1:45 a.m.
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2018-4a16e37c81
2018-09-21 06:43:05.931438
--------------------------------------------------------------------------------
Name : chromium
Product : Fedora 27
Version : 69.0.3497.92
Release : 1.fc27
URL : http://www.chromium.org/Home
Summary : A WebKit (Blink) powered web browser
Description :
Chromium is an open-source web browser, powered by WebKit (Blink).
--------------------------------------------------------------------------------
Update Information:
Update to Chromium 69. (EPEL-7 update is blocked by a GCC bug: 1629813, so as
soon as devtoolset-8 arrives...) Fixes a lot of security issues, like every
major release of Chromium, including CVE-2018-16087 CVE-2018-16088
CVE-2018-16086CVE-2018-16065 CVE-2018-16066 CVE-2018-16067 CVE-2018-16068
CVE-2018-16069 CVE-2018-16070 CVE-2018-16071 CVE-2018-16072 CVE-2018-16073
CVE-2018-16074 CVE-2018-16075 CVE-2018-16076 CVE-2018-16077 CVE-2018-16078 ----
Update to Chromium 68. Security fix for CVE-2018-4117 CVE-2018-6044
CVE-2018-6150 CVE-2018-6151 CVE-2018-6152 CVE-2018-6153 CVE-2018-6154
CVE-2018-6155 CVE-2018-6156 CVE-2018-6157 CVE-2018-6158 CVE-2018-6159
CVE-2018-6161 CVE-2018-6162 CVE-2018-6163 CVE-2018-6149
--------------------------------------------------------------------------------
ChangeLog:
* Wed Sep 12 2018 Tom Callaway <spot(a)fedoraproject.org> - 69.0.3497.92-1
- update to 69.0.3497.92
* Wed Sep 5 2018 Tom Callaway <spot(a)fedoraproject.org> - 69.0.3497.81-1
- update to 69.0.3497.81
* Tue Aug 28 2018 Patrik Novotn�� <panovotn(a)redhat.com> - 68.0.3440.106-4
- change requires to minizip-compat(-devel), rhbz#1609830, rhbz#1615381
* Sun Aug 19 2018 Tom Callaway <spot(a)fedoraproject.org> - 68.0.3440.106-3
- fix library filters
* Fri Aug 17 2018 Tom Callaway <spot(a)fedoraproject.org> - 68.0.3440.106-2
- fix error with defaulting on redeclaration
* Thu Aug 9 2018 Tom Callaway <spot(a)fedoraproject.org> - 68.0.3440.106-1
- update to 68.0.3440.106
* Wed Aug 8 2018 Tom Callaway <spot(a)fedoraproject.org> - 68.0.3440.84-1
- update to 68.0.3440.84
* Mon Jul 30 2018 Tom Callaway <spot(a)fedoraproject.org> - 68.0.3440.75-1
- update to 68.0.3440.75
* Thu Jul 12 2018 Fedora Release Engineering <releng(a)fedoraproject.org> -
67.0.3396.99-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
* Mon Jul 9 2018 Tom Callaway <spot(a)fedoraproject.org> 67.0.3396.99-1
- update to 67.0.3396.99
* Mon Jun 25 2018 Tom Callaway <spot(a)fedoraproject.org> 67.0.3396.87-2
- add "Fedora" to the user agent string
* Tue Jun 19 2018 Tom Callaway <spot(a)fedoraproject.org> 67.0.3396.87-1
- update to 67.0.3396.87
* Thu Jun 7 2018 Tom Callaway <spot(a)fedoraproject.org> 67.0.3396.79-1
- update to 67.0.3396.79
* Wed Jun 6 2018 Tom Callaway <spot(a)fedoraproject.org> 67.0.3396.62-2
- work around bug in RHEL7 python exec
* Wed May 30 2018 Tom Callaway <spot(a)fedoraproject.org> 67.0.3396.62-1
- 67 releases of chromium on the wall...
* Tue May 29 2018 Tom Callaway <spot(a)fedoraproject.org> 66.0.3359.181-3
- also filter out fontconfig on epel7
* Wed May 23 2018 Tom Callaway <spot(a)fedoraproject.org> 66.0.3359.181-2
- fix missing files
* Mon May 21 2018 Tom Callaway <spot(a)fedoraproject.org> 66.0.3359.181-1
- update to 66.0.3359.181
* Tue May 15 2018 Tom Callaway <spot(a)fedoraproject.org> 66.0.3359.170-2
- only x86_64 i686 have swiftshader
- fix gcc8 alignof issue on i686
* Mon May 14 2018 Tom Callaway <spot(a)fedoraproject.org> 66.0.3359.170-1
- update to 66.0.3359.170
- include swiftshader files
* Tue May 1 2018 Tom Callaway <spot(a)fedoraproject.org> 66.0.3359.139-1
- update to 66.0.3359.139
* Wed Apr 18 2018 Tom Callaway <spot(a)fedoraproject.org> 66.0.3359.117-1
- update to 66.0.3359.117
* Tue Apr 17 2018 Tom Callaway <spot(a)fedoraproject.org> 65.0.3325.181-3
- use system fontconfig (except on epel7)
* Wed Apr 4 2018 Tom Callaway <spot(a)fedoraproject.org> 65.0.3325.181-2
- add explicit dependency on minizip (bz 1534282)
* Wed Mar 28 2018 Tom Callaway <spot(a)fedoraproject.org>
- check that there is no system 'google' module, shadowing bundled ones
- conditionalize api keys (on by default)
* Wed Mar 21 2018 Tom Callaway <spot(a)fedoraproject.org> 65.0.3325.181-1
- update to 65.0.3325.181
* Mon Mar 19 2018 Tom Callaway <spot(a)fedoraproject.org> 65.0.3325.162-3
- use bundled libdrm on epel7
* Fri Mar 16 2018 Tom Callaway <spot(a)fedoraproject.org> 65.0.3325.162-2
- disable StartupNotify in chromium-browser.desktop (not in google-chrome desktop file)
(bz1545241)
- use bundled freetype on epel7
* Wed Mar 14 2018 Tom Callaway <spot(a)fedoraproject.org> 65.0.3325.162-1
- update to 65.0.3325.162
* Wed Mar 7 2018 Tom Callaway <spot(a)fedoraproject.org> 65.0.3325.146-1
- update to 65.0.3325.146
* Mon Mar 5 2018 Tom Callaway <spot(a)fedoraproject.org> 64.0.3282.186-1
- update to 64.0.3282.186
* Fri Feb 16 2018 Tom Callaway <spot(a)fedoraproject.org> 64.0.3282.167-1
- update to 64.0.3282.167
- include workaround for gcc8 bug in gn
- disable unnecessary aarch64 glibc symbol change
* Fri Feb 2 2018 Tom Callaway <spot(a)fedoraproject.org> 64.0.3282.140-1
- update to 64.0.3282.140
* Thu Feb 1 2018 Tom Callaway <spot(a)fedoraproject.org> 64.0.3282.119-2
- include user-session binary in chrome-remote-desktop subpackage
* Thu Jan 25 2018 Tom Callaway <spot(a)fedoraproject.org> 64.0.3282.119-1
- update to 64.0.3282.119
* Fri Dec 15 2017 Tomas Popela <tpopela(a)redhat.com> 63.0.3239.108-1
- Update to 63.0.3239.108
* Thu Dec 7 2017 Tom Callaway <spot(a)fedoraproject.org> 63.0.3239.84-1
- update to 63.0.3239.84
* Wed Nov 8 2017 Tom Callaway <spot(a)fedoraproject.org> 62.0.3202.89-1
- update to 62.0.3202.89
* Fri Oct 27 2017 Tom Callaway <spot(a)fedoraproject.org> 62.0.3202.75-1
- update to 62.0.3202.75
- use devtoolset-7-toolchain to build on epel7
* Tue Oct 24 2017 Tom Callaway <spot(a)fedoraproject.org> 62.0.3202.62-1.1
- do not attempt std=c++14 on epel7
* Wed Oct 18 2017 Tom Callaway <spot(a)fedoraproject.org> 62.0.3202.62-1
- update to 62.0.3202.62
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1625488 - CVE-2018-16085 chromium-browser: Use after free in Memory
Instrumentation
https://bugzilla.redhat.com/show_bug.cgi?id=1625488
[ 2 ] Bug #1625487 - CVE-2018-16084 chromium-browser: User confirmation bypass in
external protocol handling
https://bugzilla.redhat.com/show_bug.cgi?id=1625487
[ 3 ] Bug #1625486 - CVE-2018-16083 chromium-browser: Out of bounds read in WebRTC
https://bugzilla.redhat.com/show_bug.cgi?id=1625486
[ 4 ] Bug #1625485 - CVE-2018-16082 chromium-browser: Stack buffer overflow in
SwiftShader
https://bugzilla.redhat.com/show_bug.cgi?id=1625485
[ 5 ] Bug #1625484 - CVE-2018-16081 chromium-browser: Local file access in DevTools
https://bugzilla.redhat.com/show_bug.cgi?id=1625484
[ 6 ] Bug #1625482 - CVE-2018-16080 chromium-browser: URL spoof in full screen mode
https://bugzilla.redhat.com/show_bug.cgi?id=1625482
[ 7 ] Bug #1625481 - CVE-2018-16079 chromium-browser: URL spoof in permission dialogs
https://bugzilla.redhat.com/show_bug.cgi?id=1625481
[ 8 ] Bug #1625480 - CVE-2018-16078 chromium-browser: Credit card information leak in
Autofill
https://bugzilla.redhat.com/show_bug.cgi?id=1625480
[ 9 ] Bug #1625479 - CVE-2018-16077 chromium-browser: Content security policy bypass in
Blink
https://bugzilla.redhat.com/show_bug.cgi?id=1625479
[ 10 ] Bug #1625478 - CVE-2018-16076 chromium-browser: Out of bounds read in PDFium
https://bugzilla.redhat.com/show_bug.cgi?id=1625478
[ 11 ] Bug #1625477 - CVE-2018-16075 chromium-browser: Local file access in Blink
https://bugzilla.redhat.com/show_bug.cgi?id=1625477
[ 12 ] Bug #1625476 - CVE-2018-16074 chromium-browser: Site Isolation bypass using Blob
URLS
https://bugzilla.redhat.com/show_bug.cgi?id=1625476
[ 13 ] Bug #1625475 - CVE-2018-16073 chromium-browser: Site Isolation bypass after tab
restore
https://bugzilla.redhat.com/show_bug.cgi?id=1625475
[ 14 ] Bug #1625474 - CVE-2018-16072 chromium-browser: Cross origin pixel leak in
Chrome's interaction with Android's MediaPlayer
https://bugzilla.redhat.com/show_bug.cgi?id=1625474
[ 15 ] Bug #1625473 - CVE-2018-16071 chromium-browser: Use after free in WebRTC
https://bugzilla.redhat.com/show_bug.cgi?id=1625473
[ 16 ] Bug #1625472 - CVE-2018-16070 chromium-browser: Integer overflow in Skia
https://bugzilla.redhat.com/show_bug.cgi?id=1625472
[ 17 ] Bug #1625471 - CVE-2018-16069 chromium-browser: Out of bounds read in
SwiftShader
https://bugzilla.redhat.com/show_bug.cgi?id=1625471
[ 18 ] Bug #1625470 - CVE-2018-16068 chromium-browser: Out of bounds write in Mojo
https://bugzilla.redhat.com/show_bug.cgi?id=1625470
[ 19 ] Bug #1625469 - CVE-2018-16067 chromium-browser: Out of bounds read in WebAudio
https://bugzilla.redhat.com/show_bug.cgi?id=1625469
[ 20 ] Bug #1625467 - CVE-2018-16066 chromium-browser: Out of bounds read in Blink
https://bugzilla.redhat.com/show_bug.cgi?id=1625467
[ 21 ] Bug #1625466 - CVE-2018-16065 chromium-browser: Out of bounds write in V8
https://bugzilla.redhat.com/show_bug.cgi?id=1625466
[ 22 ] Bug #1628080 - chromium-browser: URL Spoofing in Omnibox
https://bugzilla.redhat.com/show_bug.cgi?id=1628080
[ 23 ] Bug #1628078 - chromium-browser: Function signature mismatch in WebAssembly
https://bugzilla.redhat.com/show_bug.cgi?id=1628078
[ 24 ] Bug #1608208 - CVE-2018-6152 chromium-browser: Local file write in DevTools
https://bugzilla.redhat.com/show_bug.cgi?id=1608208
[ 25 ] Bug #1608207 - CVE-2018-6151 chromium-browser: Bad cast in DevTools
https://bugzilla.redhat.com/show_bug.cgi?id=1608207
[ 26 ] Bug #1608206 - CVE-2018-6150 chromium-browser: Cross origin information
disclosure in Service Workers
https://bugzilla.redhat.com/show_bug.cgi?id=1608206
[ 27 ] Bug #1608205 - CVE-2018-4117 chromium-browser: Cross origin information leak in
Blink
https://bugzilla.redhat.com/show_bug.cgi?id=1608205
[ 28 ] Bug #1608204 - CVE-2018-6044 chromium-browser: Request privilege escalation in
Extensions
https://bugzilla.redhat.com/show_bug.cgi?id=1608204
[ 29 ] Bug #1608203 - CVE-2018-6179 chromium-browser: Local file information leak in
Extensions
https://bugzilla.redhat.com/show_bug.cgi?id=1608203
[ 30 ] Bug #1608202 - CVE-2018-6178 chromium-browser: UI spoof in Extensions
https://bugzilla.redhat.com/show_bug.cgi?id=1608202
[ 31 ] Bug #1608201 - CVE-2018-6177 chromium-browser: Cross origin information leak in
Blink
https://bugzilla.redhat.com/show_bug.cgi?id=1608201
[ 32 ] Bug #1608200 - CVE-2018-6176 chromium-browser: Local user privilege escalation in
Extensions
https://bugzilla.redhat.com/show_bug.cgi?id=1608200
[ 33 ] Bug #1608199 - CVE-2018-6175 chromium-browser: URL spoof in Omnibox
https://bugzilla.redhat.com/show_bug.cgi?id=1608199
[ 34 ] Bug #1608198 - CVE-2018-6174 chromium-browser: Integer overflow in SwiftShader
https://bugzilla.redhat.com/show_bug.cgi?id=1608198
[ 35 ] Bug #1608197 - CVE-2018-6173 chromium-browser: URL spoof in Omnibox
https://bugzilla.redhat.com/show_bug.cgi?id=1608197
[ 36 ] Bug #1608196 - CVE-2018-6172 chromium-browser: URL spoof in Omnibox
https://bugzilla.redhat.com/show_bug.cgi?id=1608196
[ 37 ] Bug #1608195 - CVE-2018-6171 chromium-browser: Use after free in WebBluetooth
https://bugzilla.redhat.com/show_bug.cgi?id=1608195
[ 38 ] Bug #1608194 - CVE-2018-6170 chromium-browser: Type confusion in PDFium
https://bugzilla.redhat.com/show_bug.cgi?id=1608194
[ 39 ] Bug #1608193 - CVE-2018-6169 chromium-browser: Permissions bypass in extension
installation
https://bugzilla.redhat.com/show_bug.cgi?id=1608193
[ 40 ] Bug #1608192 - CVE-2018-6168 chromium-browser: CORS bypass in Blink
https://bugzilla.redhat.com/show_bug.cgi?id=1608192
[ 41 ] Bug #1608191 - CVE-2018-6167 chromium-browser: URL spoof in Omnibox
https://bugzilla.redhat.com/show_bug.cgi?id=1608191
[ 42 ] Bug #1608190 - CVE-2018-6166 chromium-browser: URL spoof in Omnibox
https://bugzilla.redhat.com/show_bug.cgi?id=1608190
[ 43 ] Bug #1608189 - CVE-2018-6165 chromium-browser: URL spoof in Omnibox
https://bugzilla.redhat.com/show_bug.cgi?id=1608189
[ 44 ] Bug #1608188 - CVE-2018-6164 chromium-browser: Same origin policy bypass in
ServiceWorker
https://bugzilla.redhat.com/show_bug.cgi?id=1608188
[ 45 ] Bug #1608187 - CVE-2018-6163 chromium-browser: URL spoof in Omnibox
https://bugzilla.redhat.com/show_bug.cgi?id=1608187
[ 46 ] Bug #1608186 - CVE-2018-6162 chromium-browser: Heap buffer overflow in WebGL
https://bugzilla.redhat.com/show_bug.cgi?id=1608186
[ 47 ] Bug #1608185 - CVE-2018-6161 chromium-browser: Same origin policy bypass in
WebAudio
https://bugzilla.redhat.com/show_bug.cgi?id=1608185
[ 48 ] Bug #1608184 - CVE-2018-6160 chromium-browser: URL spoof in Chrome on iOS
https://bugzilla.redhat.com/show_bug.cgi?id=1608184
[ 49 ] Bug #1608183 - CVE-2018-6159 chromium-browser: Same origin policy bypass in
ServiceWorker
https://bugzilla.redhat.com/show_bug.cgi?id=1608183
[ 50 ] Bug #1608182 - CVE-2018-6158 chromium-browser: Use after free in Blink
https://bugzilla.redhat.com/show_bug.cgi?id=1608182
[ 51 ] Bug #1608181 - CVE-2018-6157 chromium-browser: Type confusion in WebRTC
https://bugzilla.redhat.com/show_bug.cgi?id=1608181
[ 52 ] Bug #1608180 - CVE-2018-6156 chromium-browser: Heap buffer overflow in WebRTC
https://bugzilla.redhat.com/show_bug.cgi?id=1608180
[ 53 ] Bug #1608179 - CVE-2018-6155 chromium-browser: Use after free in WebRTC
https://bugzilla.redhat.com/show_bug.cgi?id=1608179
[ 54 ] Bug #1608178 - CVE-2018-6154 chromium-browser: Heap buffer overflow in WebGL
https://bugzilla.redhat.com/show_bug.cgi?id=1608178
[ 55 ] Bug #1608177 - CVE-2018-6153 chromium-browser: Stack buffer overflow in Skia
https://bugzilla.redhat.com/show_bug.cgi?id=1608177
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2018-4a16e37c81' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------