free in SVG resource handling.
Credit to Arthur Gerkis.
- [119281] Medium CVE-2011-3074: Use-after-free in media handling. Credit
to Sławomir Błażek.
- [119525] High CVE-2011-3075: Use-after-free applying style command.
Credit to miaubiz.
- [120037] High CVE-2011-3076: Use-after-free in focus handling. Credit to
miaubiz.
- [120189] Medium CVE-2011-3077: Read-after-free in script bindings. Credit
to Google Chrome Security Team (Inferno).
chromium-browser (18.0.1025.142~r129054-0ubuntu0.10.04.1) lucid-security; urgency=low
* New upstream release from the Stable Channel (LP: #968901)
This release fixes the following security issues:
- [109574] Medium CVE-2011-3058: Bad interaction possibly leading to XSS in
EUC-JP. Credit to Masato Kinugawa.
- [112317] Medium CVE-2011-3059: Out-of-bounds read in SVG text handling.
Credit to Arthur Gerkis.
- [114056] Medium CVE-2011-3060: Out-of-bounds read in text fragment
handling. Credit to miaubiz.
- [116398] Medium CVE-2011-3061: SPDY proxy certificate checking error.
Credit to Leonidas Kontothanassis of Google.
- [116524] High CVE-2011-3062: Off-by-one in OpenType Sanitizer. Credit to
Mateusz Jurczyk of the Google Security Team.
- [117417] Low CVE-2011-3063: Validate navigation requests from the renderer
more carefully. Credit to kuzzcc, Sergey Glazunov, PinkiePie and
scarybeasts (Google Chrome Security Team).
- [117471] High CVE-2011-3064: Use-after-free in SVG clipping. Credit to
Atte Kettunen of OUSPG.
- [117588] High CVE-2011-3065: Memory corruption in Skia. Credit to Omair.
- [117794] Medium CVE-2011-3057: Invalid read in v8. Credit to Christian
Holler.
* Add build dependency on libudev-dev to allow for gamepad detection; see
http://code.google.com/p/chromium/issues/detail?id=79050
- update debian/control
* Drop dlopen_libgnutls patch as it's been implemented upstream
- drop debian/patches/dlopen_libgnutls.patch
- update debian/patches/series
* Start removing *.so and *.so.* from the upstream tarball creation
- update debian/rules
* Strip almost the entire third_party/openssl directory as it's needed only
on android, but is used by the build system
- update debian/rules
* Use tar's --exclude-vcs flag instead of just excluding .svn
- update debian/rules
chromium-browser (17.0.963.83~r127885-0ubuntu0.10.04.1) lucid-security; urgency=low
* New upstream release from the Stable Channel (LP: #961831)
This release fixes the following security issues:
- [113902] High CVE-2011-3050: Use-after-free with first-letter handling.
Credit to miaubiz.
- [116162] High CVE-2011-3045: libpng integer issue from upstream. Credit
to Glenn Randers-Pehrson of the libpng project.
- [116461] High CVE-2011-3051: Use-after-free in CSS cross-fade handling.
Credit to Arthur Gerkis.
- [116637] High CVE-2011-3052: Memory corruption in WebGL canvas handling.
Credit to Ben Vanik of Google.
- [116746] High CVE-2011-3053: Use-after-free in block splitting.
Credit to miaubiz.
- [117418] Low CVE-2011-3054: Apply additional isolations to webui
privileges. Credit to Sergey Glazunov.
- [117736] Low CVE-2011-3055: Prompt in the browser native UI for unpacked
extension installation. Credit to PinkiePie.
- [117550] High CVE-2011-3056: Cross-origin violation with “magic iframe”.
Credit to Sergey Glazunov.
- [117794] Medium CVE-2011-3057: Invalid read in v8. Credit to Christian
Holler.
-- Micah Gersten <email address hidden> Mon, 09 Apr 2012 19:10:03 -0500
-
chromium-browser (18.0.1025.142~r129054-0ubuntu0.10.04.1) lucid-security; urgency=low
* New upstream release from the Stable Channel (LP: #968901)
This release fixes the following security issues:
- [109574] Medium CVE-2011-3058: Bad interaction possibly leading to XSS in
EUC-JP. Credit to Masato Kinugawa.
- [112317] Medium CVE-2011-3059: Out-of-bounds read in SVG text handling.
Credit to Arthur Gerkis.
- [114056] Medium CVE-2011-3060: Out-of-bounds read in text fragment
handling. Credit to miaubiz.
- [116398] Medium CVE-2011-3061: SPDY proxy certificate checking error.
Credit to Leonidas Kontothanassis of Google.
- [116524] High CVE-2011-3062: Off-by-one in OpenType Sanitizer. Credit to
Mateusz Jurczyk of the Google Security Team.
- [117417] Low CVE-2011-3063: Validate navigation requests from the renderer
more carefully. Credit to kuzzcc, Sergey Glazunov, PinkiePie and
scarybeasts (Google Chrome Security Team).
- [117471] High CVE-2011-3064: Use-after-free in SVG clipping. Credit to
Atte Kettunen of OUSPG.
- [117588] High CVE-2011-3065: Memory corruption in Skia. Credit to Omair.
- [117794] Medium CVE-2011-3057: Invalid read in v8. Credit to Christian
Holler.
* Add build dependency on libudev-dev to allow for gamepad detection; see
http://code.google.com/p/chromium/issues/detail?id=79050
- update debian/control
* Drop dlopen_libgnutls patch as it's been implemented upstream
- drop debian/patches/dlopen_libgnutls.patch
- update debian/patches/series
* Start removing *.so and *.so.* from the upstream tarball creation
- update debian/rules
* Strip almost the entire third_party/openssl directory as it's needed only
on android, but is used by the build system
- update debian/rules
* Use tar's --exclude-vcs flag instead of just excluding .svn
- update debian/rules
chromium-browser (17.0.963.83~r127885-0ubuntu0.10.04.1) lucid-security; urgency=low
* New upstream release from the Stable Channel (LP: #961831)
This release fixes the following security issues:
- [113902] High CVE-2011-3050: Use-after-free with first-letter handling.
Credit to miaubiz.
- [116162] High CVE-2011-3045: libpng integer issue from upstream. Credit
to Glenn Randers-Pehrson of the libpng project.
- [116461] High CVE-2011-3051: Use-after-free in CSS cross-fade handling.
Credit to Arthur Gerkis.
- [116637] High CVE-2011-3052: Memory corruption in WebGL canvas handling.
Credit to Ben Vanik of Google.
- [116746] High CVE-2011-3053: Use-after-free in block splitting.
Credit to miaubiz.
- [117418] Low CVE-2011-3054: Apply additional isolations to webui
privileges. Credit to Sergey Glazunov.
- [117736] Low CVE-2011-3055: Prompt in the browser native UI for unpacked
extension installation. Credit to PinkiePie.
- [117550] High CVE-2011-3056: Cross-origin violation with “magic iframe”.
Credit to Sergey Glazunov.
- [117794] Medium CVE-2011-3057: Invalid read in v8. Credit to Christian
Holler.
-- Micah Gersten <email address hidden> Mon, 02 Apr 2012 02:49:35 -0500
-
chromium-browser (17.0.963.83~r127885-0ubuntu0.10.04.1) lucid-security; urgency=low
* New upstream release from the Stable Channel (LP: #961831)
This release fixes the following security issues:
- [113902] High CVE-2011-3050: Use-after-free with first-letter handling.
Credit to miaubiz.
- [116162] High CVE-2011-3045: libpng integer issue from upstream. Credit
to Glenn Randers-Pehrson of the libpng project.
- [116461] High CVE-2011-3051: Use-after-free in CSS cross-fade handling.
Credit to Arthur Gerkis.
- [116637] High CVE-2011-3052: Memory corruption in WebGL canvas handling.
Credit to Ben Vanik of Google.
- [116746] High CVE-2011-3053: Use-after-free in block splitting.
Credit to miaubiz.
- [117418] Low CVE-2011-3054: Apply additional isolations to webui
privileges. Credit to Sergey Glazunov.
- [117736] Low CVE-2011-3055: Prompt in the browser native UI for unpacked
extension installation. Credit to PinkiePie.
- [117550] High CVE-2011-3056: Cross-origin violation with “magic iframe”.
Credit to Sergey Glazunov.
- [117794] Medium CVE-2011-3057: Invalid read in v8. Credit to Christian
Holler.
-- Micah Gersten <email address hidden> Wed, 21 Mar 2012 21:42:19 -0500
-
chromium-browser (17.0.963.79~r125985-0ubuntu0.10.04.1) lucid-security; urgency=low
* New upstream release from the Stable Channel (LP: #952711)
This release fixes the following security issue:
- [117620] [117656] Critical CVE-2011-3047: Errant plug-in load and GPU
process memory corruption. Credit to PinkiePie.
-- Micah Gersten <email address hidden> Mon, 12 Mar 2012 01:11:05 -0500
-
chromium-browser (17.0.963.78~r125577-0ubuntu0.10.04.1) lucid-security; urgency=low
* New upstream release from the Stable Channel (LP: #950174)
This release fixes the following security issue:
- [117226] [117230] Critical CVE-2011-3046: UXSS and bad history navigation.
Credit to Sergey Glazunov.
chromium-browser (17.0.963.66~r124982-0ubuntu0.10.04.1) lucid-security; urgency=low
* New upstream release from the Stable Channel (LP: #948749)
- fixes regression in the DOM [116789]
-- Micah Gersten <email address hidden> Fri, 09 Mar 2012 04:21:45 -0600
-
chromium-browser (17.0.963.66~r124982-0ubuntu0.10.04.1) lucid-security; urgency=low
* New upstream release from the Stable Channel (LP: #948749)
- fixes regression in the DOM [116789]
-- Micah Gersten <email address hidden> Wed, 07 Mar 2012 02:54:33 -0600
-
chromium-browser (17.0.963.65~r124586-0ubuntu0.10.04.1) lucid-security; urgency=low
* New upstream release from the Stable Channel (LP: #946914)
- Cursors and backgrounds sometimes do not load [111218]
- Plugins not loading on some pages [108228]
- Text paste includes trailing spaces [106551]
- Websites using touch controls break [110332]
This release fixes the following security issues:
- [105867] High CVE-2011-3031: Use-after-free in v8 element wrapper. Credit
to Chamal de Silva.
- [108037] High CVE-2011-3032: Use-after-free in SVG value handling. Credit
to Arthur Gerkis.
- [108406] [115471] High CVE-2011-3033: Buffer overflow in the Skia drawing
library. Credit to Aki Helin of OUSPG.
- [111748] High CVE-2011-3034: Use-after-free in SVG document handling.
Credit to Arthur Gerkis.
- [112212] High CVE-2011-3035: Use-after-free in SVG use handling. Credit to
Arthur Gerkis.
- [113258] High CVE-2011-3036: Bad cast in line box handling. Credit to
miaubiz.
- [113439] [114924] [115028] High CVE-2011-3037: Bad casts in anonymous
block splitting. Credit to miaubiz.
- [113497] High CVE-2011-3038: Use-after-free in multi-column handling.
Credit to miaubiz.
- [113707] High CVE-2011-3039: Use-after-free in quote handling. Credit to
miaubiz.
- [114054] High CVE-2011-3040: Out-of-bounds read in text handling. Credit
to miaubiz.
- [114068] High CVE-2011-3041: Use-after-free in class attribute handling.
Credit to miaubiz.
- [114219] High CVE-2011-3042: Use-after-free in table section handling.
Credit to miaubiz.
- [115681] High CVE-2011-3043: Use-after-free in flexbox with floats. Credit
to miaubiz.
- [116093] High CVE-2011-3044: Use-after-free with SVG animation elements.
Credit to Arthur Gerkis.
-- Micah Gersten <email address hidden> Mon, 05 Mar 2012 04:40:43 -0600
-
chromium-browser (17.0.963.56~r121963-0ubuntu0.10.04.1) lucid-security; urgency=low
* New upstream release from the Stable Channel (LP: #931905, #933262)
This release fixes the following security issues from 17.0.963.56:
- [105803] High CVE-2011-3015: Integer overflows in PDF codecs. Credit to
Google Chrome Security Team (scarybeasts).
- [106336] Medium CVE-2011-3016: Read-after-free with counter nodes. Credit
to miaubiz.
- [108695] High CVE-2011-3017: Possible use-after-free in database handling.
Credit to miaubiz.
- [110172] High CVE-2011-3018: Heap overflow in path rendering. Credit to
Aki Helin of OUSPG.
- [110849] High CVE-2011-3019: Heap buffer overflow in MKV handling. Credit
to Google Chrome Security Team (scarybeasts) and Mateusz Jurczyk of the
Google Security Team.
- [111575] Medium CVE-2011-3020: Native client validator error. Credit to
Nick Bray of the Chromium development community.
- [111779] High CVE-2011-3021: Use-after-free in subframe loading. Credit to
Arthur Gerkis.
- [112236] Medium CVE-2011-3022: Inappropriate use of http for translation
script. Credit to Google Chrome Security Team (Jorge Obes).
- [112259] Medium CVE-2011-3023: Use-after-free with drag and drop. Credit
to pa_kt.
- [112451] Low CVE-2011-3024: Browser crash with empty x509 certificate.
Credit to chrometot.
- [112670] Medium CVE-2011-3025: Out-of-bounds read in h.264 parsing. Credit
to Sławomir Błażek.
- [112822] High CVE-2011-3026: Integer overflow / truncation in libpng.
Credit to Jüri Aedla.
- [112847] High CVE-2011-3027: Bad cast in column handling. Credit to
miaubiz.
This release fixes the following security issues from 17.0.963.46:
- [73478] Low CVE-2011-3953: Avoid clipboard monitoring after paste event.
Credit to Daniel Cheng of the Chromium development community.
- [92550] Low CVE-2011-3954: Crash with excessive database usage. Credit to
Collin Payne.
- [93106] High CVE-2011-3955: Crash aborting an IndexDB transaction. Credit
to David Grogan of the Chromium development community.
- [103630] Low CVE-2011-3956: Incorrect handling of sandboxed origins inside
extensions. Credit to Devdatta Akhawe, UC Berkeley.
- [104056] High CVE-2011-3957: Use-after-free in PDF garbage collection.
Credit to Aki Helin of OUSPG.
- [105459] High CVE-2011-3958: Bad casts with column spans. Credit to
miaubiz.
- [106441] High CVE-2011-3959: Buffer overflow in locale handling. Credit to
Aki Helin of OUSPG.
- [108416] Medium CVE-2011-3960: Out-of-bounds read in audio decoding.
Credit to Aki Helin of OUSPG.
- [108871] Critical CVE-2011-3961: Race condition after crash of utility
process. Credit to Shawn Goertzen.
- [108901] Medium CVE-2011-3962: Out-of-bounds read in path clipping. Credit
to Aki Helin of OUSPG.
- [109094] Medium CVE-2011-3963: Out-of-bounds read in PDF fax image
handling. Credit to Atte Kettunen of OUSPG.
- [109245] Low CVE-2011-3964: URL bar confusion after drag + drop. Credit to
Code Audit Labs of VulnHunt.com.
- [109664] Low CVE-2011-3965: Crash in signature check. Credit to Sławomir
Błażek.
- [109716] High CVE-2011-3966: Use-after-free in stylesheet error handling.
Credit to Aki Helin of OUSPG.
- [109717] Low CVE-2011-3967: Crash with unusual certificate. Credit to Ben
Carrillo.
- [109743] High CVE-2011-3968: Use-after-free in CSS handling. Credit to
Arthur Gerkis.
- [110112] High CVE-2011-3969: Use-after-free in SVG layout. Credit to
Arthur Gerkis.
- [110277] Medium CVE-2011-3970: Out-of-bounds read in libxslt. Credit to
Aki Helin of OUSPG.
- [110374] High CVE-2011-3971: Use-after-free with mousemove events. Credit
to Arthur Gerkis.
- [110559] Medium CVE-2011-3972: Out-of-bounds read in shader translator.
Credit to Google Chrome Security Team (Inferno).
* Rebase patch
- update debian/patches/disable_dlog_and_dcheck_in_release_builds.patch
* Update .install file to just install all .pak files instead of listing them
by name
- update debian/chromium-browser.install
-- Micah Gersten <email address hidden> Tue, 21 Feb 2012 01:20:24 -0600
-
chromium-browser (16.0.912.77~r118311-0ubuntu0.10.04.1) lucid-security; urgency=low
* New upstream release from the Stable Channel (LP: #923602)
This release fixes the following security issues:
- [106484] High CVE-2011-3924: Use-after-free in DOM selections. Credit to
Arthur Gerkis.
- [107182] Critical CVE-2011-3925: Use-after-free in Safe Browsing
navigation. Credit to Chamal de Silva.
- [108461] High CVE-2011-3928: Use-after-free in DOM handling. Credit to
wushi of team509 reported through ZDI (ZDI-CAN-1415).
- [108605] High CVE-2011-3927: Uninitialized value in Skia. Credit to
miaubiz.
- [109556] High CVE-2011-3926: Heap-buffer-overflow in tree builder.
Credit to Arthur Gerkis.
chromium-browser (16.0.912.75~r116452-0ubuntu0.10.04.1) lucid-security; urgency=low
* New upstream release from the Stable Channel (LP: #914648, #889711)
This release fixes the following security issues:
- [106672] High CVE-2011-3921: Use-after-free in animation frames. Credit to
Boris Zbarsky of Mozilla.
- [107128] High CVE-2011-3919: Heap-buffer-overflow in libxml. Credit to
Jüri Aedla.
- [108006] High CVE-2011-3922: Stack-buffer-overflow in glyph handling.
Credit to Google Chrome Security Team (Cris Neckar).
This upload also includes the following security fixes from 16.0.912.63:
- [81753] Medium CVE-2011-3903: Out-of-bounds read in regex matching. Credit
to David Holloway of the Chromium development community.
- [95465] Low CVE-2011-3905: Out-of-bounds reads in libxml. Credit to Google
Chrome Security Team (Inferno).
- [98809] Medium CVE-2011-3906: Out-of-bounds read in PDF parser. Credit to
Aki Helin of OUSPG.
- [99016] High CVE-2011-3907: URL bar spoofing with view-source. Credit to
Luka Treiber of ACROS Security.
- [100863] Low CVE-2011-3908: Out-of-bounds read in SVG parsing. Credit to
Aki Helin of OUSPG.
- [101010] Medium CVE-2011-3909: [64-bit only] Memory corruption in CSS
property array. Credit to Google Chrome Security Team (scarybeasts) and
Chu.
- [101494] Medium CVE-2011-3910: Out-of-bounds read in YUV video frame
handling. Credit to Google Chrome Security Team (Cris Neckar).
- [101779] Medium CVE-2011-3911: Out-of-bounds read in PDF. Credit to Google
Chrome Security Team (scarybeasts) and Robert Swiecki of the Google
Security Team.
- [102359] High CVE-2011-3912: Use-after-free in SVG filters. Credit to
Arthur Gerkis.
- [103921] High CVE-2011-3913: Use-after-free in Range handling. Credit to
Arthur Gerkis.
- [104011] High CVE-2011-3914: Out-of-bounds write in v8 i18n handling.
Credit to Sławomir Błażek.
- [104529] High CVE-2011-3915: Buffer overflow in PDF font handling. Credit
to Atte Kettunen of OUSPG.
- [104959] Medium CVE-2011-3916: Out-of-bounds reads in PDF cross
references. Credit to Atte Kettunen of OUSPG.
- [105162] Medium CVE-2011-3917: Stack-buffer-overflow in FileWatcher.
Credit to Google Chrome Security Team (Marty Barbella).
- [107258] High CVE-2011-3904: Use-after-free in bidi handling. Credit to
Google Chrome Security Team (Inferno) and miaubiz.
This upload also includes the following security fixes from 15.0.874.121:
- [103259] High CVE-2011-3900: Out-of-bounds write in v8. Credit to
Christian Holler.
This upload also includes the following security fixes from 15.0.874.120:
- [100465] High CVE-2011-3892: Double free in Theora decoder. Credit to Aki
Helin of OUSPG.
- [100492] [100543] Medium CVE-2011-3893: Out of bounds reads in MKV and
Vorbis media handlers. Credit to Aki Helin of OUSPG.
- [101172] High CVE-2011-3894: Memory corruption regression in VP8 decoding.
Credit to Andrew Scherkus of the Chromium development community.
- [101458] High CVE-2011-3895: Heap overflow in Vorbis decoder. Credit to
Aki Helin of OUSPG.
- [101624] High CVE-2011-3896: Buffer overflow in shader variable mapping.
Credit to Ken “strcpy” Russell of the Chromium development community.
- [102242] High CVE-2011-3897: Use-after-free in editing. Credit to pa_kt
reported through ZDI (ZDI-CAN-1416).
[ Brandon Snider <email address hidden> ]
* Refresh patch
- update debian/patches/chromium_useragent.patch.in
-- Micah Gersten <email address hidden> Sun, 29 Jan 2012 23:42:30 -0600
-
chromium-browser (16.0.912.75~r116452-0ubuntu0.10.04.1) lucid-security; urgency=low
* New upstream release from the Stable Channel (LP: #914648, #889711)
This release fixes the following security issues:
- [106672] High CVE-2011-3921: Use-after-free in animation frames. Credit to
Boris Zbarsky of Mozilla.
- [107128] High CVE-2011-3919: Heap-buffer-overflow in libxml. Credit to
Jüri Aedla.
- [108006] High CVE-2011-3922: Stack-buffer-overflow in glyph handling.
Credit to Google Chrome Security Team (Cris Neckar).
This upload also includes the following security fixes from 16.0.912.63:
- [81753] Medium CVE-2011-3903: Out-of-bounds read in regex matching. Credit
to David Holloway of the Chromium development community.
- [95465] Low CVE-2011-3905: Out-of-bounds reads in libxml. Credit to Google
Chrome Security Team (Inferno).
- [98809] Medium CVE-2011-3906: Out-of-bounds read in PDF parser. Credit to
Aki Helin of OUSPG.
- [99016] High CVE-2011-3907: URL bar spoofing with view-source. Credit to
Luka Treiber of ACROS Security.
- [100863] Low CVE-2011-3908: Out-of-bounds read in SVG parsing. Credit to
Aki Helin of OUSPG.
- [101010] Medium CVE-2011-3909: [64-bit only] Memory corruption in CSS
property array. Credit to Google Chrome Security Team (scarybeasts) and
Chu.
- [101494] Medium CVE-2011-3910: Out-of-bounds read in YUV video frame
handling. Credit to Google Chrome Security Team (Cris Neckar).
- [101779] Medium CVE-2011-3911: Out-of-bounds read in PDF. Credit to Google
Chrome Security Team (scarybeasts) and Robert Swiecki of the Google
Security Team.
- [102359] High CVE-2011-3912: Use-after-free in SVG filters. Credit to
Arthur Gerkis.
- [103921] High CVE-2011-3913: Use-after-free in Range handling. Credit to
Arthur Gerkis.
- [104011] High CVE-2011-3914: Out-of-bounds write in v8 i18n handling.
Credit to Sławomir Błażek.
- [104529] High CVE-2011-3915: Buffer overflow in PDF font handling. Credit
to Atte Kettunen of OUSPG.
- [104959] Medium CVE-2011-3916: Out-of-bounds reads in PDF cross
references. Credit to Atte Kettunen of OUSPG.
- [105162] Medium CVE-2011-3917: Stack-buffer-overflow in FileWatcher.
Credit to Google Chrome Security Team (Marty Barbella).
- [107258] High CVE-2011-3904: Use-after-free in bidi handling. Credit to
Google Chrome Security Team (Inferno) and miaubiz.
This upload also includes the following security fixes from 15.0.874.121:
- [103259] High CVE-2011-3900: Out-of-bounds write in v8. Credit to
Christian Holler.
This upload also includes the following security fixes from 15.0.874.120:
- [100465] High CVE-2011-3892: Double free in Theora decoder. Credit to Aki
Helin of OUSPG.
- [100492] [100543] Medium CVE-2011-3893: Out of bounds reads in MKV and
Vorbis media handlers. Credit to Aki Helin of OUSPG.
- [101172] High CVE-2011-3894: Memory corruption regression in VP8 decoding.
Credit to Andrew Scherkus of the Chromium development community.
- [101458] High CVE-2011-3895: Heap overflow in Vorbis decoder. Credit to
Aki Helin of OUSPG.
- [101624] High CVE-2011-3896: Buffer overflow in shader variable mapping.
Credit to Ken “strcpy” Russell of the Chromium development community.
- [102242] High CVE-2011-3897: Use-after-free in editing. Credit to pa_kt
reported through ZDI (ZDI-CAN-1416).
[ Brandon Snider <email address hidden> ]
* Refresh patch
- update debian/patches/chromium_useragent.patch.in
-- Micah Gersten <email address hidden> Thu, 12 Jan 2012 12:52:54 +0100
-
chromium-browser (15.0.874.106~r107270-0ubuntu0.10.04.1) lucid-security; urgency=low
* New upstream release from the Stable Channel (LP: #881786)
This release fixes the following security issues:
- [86758] High CVE-2011-2845: URL bar spoof in history handling. Credit to
Jordi Chancel.
- [88949] Medium CVE-2011-3875: URL bar spoof with drag+drop of URLs. Credit
to Jordi Chancel.
- [90217] Low CVE-2011-3876: Avoid stripping whitespace at the end of
download filenames. Credit to Marc Novak.
- [91218] Low CVE-2011-3877: XSS in appcache internals page. Credit to
Google Chrome Security Team (Tom Sepez) plus independent discovery by
Juho Nurminen.
- [94487] Medium CVE-2011-3878: Race condition in worker process
initialization. Credit to miaubiz.
- [95374] Low CVE-2011-3879: Avoid redirect to chrome scheme URIs. Credit to
Masato Kinugawa.
- [95992] Low CVE-2011-3880: Don’t permit as a HTTP header delimiter. Credit
to Vladimir Vorontsov, ONsec company.
- [96047] [96885] [98053] [99512] [99750] High CVE-2011-3881: Cross-origin
policy violations. Credit to Sergey Glazunov.
- [96292] High CVE-2011-3882: Use-after-free in media buffer handling.
Credit to Google Chrome Security Team (Inferno).
- [96902] High CVE-2011-3883: Use-after-free in counter handling. Credit to
miaubiz.
- [97148] High CVE-2011-3884: Timing issues in DOM traversal. Credit to
Brian Ryner of the Chromium development community.
- [97599] [98064] [98556] [99294] [99880] [100059] High CVE-2011-3885: Stale
style bugs leading to use-after-free. Credit to miaubiz.
- [98773] [99167] High CVE-2011-3886: Out of bounds writes in v8. Credit to
Christian Holler.
- [98407] Medium CVE-2011-3887: Cookie theft with javascript URIs. Credit to
Sergey Glazunov.
- [99138] High CVE-2011-3888: Use-after-free with plug-in and editing.
Credit to miaubiz.
- [99211] High CVE-2011-3889: Heap overflow in Web Audio. Credit to miaubiz.
- [99553] High CVE-2011-3890: Use-after-free in video source handling.
Credit to Ami Fischman of the Chromium development community.
- [100332] High CVE-2011-3891: Exposure of internal v8 functions. Credit to
Steven Keuchel of the Chromium development community plus independent
discovery by Daniel Divricean.
[ Chris Coulson <email address hidden> ]
* Refresh patches
- update debian/patches/dlopen_sonamed_gl.patch
- update debian/patches/webkit_rev_parser.patch
[ Fabien Tassin ]
* Disable NaCl until we figure out what to do with the private toolchain
- update debian/rules
* Do not install the pseudo_locales files in the debs
- update debian/rules
* Add python-simplejson to Build-depends. This is needed by NaCl even with
NaCl disabled, so this is a temporary workaround to unbreak the build, it
must be fixed upstream
- update debian/control
-- Micah Gersten <email address hidden> Thu, 27 Oct 2011 00:23:10 -0500
-
chromium-browser (14.0.835.202~r103287-0ubuntu0.10.04.2) lucid-security; urgency=low
* New upstream release from the Stable Channel (LP: #858744)
This release fixes the following security issues:
+ Chromium issues (13.0.782.220):
- Trust in Diginotar Intermediate CAs revoked
+ Chromium issues (14.0.835.163):
- [49377] High CVE-2011-2835: Race condition in the certificate cache.
Credit to Ryan Sleevi.
- [57908] Low CVE-2011-2837: Use PIC / pie compiler flags. Credit to
wbrana.
- [75070] Low CVE-2011-2838: Treat MIME type more authoritatively when
loading plug-ins. Credit to Michal Zalewski.
- [78639] High CVE-2011-2841: Garbage collection error in PDF. Credit to
Mario Gomes.
- [82438] Medium CVE-2011-2843: Out-of-bounds read with media buffers.
Credit to Kostya Serebryany.
- [85041] Medium CVE-2011-2844: Out-of-bounds read with mp3 files. Credit
to Mario Gomes.
- [89564] Medium CVE-2011-2848: URL bar spoof with forward button. Credit
to Jordi Chancel.
- [89795] Low CVE-2011-2849: Browser NULL pointer crash with WebSockets.
Credit to Arthur Gerkis.
- [90134] Medium CVE-2011-2850: Out-of-bounds read with Khmer characters.
Credit to miaubiz.
- [90173] Medium CVE-2011-2851: Out-of-bounds read in video handling.
Credit to Google Chrome Security Team (Inferno).
- [91197] High CVE-2011-2853: Use-after-free in plug-in handling. Credit
to Google Chrome Security Team (SkyLined).
- [93497] Medium CVE-2011-2859: Incorrect permissions assigned to
non-gallery pages. Credit to Bernhard ‘Bruhns’ Brehm
- [93596] Medium CVE-2011-2861: Bad string read in PDF. Credit to Aki
Helin of OUSPG.
- [95563] Medium CVE-2011-2864: Out-of-bounds read with Tibetan
characters. Credit to Google Chrome Security Team (Inferno).
- [95625] Medium CVE-2011-2858: Out-of-bounds read with triangle arrays.
Credit to Google Chrome Security Team (Inferno).
- [95917] Low CVE-2011-2874: Failure to pin a self-signed cert for a
session. Credit to Nishant Yadant and Craig Chamberlain (@randomuserid).
+ Chromium issues (14.0.835.202):
- [95671] High CVE-2011-2878: Inappropriate cross-origin access to the
window prototype. Credit to Sergey Glazunov.
- [96150] High CVE-2011-2879: Lifetime and threading issues in audio node
handling. Credit to Google Chrome Security Team (Inferno).
- [98089] Critical CVE-2011-3873: Memory corruption in shader translator.
Credit to Zhenyao Mo.
+ Webkit issues (14.0.835.163):
- [78427] [83031] Low CVE-2011-2840: Possible URL bar spoofs with unusual
user interaction. Credit to kuzzcc.
- [89219] High CVE-2011-2846: Use-after-free in unload event handling.
Credit to Arthur Gerkis.
- [89330] High CVE-2011-2847: Use-after-free in document loader. Credit to
miaubiz.
- [89991] Medium CVE-2011-3234: Out-of-bounds read in box handling. Credit
to miaubiz.
- [92651] [94800] High CVE-2011-2854: Use-after-free in ruby / table style
handing. Credit to Sławomir Błażek, and independent later discoveries by
miaubiz and Google Chrome Security Team (Inferno).
- [92959] High CVE-2011-2855: Stale node in stylesheet handling. Credit to
Arthur Gerkis.
- [93420] High CVE-2011-2857: Use-after-free in focus controller. Credit
to miaubiz.
- [93587] High CVE-2011-2860: Use-after-free in table style handling.
Credit to miaubiz.
+ Webkit issues (14.0.835.202):
- [93788] High CVE-2011-2876: Use-after-free in text line box handling.
Credit to miaubiz.
- [95072] High CVE-2011-2877: Stale font in SVG text handling. Credit to
miaubiz.
+ LibXML issue (14.0.835.163):
- [93472] High CVE-2011-2834: Double free in libxml XPath handling. Credit
to Yang Dingning
+ V8 issues (14.0.835.163):
- [76771] High CVE-2011-2839: Crash in v8 script object wrappers. Credit
to Kostya Serebryany
- [91120] High CVE-2011-2852: Off-by-one in v8. Credit to Christian Holler
- [93416] High CVE-2011-2856: Cross-origin bypass in v8. Credit to Daniel
Divricean.
- [93906] High CVE-2011-2862: Unintended access to v8 built-in objects.
Credit to Sergey Glazunov.
- [95920] High CVE-2011-2875: Type confusion in v8 object sealing. Credit
to Christian Holler.
+ V8 issues (14.0.835.202):
- [97451] [97520] [97615] High CVE-2011-2880: Use-after-free in the v8
bindings. Credit to Sergey Glazunov.
- [97784] High CVE-2011-2881: Memory corruption with v8 hidden objects.
Credit to Sergey Glazunov.
[ Fabien Tassin ]
* Add libpulse-dev to Build-Depends, needed for WebRTC
- update debian/control
* Rename ui/base/strings/app_strings.grd to ui_strings.grd following
the upstream rename, and add a mapping flag to the grit converter
- update debian/rules
* Refresh Patches
[ Micah Gersten ]
* Switch to internal libvpx (Fixes FTBFS since we now need at least 0.9.6)
- update debian/rules
* Drop build dependency on libvpx due to the switch to internal libvpx
- update debian/control
chromium-browser (13.0.782.215~r97094-0ubuntu0.10.04.1) lucid-security; urgency=low
[ Fabien Tassin <email address hidden> ]
* New upstream release from the Stable Channel (LP: #834922)
This release fixes the following security issues:
+ Chromium issues:
- [91517] High, CVE-2011-2828: Out-of-bounds write in v8. Credit to Google
Chrome Security Team (SkyLined).
+ Webkit issues:
- [82552] High, CVE-2011-2823: Use-after-free in line box handling. Credit
to Google Chrome Security Team (SkyLined) and independent later
discovery by miaubiz.
- [88216] High, CVE-2011-2824: Use-after-free with counter nodes. Credit
to miaubiz.
- [88670] High, CVE-2011-2825: Use-after-free with custom fonts. Credit to
wushi of team509 reported through ZDI (ZDI-CAN-1283), plus indepdendent
later discovery by miaubiz.
- [87453] High, CVE-2011-2826: Cross-origin violation with empty origins.
Credit to Sergey Glazunov.
- [90668] High, CVE-2011-2827: Use-after-free in text searching. Credit to
miaubiz.
- [32-bit only] [91598] High, CVE-2011-2829: Integer overflow in uniform
arrays. Credit to Sergey Glazunov.
+ libxml2 issue:
- [89402] High, CVE-2011-2821: Double free in libxml XPath handling.
Credit to Yang Dingning from NCNIPC, Graduate University of Chinese
Academy of Sciences.
chromium-browser (13.0.782.107~r94237-0ubuntu0.10.04.1) lucid-security; urgency=low
[ Fabien Tassin <email address hidden> ]
* New Major upstream release from the Stable Channel (LP: #819991)
This release fixes the following security issues:
+ Chromium issues:
- [75821] Medium, CVE-2011-2358: Always confirm an extension install via a
browser dialog. Credit to Sergey Glazunov.
- [79266] Low, CVE-2011-2360: Potential bypass of dangerous file prompt.
Credit to kuzzcc.
- [79426] Low, CVE-2011-2361: Improve designation of strings in the basic
auth dialog. Credit to kuzzcc.
- [81307] Medium, CVE-2011-2782: File permissions error with drag and
drop. Credit to Evan Martin of the Chromium development community.
- [83273] Medium, CVE-2011-2783: Always confirm a developer mode NPAPI
extension install via a browser dialog. Credit to Sergey Glazunov.
- [84402] Low, CVE-2011-2785: Sanitize the homepage URL in extensions.
Credit to kuzzcc.
- [84805] Medium, CVE-2011-2787: Browser crash due to GPU lock re-entrancy
issue. Credit to kuzzcc.
- [85808] Medium, CVE-2011-2789: Use after free in Pepper plug-in
instantiation. Credit to Mario Gomes and kuzzcc.
- [87815] Low, CVE-2011-2798: Prevent a couple of internal schemes from
being web accessible. Credit to sirdarckcat of the Google Security Team.
- [88827] Medium, CVE-2011-2803: Out-of-bounds read in Skia paths. Credit
to Google Chrome Security Team (Inferno).
+ Webkit issues:
- [78841] High, CVE-2011-2359: Stale pointer due to bad line box tracking
in rendering. Credit to miaubiz and Martin Barbella.
- [83841] Low, CVE-2011-2784: Local file path disclosure via GL program
log. Credit to kuzzcc.
- [84600] Low, CVE-2011-2786: Make sure the speech input bubble is always
on-screen. Credit to Olli Pettay of Mozilla.
- [85559] Low, CVE-2011-2788: Buffer overflow in inspector serialization.
Credit to Mikołaj Małecki.
- [86502] High, CVE-2011-2790: Use-after-free with floating styles. Credit
to miaubiz.
- [87148] High, CVE-2011-2792: Use-after-free with float removal. Credit
to miaubiz.
- [87227] High, CVE-2011-2793: Use-after-free in media selectors. Credit
to miaubiz.
- [87298] Medium, CVE-2011-2794: Out-of-bounds read in text iteration.
Credit to miaubiz.
- [87339] Medium, CVE-2011-2795: Cross-frame function leak. Credit to Shih
Wei-Long.
- [87548] High, CVE-2011-2796: Use-after-free in Skia. Credit to Google
Chrome Security Team (Inferno) and Kostya Serebryany of the Chromium
development community.
- [87729] High, CVE-2011-2797: Use-after-free in resource caching. Credit
to miaubiz.
- [87925] High, CVE-2011-2799: Use-after-free in HTML range handling.
Credit to miaubiz.
- [88337] Medium, CVE-2011-2800: Leak of client-side redirect target.
Credit to Juho Nurminen.
- [88591] High, CVE-2011-2802: v8 crash with const lookups. Credit to
Christian Holler.
- [88846] High, CVE-2011-2801: Use-after-free in frame loader. Credit to
miaubiz.
- [88889] High, CVE-2011-2818: Use-after-free in display box rendering.
Credit to Martin Barbella.
- [89520] High, CVE-2011-2805: Cross-origin script injection. Credit to
Sergey Glazunov.
- [90222] High, CVE-2011-2819: Cross-origin violation in base URI
handling. Credit to Sergey Glazunov.
+ ICU 4.6 issue:
- [86900] High, CVE-2011-2791: Out-of-bounds write in ICU. Credit to Yang
Dingning from NCNIPC, Graduate University of Chinese Academy of
Sciences.
Packaging changes:
* Run the gclient hooks when creating the source tarball, as we need files
from the Native Client's integrated runtime (IRT) library.
Install the NaCL IRT files in the main deb
- update debian/rules
- update debian/chromium-browser.install
-- Micah Gersten <email address hidden> Wed, 12 Oct 2011 01:16:47 -0500
-
chromium-browser (13.0.782.215~r97094-0ubuntu0.10.04.1) lucid-security; urgency=low
[ Fabien Tassin <email address hidden> ]
* New upstream release from the Stable Channel (LP: #834922)
This release fixes the following security issues:
+ Chromium issues:
- [91517] High, CVE-2011-2828: Out-of-bounds write in v8. Credit to Google
Chrome Security Team (SkyLined).
+ Webkit issues:
- [82552] High, CVE-2011-2823: Use-after-free in line box handling. Credit
to Google Chrome Security Team (SkyLined) and independent later
discovery by miaubiz.
- [88216] High, CVE-2011-2824: Use-after-free with counter nodes. Credit
to miaubiz.
- [88670] High, CVE-2011-2825: Use-after-free with custom fonts. Credit to
wushi of team509 reported through ZDI (ZDI-CAN-1283), plus indepdendent
later discovery by miaubiz.
- [87453] High, CVE-2011-2826: Cross-origin violation with empty origins.
Credit to Sergey Glazunov.
- [90668] High, CVE-2011-2827: Use-after-free in text searching. Credit to
miaubiz.
- [32-bit only] [91598] High, CVE-2011-2829: Integer overflow in uniform
arrays. Credit to Sergey Glazunov.
+ libxml2 issue:
- [89402] High, CVE-2011-2821: Double free in libxml XPath handling.
Credit to Yang Dingning from NCNIPC, Graduate University of Chinese
Academy of Sciences.
chromium-browser (13.0.782.107~r94237-0ubuntu0.10.04.1) lucid-security; urgency=low
[ Fabien Tassin <email address hidden> ]
* New Major upstream release from the Stable Channel (LP: #819991)
This release fixes the following security issues:
+ Chromium issues:
- [75821] Medium, CVE-2011-2358: Always confirm an extension install via a
browser dialog. Credit to Sergey Glazunov.
- [79266] Low, CVE-2011-2360: Potential bypass of dangerous file prompt.
Credit to kuzzcc.
- [79426] Low, CVE-2011-2361: Improve designation of strings in the basic
auth dialog. Credit to kuzzcc.
- [81307] Medium, CVE-2011-2782: File permissions error with drag and
drop. Credit to Evan Martin of the Chromium development community.
- [83273] Medium, CVE-2011-2783: Always confirm a developer mode NPAPI
extension install via a browser dialog. Credit to Sergey Glazunov.
- [84402] Low, CVE-2011-2785: Sanitize the homepage URL in extensions.
Credit to kuzzcc.
- [84805] Medium, CVE-2011-2787: Browser crash due to GPU lock re-entrancy
issue. Credit to kuzzcc.
- [85808] Medium, CVE-2011-2789: Use after free in Pepper plug-in
instantiation. Credit to Mario Gomes and kuzzcc.
- [87815] Low, CVE-2011-2798: Prevent a couple of internal schemes from
being web accessible. Credit to sirdarckcat of the Google Security Team.
- [88827] Medium, CVE-2011-2803: Out-of-bounds read in Skia paths. Credit
to Google Chrome Security Team (Inferno).
+ Webkit issues:
- [78841] High, CVE-2011-2359: Stale pointer due to bad line box tracking
in rendering. Credit to miaubiz and Martin Barbella.
- [83841] Low, CVE-2011-2784: Local file path disclosure via GL program
log. Credit to kuzzcc.
- [84600] Low, CVE-2011-2786: Make sure the speech input bubble is always
on-screen. Credit to Olli Pettay of Mozilla.
- [85559] Low, CVE-2011-2788: Buffer overflow in inspector serialization.
Credit to Mikołaj Małecki.
- [86502] High, CVE-2011-2790: Use-after-free with floating styles. Credit
to miaubiz.
- [87148] High, CVE-2011-2792: Use-after-free with float removal. Credit
to miaubiz.
- [87227] High, CVE-2011-2793: Use-after-free in media selectors. Credit
to miaubiz.
- [87298] Medium, CVE-2011-2794: Out-of-bounds read in text iteration.
Credit to miaubiz.
- [87339] Medium, CVE-2011-2795: Cross-frame function leak. Credit to Shih
Wei-Long.
- [87548] High, CVE-2011-2796: Use-after-free in Skia. Credit to Google
Chrome Security Team (Inferno) and Kostya Serebryany of the Chromium
development community.
- [87729] High, CVE-2011-2797: Use-after-free in resource caching. Credit
to miaubiz.
- [87925] High, CVE-2011-2799: Use-after-free in HTML range handling.
Credit to miaubiz.
- [88337] Medium, CVE-2011-2800: Leak of client-side redirect target.
Credit to Juho Nurminen.
- [88591] High, CVE-2011-2802: v8 crash with const lookups. Credit to
Christian Holler.
- [88846] High, CVE-2011-2801: Use-after-free in frame loader. Credit to
miaubiz.
- [88889] High, CVE-2011-2818: Use-after-free in display box rendering.
Credit to Martin Barbella.
- [89520] High, CVE-2011-2805: Cross-origin script injection. Credit to
Sergey Glazunov.
- [90222] High, CVE-2011-2819: Cross-origin violation in base URI
handling. Credit to Sergey Glazunov.
+ ICU 4.6 issue:
- [86900] High, CVE-2011-2791: Out-of-bounds write in ICU. Credit to Yang
Dingning from NCNIPC, Graduate University of Chinese Academy of
Sciences.
Packaging changes:
* Run the gclient hooks when creating the source tarball, as we need files
from the Native Client's integrated runtime (IRT) library.
Install the NaCL IRT files in the main deb
- update debian/rules
- update debian/chromium-browser.install
-- Micah Gersten <email address hidden> Fri, 26 Aug 2011 14:00:43 -0500
-
chromium-browser (13.0.782.107~r94237-0ubuntu0.10.04.1) lucid-security; urgency=low
[ Fabien Tassin <email address hidden> ]
* New Major upstream release from the Stable Channel
This release fixes the following security issues:
+ Chromium issues:
- [75821] Medium, CVE-2011-2358: Always confirm an extension install via a
browser dialog. Credit to Sergey Glazunov.
- [79266] Low, CVE-2011-2360: Potential bypass of dangerous file prompt.
Credit to kuzzcc.
- [79426] Low, CVE-2011-2361: Improve designation of strings in the basic
auth dialog. Credit to kuzzcc.
- [81307] Medium, CVE-2011-2782: File permissions error with drag and
drop. Credit to Evan Martin of the Chromium development community.
- [83273] Medium, CVE-2011-2783: Always confirm a developer mode NPAPI
extension install via a browser dialog. Credit to Sergey Glazunov.
- [84402] Low, CVE-2011-2785: Sanitize the homepage URL in extensions.
Credit to kuzzcc.
- [84805] Medium, CVE-2011-2787: Browser crash due to GPU lock re-entrancy
issue. Credit to kuzzcc.
- [85808] Medium, CVE-2011-2789: Use after free in Pepper plug-in
instantiation. Credit to Mario Gomes and kuzzcc.
- [87815] Low, CVE-2011-2798: Prevent a couple of internal schemes from
being web accessible. Credit to sirdarckcat of the Google Security Team.
- [88827] Medium, CVE-2011-2803: Out-of-bounds read in Skia paths. Credit
to Google Chrome Security Team (Inferno).
+ Webkit issues:
- [78841] High, CVE-2011-2359: Stale pointer due to bad line box tracking
in rendering. Credit to miaubiz and Martin Barbella.
- [83841] Low, CVE-2011-2784: Local file path disclosure via GL program
log. Credit to kuzzcc.
- [84600] Low, CVE-2011-2786: Make sure the speech input bubble is always
on-screen. Credit to Olli Pettay of Mozilla.
- [85559] Low, CVE-2011-2788: Buffer overflow in inspector serialization.
Credit to Mikołaj Małecki.
- [86502] High, CVE-2011-2790: Use-after-free with floating styles. Credit
to miaubiz.
- [87148] High, CVE-2011-2792: Use-after-free with float removal. Credit
to miaubiz.
- [87227] High, CVE-2011-2793: Use-after-free in media selectors. Credit
to miaubiz.
- [87298] Medium, CVE-2011-2794: Out-of-bounds read in text iteration.
Credit to miaubiz.
- [87339] Medium, CVE-2011-2795: Cross-frame function leak. Credit to Shih
Wei-Long.
- [87548] High, CVE-2011-2796: Use-after-free in Skia. Credit to Google
Chrome Security Team (Inferno) and Kostya Serebryany of the Chromium
development community.
- [87729] High, CVE-2011-2797: Use-after-free in resource caching. Credit
to miaubiz.
- [87925] High, CVE-2011-2799: Use-after-free in HTML range handling.
Credit to miaubiz.
- [88337] Medium, CVE-2011-2800: Leak of client-side redirect target.
Credit to Juho Nurminen.
- [88591] High, CVE-2011-2802: v8 crash with const lookups. Credit to
Christian Holler.
- [88846] High, CVE-2011-2801: Use-after-free in frame loader. Credit to
miaubiz.
- [88889] High, CVE-2011-2818: Use-after-free in display box rendering.
Credit to Martin Barbella.
- [89520] High, CVE-2011-2805: Cross-origin script injection. Credit to
Sergey Glazunov.
- [90222] High, CVE-2011-2819: Cross-origin violation in base URI
handling. Credit to Sergey Glazunov.
+ ICU 4.6 issue:
- [86900] High, CVE-2011-2791: Out-of-bounds write in ICU. Credit to Yang
Dingning from NCNIPC, Graduate University of Chinese Academy of
Sciences.
Packaging changes:
* Run the gclient hooks when creating the source tarball, as we need files
from the Native Client's integrated runtime (IRT) library.
Install the NaCL IRT files in the main deb
- update debian/rules
- update debian/chromium-browser.install
-- Micah Gersten <email address hidden> Thu, 04 Aug 2011 00:55:18 -0500
-
chromium-browser (12.0.742.112~r90304-0ubuntu0.10.04.1) lucid-security; urgency=low
[ Fabien Tassin <email address hidden> ]
* New Minor upstream release from the Stable Channel (LP: #803107)
This release fixes the following security issues:
+ WebKit issues:
- [84355] High, CVE-2011-2346: Use-after-free in SVG font handling.
Credit to miaubiz.
- [85003] High, CVE-2011-2347: Memory corruption in CSS parsing. Credit
to miaubiz.
- [85102] High, CVE-2011-2350: Lifetime and re-entrancy issues in the
HTML parser. Credit to miaubiz.
- [85211] High, CVE-2011-2351: Use-after-free with SVG use element.
Credit to miaubiz.
- [85418] High, CVE-2011-2349: Use-after-free in text selection. Credit
to miaubiz.
+ Chromium issues:
- [77493] Medium, CVE-2011-2345: Out-of-bounds read in NPAPI string
handling. Credit to Philippe Arteau.
- [85177] High, CVE-2011-2348: Bad bounds check in v8. Credit to Aki
Helin of OUSPG.
[ Micah Gersten <email address hidden> ]
* Drop armel again from control file to not block on i386/amd64 updates
- update debian/control
-- Micah Gersten <email address hidden> Wed, 29 Jun 2011 14:42:28 +0100
-
chromium-browser (12.0.742.91~r87961-0ubuntu0.10.04.1) lucid-security; urgency=low
[ Fabien Tassin <email address hidden> ]
* New upstream release from the Stable Channel (LP: #794197)
It includes:
- Hardware accelerated 3D CSS
- New Safe Browsing protection against downloading malicious files
- Integrated Sync into new settings pages
This release fixes the following security issues:
+ WebKit issues:
- [73962] [79746] High CVE-2011-1808: Use-after-free due to integer
issues in float handling. Credit to miaubiz.
- [75496] Medium CVE-2011-1809: Use-after-free in accessibility support.
Credit to Google Chrome Security Team (SkyLined).
- [75643] Low CVE-2011-1810: Visit history information leak in CSS.
Credit to Jesse Mohrland of Microsoft and Microsoft Vulnerability
Research (MSVR).
- [80358] Medium CVE-2011-1816: Use-after-free in developer tools. Credit
to kuzzcc.
- [81949] High CVE-2011-1818: Use-after-free in image loader. Credit to
miaubiz.
- [83743] High CVE-2011-2342: Same origin bypass in DOM. Credit to Sergey
Glazunov.
+ Chromium issues:
- [76034] Low CVE-2011-1811: Browser crash with lots of form submissions.
Credit to “DimitrisV22”.
- [77026] Medium CVE-2011-1812: Extensions permission bypass. Credit to
kuzzcc.
- [78516] High CVE-2011-1813: Stale pointer in extension framework.
Credit to Google Chrome Security Team (Inferno).
- [79862] Low CVE-2011-1815: Extension script injection into new tab
page. Credit to kuzzcc.
- [81916] Medium CVE-2011-1817: Browser memory corruption in history
deletion. Credit to Collin Payne.
- [83010] Medium CVE-2011-1819: Extension injection into chrome:// pages.
Credit to Vladislavas Jarmalis, plus subsequent independent discovery
by Sergey Glazunov.
- [83275] High CVE-2011-2332: Same origin bypass in v8. Credit to Sergey
Glazunov.
* Drop the stored passwords patch (fixed upstream)
- remove debian/patches/stored_passwords_lp743494.patch
- update debian/patches/series
* Empty the -inspector package now that it has been merged into the main
resources.pak file (so that the Inspector remains usable after an upgrade
until the next browser restart). Also remove the resources directory,
now empty
- remove debian/chromium-browser-inspector.install
- update debian/chromium-browser.dirs
- update debian/rules
* Update the location of the app_strings templates
- update debian/rules
* Don't build with libjpeg-turbo on armel, to prevent a FTBFS
- update debian/rules
* Rebase the GL dlopen patch
- update debian/patches/dlopen_sonamed_gl.patch
[ Micah Gersten <email address hidden> ]
* Don't have chromium-browser depend on chromium-browser-inspector anymore
it's now a transitional package; Change text of chromium-browser-inspector
to reflect its transitional nature
- update debian/control
* Re-enable armel builds
- update debian/control
-- Micah Gersten <email address hidden> Tue, 07 Jun 2011 18:48:38 -0500
-
chromium-browser (11.0.696.71~r86024-0ubuntu0.10.04.1) lucid-security; urgency=low
[ Fabien Tassin <email address hidden> ]
* New Minor upstream release from the Stable Channel (LP: #787846)
This release fixes the following security issues:
+ WebKit issues:
- [72189] Low, CVE-2011-1801: Pop-up blocker bypass. Credit to Chamal De
Silva.
- [82546] High, CVE-2011-1804: Stale pointer in floats rendering. Credit
to Martin Barbella.
- [82903] Critical, CVE-2011-1807: Out-of-bounds write in blob handling.
Credit to Google Chrome Security Team (Inferno) and Kostya Serebryany
of the Chromium development community.
+ GPU/WebGL issue:
- [82873] Critical, CVE-2011-1806: Memory corruption in GPU command
buffer. Credit to Google Chrome Security Team (Cris Neckar).
* Update the svg icon once again, the previous one contained an embedded png
(LP: #748881)
- update debian/chromium-browser.svg
-- Micah Gersten <email address hidden> Wed, 25 May 2011 15:24:22 -0500
-
chromium-browser (11.0.696.68~r84545-0ubuntu0.10.04.1) lucid-security; urgency=low
[ Fabien Tassin <email address hidden> ]
* New Minor upstream release from the Stable Channel (LP: #781822)
This release fixes the following security issues:
+ WebKit issues:
- [64046] High, CVE-2011-1799: Bad casts in Chromium WebKit glue. Credit
to Google Chrome Security Team (SkyLined).
- [80608] High, CVE-2011-1800: Integer overflows in SVG filters. Credit
to Google Chrome Security Team (Cris Neckar).
-- Micah Gersten <email address hidden> Sat, 14 May 2011 22:35:25 +0200
-
chromium-browser (11.0.696.65~r84435-0ubuntu0.10.04.1) lucid-security; urgency=low
[ Fabien Tassin <email address hidden> ]
* New Minor upstream release from the Stable Channel (LP: #778822)
This release fixes the following security issues:
+ WebKit issues:
- [67923] High, CVE-2011-1793: stale pointer in SVG image handling
(credit: Mitz)
- [78327] High, CVE-2011-1794: integer overflow in SVG filters (credit:
Inferno)
- [78948] High, CVE-2011-1795: integer underflow in forms handling
(credit: Cris Neckar)
- [79055] High, CVE-2011-1796: use-after-free in frame handling (credit:
Inferno)
- [79075] High, CVE-2011-1797: stale pointer in table captioning (credit:
wushi)
- [79595] High, CVE-2011-1798: bad cast in SVG text handling (credit:
Inferno)
* Pass --delete_unversioned_trees to gclient and drop the git.chromium.org
workaround.
- update debian/rules
[ Micah Gersten <email address hidden> ]
* Switch arch: any to arch: i386 amd64 so that we don't have to wait for armel
- update debian/control
-- Micah Gersten <email address hidden> Sun, 08 May 2011 01:46:21 +0200
-
chromium-browser (11.0.696.57~r82915-0ubuntu0.10.04.1) lucid-security; urgency=high
* New Major upstream release from the Stable Channel (LP: #771935)
This release fixes the following security issues:
+ WebKit issues:
- [61502] High, CVE-2011-1303: Stale pointer in floating object handling.
Credit to Scott Hess of the Chromium development community and Martin
Barbella.
- [70538] Low, CVE-2011-1304: Pop-up block bypass via plug-ins. Credit to
Chamal De Silva.
- [70589] Medium, CVE-2011-1305: Linked-list race in database handling.
Credit to Kostya Serebryany of the Chromium development community.
- [73526] High, CVE-2011-1437: Integer overflows in float rendering.
Credit to miaubiz.
- [74653] High, CVE-2011-1438: Same origin policy violation with blobs.
Credit to kuzzcc.
- [75186] High, CVE-2011-1440: Use-after-free with <ruby> tag and CSS.
Credit to Jose A. Vazquez.
- [75347] High, CVE-2011-1441: Bad cast with floating select lists.
Credit to Michael Griffiths.
- [75801] High, CVE-2011-1442: Corrupt node trees with mutation events.
Credit to Sergey Glazunov and wushi of team 509.
- [76001] High, CVE-2011-1443: Stale pointers in layering code. Credit to
Martin Barbella.
- [76646] Medium, CVE-2011-1445: Out-of-bounds read in SVG. Credit to
wushi of team509.
- [76666] [77507] [78031] High, CVE-2011-1446: Possible URL bar spoofs
with navigation errors and interrupted loads. Credit to kuzzcc.
- [76966] High, CVE-2011-1447: Stale pointer in drop-down list handling.
Credit to miaubiz.
- [77130] High, CVE-2011-1448: Stale pointer in height calculations.
Credit to wushi of team509.
- [77346] High, CVE-2011-1449: Use-after-free in WebSockets. Credit to
Marek Majkowski.
- [77463] High, CVE-2011-1451: Dangling pointers in DOM id map. Credit to
Sergey Glazunov.
- [79199] High, CVE-2011-1454: Use-after-free in DOM id handling. Credit
to Sergey Glazunov.
+ Chromium issues:
- [71586] Medium, CVE-2011-1434: Lack of thread safety in MIME handling.
Credit to Aki Helin.
- [72523] Medium, CVE-2011-1435: Bad extension with ‘tabs’ permission can
capture local files. Credit to Cole Snodgrass.
- [72910] Low, CVE-2011-1436: Possible browser crash due to bad
interaction with X. Credit to miaubiz.
- [76542] High, CVE-2011-1444: Race condition in sandbox launcher. Credit
to Dan Rosenberg.
- [77349] Low, CVE-2011-1450: Dangling pointers in file dialogs. Credit
to kuzzcc.
- [77786] Medium, CVE-2011-1452: URL bar spoof with redirect and manual
reload. Credit to Jordi Chancel.
- [74763] High, CVE-2011-1439: Prevent interference between renderer
processes. Credit to Julien Tinnes of the Google Security Team.
* Fix the password store regression from the last Chromium 10 update.
Backport from trunk provided by Elliot Glaysher from upstream (LP: #743494)
- add debian/patches/stored_passwords_lp743494.patch
- update debian/patches/series
* Update the SVG logo to match the new simplified 2D logo (LP: #748881)
- update debian/chromium-browser.svg
* Ship the app icon in all the sizes provided upstream
- update debian/rules
* Add libpam0g-dev to Build-depends, needed by "Chromoting"
- update debian/control
* Enable the new use_third_party_translations flag at build time (it enables
the Launchpad translations already used in Ubuntu since Chromium 8)
- update debian/rules
-- Fabien Tassin <email address hidden> Wed, 27 Apr 2011 17:31:35 +0200
-
chromium-browser (10.0.648.205~r81283-0ubuntu0.10.04.1) lucid-security; urgency=high
* New upstream minor release from the Stable Channel (LP: #762275)
This release fixes the following security issues:
- [75629] Critical, CVE-2011-1301: Use-after-free in the GPU process.
Credit to Google Chrome Security Team (Inferno).
- [78524] Critical, CVE-2011-1302: Heap overflow in the GPU process. Credit
to Christoph Diehl.
This releasse also contains the security fixes from 10.0.648.204~r79063
(which has been skipped by the sponsors) (LP: #742118)
+ Webkit bugs:
- [73216] High, CVE-2011-1292: Use-after-free in the frame loader. Credit
to Sławomir Błażek.
- [73595] High, CVE-2011-1293: Use-after-free in HTMLCollection. Credit
to Sergey Glazunov.
- [74562] High, CVE-2011-1294: Stale pointer in CSS handling. Credit to
Sergey Glazunov.
- [74991] High, CVE-2011-1295: DOM tree corruption with broken node
parentage. Credit to Sergey Glazunov.
- [75170] High, CVE-2011-1296: Stale pointer in SVG text handling. Credit
to Sergey Glazunov.
+ Chromium bugs:
- [72517] High, CVE-2011-1291: Buffer error in base string handling.
Credit to Alex Turpin.
Packaging changes:
* Set arm_fpu=vfpv3-d16 on arm (less restrictive than the default vfpv3)
preventing a SIGILL crash on some boards (LP: #735877)
- update debian/control
* Install libppGoogleNaClPluginChrome.so (LP: #738331)
- update debian/rules
- update debian/chromium-browser.install
* Fix the apport hooks to pass the expected 'ui' to add_info(), needed when
called from apport/ubuntu-bug (LP: #759635)
- update debian/apport/chromium-browser.py
* NaCL may be blacklisted, so only include it when it's actually been
built (fixes the ftbfs on arm) (LP: #745854)
- update debian/rules
- update debian/chromium-browser.install
* Harden the apport hooks in the extensions section
- update debian/apport/chromium-browser.py
-- Fabien Tassin <email address hidden> Thu, 14 Apr 2011 22:36:16 +0200
-
chromium-browser (10.0.648.133~r77742-0ubuntu0.10.04.1) lucid-security; urgency=high
* New upstream security release from the Stable Channel (LP: #733514)
+ Webkit:
- CVE-2011-1290 [75712] High, Memory corruption in style handling. Credit
to Vincenzo Iozzo, Ralf Philipp Weinmann and Willem Pinckaers reported
through ZDI.
-- Fabien Tassin <email address hidden> Fri, 11 Mar 2011 22:10:11 +0100
-
chromium-browser (10.0.648.127~r76697-0ubuntu0.10.04.1) lucid-security; urgency=high
* New upstream major release from the Stable Channel (LP: #731520)
It includes:
- New version of V8 - Crankshaft - which greatly improves javascript
performance
- New settings pages that open in a tab, rather than a dialog box
- Improved security with malware reporting and disabling outdated plugins
by default
- Password sync as part of Chrome Sync now enabled by default
- GPU Accelerated Video
- Background WebApps
- webNavigation extension API
This release also fixes the following security issues:
+ Webkit bugs:
- [42574] [42765] Low, Possible to navigate or close the top location in
a sandboxed frame. Credit to sirdarckcat of the Google Security Team.
- [69628] High, Memory corruption with counter nodes. Credit to Martin
Barbella.
- [70027] High, Stale node in box layout. Credit to Martin Barbella.
- [70336] Medium, Cross-origin error message leak with workers. Credit to
Daniel Divricean.
- [70442] High, Use after free with DOM URL handling. Credit to Sergey
Glazunov.
- [70779] Medium, Out of bounds read handling unicode ranges. Credit to
miaubiz.
- [70885] [71167] Low, Pop-up blocker bypasses. Credit to Chamal de
Silva.
- [71763] High, Use-after-free in document script lifetime handling.
Credit to miaubiz.
- [72028] High, Stale pointer in table painting. Credit to Martin
Barbella.
- [73066] High, Crash with the DataView object. Credit to Sergey
Glazunov.
- [73134] High, Bad cast in text rendering. Credit to miaubiz.
- [73196] High, Stale pointer in WebKit context code. Credit to Sergey
Glazunov.
- [73746] High, Stale pointer with SVG cursors. Credit to Sergey
Glazunov.
- [74030] High, DOM tree corruption with attribute handling. Credit to
Sergey Glazunov.
+ Chromium bugs:
- [49747] Low, Work around an X server bug and crash with long messages.
Credit to Louis Lang.
- [66962] Low, Possible browser crash with parallel print()s. Credit to
Aki Helin of OUSPG.
- [69187] Medium, Cross-origin error message leak. Credit to Daniel
Divricean.
- [70877] High, Same origin policy bypass in v8. Credit to Daniel
Divricean.
+ v8:
- [74662] High, Corruption via re-entrancy of RegExp code. Credit to
Christian Holler.
- [74675] High, Invalid memory access in v8. Credit to Christian Holler.
+ ffmpeg:
- [71788] High, Out-of-bounds write in the OGG container. Credit to
Google Chrome Security Team (SkyLined); plus subsequent independent
discovery by David Weston of Microsoft and MSVR.
- [73026] High, Use of corrupt out-of-bounds structure in video code.
Credit to Tavis Ormandy of the Google Security Team.
+ libxslt:
- [73716] Low, Leak of heap address in XSLT. Credit to Google Chrome
Security Team (Chris Evans).
Packaging changes:
* Promote Uyghur to the list of supported translations
- update debian/rules
- update debian/control
* Fix the FTBFS on arm by re-adding the lost arm_neon=0, and really set armv7=1
on maverick and natty
- update debian/rules
* Fix the broken symlinks in /usr/share/doc created by CDBS (See LP: #194574)
- update debian/rules
* Add libxt-dev to Build-deps needed by ppGoogleNaClPluginChrome
- update debian/control
* Fix the Webkit version in about:version (the build system expects the svn
or git directories to be available at build time)
- add debian/patches/webkit_rev_parser.patch
- update debian/patches/series
* Bump build-depends on libvpx-dev to >= 0.9.5
- update debian/control
-- Fabien Tassin <email address hidden> Tue, 08 Mar 2011 17:19:58 +0100
-
chromium-browser (9.0.597.107~r75357-0ubuntu0.10.04.1) lucid-security; urgency=high
* New upstream release from the Stable Channel (LP: #726895)
This release fixes the following security issues:
+ Webkit bugs:
- [54262] High, URL bar spoof with history interaction. Credit to Jordi
Chancel.
- [68263] High, Stylesheet node stale pointer. Credit to Sergey Glazunov.
- [68741] High, Stale pointer with key frame rule. Credit to Sergey
Glazunov.
- [70078] High, Crash with forms controls. Credit to Stefan van Zanden.
- [70244] High, Crash in SVG rendering. Credit to Sławomir Błażek.
- [71114] High, Stale node in table child handling. Credit to Martin
Barbella.
- [71115] High, Stale pointer in table rendering. Credit to Martin
Barbella.
- [71296] High, Stale pointer in SVG animations. Credit to miaubiz.
- [71386] High, Stale nodes in XHTML. Credit to wushi of team509.
- [71388] High, Crash in textarea handling. Credit to wushi of team509.
- [71595] High, Stale pointer in device orientation. Credit to Sergey
Glazunov.
- [71855] High, Integer overflow in textarea handling. Credit to miaubiz.
- [71960] Medium, Out-of-bounds read in WebGL. Credit to Google Chrome
Security Team (Inferno).
- [73235] High, Stale pointer in layout. Credit to Martin Barbella.
+ Chromium bugs:
- [63732] High, Crash with javascript dialogs. Credit to Sergey
Radchenko.
- [64-bit only] [70376] Medium, Out-of-bounds read in pickle
deserialization. Credit to Evgeniy Stepanov of the Chromium development
community.
- [71717] Medium, Out-of-bounds read in WebGL. Credit to miaubiz.
- [72214] High, Accidental exposure of internal extension functions.
Credit to Tavis Ormandy of the Google Security Team.
- [72437] High, Use-after-free with blocked plug-ins. Credit to Chamal de
Silva.
* Bump the lang-pack package from Suggests to Recommends (LP: #689267)
- update debian/control
* Disable PIE on Armel/Lucid (LP: #716703)
- update debian/rules
* Add the disk usage to the Apport hooks
- update debian/apport/chromium-browser.py
* Drop gyp from Build-Depends, use in-source gyp instead
- update debian/control
* Merge back the ffmpeg codecs (from the chromium-codecs-ffmpeg source package)
- update debian/rules
- update debian/control
- add debian/chromium-codecs-ffmpeg-extra.install
- add debian/chromium-codecs-ffmpeg.install
-- Fabien Tassin <email address hidden> Tue, 01 Mar 2011 00:14:02 +0100
-
chromium-browser (9.0.597.94~r73967-0ubuntu0.10.04.1) lucid-security; urgency=high
* New upstream release from the Stable Channel (LP: #715357)
This release fixes the following security issues:
- [67234] High, Stale pointer in animation event handling. Credit to Rik
Cabanier.
- [68120] High, Use-after-free in SVG font faces. Credit to miaubiz.
- [69556] High, Stale pointer with anonymous block handling. Credit to
Martin Barbella.
- [69970] Medium, Out-of-bounds read in plug-in handling. Credit to Bill
Budge of Google.
- [70456] Medium, Possible failure to terminate process on out-of-memory
condition. Credit to David Warren of CERT/CC.
* Update the gl dlopen patch to search for libGLESv2.so.2 instead of .1
- update debian/patches/dlopen_sonamed_gl.patch
-- Fabien Tassin <email address hidden> Tue, 08 Feb 2011 20:18:51 +0100
-
chromium-browser (9.0.597.84~r72991-0ubuntu0.10.04.1) lucid-security; urgency=high
* New upstream release from the Stable Channel (LP: #712655)
This release fixes the following security issues:
- [55831] High, Use-after-free in image loading. Credit to Aki Helin of
OUSPG.
- [59081] Low, Apply some restrictions to cross-origin drag + drop. Credit
to Google Chrome Security Team (SkyLined) and the Google Security Team
(Michal Zalewski, David Bloom).
- [62791] Low, Browser crash with extension with missing key. Credit to
Brian Kirchoff.
- [65669] Low, Handle merging of autofill profiles more gracefully. Credit
to Google Chrome Security Team (Inferno).
- [68244] Low, Browser crash with bad volume setting. Credit to Matthew
Heidermann.
- [69195] Critical, Race condition in audio handling. Credit to the gamers
of Reddit!
* Add the app/resources/app_strings.grd template to the list
of templates translated in Launchpad
- update debian/rules
* Drop the gcc 4.5 work-around, applied upstream
- remove debian/patches/gcc-4.5-build-workaround.patch
- update debian/patches/series
* Drop gcc 4.2/4.3 from Build-depends and remove the gcc 4.4 workarounds
now done in the upstream gyp files
- update debian/control
- update debian/rules
* Add libxtst-dev to Build-deps now that chromoting uses the XTest extension
to execute mouse and keyboard events
- update debian/control
* Fix the libgnutls dlopen to look for the sonamed lib
- add debian/patches/dlopen_libgnutls.patch
- update debian/patches/series
* Fix the libosmesa/libGLESv2/libEGL dlopen() to look for the sonamed libs.
This assumes either the libgles2-mesa + libegl1-mesa packages (better) or
the libosmesa6 package are installed
- add debian/patches/dlopen_sonamed_gl.patch
- update debian/patches/series
-- Fabien Tassin <email address hidden> Thu, 03 Feb 2011 22:56:37 +0100
-
chromium-browser (8.0.552.237~r70801-0ubuntu0.10.04.1) lucid-security; urgency=high
* New upstream release from the Stable Channel (LP: #702542)
This release fixes the following security issues:
- [58053] Medium, Browser crash in extensions notification handling. Credit
to Eric Roman of the Chromium development community.
- [65764] High, Bad pointer handling in node iteration. Credit to Sergey
Glazunov.
- [66560] High, Stale pointer with CSS + canvas. Credit to Sergey Glazunov.
- [66748] High, Stale pointer with CSS + cursors. Credit to Jan Tošovský.
- [67303] High, Bad memory access with mismatched video frame sizes. Credit
to Aki Helin of OUSPG; plus independent discovery by Google Chrome
Security Team (SkyLined) and David Warren of CERT.
- [67363] High, Stale pointer with SVG use element. Credited anonymously;
plus indepdent discovery by miaubiz.
- [67393] Medium, Uninitialized pointer in the browser triggered by rogue
extension. Credit to kuzzcc.
- [68115] High, Vorbis decoder buffer overflows. Credit to David Warren of
CERT.
- [68178] High, Bad cast in anchor handling. Credit to Sergey Glazunov.
- [68181] High, Bad cast in video handling. Credit to Sergey Glazunov.
- [68439] High, Stale rendering node after DOM node removal. Credit to
Martin Barbella; plus independent discovery by Google Chrome Security
Team (SkyLined).
- [68666] Critical, Stale pointer in speech handling. Credit to Sergey
Glazunov.
* Add the chrome/app/policy/policy_templates.grd template to the list
of templates translated in Launchpad
- update debian/rules
* Add Basque and Galician to the list of supported langs for the lang-packs
(translations from Launchpad/Rosetta)
- update debian/rules
-- Fabien Tassin <email address hidden> Thu, 13 Jan 2011 07:31:05 +0100
-
chromium-browser (8.0.552.224~r68599-0ubuntu0.10.04.1) lucid-security; urgency=high
* New upstream release from the Stable Channel (LP: #689849)
This release fixes the following security issues:
- [64-bit Linux only] [56449] High Bad validation for message
deserialization on 64-bit builds. Credit to Lei Zhang of the Chromium
development community.
- [60761] Medium, Bad extension can cause browser crash in tab handling.
Credit to kuzzcc.
- [63529] Low, Browser crash with NULL pointer in web worker handling.
Credit to Nathan Weizenbaum of Google.
- [63866] Medium, Out-of-bounds read in CSS parsing. Credit to Chris Rohlf.
- [64959] High, Stale pointers in cursor handling. Credit to Sławomir
Błażek and Sergey Glazunov.
-- Fabien Tassin <email address hidden> Mon, 13 Dec 2010 21:21:39 +0100
-
chromium-browser (8.0.552.215~r67652-0ubuntu0.10.04.1) lucid-security; urgency=high
* New upstream Major release from the Stable Channel (LP: #684502), also
fixing the following security issues:
- [17655] Low, Possible pop-up blocker bypass. Credit to Google Chrome
Security Team (SkyLined).
- [55745] Medium, Cross-origin video theft with canvas. Credit to Nirankush
Panchbhai and Microsoft Vulnerability Research (MSVR).
- [56237] Low, Browser crash with HTML5 databases. Credit to Google Chrome
Security Team (Inferno).
- [58319] Low, Prevent excessive file dialogs, possibly leading to browser
crash. Credit to Cezary Tomczak (gosu.pl).
- [59554] High, Use after free in history handling. Credit to Stefan
Troger.
- [59817] Medium, Make sure the “dangerous file types” list is uptodate
with the Windows platforms. Credit to Billy Rios of the Google Security
Team.
- [61701] Low, Browser crash with HTTP proxy authentication. Credit to
Mohammed Bouhlel.
- [61653] Medium, Out-of-bounds read regression in WebM video support.
Credit to Google Chrome Security Team (Chris Evans), based on earlier
testcases from Mozilla and Microsoft (MSVR).
- [62127] High, Crash due to bad indexing with malformed video. Credit to
miaubiz.
- [62168] Medium, Possible browser memory corruption via malicious
privileged extension. Credit to kuzzcc.
- [62401] High, Use after free with SVG animations. Credit to Sławomir
Błażek.
- [63051] Medium, Use after free in mouse dragging event handling. Credit
to kuzzcc.
- [63444] High, Double free in XPath handling. Credit to Yang Dingning from
NCNIPC, Graduate University of Chinese Academy of Sciences.
* Automatically merge Launchpad translations with the upstream grit files and
produce patches in the source tarball. Apply those patches at build time
during configure
- update debian/rules
-- Fabien Tassin <email address hidden> Thu, 02 Dec 2010 20:32:06 +0100
-
chromium-browser (7.0.517.44~r64615-0ubuntu0.10.04.1) lucid-security; urgency=high
* New upstream Major release from the Stable Channel (LP: #671420), also
fixing the following security issues:
- [51602] High, Use-after-free in text editing. Credit to David Bloom of
the Google Security Team, Google Chrome Security Team (Inferno) and
Google Chrome Security Team (Cris Neckar).
- [55257] High, Memory corruption with enormous text area. Credit to wushi
of team509.
- [58657] High, Bad cast with the SVG use element. Credit to the kuzzcc.
- [58731] High, Invalid memory read in XPath handling. Credit to Bui Quang
Minh from Bkis (www.bkis.com).
- [58741] High, Use-after-free in text control selections. Credit to
“vkouchna”.
- [59320] High, Integer overflows in font handling. Credit to Aki Helin of
OUSPG.
- [60055] High, Memory corruption in libvpx. Credit to Christoph Diehl.
- [60238] High, Bad use of destroyed frame object. Credit to various
developers, including “gundlach”.
- [60327] [60769] [61255] High, Type confusions with event objects. Credit
to “fam.lam” and Google Chrome Security Team (Inferno).
- [60688] High, Out-of-bounds array access in SVG handling. Credit to wushi
of team509.
-- Fabien Tassin <email address hidden> Thu, 04 Nov 2010 20:53:09 +0100
-
chromium-browser (7.0.517.41~r62167-0ubuntu0.10.04.1) lucid-security; urgency=high
* New upstream Major release from the Stable Channel (LP: #663523), also
fixing the following security issues:
- [48225] [51727] Medium, Possible autofill / autocomplete profile
spamming. Credit to Google Chrome Security Team (Inferno).
- [48857] High, Crash with forms. Credit to the Chromium development
community.
- [50428] Critical, Browser crash with form autofill. Credit to the
Chromium development community.
- [51680] High, Possible URL spoofing on page unload. Credit to kuzzcc;
plus independent discovery by Jordi Chancel.
- [53002] Low, Pop-up block bypass. Credit to kuzzcc.
- [53985] Medium, Crash on shutdown with Web Sockets. Credit to the
Chromium development community.
- [54132] Low, Bad construction of PATH variable. Credit to Dan Rosenberg,
Virtual Security Research.
- [54500] High, Possible memory corruption with animated GIF. Credit to
Simon Schaak.
- [54794] High, Failure to sandbox worker processes on Linux. Credit to
Google Chrome Security Team (Chris Evans).
- [56451] High, Stale elements in an element map. Credit to Michal Zalewski
of the Google Security Team.
* Drop the -fno-tree-sink workaround for the armel gcc inlining bug now that the
strict-aliasing issue in dtoa has been fixed
- drop debian/patches/no_tree_sink_v8.patch
- update debian/patches/series
* Disable -Werror when building with gcc 4.5 until
http://code.google.com/p/chromium/issues/detail?id=49533 gets fixed
- update debian/rules
* Fix the apport hook crash when the use_system key is unset (LP: #660579)
- update debian/apport/chromium-browser.py
* Set CHROME_DESKTOP in the wrapper to help the default browser
checker (LP: #513133)
- update debian/chromium-browser.sh.in
-- Fabien Tassin <email address hidden> Tue, 19 Oct 2010 22:36:19 +0200
-
chromium-browser (6.0.472.62~r59676-0ubuntu0.10.04.1) lucid-security; urgency=high
* New upstream release from the Stable Channel (LP: #641699)
This release fixes the following security issues:
- [55114] High, Bad cast with malformed SVG. Credit to wushi of team 509.
- [55119] Critical, Buffer mismanagement in the SPDY protocol. Credit to
Mike Belshe of the Chromium development community.
- [55350] High, Cross-origin property pollution. Credit to Stefano Di Paola
of MindedSecurity.
Also includes the following security issues from 6.0.472.59 (LP: #638736)
- [50250] High, Use-after-free when using document APIs during parse.
Credit to David Weston of Microsoft + Microsoft Vulnerability Research
(MSVR) and wushi of team 509 (independent discoveries).
- [50712] High, Use-after-free in SVG styles. Credit to kuzzcc.
- [51252] High, Use-after-free with nested SVG elements. Credit to kuzzcc.
- [51709] Low, Possible browser assert in cursor handling. Credit to
“magnusmorton”.
- [51919] High, Race condition in console handling. Credit to kuzzcc.
- [53176] Low, Unlikely browser crash in pop-up blocking. Credit to kuzzcc.
- [53394] High, Memory corruption in Geolocation. Credit to kuzzcc.
- [53930] High, Memory corruption in Khmer handling. Credit to Google
Chrome Security Team (Chris Evans).
- [54006] Low, Failure to prompt for extension history access. Credit to
“adriennefelt”.
* Don't build with PIE on armel for now, it fails to link.
- update debian/rules
* Add some translations for the "Name" field in the desktop file, and fix
some "Comment" / "GenericName". Thanks to the Ubuntu translation team.
See https://wiki.ubuntu.com/Translations/Wanted/ChromiumDesktop to
contribute more translations (LP: #631670)
-- Fabien Tassin <email address hidden> Fri, 17 Sep 2010 22:25:54 +0200
-
chromium-browser (6.0.472.55~r58392-0ubuntu0.10.04.1) lucid-security; urgency=low
* New upstream release from the Stable Channel (LP: #635949)
This release fixes the following issues/regressions:
- [51727] [52940] Failures when using autocomplete
- [10913] Default search engine settings wiped out
- [1906] Shift reload not working
* Build with the Hardening Wrapper (to gain PIE), adding another layer of
protection (See https://wiki.ubuntu.com/Security/HardeningWrapper)
- update debian/control
- update debian/rules
* On Armel, when checking for armv7, also test for Maverick version
- update debian/rules
-- Fabien Tassin <email address hidden> Wed, 08 Sep 2010 09:12:35 +0200
-
chromium-browser (6.0.472.53~r57914-0ubuntu0.10.04.1) lucid-security; urgency=low
* New upstream release from the Stable Channel (LP: #628924)
This release fixes the following security issues:
- [34414] Low, Pop-up blocker bypass with blank frame target. Credit to
Google Chrome Security Team (Inferno) and “ironfist99”.
- [37201] Medium, URL bar visual spoofing with homographic sequences.
Credit to Chris Weber of Casaba Security.
- [41654] Medium, Apply more restrictions on setting clipboard content.
Credit to Brook Novak.
- [45659] High, Stale pointer with SVG filters. Credit to Tavis Ormandy of
the Google Security Team.
- [45876] Medium, Possible installed extension enumeration. Credit to
Lostmon.
- [46750] [51846] Low, Browser NULL crash with WebSockets. Credit to Google
Chrome Security Team (SkyLined), Google Chrome Security Team (Justin Schuh)
and Keith Campbell.
- [50386] High, Use-after-free in Notifications presenter. Credit to Sergey
Glazunov.
- [50839] High, Notification permissions memory corruption. Credit to
Michal Zalewski of the Google Security Team and Google Chrome Security
Team (SkyLined).
- [51630] [51739] High, Integer errors in WebSockets. Credit to Keith
Campbell and Google Chrome Security Team (Cris Neckar).
- [51653] High, Memory corruption with counter nodes. Credit to kuzzcc.
- [51727] Low, Avoid storing excessive autocomplete entries. Credit to
Google Chrome Security Team (Inferno).
- [52443] High, Stale pointer in focus handling. Credit to VUPEN
Vulnerability Research Team (VUPEN-SR-2010-249).
- [52682] High, Sandbox parameter deserialization error. Credit to Ashutosh
Mehra and Vineet Batra of the Adobe Reader Sandbox Team.
- [53001] Medium, Cross-origin image theft. Credit to Isaac Dawson.
* Enable all codecs for HTML5 in Chromium, depending on which ffmpeg sumo lib
is installed, the set of usable codecs (at runtime) will still vary.
This is now done by setting proprietary_codecs=1 so we can drop our patch
- update debian/rules
- drop debian/patches/html5_video_mimetypes.patch
- update debian/patches/series
* Bump the Dependencies on chromium-codecs-ffmpeg to >= 0.6, needed for the new API
- update debian/control
* Add "libcups2-dev | libcupsys2-dev" (the latter for Hardy) to Build-Depends.
This is needed for Cloud Printing
- update debian/control
* Add libppapi_tests.so and linker.lock to INSTALL_EXCLUDE_FILES and
DumpRenderTree_resources/ to INSTALL_EXCLUDE_DIRS
- update debian/rules
* Install resources.pak in the main deb, and remove all resources/ accordingly
- update debian/chromium-browser.install
* Add libgnome-keyring-dev to Build-Depends. This is needed for the GNOME
Keyring and KWallet integration. See http://crbug.com/12351
- update debian/control
* Ship empty policy dirs (for now) in /etc/chromium-browser/policies
- update debian/rules
- update debian/chromium-browser.dirs
* Bump build-deps for gyp to >= 0.1~svn837
- update debian/control
* Drop the icedtea6-plugin workaround, it's no longer needed and it may cause
troubles when the default xulrunner contains older nss/nspr libs
- update debian/chromium-browser.sh.in
-- Fabien Tassin <email address hidden> Thu, 02 Sep 2010 17:03:41 +0200
-
chromium-browser (5.0.375.127~r55887-0ubuntu0.10.04.1) lucid-security; urgency=low
* New upstream release from the Stable Channel (LP: #622823)
This release fixes the following security issues:
- [45400] Critical, Memory corruption with file dialog. Credit to Sergey
Glazunov.
- [49596] High, Memory corruption with SVGs. Credit to wushi of team509.
- [49628] High, Bad cast with text editing. Credit to wushi of team509.
- [49964] High, Possible address bar spoofing with history bug. Credit to
Mike Taylor.
- [50515] [51835] High, Memory corruption in MIME type handling. Credit to
Sergey Glazunov.
- [50553] Critical, Crash on shutdown due to notifications bug. Credit to
Sergey Glazunov.
- [51146] Medium, Stop omnibox autosuggest if the user might be about to
type a password. Credit to Robert Hansen.
- [51654] High, Memory corruption with Ruby support. Credit to kuzzcc.
- [51670] High, Memory corruption with Geolocation support. Credit to
kuzzcc.
* Add the xul libdir to LD_LIBRARY_PATH in the wrapper to help icedtea6-plugin
(LP: #529242). This is needed at least for openjdk-6 6b18.
- update debian/chromium-browser.sh
* No longer use tar --lzma in get-orig-source now that it silently uses xz
(since tar 1.23-2) which is not available in the backports. Use "tar | lzma"
instead so the embedded tarball is always a lzma file
- update debian/rules
* Tweak the user agent to include Chromium and the Distro's name and version.
- add debian/patches/chromium_useragent.patch.in
- update debian/patches/series
- update debian/rules
* Fix a typo in the subst_files rule
- update debian/rules
* Fix a gyp file that triggers an error with newer gyp (because of dead code)
- add debian/patches/drop_unused_rules_to_please_newer_gyp.patch
- update debian/patches/series
* Bump gyp Build-Depends to >= 0.1~svn810 to match upstream requirement
- update debian/control
-- Fabien Tassin <email address hidden> Fri, 20 Aug 2010 14:09:16 +0200
-
chromium-browser (5.0.375.125~r53311-0ubuntu0.10.04.1) lucid-security; urgency=low
* New upstream release from the Stable Channel (LP: #612109)
This release fixes the following security issues:
- [42736] Medium Memory contents disclosure in layout code. Credit to
Michail Nikolaev.
- [43813] High Issue with large canvases. Credit to sp3x of
SecurityReason.com.
- [47866] High Memory corruption in rendering code. Credit to Jose A.
Vazquez.
- [48284] High Memory corruption in SVG handling. Credit to Aki Helin of
OUSPG.
- [48597] Low Avoid hostname truncation and incorrect eliding. Credit to
Google Chrome Security Team (Inferno).
* lsb_release is slow so try to source the static file /etc/lsb-release
instead, and fallback to lsb_release if we didn't get the information we need
for about:version (LP: #608253). Thanks to pitti for the idea.
- update debian/chromium-browser.sh.in
-- Fabien Tassin <email address hidden> Tue, 27 Jul 2010 12:03:40 +0200
-
chromium-browser (5.0.375.99~r51029-0ubuntu0.10.04.1) lucid-proposed; urgency=low
* New upstream release from the Stable Channel (LP: #602142)
This release fixes the following security issues:
- [42396] Low OOB read with WebGL. Credit to Sergey Glazunov; Google Chrome
Security Team (SkyLined).
- [42575] [42980] Medium Isolate sandboxed iframes more strongly. Credit to
sirdarckcat of Google Security Team.
- [43488] High Memory corruption with invalid SVGs. Credit to Aki Hekin of
OUSPG; wushi of team509.
- [44424] High Memory corruption in bidi algorithm. Credit to wushi of
team509.
- [45164] Low Crash with invalid image. Credit to Jose A. Vazquez.
- [45983] High Memory corruption with invalid PNG (libpng bug). Credit to
Aki Helin of OUSPG.
- [46360] High Memory corruption in CSS style rendering. Credit to wushi of
team509.
- [46575] Low Annoyance with print dialogs. Credit to Mats Ahlgren.
- [47056] Low Crash with modal dialogs. Credit to Aki Helin of OUSPG.
-- Fabien Tassin <email address hidden> Fri, 02 Jul 2010 01:05:06 +0200
-
chromium-browser (5.0.375.86~r49890-0ubuntu0.10.04.1) lucid-proposed; urgency=low
* New upstream release from the Stable Channel (LP: #598913)
Fixes the following security issues:
- [38105] Medium XSS via application/json response (regression). Credit to
Ben Davis for original discovery and Emanuele Gentili for regression
discovery.
- [43322] Medium Memory error in video handling. Credit to Mark Dowd under
contract to Google Chrome Security Team.
- [43967] High Subresource displayed in omnibox loading. Credit to Michal
Zalewski of Google Security Team.
- [45267] High Memory error in video handling. Credit to Google Chrome
Security Team (Cris Neckar).
- [46126] High Stale pointer in x509-user-cert response. Credit to Rodrigo
Marcos of SECFORCE.
* Drop the XLIB_SKIP_ARGB_VISUALS workaround now that the rgba patch has
been backed off from gtk2 (LP: #584959)
- update debian/chromium-browser.sh
* Show in about:version and in the About UI when chromium is running on a different
distribution that it has been built on
- udpate debian/rules
- rename and update debian/chromium-browser.sh => debian/chromium-browser.sh.in
* Refresh list of languages in the -l10n package
- update debian/control
* Stop building and running the testsuite. The builders restricted env
makes the results mostly unusable in an automated way and resources to
manually exploit them are not available
- update debian/control
- update debian/rules
* Remove duplicates of the main copyright file in order to save space on the CD
- update debian/rules
* Add support for the Ambiance/Radiance and Dust themes button ordering by
reading the gconf pref (LP: #568307)
(thanks to Giuseppe Iuculano for importing the patch from trunk)
- add debian/patches/gtk-ambiance.patch
- update debian/patches/series
-- Fabien Tassin <email address hidden> Fri, 25 Jun 2010 02:05:06 +0200
-
chromium-browser (5.0.375.70~r48679-0ubuntu0.10.04.1) lucid-security; urgency=low
* New upstream release from the Stable Channel (LP: #591474)
Fixes the following security issues:
- [15766] Medium Cross-origin keystroke redirection. Credit to Michal
Zalewski of Google Security Team.
- [39985] High Cross-origin bypass in DOM methods. Credit to Sergey
Glazunov.
- [42723] High Memory error in table layout. Credit to wushi of team509.
- [43304] High Linux sandbox escape. Credit to Mark Dowd under contract to
Google Chrome Security Team.
- [43307] High Bitmap stale pointer. Credit to Mark Dowd under contract to
Google Chrome Security Team.
- [43315] High Memory corruption in DOM node normalization. Credit to Mark
Dowd under contract to Google Chrome Security Team.
- [43487] High Memory corruption in text transforms. Credit to wushi of
team509.
- [43902] Medium XSS in innerHTML property of textarea. Credit to
sirdarckcat of Google Security Team.
- [44740] High Memory corruption in font handling. Credit: Apple.
- [44868] High Geolocation events fire after document deletion. Credit to
Google Chrome Security Team (Justin Schuh).
- [44955] High Memory corruption in rendering of list markers. Credit:
Apple.
* Add a --temp-profile knob to the launcher script starting Chromium with
a new profile which will last only for the duration of the session
- update debian/chromium-browser.sh
* Change StartupWMClass to Chromium-browser in the desktop launcher so
cairo-dock does the right thing (LP: #587664)
- update debian/chromium-browser.desktop
* Set XLIB_SKIP_ARGB_VISUALS=1 in the wrapper to prevent flash from dying
with a Gdk-ERROR when gtk2 is built with RGBA support (like in Maverick).
(LP: #584959)
- update debian/chromium-browser.sh
* Unbreak get-orig-source when it needs to drop its cache after a channel jump
(replace brace expansion - which is a bashism - with proper $(wildcard))
- update debian/rules
-- Fabien Tassin <email address hidden> Wed, 09 Jun 2010 07:30:50 +0200
-
chromium-browser (5.0.375.38~r46659-0ubuntu0.10.04.1) lucid-security; urgency=low
* New upstream release from the Beta Channel
- Some crash and stability fixes
- Localization refresh of the strings
-- Fabien Tassin <email address hidden> Tue, 11 May 2010 10:23:45 +0200
-
chromium-browser (5.0.342.9~r43360-0ubuntu2) lucid; urgency=low
[ Fabien Tassin <email address hidden> ]
* Mention 'Chrome' in the main package description (LP: #561667)
- update debian/control
* When 'gclient update' fails, clear up the cache and retry. This helps
the channels updates often failing with a "Can't switch the checkout" error
- update debian/rules
[ Chris Coulson <email address hidden> ]
* Update the default search URL
- update debian/rules
-- Fabien Tassin <email address hidden> Fri, 16 Apr 2010 17:36:29 +0200
-
chromium-browser (5.0.342.9~r43360-0ubuntu1) lucid; urgency=low
* New upstream release from the Beta Channel
- Fix extensions installer where some extensions cannot be installed
(issue 38220)
* Don't build with system zlib on Intrepid/Jaunty (needed to unbreak the
backports). See http://crbug.com/38073
- update debian/rules
-- Fabien Tassin <email address hidden> Wed, 07 Apr 2010 21:02:55 +0200
-
chromium-browser (5.0.342.7~r42476-0ubuntu1) lucid; urgency=low
* New upstream release from the Beta Channel
- fix an issue with Google SSL sites failing with 'error 107
(net::ERR_SSL_PROTOCOL_ERROR)' (issue 37722)
- Automatic translations and greater control over content for privacy
- Really, really reload. A normal reload causes the browser to check with
the server before reusing its cached content. The server can decide
whether or not the browser should use its cached content. A force reload
causes the browser to ignore its cached content and ask the server for a
fresh copy of the page. Use Shift+Reload to force a reload.
* Add libdbus-glib-1-dev to Build-Depends
- update debian/control
* Move third_party/gles2_book from STRIPPED_DIRS to ALMOST_STRIPPED_DIRS
as we now need its gyp file (but nothing else)
- update debian/rules
* Bump gyp requirement to >= 0.1~svn795, it's needed for the new syntax
- update debian/control
* Add 'timestats' to INSTALL_EXCLUDE_FILES
- update debian/rules
* Import translations and mime-types from the upstream desktop file
Thanks to Julien Lavergne <email address hidden> (LP: #538664)
- update debian/chromium-browser.desktop
* Import the free SVG logo from the Chromium website and install it
in /usr/share/icons/hicolor/scalable/apps (LP: #528640)
- add debian/chromium-browser.svg
- update debian/rules
* Move chromium-browser-inspector to Depends, it breaks some features
when it's not installed
- update debian/control
* Rename chromium-codecs-ffmpeg-nonfree into chromium-codecs-ffmpeg-extra
and move the two codecs back to Depends (LP: #537617, #513776)
- update debian/control
-- Fabien Tassin <email address hidden> Thu, 25 Mar 2010 08:22:40 +0100
-
chromium-browser (5.0.307.11~r39572-0ubuntu1) lucid; urgency=low
* New upstream release from the Beta Channel
- Fixed an issue where an error resolving a proxy server would not try a
direct connection. (Issue 32316)
- Fixed an extensions bug that could crash the entire browser. (Issue 34778)
- Fixed an issue in the cross-site scripting auditor that could prevent
Google translate from working on sites. (Issue 33115)
-- Fabien Tassin <email address hidden> Sat, 27 Feb 2010 17:07:23 +0100
-
chromium-browser (5.0.307.9~r39052-0ubuntu1) lucid; urgency=low
* New upstream release from the Beta Channel
- Fixed a tab crash that could be triggered by visiting wordpress.com,
http://acid3.acidtests.org/, and many other sites. (Issue 35498)
- Fixed a tab crash in image loading. (Issue 32230)
- Improved font bolding for fonts without native bold. (Issue 22360)
* Bump gyp Build-Depends to >= 0.1~svn785
- update debian/control
* Add --no-circular-check to gyp_chromium to prevent gyp from failing
- update debian/rules
-- Fabien Tassin <email address hidden> Thu, 18 Feb 2010 00:20:07 +0100
-
chromium-browser (5.0.307.7~r38400+0-0ubuntu1) lucid; urgency=low
* Disable WANT_SYSTEM_LIBS since it makes Gmail/GCal crash (libxml,
libxslt, ..). See http://crbug.com/34725 (LP: #522078)
- update debian/rules
-- Fabien Tassin <email address hidden> Mon, 15 Feb 2010 12:17:07 +0100
-
chromium-browser (5.0.307.7~r38400-0ubuntu1) lucid; urgency=low
* New upstream release from the Beta Channel
* Re-add the -l10n strict version dependency on chromium-browser
- update debian/control
-- Fabien Tassin <email address hidden> Fri, 12 Feb 2010 22:00:39 +0100
-
chromium-browser (5.0.307.5~r37950+0-0ubuntu1) lucid; urgency=low
* Drop third_party/libxml from STRIPPED_SYSTEM_LIB_DIRS
- update debian/rules
-- Fabien Tassin <email address hidden> Wed, 10 Feb 2010 18:46:55 +0100
-
chromium-browser (5.0.307.5~r37950-0ubuntu1) lucid; urgency=low
* Add libxss-dev to Build-Depends, the new browser sync engine needs
X11/extensions/scrnsaver.h
- update debian/control
* Add a safety net to get-orig-source when fetching sources for a channel
- update debian/rules
-- Fabien Tassin <email address hidden> Tue, 09 Feb 2010 17:07:18 +0100
-
chromium-browser (4.0.305.0~svn20100123r36929-0ubuntu1) lucid; urgency=low
[ Fabien Tassin <email address hidden> ]
* Initial release. (Closes: #520324, LP: #387765)
[ Alexander Sack <email address hidden> ]
* extensive license review; see copyright and copyright.problems;
also see debian/licensecheck.pl for details how the copyright files are
generated
* address archive-admin comments:
+ add "Paul Hsieh's Public Domain Option" license snippet and mark
net/disk_cache/hash.cc to be govered by that; recreate copyright*
- add debian/licenses/LICENSE.Paul Hsieh's Public Domain Option
- update debian/licensecheck.pl
- update debian/copyright
- update debian/copyright.problems
-- Fabien Tassin <email address hidden> Tue, 26 Jan 2010 17:43:19 +0100
