CVE-2022-0108

Inappropriate implementation in Navigation in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

Inappropriate implementation in Navigation in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

CVE-2022-0096: Use after free in Storage. CVE-2022-0097: Inappropriate implementation in DevTools. CVE-2022-0098: Use after free in Screen Capture. CVE-2022-0099: Use after free in Sign-in. CVE-2022-0100: Heap buffer overflow in Media streams API. CVE-2022-0101: Heap buffer overflow in Bookmarks. CVE-2022-0102: Type Confusion in V8. CVE-2022-0103: Use after free in SwiftShader. CVE-2022-0104: Heap buffer overflow in ANGLE. CVE-2022-0105: Use after free in PDF. CVE-2022-0106: Use after free in Autofill. CVE-2022-0107: Use after free in File Manager API. CVE-2022-0108: Inappropriate implementation in Navigation. CVE-2022-0109: Inappropriate implementation in Autofill. CVE-2022-0110: Incorrect security UI in Autofill. CVE-2022-0111: Inappropriate implementation in Navigation. CVE-2022-0112: Incorrect security UI in Browser UI. CVE-2022-0113: Inappropriate implementation in Blink. CVE-2022-0114: Out of bounds memory access in Web Serial. CVE-2022-0115: Uninitialized Use in File API. CVE-2022-0116: Inappropriate implementation in Compositing. CVE-2022-0117: Policy bypass in Service Workers. CVE-2022-0118: Inappropriate implementation in WebShare. CVE-2022-0120: Inappropriate implementation in Passwords. CVE-2022-0289: Use after free in Safe browsing. CVE-2022-0290: Use after free in Site isolation. CVE-2022-0291: Inappropriate implementation in Storage. CVE-2022-0292: Inappropriate implementation in Fenced Frames. CVE-2022-0293: Use after free in Web packaging. CVE-2022-0294: Inappropriate implementation in Push messaging. CVE-2022-0295: Use after free in Omnibox. CVE-2022-0296: Use after free in Printing. CVE-2022-0297: Use after free in Vulkan. CVE-2022-0298: Use after free in Scheduling. CVE-2022-0300: Use after free in Text Input Method Editor. CVE-2022-0301: Heap buffer overflow in DevTools. CVE-2022-0302: Use after free in Omnibox. CVE-2022-0304: Use after free in Bookmarks. CVE-2022-0305: Inappropriate implementation in Service Worker API. CVE-2022-0306: Heap buffer overflow in PDFium. CVE-2022-0307: Use after free in Optimization Guide. CVE-2022-0308: Use after free in Data Transfer. CVE-2022-0309: Inappropriate implementation in Autofill. CVE-2022-0310: Heap buffer overflow in Task Manager. CVE-2022-0311: Heap buffer overflow in Task Manager. CVE-2022-0337: Inappropriate implementation in File System API.

HTML document may be able to render iframes with sensitive user information (CVE-2022-0108) maliciously crafted web content may lead to arbitrary code execution. (CVE-2022-32885) use-after-free vulnerability exists in WebCore::RenderLayer. This issue allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. (CVE-2023-25358) maliciously crafted web content may bypass Same Origin Policy (CVE-2023-27932) Website may be able to track sensitive user information. Description: The issue was addressed by removing origin information. (CVE-2023-27954) maliciously crafted web content may lead to arbitrary code execution (CVE-2023-28205)

This update for chromium fixes the following issues:

Chromium 97.0.4692.71 (boo#1194331):

• CVE-2022-0096: Use after free in Storage
• CVE-2022-0097: Inappropriate implementation in DevTools
• CVE-2022-0098: Use after free in Screen Capture
• CVE-2022-0099: Use after free in Sign-in
• CVE-2022-0100: Heap buffer overflow in Media streams API
• CVE-2022-0101: Heap buffer overflow in Bookmarks
• CVE-2022-0102: Type Confusion in V8
• CVE-2022-0103: Use after free in SwiftShader
• CVE-2022-0104: Heap buffer overflow in ANGLE
• CVE-2022-0105: Use after free in PDF
• CVE-2022-0106: Use after free in Autofill
• CVE-2022-0107: Use after free in File Manager API
• CVE-2022-0108: Inappropriate implementation in Navigation
• CVE-2022-0109: Inappropriate implementation in Autofill
• CVE-2022-0110: Incorrect security UI in Autofill
• CVE-2022-0111: Inappropriate implementation in Navigation
• CVE-2022-0112: Incorrect security UI in Browser UI
• CVE-2022-0113: Inappropriate implementation in Blink
• CVE-2022-0114: Out of bounds memory access in Web Serial
• CVE-2022-0115: Uninitialized Use in File API
• CVE-2022-0116: Inappropriate implementation in Compositing
• CVE-2022-0117: Policy bypass in Service Workers
• CVE-2022-0118: Inappropriate implementation in WebShare
• CVE-2022-0120: Inappropriate implementation in Passwords

• Revert wayland fixes because it doesn't handle GPU correctly (boo#1194182)

This update for opera fixes the following issues:

Update to 83.0.4254.27

• CHR-8737 Update chromium on desktop-stable-97-4254 to 97.0.4692.99

• DNA-96336 [Mac] Translate new network installer slogan

• DNA-96678 Add battery level monitoring capability to powerSavePrivate

• DNA-96939 Crash at opera::ExternalVideoService::MarkAsManuallyClosed()

• DNA-97276 Enable #static-tab-audio-indicator on all streams

• The update to chromium 97.0.4692.99 fixes following issues: CVE-2022-0289, CVE-2022-0290, CVE-2022-0291, CVE-2022-0292, CVE-2022-0293, CVE-2022-0294, CVE-2022-0295, CVE-2022-0296, CVE-2022-0297, CVE-2022-0298, CVE-2022-0300, CVE-2022-0301, CVE-2022-0302, CVE-2022-0304, CVE-2022-0305, CVE-2022-0306, CVE-2022-0307, CVE-2022-0308, CVE-2022-0309, CVE-2022-0310, CVE-2022-0311

Update to 83.0.4254.19

• DNA-96079 Turn on #automatic-video-popout on developer

• DNA-97070 Opera 83 translations

• DNA-97119 [LastCard] Stop showing used burner cards

• DNA-97131 Enable automatic-video-popout on all streams from O84 on

• DNA-97257 Crash at views::ImageButton::SetMinimumImageSize(gfx::Size const&)

• DNA-97259 Promote O83 to stable

• Complete Opera 83.0 changelog at: https://blogs.opera.com/desktop/changelog-for-83/

• Update to 83.0.4254.16

  • DNA-96968 Fix alignment of the 'Advanced' button in Settings

• Update to 83.0.4254.14

  • CHR-8701 Update chromium on desktop-stable-97-4254 to 97.0.4692.45
  • CHR-8713 Update chromium on desktop-stable-97-4254 to 97.0.4692.56
  • CHR-8723 Update chromium on desktop-stable-97-4254 to 97.0.4692.71
  • DNA-96780 Crash at ui::NativeTheme::RemoveObserver(ui::NativeThemeObserver*)
  • DNA-96822 Tab close resize behavior change
  • DNA-96861 Create Loomi Options menu
  • DNA-96904 Support Win11 snap layout popup
  • DNA-96951 Tab close animation broken
  • DNA-96991 Tab X button doesn’t work correctly
  • DNA-97027 Incorrect tab size after tab close

• The update to chromium 97.0.4692.71 fixes following issues: CVE-2022-0096, CVE-2022-0097, CVE-2022-0098, CVE-2022-0099, CVE-2022-0100, CVE-2022-0101, CVE-2022-0102, CVE-2022-0103, CVE-2022-0104, CVE-2022-0105, CVE-2022-0105, CVE-2022-0106, CVE-2022-0107, CVE-2022-0108, CVE-2022-0109, CVE-2022-0110, CVE-2022-0111, CVE-2022-0111, CVE-2022-0112, CVE-2022-0113, CVE-2022-0114, CVE-2022-0115, CVE-2022-0116, CVE-2022-0117, CVE-2022-0118, CVE-2022-0120

• Update to version 82.0.4227.58

  • DNA-96780 Crash at ui::NativeTheme::RemoveObserver(ui::NativeThemeObserver*)
  • DNA-96890 Settings default browser not working for current user on Windows 7

• Update to version 82.0.4227.43

  • CHR-8705 Update chromium on desktop-stable-96-4227 to 96.0.4664.110
  • DNA-93284 Unstable obj/opera/desktop/common/installer_rc_generated/installer.res
  • DNA-95908 Interstitial/internal pages shown as NOT SECURE after visiting http site
  • DNA-96404 Opera doesn’t show on main screen when second screen is abruptly disconnected

• The update to chromium 96.0.4664.110 fixes following issues: CVE-2021-4098, CVE-2021-4099, CVE-2021-4100, CVE-2021-4101, CVE-2021-4102

• Update to version 82.0.4227.33

  • CHR-8689 Update chromium on desktop-stable-96-4227 to 96.0.4664.93
  • DNA-96559 Tooltip popup looks bad in dark theme
  • DNA-96570 [Player] Tidal logging in via PLAY doesn’t work
  • DNA-96594 Unnecessary extra space in fullscreen mode on M1 Pro MacBooks
  • DNA-96649 Update Meme button
  • DNA-96676 Add Icon in the Sidebar Setup
  • DNA-96677 Add default URL

• The update to chromium 96.0.4664.93 fixes following issues: CVE-2021-4052, CVE-2021-4053, CVE-2021-4079, CVE-2021-4054, CVE-2021-4078, CVE-2021-4055, CVE-2021-4056, CVE-2021-4057, CVE-2021-4058, CVE-2021-4059, CVE-2021-4061, CVE-2021-4062, CVE-2021-4063, CVE-2021-4064, CVE-2021-4065, CVE-2021-4066, CVE-2021-4067, CVE-2021-4068

• Update to version 82.0.4227.23

  • DNA-95632 With new…

This update for opera fixes the following issues:

Update to 85.0.4341.28

• CHR-8816 Update chromium on desktop-stable-99-4341 to 99.0.4844.84

• DNA-98092 Crash at views::MenuItemView::GetMenuController()

• DNA-98278 Translations for O85

• DNA-98320 [Mac] Unable to delete recent search entries

• DNA-98614 Show recent searches for non-BABE users

• DNA-98615 Allow removal of recent searches

• DNA-98616 Add recent searches to ‘old’ BABE

• DNA-98617 Make it possible to disable ad-blocker per-country

• DNA-98651 Remove Instagram and Facebook Messenger in Russia

• DNA-98653 Add flag #recent-searches

• DNA-98696 smoketest PageInfoHistoryDataSourceTest.FormatTimestampString failing

• DNA-98703 Port Chromium issue 1309225 to Opera Stable

• The update to chromium 99.0.4844.84 fixes following issues:
  CVE-2022-1096

• Changes in 85.0.4341.18

  • CHR-8789 Update chromium on desktop-stable-99-4341 to 99.0.4844.51
  • DNA-98059 [Linux] Crash at opera::FreedomSettingsImpl::IsBypassForDotlessDomainsEnabled
  • DNA-98349 [Linux] Crash at bluez::BluezDBusManager::Get()
  • DNA-98126 System crash dialog shown on macOS <= 10.15
  • DNA-98331 [Snap] Meme generator cropping / resizing broken
  • DNA-98394 Audio tab indicator set to 'muted' on videoconferencing sites
  • DNA-98481 Report errors in opauto_collector

• The update to chromium 99.0.4844.51 fixes following issues: CVE-2022-0789, CVE-2022-0790, CVE-2022-0791, CVE-2022-0792, CVE-2022-0793, CVE-2022-0794, CVE-2022-0795, CVE-2022-0796, CVE-2022-0797, CVE-2022-0798, CVE-2022-0799, CVE-2022-0800, CVE-2022-0801, CVE-2022-0802, CVE-2022-0803, CVE-2022-0804, CVE-2022-0805, CVE-2022-0806, CVE-2022-0807, CVE-2022-0808, CVE-2022-0809

• Changes in 85.0.4341.13

  • DNA-94119 Upgrade curl to 7.81.0
  • DNA-97849 [Mac monterey] System shortcut interfere with Opera’s ToggleSearchInOpenTabs shortcut
  • DNA-98204 Automatic popout happens when video is paused
  • DNA-98231 Shortcuts are blocked by displayed tab tooltip when triggered quickly after tooltip appears
  • DNA-98321 Add thinlto-cache warnings to suppression list
  • DNA-98395 Promote O85 to stable

• Complete Opera 85.0 changelog at: https://blogs.opera.com/desktop/changelog-for-85/

• Update to 84.0.4316.42

  • DNA-94119 Upgrade curl to 7.81.0
  • DNA-98092 Crash at views::MenuItemView::GetMenuController()
  • DNA-98204 Automatic popout happens when video is paused
  • DNA-98231 Shortcuts are blocked by displayed tab tooltip when triggered quickly after tooltip appears

• Update to 84.0.4316.31

  • CHR-8772 Update chromium on desktop-stable-98-4316 to 98.0.4758.109
  • DNA-97573 [Win][Lin]”Close tab” button is not displayed on tabs playing media when many tabs are open
  • DNA-97729 cancelling the process uploading custom Wallpaper crashes the browser
  • DNA-97871 Google meet tab’s icons don’t fit on pinned tab
  • DNA-97872 Tab is being unpinned when video conferencing button is clicked
  • DNA-98039 Dark theme top sites have black background
  • DNA-98117 Clicking current tab information should hide tooltip

• Update to 84.0.4316.21

  • CHR-8762 Update chromium on desktop-stable-98-4316 to 98.0.4758.102
  • DNA-97333 ‘Add a site’ label on start page tile barely visible
  • DNA-97691 Opera 84 translations
  • DNA-97767 Wrong string in FR
  • DNA-97855 Crash at ScopedProfileKeepAlive::~ScopedProfileKeepAlive()
  • DNA-97982 Enable #snap-upstream-implementation on all streams

• The update to chromium 98.0.4758.102 fixes following issues: CVE-2022-0603, CVE-2022-0604, CVE-2022-0605, CVE-2022-0606, CVE-2022-0607, CVE-2022-0608, CVE-2022-0609, CVE-2022-0610

• Update to 84.0.4316.14

  • CHR-8753 Update chromium on desktop-stable-98-4316 to 98.0.4758.82
  • DNA-97177 Battery saver – the icon looks bad for DPI!=100%
  • DNA-97614 automatic video pop-out for most popular websites broadcasting Winter Olympic Games…

These are all security issues fixed in the chromedriver-97.0.4692.71-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libQt5Pdf5-5.15.9-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ungoogled-chromium-113.0.5672.92-1.1 package on the GA media of openSUSE Tumbleweed.

This update for webkit2gtk3 fixes the following issues:

Update to version 2.38.6 (bsc#1210731):

• CVE-2022-0108: Fixed information leak.
• CVE-2022-32885: Fixed arbitrary code execution.
• CVE-2023-25358: Fixed use-after-free vulnerability in WebCore::RenderLayer.
• CVE-2023-27932: Fixed Same Origin Policy bypass.
• CVE-2023-27954: Fixed sensitive user information tracking.
• CVE-2023-28205: Fixed arbitrary code execution (bsc#1210295).

Already fixed in version 2.38.5:

• CVE-2022-32886, CVE-2022-32912, CVE-2023-25360, CVE-2023-25361, CVE-2023-25362, CVE-2023-25363.

This update for webkit2gtk3 fixes the following issues:

Update to version 2.38.6 (bsc#1210731):

• CVE-2022-0108: Fixed information leak.
• CVE-2022-32885: Fixed arbitrary code execution.
• CVE-2023-25358: Fixed use-after-free vulnerability in WebCore::RenderLayer.
• CVE-2023-27932: Fixed Same Origin Policy bypass.
• CVE-2023-27954: Fixed sensitive user information tracking.
• CVE-2023-28205: Fixed arbitrary code execution (bsc#1210295).

Already fixed in version 2.38.5:

• CVE-2022-32886, CVE-2022-32912, CVE-2023-25360, CVE-2023-25361, CVE-2023-25362, CVE-2023-25363.

This update for webkit2gtk3 fixes the following issues: Update to version 2.38.6 (bsc#1210731):

• CVE-2022-0108: Fixed information leak.
• CVE-2022-32885: Fixed arbitrary code execution.
• CVE-2023-25358: Fixed use-after-free vulnerability in WebCore::RenderLayer.
• CVE-2023-27932: Fixed Same Origin Policy bypass.
• CVE-2023-27954: Fixed sensitive user information tracking.
• CVE-2023-28205: Fixed arbitrary code execution (bsc#1210295).

Already fixed in version 2.38.5:

• CVE-2022-32886, CVE-2022-32912, CVE-2023-25360, CVE-2023-25361, CVE-2023-25362, CVE-2023-25363.

This update for webkit2gtk3 fixes the following issues:

Update to version 2.38.6 (bsc#1210731):

• CVE-2022-0108: Fixed information leak.
• CVE-2022-32885: Fixed arbitrary code execution.
• CVE-2023-25358: Fixed use-after-free vulnerability in WebCore::RenderLayer.
• CVE-2023-27932: Fixed Same Origin Policy bypass.
• CVE-2023-27954: Fixed sensitive user information tracking.
• CVE-2023-28205: Fixed arbitrary code execution (bsc#1210295).

Already fixed in version 2.38.5:

• CVE-2022-32886, CVE-2022-32912, CVE-2023-25360, CVE-2023-25361, CVE-2023-25362, CVE-2023-25363.

Several security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution.