-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Mon, 15 Jul 2024 05:28:21 +0000
Source: chromium
Architecture: source
Version: 126.0.6478.126-1~deb13u1
Distribution: trixie
Urgency: high
Maintainer: Debian Chromium Team <chromium@packages.debian.org>
Changed-By: Andres Salomon <dilinger@debian.org>
Closes: 1068096 1071662 1073378
Changes:
chromium (126.0.6478.126-1~deb13u1) trixie; urgency=high
.
* Rebuild for trixie.
* Revert libxml2-dev versioned build dep, and re-add
d/patches/fixes/libxml-parseerr.patch.
.
chromium (126.0.6478.126-1) unstable; urgency=high
.
* New upstream security release.
- CVE-2024-6290: Use after free in Dawn. Reported by wgslfuzz.
- CVE-2024-6291: Use after free in Swiftshader.
Reported by Cassidy Kim(@cassidy6564).
- CVE-2024-6292: Use after free in Dawn. Reported by wgslfuzz.
- CVE-2024-6293: Use after free in Dawn. Reported by wgslfuzz.
* d/patches/upstream/observer.patch: add crash-on-exit fix from
upstream (closes: #1073378).
.
chromium (126.0.6478.114-1) unstable; urgency=high
.
* New upstream security release.
- CVE-2024-6100: Type Confusion in V8. Reported by Seunghyun Lee
(@0x10n) participating in SSD Secure Disclosure's TyphoonPWN 2024.
- CVE-2024-6101: Inappropriate implementation in WebAssembly.
Reported by @ginggilBesel.
- CVE-2024-6102: Out of bounds memory access in Dawn.
Reported by wgslfuzz.
- CVE-2024-6103: Use after free in Dawn. Reported by wgslfuzz.
.
chromium (126.0.6478.56-1) unstable; urgency=high
.
* New upstream stable release.
- CVE-2024-5830: Type Confusion in V8.
Reported by Man Yue Mo of GitHub Security Lab.
- CVE-2024-5831: Use after free in Dawn. Reported by wgslfuzz.
- CVE-2024-5832: Use after free in Dawn. Reported by wgslfuzz.
- CVE-2024-5833: Type Confusion in V8. Reported by @ginggilBesel.
- CVE-2024-5834: Inappropriate implementation in Dawn.
Reported by gelatin dessert.
- CVE-2024-5835: Heap buffer overflow in Tab Groups.
Reported by Weipeng Jiang (@Krace) of VRI.
- CVE-2024-5836: Inappropriate Implementation in DevTools.
Reported by Allen Ding.
- CVE-2024-5837: Type Confusion in V8. Reported by Anonymous.
- CVE-2024-5838: Type Confusion in V8.
Reported by Zhenghang Xiao (@Kipreyyy).
- CVE-2024-5839: Inappropriate Implementation in Memory Allocator.
Reported by Mickey.
- CVE-2024-5840: Policy Bypass in CORS. Reported by Matt Howard.
- CVE-2024-5841: Use after free in V8.
Reported by Cassidy Kim(@cassidy6564).
- CVE-2024-5842: Use after free in Browser UI.
Reported by Sven Dysthe (@svn_dy).
- CVE-2024-5843: Inappropriate implementation in Downloads.
Reported by hjy79425575.
- CVE-2024-5844: Heap buffer overflow in Tab Strip. Reported by Sri.
- CVE-2024-5845: Use after free in Audio. Reported by anonymous.
- CVE-2024-5846: Use after free in PDFium.
Reported by Han Zheng (HexHive).
- CVE-2024-5847: Use after free in PDFium.
Reported by Han Zheng (HexHive).
* d/copyright: delete bullseye environment that upstream ships (??).
* d/patches:
- upstream/appservice-include.patch: drop, merged upstream.
- upstream/lens-include.patch: drop, merged upstream.
- upstream/mojo-bindings-include.patch: drop, merged upstream.
- upstream/ninja.patch: drop, merged upstream.
- upstream/no-vector-consts.patch: drop, merged upstream.
- upstream/vulkan-include.patch: drop, merged upstream.
- system/clang-format.patch: drop it; we broke it some time ago, and
didn't notice. Guess we don't need it?
- bookworm/clang16.patch: refresh.
- fixes/bad-font-gc00000.patch: refresh
- fixes/bad-font-gc11.patch: refresh
- fixes/bad-font-gc2.patch: refresh
- disable/signin.patch: refresh
- upstream/quiche-deque.patch: gcc build fix pulled from upstream.
- upstream/gpu-header.patch: add header build fix from upstream.
- upstream/blink-header.patch: add header build fix from upstream.
- upstream/blink-header2.patch: add header build fix from upstream.
- upstream/blink-header3.patch: add header build fix from upstream.
- upstream/realtime-reporting.patch: gcc build fix from upstream.
- upstream/urlvisit-header.patch: add header build fix from upstream.
- upstream/accessibility-format.patch: gcc build fix from upstream.
- bookworm/urlhelper-ctor.patch: work around a clang-16 bug; add an
explicit constructor.
.
[ Timothy Pearson ]
* d/patches/ppc64le:
- sandbox/0008-sandbox-fix-ppc64le-glibc234.patch: Modify for upstream
changes
- third_party/0002-Add-PPC64-generated-files-for-boringssl.patch: Modify
for upstream changes
- libaom/0001-Add-pregenerated-config-for-libaom-on-ppc64.patch: Refresh
for upstream changes
.
chromium (125.0.6422.141-1) unstable; urgency=high
.
* New upstream security release.
- CVE-2024-5493: Heap buffer overflow in WebRTC.
Reported by Cassidy Kim(@cassidy6564).
- CVE-2024-5494: Use after free in Dawn. Reported by wgslfuzz.
- CVE-2024-5495: Use after free in Dawn. Reported by wgslfuzz.
- CVE-2024-5496: Use after free in Media Session.
Reported by Cassidy Kim(@cassidy6564).
- CVE-2024-5497: Out of bounds memory access in Keyboard Inputs.
Reported by zh1x1an1221 of Ant Group Tianqiong Security Lab.
- CVE-2024-5498: Use after free in Presentation API.
- CVE-2024-5499: Out of bounds write in Streams API.
* d/patches/fixes/libxml-parseerr.patch: delete, now that we have a
newer libxml2.
* d/control: add versioned build-dep on libxml2-dev >= 2.12.
.
chromium (125.0.6422.112-1) unstable; urgency=high
.
* New upstream security release.
- CVE-2024-5274: Type Confusion in V8. Reported by Clément Lecigne of
Google's Threat Analysis Group and Brendon Tiszka of Chrome Security.
* Fix handling of quoted arguments (closes: #1071662).
.
chromium (125.0.6422.76-1) unstable; urgency=high
.
* New upstream security release.
- CVE-2024-5157: Use after free in Scheduling. Reported by Looben Yang.
- CVE-2024-5158: Type Confusion in V8.
Reported by Zhenghang Xiao (@Kipreyyy).
- CVE-2024-5159: Heap buffer overflow in ANGLE.
Reported by David Sievers (@loknop).
- CVE-2024-5160: Heap buffer overflow in Dawn. Reported by wgslfuzz.
* Don't silently ignore arguments meant for the wrapper script if chromium
args happen to come first (closes: #1068096).
* d/patches:
- upstream/tabstrip-include.patch: add header build fix.
Checksums-Sha1:
914bbb70ef1c71a70f87b023a40baf45bee7bcd5 3788 chromium_126.0.6478.126-1~deb13u1.dsc
87e695d0a9cbc777cedf80bfdbf01b2fd5b4b243 963484100 chromium_126.0.6478.126.orig.tar.xz
06b13d2156418c7f888438e5eea5ab1e6c3120bf 430444 chromium_126.0.6478.126-1~deb13u1.debian.tar.xz
7f2dd0f0240fd2fc05953914f86c4b3ed28d0b9f 21944 chromium_126.0.6478.126-1~deb13u1_source.buildinfo
Checksums-Sha256:
7d58af94dc7c089ad23c7a1acd2fff511ef4bc6a625ff9046a08672013635e59 3788 chromium_126.0.6478.126-1~deb13u1.dsc
aa828cedf44c81e21282393b8436d9c75bb20f6427476d614649b0813bf5ee16 963484100 chromium_126.0.6478.126.orig.tar.xz
ae1b2014c84faf2ecd4479a7f60a05fa050d1f569061b262b5f1d4b5ac125336 430444 chromium_126.0.6478.126-1~deb13u1.debian.tar.xz
b872e8cad1bc13f450e4b3c7a3decf7df8331a0dd8bd0800cb1d9bace71ffce3 21944 chromium_126.0.6478.126-1~deb13u1_source.buildinfo
Files:
636a233c3f0214439bbf4d9564600fe4 3788 web optional chromium_126.0.6478.126-1~deb13u1.dsc
799dbd059c1642ac0ce58438f44d1169 963484100 web optional chromium_126.0.6478.126.orig.tar.xz
6e32992cdac465cdf16e5c08d9df67be 430444 web optional chromium_126.0.6478.126-1~deb13u1.debian.tar.xz
3d1abbfb1efc90fcc65f7c00302e9650 21944 web optional chromium_126.0.6478.126-1~deb13u1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJIBAEBCAAyFiEEUAUk+X1YiTIjs19qZF0CR8NudjcFAmaVWkoUHGRpbGluZ2Vy
QGRlYmlhbi5vcmcACgkQZF0CR8Nudjeq/w//TDxkY2MPt0jKGXQdebXSySkD1KXt
HdCcIByPz0sFtgeJ9VL3pD0n61ag4syjBjnWj6DgAWIQyXVxh9mBMlBtG/OF6dyl
A6Bryk9pAsr0dLW2wY5dmLQooll5hEnCjgJ9BnyBEOGxMpZi633Y3BMWkLnYLThi
ztFVxLaICc0V6h14dJ7p2TxKMhVngn94o3/sI/oKYEU2nnUMkU/fDZPqBO1+Iuxe
qzd+NaqnyQSB5Bb57uqfFhV5LlaVBeXX+0RQwAZRwNBiAEmMF+Qq/vTLQoXi40iP
GPQ9ZRpIhH5eA1WbnYw4iJ4zMhPJP2WGM0/dTCHfgkjsi8LYn6sXMjQmfVB8IVMt
+/1LYSGF7VWQw27Dm6yAc6JAidTufjKF4lvEzcz21gZIdyELjFh/Qgpv8OrLVAXf
A57XbcKQaOC5vlbH/ScCEBpvjYVRwN35QtsBj1lrRzmfq8RiGM5tTVLgTyaF4XWC
nlYcV7v3+J5cQWo8sUMPI6EhYE6lp9xqZFTXvp9gbb0e1uA+cD+1zvog+PTN4cQy
t8z0HrGhYmBhmWr3CUF78QF46OSb0K+xfiLrqcJZsPDai4secc7x57f6YUgoq/qk
dbQelouPEKAOgK9iUYNVCSINxmnnEXTgxl/Il93mGC0u6CGNezsD8NL1Q6GLPtUU
DvKFumR+bMyOXUM=
=yrFI
-----END PGP SIGNATURE-----
Attachment:
pgp3z9lIIoUPe.pgp
Description: PGP signature