-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 16 Aug 2022 17:29:29 -0400 Source: chromium Binary: chromium chromium-common chromium-common-dbgsym chromium-dbgsym chromium-driver chromium-sandbox chromium-sandbox-dbgsym chromium-shell chromium-shell-dbgsym Architecture: arm64 Version: 104.0.5112.101-1~deb11u1 Distribution: bullseye-security Urgency: high Maintainer: arm Build Daemon (arm-arm-03) Changed-By: Andres Salomon Description: chromium - web browser chromium-common - web browser - common resources used by the chromium packages chromium-driver - web browser - WebDriver support chromium-sandbox - web browser - setuid security sandbox for chromium chromium-shell - web browser - minimal shell Closes: 956012 1005808 1010407 1013268 Changes: chromium (104.0.5112.101-1~deb11u1) bullseye-security; urgency=high . * New upstream security release. - CVE-2022-2852: Use after free in FedCM. Reported by Sergei Glazunov of Google Project Zero - CVE-2022-2854: Use after free in SwiftShader. Reported by Cassidy Kim of Amber Security Lab, OPPO Mobile Telecommunications Corp. Ltd. - CVE-2022-2855: Use after free in ANGLE. Reported by Cassidy Kim of Amber Security Lab, OPPO Mobile Telecommunications Corp. Ltd. - CVE-2022-2857: Use after free in Blink. Reported by Anonymous - CVE-2022-2858: Use after free in Sign-In Flow. Reported by raven at KunLun lab - CVE-2022-2853: Heap buffer overflow in Downloads. Reported by Sergei Glazunov of Google Project Zero - CVE-2022-2856: Insufficient validation of untrusted input in Intents Reported by Ashley Shen and Christian Resell of Google Threat Analysis Group - CVE-2022-2859: Use after free in Chrome OS Shell. Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Alpha Lab - CVE-2022-2860: Insufficient policy enforcement in Cookies. Reported by Axel Chong - CVE-2022-2861: Inappropriate implementation in Extensions API. Reported by Rong Jian of VRI * Change default search engine to DuckDuckGo for privacy reasons. Set a different search engine under Settings -> Search Engine (closes: #956012). * Drop a bunch of versioned build-deps that have been satisfied since at least oldoldstable. * debian/NEWS.Debian: - Document upstream dropping support for older TLSv1 and TLSv1.1 protocols (closes: #1005808). - Document upstream dropping support for older x86 CPUs without SSE3 instruction support (closes: #1010407). - Document the Google to DuckDuckGo change. - Document upstream's config renaming of AuthServerWhitelist to AuthServerAllowlist (closes: #1013268). Checksums-Sha1: 8e016b79bd336040b36093d79213dfe3340daa34 1053344 chromium-common-dbgsym_104.0.5112.101-1~deb11u1_arm64.deb d1f76d79e841b3119d4039be808dd022ac29ae59 4680908 chromium-common_104.0.5112.101-1~deb11u1_arm64.deb 5a1ffbd61fde47b80674258ca8b932d6bee3ac78 25889936 chromium-dbgsym_104.0.5112.101-1~deb11u1_arm64.deb 9bfd2eda008f1ba4a1f60879ea3e8c9f613a34fe 4571684 chromium-driver_104.0.5112.101-1~deb11u1_arm64.deb 84bc1f16e11b1ef7c083eb2323309ccb5fb5c3fc 12336 chromium-sandbox-dbgsym_104.0.5112.101-1~deb11u1_arm64.deb 446f4c561fc88b2ef9d11f1b816122f3951f4e04 123948 chromium-sandbox_104.0.5112.101-1~deb11u1_arm64.deb 19a4dd6140a5c844ec09a22c881df60e068460d6 21430056 chromium-shell-dbgsym_104.0.5112.101-1~deb11u1_arm64.deb b9b33896f9a40c7b98cb1b4cf415e2277c8ee108 39185804 chromium-shell_104.0.5112.101-1~deb11u1_arm64.deb 8612153be67ad321feca8c160447fea2eaf7bc05 23507 chromium_104.0.5112.101-1~deb11u1_arm64-buildd.buildinfo 49d8da12063b99773f4c7dec74e1b4fcd9347e56 56544172 chromium_104.0.5112.101-1~deb11u1_arm64.deb Checksums-Sha256: dfaf6fd1a2ec4ee1fb64dd98b47dbc0e09b3599e5f823b5125363d9882b3eae7 1053344 chromium-common-dbgsym_104.0.5112.101-1~deb11u1_arm64.deb 1629c68b35d7f13a730e6b67a36a68784636ac42a053ec242cd0f9b143f2bdb2 4680908 chromium-common_104.0.5112.101-1~deb11u1_arm64.deb 7a41de2772ac32df2bbdc7f4376f9bddde0df6df292b497e9aabc6b5c5c523e6 25889936 chromium-dbgsym_104.0.5112.101-1~deb11u1_arm64.deb 275c55a368296743b5df0dde28c945f7b0d41663558398d89bd7d1880992835a 4571684 chromium-driver_104.0.5112.101-1~deb11u1_arm64.deb c31ea03b194c8182edb85afda02056d41490d58539dd7865db8d111459624ffa 12336 chromium-sandbox-dbgsym_104.0.5112.101-1~deb11u1_arm64.deb 6446d51c853bebc8ea8690e0d528ffd009337ae125e5134aa5c076e4fb33fdc9 123948 chromium-sandbox_104.0.5112.101-1~deb11u1_arm64.deb fa102bc6c395655a0943ab6098dfb2b0ad55a71a412c155b60baece086b0b92e 21430056 chromium-shell-dbgsym_104.0.5112.101-1~deb11u1_arm64.deb 795d25fc1a77d5fca32ca2c36239787b892113242c1670b9738bfac92720c3a7 39185804 chromium-shell_104.0.5112.101-1~deb11u1_arm64.deb 7d35a57d314356dfaf5abd9794ed645f256c185399beb7ad82c8ddec64f04a3d 23507 chromium_104.0.5112.101-1~deb11u1_arm64-buildd.buildinfo 93833fea47ab6e2f587693ab0fa047497de475be013f702381439b5b014c444f 56544172 chromium_104.0.5112.101-1~deb11u1_arm64.deb Files: d8c1038077fa353e924256246fdc25b5 1053344 debug optional chromium-common-dbgsym_104.0.5112.101-1~deb11u1_arm64.deb 8a7bf1fe74fd984a8fc5372e712fc9e2 4680908 web optional chromium-common_104.0.5112.101-1~deb11u1_arm64.deb 50bc5cce1a9f1eb4f081726b14724842 25889936 debug optional chromium-dbgsym_104.0.5112.101-1~deb11u1_arm64.deb 9e1798a7851c6cd6c5f7bba375d497ce 4571684 web optional chromium-driver_104.0.5112.101-1~deb11u1_arm64.deb b899b165e1c1bf5f4de2724d44ce75d0 12336 debug optional chromium-sandbox-dbgsym_104.0.5112.101-1~deb11u1_arm64.deb 8337ddcdbad7e3458fb1ecaf8cc260a8 123948 web optional chromium-sandbox_104.0.5112.101-1~deb11u1_arm64.deb 970290a57e29cd21cdd28b0be6e03db7 21430056 debug optional chromium-shell-dbgsym_104.0.5112.101-1~deb11u1_arm64.deb c5dddf1d4eccc7160bb057dd4dd5de99 39185804 web optional chromium-shell_104.0.5112.101-1~deb11u1_arm64.deb adf341cc0c0589031d92c30d77074188 23507 web optional chromium_104.0.5112.101-1~deb11u1_arm64-buildd.buildinfo 94802cd2c67335497af5c29474db5e88 56544172 web optional chromium_104.0.5112.101-1~deb11u1_arm64.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEqO6ffWSdcdkiR5vYVp++5mqGGP0FAmL9ljwACgkQVp++5mqG GP0oyhAApBTcOnC3gx8CLO1BNI+0yAOb802uC1wwCvLHtIiAQCDSnBC830TU7FZy 5rqOwu+DjjqHZgt2lJlOO2VsdA4Ii2hFBLK1ceywIZ5+gE9dXKUZEDWB6G4evDY+ VGMn+qRJFeWZfPlMSp1oGITdCvLXc5pESF2WESp61Z72asBj1xRtsU25ZpHUsUyY BGdrISrIfcgNz8bjxKvXj1ar5efZCA+TrAxICecE1AhLMbfq7RnhjrRjAaN6uWHT yMXDIcKfWu0YmFCgidOKxHv6uPKToCucCjRMUx9KIzWqFR0dtmYOyC8ed9nIYQNI H6yoqMFtUPb9ZCxrBZihQl6ZZuhrIpxM5TO/m57QOxP9yVbdn+1sgBUZhleuUJYr gNZIVjZKe4E38AwGfeuE6MLG5uyk0CCyrSvs3MqmoTSgCKWUSYfReH1d2VYXcnPq I45M4iJuD6djxqIbMw3eSTVNMDzRYrB5npVKggly249MxH4dZkQv73Z4TS/RRhBI 88QhAPeq1MQ3h3nChxinhHm9DxkzAUYvBoT8vCVX7AevCzFKOFuYHqi60lTjs6b3 zZ207qnjH4KS1ZV1xxkPiAgSEiJTD8vAlHEswLsySqB8HE5JV4TYgy+9mBJelAMA 3HvrfzeERaMKWOnKQwrMRT3RPs6DFC+bZ6PTw1hcFIFn9I6bywU= =3U5E -----END PGP SIGNATURE-----