GLSA 201610-09: Chromium: Multiple vulnerabilities

Severity:	normal
Title:	Chromium: Multiple vulnerabilities
Date:	10/29/2016
Bugs:	#589278, #590420, #592630, #593708, #595614, #597016
ID:	201610-09

Synopsis

Multiple vulnerabilities have been found in the Chromium web browser, the worst of which allows remote attackers to execute arbitrary code.

Background

Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web.

Affected packages

Package	Vulnerable	Unaffected	Architecture(s)
www-client/chromium	< 54.0.2840.59	>= 54.0.2840.59	All supported architectures

Description

Multiple vulnerabilities have been discovered in the Chromium web browser. Please review the CVE identifiers referenced below for details.

Impact

A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, obtain sensitive information, or bypass security restrictions.

Workaround

There is no known workaround at this time.

Resolution

All Chromium users should upgrade to the latest version:

      # emerge --sync
      # emerge --ask --oneshot --verbose
      ">=www-client/chromium-54.0.2840.59"
    

References

• CVE-2016-5127
• CVE-2016-5128
• CVE-2016-5129
• CVE-2016-5130
• CVE-2016-5131
• CVE-2016-5132
• CVE-2016-5133
• CVE-2016-5134
• CVE-2016-5135
• CVE-2016-5136
• CVE-2016-5137
• CVE-2016-5138
• CVE-2016-5139
• CVE-2016-5140
• CVE-2016-5141
• CVE-2016-5142
• CVE-2016-5143
• CVE-2016-5144
• CVE-2016-5145
• CVE-2016-5146
• CVE-2016-5147
• CVE-2016-5148
• CVE-2016-5149
• CVE-2016-5150
• CVE-2016-5151
• CVE-2016-5152
• CVE-2016-5153
• CVE-2016-5154
• CVE-2016-5155
• CVE-2016-5156
• CVE-2016-5157
• CVE-2016-5158
• CVE-2016-5159
• CVE-2016-5160
• CVE-2016-5161
• CVE-2016-5162
• CVE-2016-5163
• CVE-2016-5164
• CVE-2016-5165
• CVE-2016-5166
• CVE-2016-5167
• CVE-2016-5170
• CVE-2016-5171
• CVE-2016-5172
• CVE-2016-5173
• CVE-2016-5174
• CVE-2016-5175
• CVE-2016-5177
• CVE-2016-5178
• CVE-2016-5181
• CVE-2016-5182
• CVE-2016-5183
• CVE-2016-5184
• CVE-2016-5185
• CVE-2016-5186
• CVE-2016-5187
• CVE-2016-5188
• CVE-2016-5189
• CVE-2016-5190
• CVE-2016-5191
• CVE-2016-5192
• CVE-2016-5193
• CVE-2016-5194

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-201610-09.xml

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

License

Copyright 2010 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.