2:34 p.m.
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2021-87e6bb3010
2021-02-24 20:33:13.581003
--------------------------------------------------------------------------------
Name : chromium
Product : Fedora EPEL 8
Version : 88.0.4324.150
Release : 1.el8
URL : http://www.chromium.org/Home
Summary : A WebKit (Blink) powered web browser
Description :
Chromium is an open-source web browser, powered by WebKit (Blink).
--------------------------------------------------------------------------------
Update Information:
Update to 88.0.4324.150. Fixes: CVE-2021-21142 CVE-2021-21143 CVE-2021-21144
CVE-2021-21145 CVE-2021-21146 CVE-2021-21147 CVE-2021-21148 Please keep in mind
that this release fixes an actively exploited 0-day vulnerability. ---- This
is probably not the update you want. Let me be clear, it does fix the security
vulnerabilities in this list: CVE-2020-16044 CVE-2021-21118 CVE-2021-21119
CVE-2021-21120 CVE-2021-21121 CVE-2021-21122 CVE-2021-21123 CVE-2021-21124
CVE-2021-21125 CVE-2021-21126 CVE-2021-21127 CVE-2021-21129 CVE-2021-21130
CVE-2021-21131 CVE-2021-21132 CVE-2021-21133 CVE-2021-21134 CVE-2021-21135
CVE-2021-21136 CVE-2021-21137 CVE-2021-21138 CVE-2021-21139 CVE-2021-21140
CVE-2021-21141 CVE-2021-21117 CVE-2021-21128 But it will not behave like Google
Chrome does. Google has announced that it is cutting off access to the Sync and
"other Google Exclusive" APIs from all builds except Google Chrome. This will
make the EPEL Chromium build significantly less functional (along with every
other distro packaged Chromium). It is noteworthy that Google _gave_ the
builders of distribution Chromium packages these access rights back in 2013 via
API keys, specifically so that we could have open source builds of Chromium with
(near) feature parity to Chrome. And now they're taking it away. The reasoning
given for this change? Google does not want users to be able to "access their
personal Chrome Sync data (such as bookmarks) ... with a non-Google, Chromium-
based browser." They're not closing a security hole, they're just requiring
that
everyone use Chrome. Or to put it bluntly, they do not want you to access their
Google API functionality without using proprietary software (Google Chrome).
There is no good reason for Google to do this, other than to force people to use
Chrome. I gave a lot of thought to whether I wanted to continue to maintain the
Chromium package in EPEL, given that many (most?) users will be confused/annoyed
when API functionality like sync and geolocation stops working for no good
reason. Ultimately, I decided to continue for now, because there were at least
some users who didn't mind, and if I stopped, someone else would start over and
run blindly into this problem. I would say that you might want to reconsider
whether you want to use Chromium or not. If you want the full "Google"
experience, you can run the proprietary Chrome. If you want to use a FOSS
browser that isn't hobbled, there is a Firefox package in whatever EL flavor
you're using. Oh, last, but not least, Google isn't shutting off the API access
until March 15, 2021, but I have gone ahead and disabled it starting with this
update. I'd rather you read about it here (even though most users will never see
this) than have it just happen. ---- Update Chromium to 87.0.4280.141. Fixes:
CVE-2021-21106 CVE-2021-21107 CVE-2021-21108 CVE-2021-21109 CVE-2021-21110
CVE-2021-21111 CVE-2021-21112 CVE-2021-21113 CVE-2020-16043 CVE-2021-21114
CVE-2020-15995 CVE-2021-21115 CVE-2021-21116
--------------------------------------------------------------------------------
ChangeLog:
* Fri Feb 5 2021 Tom Callaway <spot(a)fedoraproject.org> - 88.0.4234.150-1
- update to 88.0.4234.150
* Tue Feb 2 2021 Tom Callaway <spot(a)fedoraproject.org> - 88.0.4234.146-1
- update to 88.0.4234.146
* Tue Feb 2 2021 Tom Callaway <spot(a)fedoraproject.org> - 88.0.4234.96-4
- turn on the API key (just the API key, not the client_id or client_secret)
* Tue Jan 26 2021 Fedora Release Engineering <releng(a)fedoraproject.org> -
88.0.4324.96-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
* Mon Jan 25 2021 Tom Callaway <spot(a)fedoraproject.org> - 88.0.4324.96-2
- apply fix from Kevin Kofler for new glibc fstat sandbox handling
* Wed Jan 20 2021 Tom Callaway <spot(a)fedoraproject.org> - 88.0.4324.96-1
- 88 goes from beta to stable
- disable use of api keys (Google shut off API access)
* Wed Jan 13 2021 Tom Callaway <spot(a)fedoraproject.org>
- update to 87.0.4280.141
* Wed Dec 30 2020 Tom Callaway <spot(a)fedoraproject.org> - 88.0.4324.50-1
- update to 88.0.4324.50
- drop patches 74 & 75 (applied upstream)
* Thu Dec 17 2020 Tom Callaway <spot(a)fedoraproject.org>
- add two patches for missing headers to build with gcc 11
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1913624 - CVE-2021-21106 chromium-browser: Use after free in autofill
https://bugzilla.redhat.com/show_bug.cgi?id=1913624
[ 2 ] Bug #1913625 - CVE-2021-21107 chromium-browser: Use after free in drag and drop
https://bugzilla.redhat.com/show_bug.cgi?id=1913625
[ 3 ] Bug #1913626 - CVE-2021-21108 chromium-browser: Use after free in media
https://bugzilla.redhat.com/show_bug.cgi?id=1913626
[ 4 ] Bug #1913627 - CVE-2021-21109 chromium-browser: Use after free in payments
https://bugzilla.redhat.com/show_bug.cgi?id=1913627
[ 5 ] Bug #1913629 - CVE-2021-21110 chromium-browser: Use after free in safe browsing
https://bugzilla.redhat.com/show_bug.cgi?id=1913629
[ 6 ] Bug #1913630 - CVE-2021-21111 chromium-browser: Insufficient policy enforcement in
WebUI
https://bugzilla.redhat.com/show_bug.cgi?id=1913630
[ 7 ] Bug #1913631 - CVE-2021-21112 chromium-browser: Use after free in Blink
https://bugzilla.redhat.com/show_bug.cgi?id=1913631
[ 8 ] Bug #1913632 - CVE-2021-21113 chromium-browser: Heap buffer overflow in Skia
https://bugzilla.redhat.com/show_bug.cgi?id=1913632
[ 9 ] Bug #1913633 - CVE-2020-16043 chromium-browser: Insufficient data validation in
networking
https://bugzilla.redhat.com/show_bug.cgi?id=1913633
[ 10 ] Bug #1913634 - CVE-2021-21114 chromium-browser: Use after free in audio
https://bugzilla.redhat.com/show_bug.cgi?id=1913634
[ 11 ] Bug #1913635 - CVE-2020-15995 chromium-browser: Out of bounds write in V8
https://bugzilla.redhat.com/show_bug.cgi?id=1913635
[ 12 ] Bug #1913636 - CVE-2021-21115 chromium-browser: Use after free in safe browsing
https://bugzilla.redhat.com/show_bug.cgi?id=1913636
[ 13 ] Bug #1913637 - CVE-2021-21116 chromium-browser: Heap buffer overflow in audio
https://bugzilla.redhat.com/show_bug.cgi?id=1913637
[ 14 ] Bug #1918218 - CVE-2021-21118 chromium-browser: Insufficient data validation in
V8
https://bugzilla.redhat.com/show_bug.cgi?id=1918218
[ 15 ] Bug #1918219 - CVE-2021-21119 chromium-browser: Use after free in Media
https://bugzilla.redhat.com/show_bug.cgi?id=1918219
[ 16 ] Bug #1918220 - CVE-2021-21120 chromium-browser: Use after free in WebSQL
https://bugzilla.redhat.com/show_bug.cgi?id=1918220
[ 17 ] Bug #1918222 - CVE-2021-21121 chromium-browser: Use after free in Omnibox
https://bugzilla.redhat.com/show_bug.cgi?id=1918222
[ 18 ] Bug #1918223 - CVE-2021-21122 chromium-browser: Use after free in Blink
https://bugzilla.redhat.com/show_bug.cgi?id=1918223
[ 19 ] Bug #1918224 - CVE-2021-21123 chromium-browser: Insufficient data validation in
File System API
https://bugzilla.redhat.com/show_bug.cgi?id=1918224
[ 20 ] Bug #1918225 - CVE-2021-21124 chromium-browser: Potential user after free in
Speech Recognizer
https://bugzilla.redhat.com/show_bug.cgi?id=1918225
[ 21 ] Bug #1918226 - CVE-2021-21125 chromium-browser: Insufficient policy enforcement
in File System API
https://bugzilla.redhat.com/show_bug.cgi?id=1918226
[ 22 ] Bug #1918227 - CVE-2021-21126 chromium-browser: Insufficient policy enforcement
in extensions
https://bugzilla.redhat.com/show_bug.cgi?id=1918227
[ 23 ] Bug #1918228 - CVE-2021-21127 chromium-browser: Insufficient policy enforcement
in extensions
https://bugzilla.redhat.com/show_bug.cgi?id=1918228
[ 24 ] Bug #1918229 - CVE-2021-21129 chromium-browser: Insufficient policy enforcement
in File System API
https://bugzilla.redhat.com/show_bug.cgi?id=1918229
[ 25 ] Bug #1918230 - CVE-2021-21130 chromium-browser: Insufficient policy enforcement
in File System API
https://bugzilla.redhat.com/show_bug.cgi?id=1918230
[ 26 ] Bug #1918231 - CVE-2021-21131 chromium-browser: Insufficient policy enforcement
in File System API
https://bugzilla.redhat.com/show_bug.cgi?id=1918231
[ 27 ] Bug #1918232 - CVE-2021-21132 chromium-browser: Inappropriate implementation in
DevTools
https://bugzilla.redhat.com/show_bug.cgi?id=1918232
[ 28 ] Bug #1918233 - CVE-2021-21133 chromium-browser: Insufficient policy enforcement
in Downloads
https://bugzilla.redhat.com/show_bug.cgi?id=1918233
[ 29 ] Bug #1918235 - CVE-2021-21134 chromium-browser: Incorrect security UI in Page
Info
https://bugzilla.redhat.com/show_bug.cgi?id=1918235
[ 30 ] Bug #1918236 - CVE-2021-21135 chromium-browser: Inappropriate implementation in
Performance API
https://bugzilla.redhat.com/show_bug.cgi?id=1918236
[ 31 ] Bug #1918237 - CVE-2021-21136 chromium-browser: Insufficient policy enforcement
in WebView
https://bugzilla.redhat.com/show_bug.cgi?id=1918237
[ 32 ] Bug #1918238 - CVE-2021-21137 chromium-browser: Inappropriate implementation in
DevTools
https://bugzilla.redhat.com/show_bug.cgi?id=1918238
[ 33 ] Bug #1918239 - CVE-2021-21138 chromium-browser: Use after free in DevTools
https://bugzilla.redhat.com/show_bug.cgi?id=1918239
[ 34 ] Bug #1918240 - CVE-2021-21139 chromium-browser: Inappropriate implementation in
iframe sandbox
https://bugzilla.redhat.com/show_bug.cgi?id=1918240
[ 35 ] Bug #1918241 - CVE-2021-21140 chromium-browser: Uninitialized Use in USB
https://bugzilla.redhat.com/show_bug.cgi?id=1918241
[ 36 ] Bug #1918242 - CVE-2021-21141 chromium-browser: Insufficient policy enforcement
in File System API
https://bugzilla.redhat.com/show_bug.cgi?id=1918242
[ 37 ] Bug #1924892 - CVE-2021-21143 chromium-browser: Heap buffer overflow in
Extensions
https://bugzilla.redhat.com/show_bug.cgi?id=1924892
[ 38 ] Bug #1924893 - CVE-2021-21144 chromium-browser: Heap buffer overflow in Tab
Groups
https://bugzilla.redhat.com/show_bug.cgi?id=1924893
[ 39 ] Bug #1924894 - CVE-2021-21145 chromium-browser: Use after free in Fonts
https://bugzilla.redhat.com/show_bug.cgi?id=1924894
[ 40 ] Bug #1924895 - CVE-2021-21146 chromium-browser: Use after free in Navigation
https://bugzilla.redhat.com/show_bug.cgi?id=1924895
[ 41 ] Bug #1924896 - CVE-2021-21147 chromium-browser: Inappropriate implementation in
Skia
https://bugzilla.redhat.com/show_bug.cgi?id=1924896
[ 42 ] Bug #1925434 - CVE-2021-21148 chromium-browser: Heap buffer overflow in V8
https://bugzilla.redhat.com/show_bug.cgi?id=1925434
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update chromium' at the command line.
For more information, refer to "YUM", available at
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7\
/html/System_Administrators_Guide/ch-yum.html
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------