CVE-2023-0474

Use after free in GuestView in Google Chrome prior to 109.0.5414.119 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a Chrome web app. (Chromium security severity: Medium)

The chromium-browser-stable package has been updated to the 109.0.5414.119 release, fixing 6 vulnerabilities.

Some of the security fixes are: High CVE-2023-0471: Use after free in WebTransport. Reported by chichoo Kim(chichoo) and Cassidy Kim(@cassidy6564) on 2022-10-19 High CVE-2023-0472: Use after free in WebRTC. Reported by Cassidy Kim(@cassidy6564) on 2023-01-06 Medium CVE-2023-0473: Type Confusion in ServiceWorker API. Reported by raven at KunLun lab on 2023-01-03 Medium CVE-2023-0474: Use after free in GuestView. Reported by avaue at S.S.L on 2022-12-14

This update for chromium fixes the following issues:

Chromium 109.0.5414.119 (boo#1207512):

• CVE-2023-0471: Use after free in WebTransport
• CVE-2023-0472: Use after free in WebRTC
• CVE-2023-0473: Type Confusion in ServiceWorker API
• CVE-2023-0474: Use after free in GuestView
• Various fixes from internal audits, fuzzing and other initiatives

This update for opera fixes the following issues:

Update to 95.0.4635.25

• CHR-9173 Update Chromium on desktop-stable-109-4635 to 109.0.5414.120
• DNA-104150 Turn on #consent-flow-settings on master
• DNA-104733 Crash at extensions::SyncPrivateGetSyncStateFunction::Run()
• DNA-104761 Translations for O95
• DNA-104814 [StartPage] Inline autocomplete messes up selection
• DNA-104887 Promote O95 to stable
• DNA-104908 Enable #consent-flow-settings on all streams

• Complete Opera 95.0 changelog at: https://blogs.opera.com/desktop/changelog-for-95/

• The update to chromium 109.0.5414.120 fixes following issues:
  CVE-2023-0471, CVE-2023-0472, CVE-2023-0473, CVE-2023-0474

• Update to 94.0.4606.76

  • DNA-104276 News categories layers messed up in other languages

• Update to 94.0.4606.65

  • DNA-102726 [SD][Folder] When trying to drop SD from folder back to folder, new folder is created
  • DNA-102730 [SD][Add to Opera] Remove strip at the top of modal and move 'x' button to be in line with ‘Add to Opera' text
  • DNA-102732 [SD][Folders] Add option to merge folders by drag and drop
  • DNA-102747 [SD][Folders] Empty SD folder is not visible
  • DNA-102763 [SD] Animate changing between Use bigger tiles on and off
  • DNA-102847 [SD][Folders] SD displayed on folder tile should be aligned to left
  • DNA-102855 [SD] Add SD by drag and dropping link
  • DNA-102882 [SD][News][Continue on][Suggestion] Do not focus on opened page when opening in new tab
  • DNA-102936 [News Categories] Categories become invisible after minimizing browser window
  • DNA-102988 [News categories] Only games category displayed after changing browser language
  • DNA-103000 [News Categories] Selected categories not saved after restarting browser
  • DNA-103001 [News Categories] 'x' button invisible in 'Choose language and country' on light theme
  • DNA-103002 [News Categories] Changes in 'Choose language and country' modal not saved on esc or clicking outside of modal
  • DNA-103015 [News locales] Pref startpage.news_locales udated only when close/done the moda, initial value not set
  • DNA-103097 [Settings] Enable 'Adjust Speed Dial animations for slower hardware' settings option to have effect
  • DNA-103098 [SD] No big icon for decathlon.pl
  • DNA-103110 Strange animation when dragging tiles
  • DNA-103112 [Continue on] Offers opened on current tab
  • DNA-103116 [Continue on] Not possible to drag tiles from continue on section
  • DNA-103131 [Feedback] Implement 'Rate Opera' element and modal
  • DNA-103193 [SD][Edit] Set OK button to read only when typed in address is invalid
  • DNA-103293 [SD][Add to Opera] '/' added in autocomplete for URL
  • DNA-103360 [SD][Add to Opera] Tile graphic does not update automatically when adding suggestion through Add to Opera modal
  • DNA-103393 [Continue on] Start page needs to be reloaded in order to show 'Continue on' section
  • DNA-103545 [Banner] Wide banner have no background
  • DNA-103550 [Banners] Black Friday deals promoted on Start Page with related settings off
  • DNA-103569 No margin under suggested speed dials
  • DNA-103578 [SD] Impressions should be reported every time user comes back to start page tab
  • DNA-103593 [Navigation] Change which elements on start page are possible to navigate through with keyboard shortcuts
  • DNA-103595 [Navigation] Show which element is focused when navigating with keyboard shortcuts
  • DNA-103605 Dark stripe blinks in Speed Dial Search box when changing color mode
  • DNA-103618 [SD][Folder] Not possible to drag SD into empty folder
  • DNA-103619 [SD][Suggestions] Blue border on tile when it is being dragged
  • DNA-103678 Font modification from themes not applied
  • DNA-103723 [SD][Folders][Edit] Confirm change to SD folder name with Enter key
  • DNA-103738 Disable Updater diagnostic metrics that surpass session…

This update for opera fixes the following issues:

• Update to 99.0.4788.13

  • CHR-9290 Update Chromium on desktop-stable-113-4788 to 113.0.5672.127
  • DNA-107317 __delayLoadHelper2 crash in crashreporter

• The update to chromium 113.0.5672.127 fixes following issues: CVE-2023-2721, CVE-2023-2722, CVE-2023-2723, CVE-2023-2724, CVE-2023-2725, CVE-2023-2726

• Update to 99.0.4788.9

  • CHR-9283 Update Chromium on desktop-stable-113-4788 to 113.0.5672.93
  • DNA-107638 Translations for O99
  • DNA-107678 Crash Report [@ BrowserContextKeyedServiceFactory:: BrowserContextKeyedServiceFactory(char const*, BrowserContextDependencyManager*) ]
  • DNA-107795 Fix wrong german translation of 'Close All Duplicate Tabs'
  • DNA-107800 Fonts on section#folder and AddSitePanel not readable when animated wallpaper chosen
  • DNA-107840 Promote O99 to stable

• Update to 98.0.4759.39

  • DNA-102363 ChromeFileSystemAccessPermissionContextTest. ConfirmSensitiveEntryAccess_DangerousFile fails
  • DNA-105534 [Add to Opera] Incorrect scroll on modal when browser window size is too small
  • DNA-106649 Opening new tab when pinned tab is active gives 2 active tabs
  • DNA-107226 Speed Dial freezes and empty space remains after Continue booking tile dragging
  • DNA-107435 Building archive_source_release target fails
  • DNA-107441 [Start page] Right mouse click on tile in continue on section opens target site in current tab
  • DNA-107508 Crash at permissions::PermissionRecoverySuccessRate Tracker::TrackUsage(ContentSettingsType)
  • DNA-107528 Handle real-time SD impression reporting
  • DNA-107546 Context menus broken with one workspace
  • DNA-107548 Paste from Context Menu doesn’t work for Search on StartPage
  • DNA-107560 Optimize real-time SD impression reporting

These are all security issues fixed in the chromedriver-109.0.5414.119-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ungoogled-chromium-113.0.5672.92-1.1 package on the GA media of openSUSE Tumbleweed.

It was discovered that Chromium did not properly manage memory. A remote attacker could possibly use these issues to cause a denial of service or execute arbitrary code via a crafted HTML page. (CVE-2023-0471, CVE-2023-0472, CVE-2023-0473, CVE-2023-0696, CVE-2023-0698, CVE-2023-0699, CVE-2023-0702, CVE-2023-0705)

It was discovered that Chromium did not properly manage memory. A remote attacker who convinced a user to install a malicious extension could possibly use this issue to corrupt memory via a Chrome web app. (CVE-2023-0474)

It was discovered that Chromium contained an inappropriate implementation in the Download component. A remote attacker could possibly use this issue to spoof contents of the Omnibox (URL bar) via a crafted HTML page. (CVE-2023-0700)

It was discovered that Chromium did not properly manage memory. A remote attacker who convinced a user to engage in specific UI interactions could possibly use these issues to cause a denial of service or execute arbitrary code. (CVE-2023-0701, CVE-2023-0703)

It was discovered that Chromium insufficiently enforced policies. A remote attacker could possibly use this issue to bypass same origin policy and proxy settings via a crafted HTML page. (CVE-2023-0704)