{"schema_version":"1.7.3","id":"openSUSE-SU-2017:3245-1","published":"2017-12-08T07:34:05Z","modified":"2026-02-04T03:15:35.600558Z","related":["CVE-2017-15386","CVE-2017-15387","CVE-2017-15388","CVE-2017-15389","CVE-2017-15390","CVE-2017-15391","CVE-2017-15392","CVE-2017-15393","CVE-2017-15394","CVE-2017-15395","CVE-2017-15396","CVE-2017-15398","CVE-2017-15399","CVE-2017-15408","CVE-2017-15409","CVE-2017-15410","CVE-2017-15411","CVE-2017-15412","CVE-2017-15413","CVE-2017-15415","CVE-2017-15416","CVE-2017-15417","CVE-2017-15418","CVE-2017-15419","CVE-2017-15420","CVE-2017-15422","CVE-2017-15423","CVE-2017-15424","CVE-2017-15425","CVE-2017-15426","CVE-2017-15427","CVE-2017-5124","CVE-2017-5125","CVE-2017-5126","CVE-2017-5127","CVE-2017-5128","CVE-2017-5129","CVE-2017-5130","CVE-2017-5131","CVE-2017-5132","CVE-2017-5133"],"upstream":["CVE-2017-15386","CVE-2017-15387","CVE-2017-15388","CVE-2017-15389","CVE-2017-15390","CVE-2017-15391","CVE-2017-15392","CVE-2017-15393","CVE-2017-15394","CVE-2017-15395","CVE-2017-15396","CVE-2017-15398","CVE-2017-15399","CVE-2017-15408","CVE-2017-15409","CVE-2017-15410","CVE-2017-15411","CVE-2017-15412","CVE-2017-15413","CVE-2017-15415","CVE-2017-15416","CVE-2017-15417","CVE-2017-15418","CVE-2017-15419","CVE-2017-15420","CVE-2017-15422","CVE-2017-15423","CVE-2017-15424","CVE-2017-15425","CVE-2017-15426","CVE-2017-15427","CVE-2017-5124","CVE-2017-5125","CVE-2017-5126","CVE-2017-5127","CVE-2017-5128","CVE-2017-5129","CVE-2017-5130","CVE-2017-5131","CVE-2017-5132","CVE-2017-5133"],"summary":"Security update for chromium","details":"This update to Chromium 63.0.3239.84 fixes the following security issues:\n\n- CVE-2017-5124: UXSS with MHTML\n- CVE-2017-5125: Heap overflow in Skia\n- CVE-2017-5126: Use after free in PDFium \n- CVE-2017-5127: Use after free in PDFium\n- CVE-2017-5128: Heap overflow in WebGL\n- CVE-2017-5129: Use after free in WebAudio  \n- CVE-2017-5132: Incorrect stack manipulation in WebAssembly.\n- CVE-2017-5130: Heap overflow in libxml2\n- CVE-2017-5131: Out of bounds write in Skia \n- CVE-2017-5133: Out of bounds write in Skia  \n- CVE-2017-15386: UI spoofing in Blink\n- CVE-2017-15387: Content security bypass\n- CVE-2017-15388: Out of bounds read in Skia\n- CVE-2017-15389: URL spoofing in OmniBox\n- CVE-2017-15390: URL spoofing in OmniBox \n- CVE-2017-15391: Extension limitation bypass in Extensions.\n- CVE-2017-15392: Incorrect registry key handling in PlatformIntegration\n- CVE-2017-15393: Referrer leak in Devtools\n- CVE-2017-15394: URL spoofing in extensions UI\n- CVE-2017-15395: Null pointer dereference in ImageCapture\n- CVE-2017-15396: Stack overflow in V8\n- CVE-2017-15398: Stack buffer overflow in QUIC\n- CVE-2017-15399: Use after free in V8\n- CVE-2017-15408: Heap buffer overflow in PDFium\n- CVE-2017-15409: Out of bounds write in Skia\n- CVE-2017-15410: Use after free in PDFium\n- CVE-2017-15411: Use after free in PDFium\n- CVE-2017-15412: Use after free in libXML\n- CVE-2017-15413: Type confusion in WebAssembly\n- CVE-2017-15415: Pointer information disclosure in IPC call\n- CVE-2017-15416: Out of bounds read in Blink\n- CVE-2017-15417: Cross origin information disclosure in Skia\n- CVE-2017-15418: Use of uninitialized value in Skia\n- CVE-2017-15419: Cross origin leak of redirect URL in Blink\n- CVE-2017-15420: URL spoofing in Omnibox\n- CVE-2017-15422: Integer overflow in ICU\n- CVE-2017-15423: Issue with SPAKE implementation in BoringSSL\n- CVE-2017-15424: URL Spoof in Omnibox\n- CVE-2017-15425: URL Spoof in Omnibox\n- CVE-2017-15426: URL Spoof in Omnibox\n- CVE-2017-15427: Insufficient blocking of JavaScript in Omnibox\n    \nThe following tracked bug fixes are included:\n\n- sandbox crash fixes (bsc#1064298)\n","affected":[{"package":{"name":"chromium","ecosystem":"SUSE:Package Hub 12 SP2","purl":"pkg:rpm/suse/chromium&distro=SUSE%20Package%20Hub%2012%20SP2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"63.0.3239.84-40.1"}]}],"ecosystem_specific":{"binaries":[{"chromedriver":"63.0.3239.84-40.1","chromium":"63.0.3239.84-40.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2017:3245-1.json"}}],"references":[{"type":"ADVISORY","url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VA55NOXRJGNNMP5YTJMI3OWZ75GMEMB2/#VA55NOXRJGNNMP5YTJMI3OWZ75GMEMB2"},{"type":"REPORT","url":"https://bugzilla.suse.com/1064066"},{"type":"REPORT","url":"https://bugzilla.suse.com/1064298"},{"type":"REPORT","url":"https://bugzilla.suse.com/1065405"},{"type":"REPORT","url":"https://bugzilla.suse.com/1066851"},{"type":"REPORT","url":"https://bugzilla.suse.com/1071691"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-15386"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-15387"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-15388"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-15389"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-15390"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-15391"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-15392"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-15393"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-15394"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-15395"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-15396"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-15398"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-15399"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-15408"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-15409"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-15410"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-15411"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-15412"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-15413"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-15415"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-15416"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-15417"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-15418"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-15419"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-15420"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-15422"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-15423"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-15424"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-15425"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-15426"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-15427"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-5124"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-5125"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-5126"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-5127"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-5128"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-5129"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-5130"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-5131"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-5132"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-5133"}]}