openSUSE Security Update : chromium (openSUSE-SU-2014:1378-1)

Critical Nessus Plugin ID 79267


The remote openSUSE host is missing a security update.


- Update to Chromium 38.0.2125.101 This update includes 159 security fixes, including 113 relatively minor fixes. Highlighted securtiy fixes are: CVE-2014-3188: A combination of V8 and IPC bugs that can lead to remote code execution outside of the sandbox CVE-2014-3189:
Out-of-bounds read in PDFium CVE-2014-3190:
Use-after-free in Events CVE-2014-3191: Use-after-free in Rendering CVE-2014-3192: Use-after-free in DOM CVE-2014-3193: Type confusion in Session Management CVE-2014-3194: Use-after-free in Web Workers CVE-2014-3195: Information Leak in V8 CVE-2014-3196:
Permissions bypass in Windows Sandbox CVE-2014-3197:
Information Leak in XSS Auditor CVE-2014-3198:
Out-of-bounds read in PDFium CVE-2014-3199: Release Assert in V8 bindings CVE-2014-3200: Various fixes from internal audits, fuzzing and other initiatives

- Drop the build of the Native Client. This is actually not a build as that prebuild binaries are being shipped.
Also Google no longer provides prebuild binaries for the NativeClient for 32bit. Chromium as webbrowser is not affected by this and it bring Chromium inline with the regulations that prebuild binaries should not be shipped.

- toolchaing_linux tarball dropped

- Spec-file cleaned for NaCl stuff

- Added patch no-clang-on-packman.diff to prevent the usage of clang on packman, which is not supported there


Update the affected chromium packages.

See Also

Plugin Details

Severity: Critical

ID: 79267

File Name: openSUSE-2014-634.nasl

Version: $Revision: 1.3 $

Type: local

Agent: unix

Published: 2014/11/17

Modified: 2014/11/21

Dependencies: 12634

Risk Information

Risk Factor: Critical


Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:novell:opensuse:chromedriver, p-cpe:/a:novell:opensuse:chromedriver-debuginfo, p-cpe:/a:novell:opensuse:chromium, p-cpe:/a:novell:opensuse:chromium-debuginfo, p-cpe:/a:novell:opensuse:chromium-debugsource, p-cpe:/a:novell:opensuse:chromium-desktop-gnome, p-cpe:/a:novell:opensuse:chromium-desktop-kde, p-cpe:/a:novell:opensuse:chromium-ffmpegsumo, p-cpe:/a:novell:opensuse:chromium-ffmpegsumo-debuginfo, cpe:/o:novell:opensuse:13.1

Required KB Items: Host/local_checks_enabled, Host/SuSE/release, Host/SuSE/rpm-list, Host/cpu

Patch Publication Date: 2014/10/31

Reference Information

CVE: CVE-2014-3178, CVE-2014-3188, CVE-2014-3189, CVE-2014-3190, CVE-2014-3191, CVE-2014-3192, CVE-2014-3193, CVE-2014-3194, CVE-2014-3195, CVE-2014-3196, CVE-2014-3197, CVE-2014-3198, CVE-2014-3199, CVE-2014-3200