CVE-2024-1283

Heap buffer overflow in Skia in Google Chrome prior to 121.0.6167.160 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

This update for opera fixes the following issues:

• Update to 107.0.5045.21

  • CHR-9604 Update Chromium on desktop-stable-121-5045 to 121.0.6167.160
  • DNA-114167 Crash at TopLevelStorageAccessPermissionContext:: DecidePermission(permissions::PermissionRequestData, base:: OnceCallback)
  • DNA-114303 Crash at auto std::__Cr::remove_if(auto, auto, base::ObserverList::Compact()::”lambda”(auto const&))
  • DNA-114478 Start Page opening animation refresh
  • DNA-114553 Change search box animation
  • DNA-114723 [Search box] No option to highlight typed text
  • DNA-114806 [Tab cycler] Domain address should be bolded
  • DNA-114846 Translations for O107
  • DNA-114924 Crash at opera::SuggestionModelBase:: NavigateTo(WindowOpenDisposition)

• The update to chromium 121.0.6167.160 fixes following issues: CVE-2024-1283, CVE-2024-1284

• Update to 107.0.5045.15

  • CHR-9593 Update Chromium on desktop-stable-121-5045 to 121.0.6167.140
  • DNA-114421 Animate text in tab cycler from the center of the screen
  • DNA-114519 Crash at media::AVStreamToVideoDecoderConfig (AVStream const*, media::VideoDecoderConfig*)
  • DNA-114537 Default value for synchronization changed from 'Do not sync data' to 'Customise sync'
  • DNA-114554 Add shadow to tab thumbnails in tab cycler
  • DNA-114555 Fade out long tab titles
  • DNA-114686 [Import] Import from Opera Crypto is marked as done even when Crypto is not installed
  • DNA-114691 Update font colors
  • DNA-114692 Update shadow (glow) of tabs
  • DNA-114693 Update position of text and tabs when cycling through tabs
  • DNA-114790 [Linux] Unwanted 1px top border in full screen mode

• Complete Opera 107 changelog at: https://blogs.opera.com/desktop/changelog-for-107/

• The update to chromium 121.0.6167.140 fixes following issues: CVE-2024-1059, CVE-2024-1060, CVE-2024-1077

• Update to 106.0.4998.70

  • DNA-112467 Shadow on Opera popups
  • DNA-114414 The 'Move to' workspace submenu from tab strip stays blue when its submenu item is selected

• Update to 106.0.4998.66

  • CHR-9416 Updating Chromium on desktop-stable-* branches
  • DNA-114489 Release and update opera:intro extension version in Opera

These are all security issues fixed in the nodejs-electron-27.3.3-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the chromedriver-121.0.6167.184-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ungoogled-chromium-122.0.6261.111-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libQt5Pdf5-5.15.17-1.1 package on the GA media of openSUSE Tumbleweed.

This update for webkit2gtk3 fixes the following issues:

WebKitGTK and WPE WebKit Security Advisory WSA-2026-0006 (bsc#1284619):

• CVE-2024-1283: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2024-43091: Out of bounds write due to an integer overflow in filterMask of SkEmbossMaskFilter.cpp could lead to remote code execution.
• CVE-2024-43097: Out of bounds write due to an integer overflow in resizeToAtLeast of SkRegion.cpp could lead to local escalation of privilege.
• CVE-2024-43767: Heap overflow due to improper input validation in prepare_to_draw_into_mask of SkBlurMaskFilterImpl.cpp could lead to remote code execution.
• CVE-2024-43768: Out of bounds write due to an integer overflow in skia_alloc_func of SkDeflate.cpp could lead to local escalation of privilege.
• CVE-2024-7966: Out of bounds memory access in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to perform out of bounds memory access via a crafted HTML page.
• CVE-2024-8193: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
• CVE-2024-8198: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
• CVE-2024-8636: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2024-9123: Integer overflow in Skia in Google Chrome allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.
• CVE-2025-0436: Integer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2025-0444: Use after free in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2025-10502: Heap buffer overflow in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via malicious network traffic.
• CVE-2025-26416: Out of bounds write due to a heap buffer overflow in initializeSwizzler of SkBmpStandardCodec.cpp could lead to remote escalation of privilege.
• CVE-2025-32318: Out of bounds write due to a heap buffer overflow in Skia could lead to remote escalation of privilege.
• CVE-2025-48622: Out of bounds read due to a buffer overflow in ProcessArea of dng_misc_opcodes.cpp could lead to local information disclosure.
• CVE-2025-54627: An out-of-bounds write vulnerability in the skia module may affect service confidentiality upon successful exploitation.
• CVE-2025-8901: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.
• CVE-2025-9478: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2026-0908: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2026-10009: Integer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page.
• CVE-2026-10011: Inappropriate implementation in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.
• CVE-2026-10012: Use after free in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-10018: Integer overflow in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. -…

This update for webkit2gtk3 fixes the following issues:

WebKitGTK and WPE WebKit Security Advisory WSA-2026-0006 (bsc#1284619):

• CVE-2024-1283: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2024-43091: Out of bounds write due to an integer overflow in filterMask of SkEmbossMaskFilter.cpp could lead to remote code execution.
• CVE-2024-43097: Out of bounds write due to an integer overflow in resizeToAtLeast of SkRegion.cpp could lead to local escalation of privilege.
• CVE-2024-43767: Heap overflow due to improper input validation in prepare_to_draw_into_mask of SkBlurMaskFilterImpl.cpp could lead to remote code execution.
• CVE-2024-43768: Out of bounds write due to an integer overflow in skia_alloc_func of SkDeflate.cpp could lead to local escalation of privilege.
• CVE-2024-7966: Out of bounds memory access in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to perform out of bounds memory access via a crafted HTML page.
• CVE-2024-8193: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
• CVE-2024-8198: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
• CVE-2024-8636: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2024-9123: Integer overflow in Skia in Google Chrome allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.
• CVE-2025-0436: Integer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2025-0444: Use after free in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2025-10502: Heap buffer overflow in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via malicious network traffic.
• CVE-2025-26416: Out of bounds write due to a heap buffer overflow in initializeSwizzler of SkBmpStandardCodec.cpp could lead to remote escalation of privilege.
• CVE-2025-32318: Out of bounds write due to a heap buffer overflow in Skia could lead to remote escalation of privilege.
• CVE-2025-48622: Out of bounds read due to a buffer overflow in ProcessArea of dng_misc_opcodes.cpp could lead to local information disclosure.
• CVE-2025-54627: An out-of-bounds write vulnerability in the skia module may affect service confidentiality upon successful exploitation.
• CVE-2025-8901: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.
• CVE-2025-9478: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2026-0908: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2026-10009: Integer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page.
• CVE-2026-10011: Inappropriate implementation in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.
• CVE-2026-10012: Use after free in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-10018: Integer overflow in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. -…

This update for webkit2gtk3 fixes the following issues:

WebKitGTK and WPE WebKit Security Advisory WSA-2026-0006 (bsc#1284619):

• CVE-2024-1283: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2024-43091: Out of bounds write due to an integer overflow in filterMask of SkEmbossMaskFilter.cpp could lead to remote code execution.
• CVE-2024-43097: Out of bounds write due to an integer overflow in resizeToAtLeast of SkRegion.cpp could lead to local escalation of privilege.
• CVE-2024-43767: Heap overflow due to improper input validation in prepare_to_draw_into_mask of SkBlurMaskFilterImpl.cpp could lead to remote code execution.
• CVE-2024-43768: Out of bounds write due to an integer overflow in skia_alloc_func of SkDeflate.cpp could lead to local escalation of privilege.
• CVE-2024-7966: Out of bounds memory access in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to perform out of bounds memory access via a crafted HTML page.
• CVE-2024-8193: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
• CVE-2024-8198: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
• CVE-2024-8636: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2024-9123: Integer overflow in Skia in Google Chrome allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.
• CVE-2025-0436: Integer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2025-0444: Use after free in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2025-10502: Heap buffer overflow in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via malicious network traffic.
• CVE-2025-26416: Out of bounds write due to a heap buffer overflow in initializeSwizzler of SkBmpStandardCodec.cpp could lead to remote escalation of privilege.
• CVE-2025-32318: Out of bounds write due to a heap buffer overflow in Skia could lead to remote escalation of privilege.
• CVE-2025-48622: Out of bounds read due to a buffer overflow in ProcessArea of dng_misc_opcodes.cpp could lead to local information disclosure.
• CVE-2025-54627: An out-of-bounds write vulnerability in the skia module may affect service confidentiality upon successful exploitation.
• CVE-2025-8901: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.
• CVE-2025-9478: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2026-0908: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2026-10009: Integer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page.
• CVE-2026-10011: Inappropriate implementation in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.
• CVE-2026-10012: Use after free in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-10018: Integer overflow in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. -…

This update for webkit2gtk3 fixes the following issues:

Security issues fixed:

WebKitGTK and WPE WebKit Security Advisory WSA-2026-0006 (bsc#1284619):

• CVE-2024-1283: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2024-43091: Out of bounds write due to an integer overflow in filterMask of SkEmbossMaskFilter.cpp could lead to remote code execution.
• CVE-2024-43097: Out of bounds write due to an integer overflow in resizeToAtLeast of SkRegion.cpp could lead to local escalation of privilege.
• CVE-2024-43767: Heap overflow due to improper input validation in prepare_to_draw_into_mask of SkBlurMaskFilterImpl.cpp could lead to remote code execution.
• CVE-2024-43768: Out of bounds write due to an integer overflow in skia_alloc_func of SkDeflate.cpp could lead to local escalation of privilege.
• CVE-2024-7966: Out of bounds memory access in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to perform out of bounds memory access via a crafted HTML page.
• CVE-2024-8193: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
• CVE-2024-8198: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
• CVE-2024-8636: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
• CVE-2024-9123: Integer overflow in Skia in Google Chrome allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.
• CVE-2025-0436: Integer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2025-0444: Use after free in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2025-10502: Heap buffer overflow in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via malicious network traffic.
• CVE-2025-26416: Out of bounds write due to a heap buffer overflow in initializeSwizzler of SkBmpStandardCodec.cpp could lead to remote escalation of privilege.
• CVE-2025-32318: Out of bounds write due to a heap buffer overflow in Skia could lead to remote escalation of privilege.
• CVE-2025-48622: Out of bounds read due to a buffer overflow in ProcessArea of dng_misc_opcodes.cpp could lead to local information disclosure.
• CVE-2025-54627: An out-of-bounds write vulnerability in the skia module may affect service confidentiality upon successful exploitation.
• CVE-2025-8901: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.
• CVE-2025-9478: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2026-0908: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2026-10009: Integer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page.
• CVE-2026-10011: Inappropriate implementation in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.
• CVE-2026-10012: Use after free in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-10018: Integer overflow in ANGLE in Google Chrome allowed a…