CVE-2022-1305

Use after free in storage in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Use after free in storage in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

The chromium-browser-stable package has been updated to the 100.0.4896.127 version, fixing many CVE, along with fixes from the 100.0.4896.75 and 100.0.4896.88 versions.

Google is aware that an exploit for CVE-2022-1364 exists in the wild.

[1315901] High CVE-2022-1364: Type Confusion in V8. Reported by Clément Lecigne of Google's Threat Analysis Group on 2022-04-13 [1311641] High CVE-2022-1232: Type Confusion in V8. Reported by Sergei Glazunov of Google Project Zero on 2022-03-30 [1285234] High CVE-2022-1305: Use after free in storage. Reported by Anonymous on 2022-01-07 [1299287] High CVE-2022-1306: Inappropriate implementation in compositing. Reported by Sven Dysthe on 2022-02-21 [1301873] High CVE-2022-1307: Inappropriate implementation in full screen. Reported by Irvan Kurniawan (sourc7) on 2022-03-01 [1283050] High CVE-2022-1308: Use after free in BFCache. Reported by Samet Bekmezci @sametbekmezci on 2021-12-28 [1106456] High CVE-2022-1309: Insufficient policy enforcement in developer tools. Reported by David Erceg on 2020-07-17 [1307610] High CVE-2022-1310: Use after free in regular expressions. Reported by Brendon Tiszka on 2022-03-18 [1310717] High CVE-2022-1311: Use after free in Chrome OS shell. Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Alpha Lab on 2022-03-28 [1311701] High CVE-2022-1312: Use after free in storage. Reported by Leecraso and Guang Gong of 360 Vulnerability Research Institute on 2022-03-30 [1270539] Medium CVE-2022-1313: Use after free in tab groups. Reported by Thomas Orlita on 2021-11-16 [1304658] Medium CVE-2022-1314: Type Confusion in V8. Reported by Bohan Liu (@P4nda20371774) of Tencent Security Xuanwu Lab on 2022-03-09 [1315276] Various fixes from internal audits, fuzzing and other initiatives [1316420] Various fixes from internal audits, fuzzing and other initiatives

This update for libqt5-qtwebengine fixes the following issues:

Update to version 5.15.10:

• Fix top level build with no widget

• Fix read-after-free on EGL extensions

• Update Chromium

• Add workaround for unstable gn on macOS in ci

• Pass archiver to gn build

• Fix navigation to non-local URLs

• Add support for universal builds for qtwebengine and qtpdf

• Enable Apple Silicon support

• Fix cross compilation x86_64->arm64 on mac

• Bump version to 5.15.10

• CustomDialogs: Make custom input fields readable in dark mode

• CookieBrowser: Make alternating rows readable in dark mode

• Update Chromium:

  • Bump V8_PATCH_LEVEL
  • Fix clang set-but-unused-variable warning
  • Fix mac toolchain python linker script call
  • Fix missing dependency for gpu sources
  • Fix python calls
  • Fix undefined symbol for universal link
  • Quick fix for regression in service workers by reverting backports
  • [Backport] CVE-2022-0797: Out of bounds memory access in Mojo
  • [Backport] CVE-2022-1125
  • [Backport] CVE-2022-1138: Inappropriate implementation in Web Cursor.
  • [Backport] CVE-2022-1305: Use after free in storage
  • [Backport] CVE-2022-1310: Use after free in regular expressions
  • [Backport] CVE-2022-1314: Type Confusion in V8
  • [Backport] CVE-2022-1493: Use after free in Dev Tools
  • [Backport] On arm64 hosts, set host_cpu to 'arm64', not 'arm'
  • [Backport] Security Bug 1296876
  • [Backport] Security bug 1269999
  • [Backport] Security bug 1280852
  • [Backport] Security bug 1292905
  • [Backport] Security bug 1304659
  • [Backport] Security bug 1306507

These are all security issues fixed in the chromedriver-100.0.4896.88-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libQt5Pdf5-5.15.10-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ungoogled-chromium-113.0.5672.92-1.1 package on the GA media of openSUSE Tumbleweed.