CVE-2013-6628

net/socket/ssl_client_socket_nss.cc in the TLS implementation in Google Chrome before 31.0.1650.48 does not ensure that a server's X.509 certificate is the same during renegotiation as it was before renegotiation, which might allow remote web servers to interfere with trust relationships by renegotiating a session.

net/socket/ssl_client_socket_nss.cc in the TLS implementation in Google Chrome before 31.0.1650.48 does not ensure that a server's X.509 certificate is the same during renegotiation as it was before renegotiation, which might allow remote web servers to interfere with trust relationships by renegotiating a session.

net/socket/ssl_client_socket_nss.cc in the TLS implementation in Google Chrome before 31.0.1650.48 does not ensure that a server's X.509 certificate is the same during renegotiation as it was before renegotiation, which might allow remote web servers to interfere with trust relationships by renegotiating a session.

net/socket/ssl_client_socket_nss.cc in the TLS implementation in Google Chrome before 31.0.1650.48 does not ensure that a server's X.509 certificate is the same during renegotiation as it was before renegotiation, which might allow remote web servers to interfere with trust relationships by renegotiating a session.

Updated chromium-browser-stable packages fix security vulnerabilities:

Various fixes from internal audits, fuzzing and other initiatives (CVE-2013-2931).

Use after free related to speech input elements (CVE-2013-6621).

Use after free related to media elements (CVE-2013-6622).

Out of bounds read in SVG (CVE-2013-6623).

Use after free related to 'id' attribute strings (CVE-2013-6624).

Use after free in DOM ranges (CVE-2013-6625).

Address bar spoofing related to interstitial warnings (CVE-2013-6626).

Out of bounds read in HTTP parsing (CVE-2013-6627).

Issue with certificates not being checked during TLS renegotiation (CVE-2013-6628).

libjpeg 6b and libjpeg-turbo will use uninitialized memory when decoding images with missing SOS data for the luminance component (Y) in presence of valid chroma data (Cr, Cb) (CVE-2013-6629).

libjpeg-turbo will use uninitialized memory when handling Huffman tables (CVE-2013-6630).

Use after free in libjingle (CVE-2013-6631).

These are all security issues fixed in the chromedriver-55.0.2883.75-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ungoogled-chromium-113.0.5672.92-1.1 package on the GA media of openSUSE Tumbleweed.