5.0.375.70 security update available
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| | chromium-browser (Ubuntu) |
High
|
Unassigned | ||
| | Lucid |
High
|
Unassigned | ||
Bug Description
Binary package hint: chromium-browser
http://
| security vulnerability: | no → yes |
| Changed in chromium-browser (Ubuntu): | |
| status: | New → Confirmed |
| importance: | Undecided → High |
| Launchpad Janitor (janitor) wrote : | #1 |
| Changed in chromium-browser (Ubuntu): | |
| status: | Confirmed → Fix Released |
| Changed in chromium-browser (Ubuntu Lucid): | |
| status: | New → Confirmed |
| importance: | Undecided → High |
| Jamie Strandboge (jdstrand) wrote : | #2 |
An updated packaged for Lucid has been uploaded to the ubuntu-
| Jamie Strandboge (jdstrand) wrote : | #3 |
ACK, though the new packaging also includes:
* Add a --temp-profile knob to the launcher script starting Chromium with
a new profile which will last only for the duration of the session
- update debian/
* Change StartupWMClass to Chromium-browser in the desktop launcher so
cairo-dock does the right thing (LP: #587664)
- update debian/
* Set XLIB_SKIP_
with a Gdk-ERROR when gtk2 is built with RGBA support (like in Maverick).
(LP: #584959)
- update debian/
* Unbreak get-orig-source when it needs to drop its cache after a channel jump
(replace brace expansion - which is a bashism - with proper $(wildcard))
- update debian/rules
These items will need to be separately tested.
| Changed in chromium-browser (Ubuntu Lucid): | |
| status: | Confirmed → In Progress |
| Jamie Strandboge (jdstrand) wrote : | #4 |
Pocket copied chromium-browser to proposed. Please test and give feedback here. See https:/
| tags: | added: verification-needed |
| Changed in chromium-browser (Ubuntu Lucid): | |
| status: | In Progress → Fix Committed |
| Jamie Strandboge (jdstrand) wrote : | #5 |
To ubuntu-sru: if this passes the verification process, please also pocket copy to security. Thanks!
| Jamie Strandboge (jdstrand) wrote : | #6 |
Installed 5.0.375.
| Marc Deslauriers (mdeslaur) wrote : | #7 |
I installed 5.0.375.
| Daniel Serpell (daniel-serpell) wrote : | #8 |
Tested 5.0.375.
| tags: |
added: verification-done removed: verification-needed |
| Launchpad Janitor (janitor) wrote : | #9 |
This bug was fixed in the package chromium-browser - 5.0.375.
---------------
chromium-browser (5.0.375.
* New upstream release from the Stable Channel (LP: #591474)
Fixes the following security issues:
- [15766] Medium Cross-origin keystroke redirection. Credit to Michal
Zalewski of Google Security Team.
- [39985] High Cross-origin bypass in DOM methods. Credit to Sergey
Glazunov.
- [42723] High Memory error in table layout. Credit to wushi of team509.
- [43304] High Linux sandbox escape. Credit to Mark Dowd under contract to
Google Chrome Security Team.
- [43307] High Bitmap stale pointer. Credit to Mark Dowd under contract to
Google Chrome Security Team.
- [43315] High Memory corruption in DOM node normalization. Credit to Mark
Dowd under contract to Google Chrome Security Team.
- [43487] High Memory corruption in text transforms. Credit to wushi of
team509.
- [43902] Medium XSS in innerHTML property of textarea. Credit to
sirdarckcat of Google Security Team.
- [44740] High Memory corruption in font handling. Credit: Apple.
- [44868] High Geolocation events fire after document deletion. Credit to
Google Chrome Security Team (Justin Schuh).
- [44955] High Memory corruption in rendering of list markers. Credit:
Apple.
* Add a --temp-profile knob to the launcher script starting Chromium with
a new profile which will last only for the duration of the session
- update debian/
* Change StartupWMClass to Chromium-browser in the desktop launcher so
cairo-dock does the right thing (LP: #587664)
- update debian/
* Set XLIB_SKIP_
with a Gdk-ERROR when gtk2 is built with RGBA support (like in Maverick).
(LP: #584959)
- update debian/
* Unbreak get-orig-source when it needs to drop its cache after a channel jump
(replace brace expansion - which is a bashism - with proper $(wildcard))
- update debian/rules
-- Fabien Tassin <email address hidden> Wed, 09 Jun 2010 07:30:50 +0200
| Changed in chromium-browser (Ubuntu Lucid): | |
| status: | Fix Committed → Fix Released |
This bug was fixed in the package chromium-browser - 5.0.375.
---------------
chromium-browser (5.0.375.
* New upstream release from the Stable Channel (LP: #591474)
Fixes the following security issues:
- [15766] Medium Cross-origin keystroke redirection. Credit to Michal
Zalewski of Google Security Team.
- [39985] High Cross-origin bypass in DOM methods. Credit to Sergey
Glazunov.
- [42723] High Memory error in table layout. Credit to wushi of team509.
- [43304] High Linux sandbox escape. Credit to Mark Dowd under contract to
Google Chrome Security Team.
- [43307] High Bitmap stale pointer. Credit to Mark Dowd under contract to
Google Chrome Security Team.
- [43315] High Memory corruption in DOM node normalization. Credit to Mark
Dowd under contract to Google Chrome Security Team.
- [43487] High Memory corruption in text transforms. Credit to wushi of
team509.
- [43902] Medium XSS in innerHTML property of textarea. Credit to
sirdarckcat of Google Security Team.
- [44740] High Memory corruption in font handling. Credit: Apple.
- [44868] High Geolocation events fire after document deletion. Credit to
Google Chrome Security Team (Justin Schuh).
- [44955] High Memory corruption in rendering of list markers. Credit:
Apple.
* Add a --temp-profile knob to the launcher script starting Chromium with
a new profile which will last only for the duration of the session
- update debian/
* Change StartupWMClass to Chromium-browser in the desktop launcher so
cairo-dock does the right thing (LP: #587664)
- update debian/
* Set XLIB_SKIP_
with a Gdk-ERROR when gtk2 is built with RGBA support (like in Maverick).
(LP: #584959)
- update debian/
* Unbreak get-orig-source when it needs to drop its cache after a channel jump
(replace brace expansion - which is a bashism - with proper $(wildcard))
- update debian/rules
-- Fabien Tassin <email address hidden> Wed, 09 Jun 2010 07:30:50 +0200