-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 16 Aug 2022 17:29:29 -0400 Source: chromium Binary: chromium chromium-common chromium-common-dbgsym chromium-dbgsym chromium-driver chromium-sandbox chromium-sandbox-dbgsym chromium-shell chromium-shell-dbgsym Architecture: i386 Version: 104.0.5112.101-1~deb11u1 Distribution: bullseye-security Urgency: high Maintainer: i386 Build Daemon (x86-grnet-01) Changed-By: Andres Salomon Description: chromium - web browser chromium-common - web browser - common resources used by the chromium packages chromium-driver - web browser - WebDriver support chromium-sandbox - web browser - setuid security sandbox for chromium chromium-shell - web browser - minimal shell Closes: 956012 1005808 1010407 1013268 Changes: chromium (104.0.5112.101-1~deb11u1) bullseye-security; urgency=high . * New upstream security release. - CVE-2022-2852: Use after free in FedCM. Reported by Sergei Glazunov of Google Project Zero - CVE-2022-2854: Use after free in SwiftShader. Reported by Cassidy Kim of Amber Security Lab, OPPO Mobile Telecommunications Corp. Ltd. - CVE-2022-2855: Use after free in ANGLE. Reported by Cassidy Kim of Amber Security Lab, OPPO Mobile Telecommunications Corp. Ltd. - CVE-2022-2857: Use after free in Blink. Reported by Anonymous - CVE-2022-2858: Use after free in Sign-In Flow. Reported by raven at KunLun lab - CVE-2022-2853: Heap buffer overflow in Downloads. Reported by Sergei Glazunov of Google Project Zero - CVE-2022-2856: Insufficient validation of untrusted input in Intents Reported by Ashley Shen and Christian Resell of Google Threat Analysis Group - CVE-2022-2859: Use after free in Chrome OS Shell. Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Alpha Lab - CVE-2022-2860: Insufficient policy enforcement in Cookies. Reported by Axel Chong - CVE-2022-2861: Inappropriate implementation in Extensions API. Reported by Rong Jian of VRI * Change default search engine to DuckDuckGo for privacy reasons. Set a different search engine under Settings -> Search Engine (closes: #956012). * Drop a bunch of versioned build-deps that have been satisfied since at least oldoldstable. * debian/NEWS.Debian: - Document upstream dropping support for older TLSv1 and TLSv1.1 protocols (closes: #1005808). - Document upstream dropping support for older x86 CPUs without SSE3 instruction support (closes: #1010407). - Document the Google to DuckDuckGo change. - Document upstream's config renaming of AuthServerWhitelist to AuthServerAllowlist (closes: #1013268). Checksums-Sha1: 619416ce1f0cd36a5f9b14b9dda7af56992b9675 978860 chromium-common-dbgsym_104.0.5112.101-1~deb11u1_i386.deb c102bb72edacb9c402c8e233635c657e0b8ee75f 4828656 chromium-common_104.0.5112.101-1~deb11u1_i386.deb daab15b4f837b9bf6f6fc853fabcc1c6d421b52b 25107356 chromium-dbgsym_104.0.5112.101-1~deb11u1_i386.deb c0040e13bc11b00984004c8af9f941d8b432bf04 5657548 chromium-driver_104.0.5112.101-1~deb11u1_i386.deb cb5cfb2d7c5595b267bde0ead31ca90f9bc77123 11664 chromium-sandbox-dbgsym_104.0.5112.101-1~deb11u1_i386.deb 10ed2a9695504a8204ff087f1fbe83ad51bd07a3 124036 chromium-sandbox_104.0.5112.101-1~deb11u1_i386.deb 26e6136cc3e1af3f47381060bfdba0e7f267e70f 21369564 chromium-shell-dbgsym_104.0.5112.101-1~deb11u1_i386.deb 76029ed72b6776a7741e6bddd1be8cb13a16ff55 45665088 chromium-shell_104.0.5112.101-1~deb11u1_i386.deb 5867e47d823dc894dbd80835255455893ef78670 23567 chromium_104.0.5112.101-1~deb11u1_i386-buildd.buildinfo 5440c5aa5385ca3f00becaa09afb4d879bbfc7fd 65601872 chromium_104.0.5112.101-1~deb11u1_i386.deb Checksums-Sha256: 45b9d1d380670f10618a314dae209310b95a52667c72802cf68e81412a3e6fde 978860 chromium-common-dbgsym_104.0.5112.101-1~deb11u1_i386.deb 8e7ef005d7910c8ee87a4fbd5be7fa5fb08a06a8d0451ca4429f011dba09a883 4828656 chromium-common_104.0.5112.101-1~deb11u1_i386.deb a69431ea4fd20064e3c2659e53dc3dd984acbb8074d24b3509c099814ce76399 25107356 chromium-dbgsym_104.0.5112.101-1~deb11u1_i386.deb 86576989bc54df64ee156a6044b26b08df5bf6046cb5bf835444a8e50479cb2e 5657548 chromium-driver_104.0.5112.101-1~deb11u1_i386.deb b408a4efd7d79b8896fed9be1748984656d95608e0bef83ae10c527283bc0029 11664 chromium-sandbox-dbgsym_104.0.5112.101-1~deb11u1_i386.deb d1dc710358bcfe152a389ff2b98a546a8574025566cad457d8b835126e46ebe2 124036 chromium-sandbox_104.0.5112.101-1~deb11u1_i386.deb a6ea71fd63378d2042afacda8d22bf0494bdeaceecd7d956cff92052790a38a1 21369564 chromium-shell-dbgsym_104.0.5112.101-1~deb11u1_i386.deb a54c8ce0cfa022fc7071530a7dc0f5631b351b23728d71b960dd963eb8a40ef1 45665088 chromium-shell_104.0.5112.101-1~deb11u1_i386.deb ef39821bc0a0b3a1e5c108f4b2c1c3d60c0d3056c2e6e24e07870c96144c07d1 23567 chromium_104.0.5112.101-1~deb11u1_i386-buildd.buildinfo 00e623cd0fd53f89b33495affdb80d60a48bc0b41704c25bac482bf28f44ca1e 65601872 chromium_104.0.5112.101-1~deb11u1_i386.deb Files: 8b14cdfabdc1d9f4f6038f46fc6c7f70 978860 debug optional chromium-common-dbgsym_104.0.5112.101-1~deb11u1_i386.deb 1bb62888a16335ac16b8cbe6ae8c47c1 4828656 web optional chromium-common_104.0.5112.101-1~deb11u1_i386.deb c14f5b2c0d53f12a97ac3b001e45dd71 25107356 debug optional chromium-dbgsym_104.0.5112.101-1~deb11u1_i386.deb e176b81d28d0e316f1aaf955085ca418 5657548 web optional chromium-driver_104.0.5112.101-1~deb11u1_i386.deb 5b4414a2a75b5673ba3ff992f6da2068 11664 debug optional chromium-sandbox-dbgsym_104.0.5112.101-1~deb11u1_i386.deb d355cbb5bcecaa4698757856c85d4fd4 124036 web optional chromium-sandbox_104.0.5112.101-1~deb11u1_i386.deb f12a9396883987d5ba92bc959d08d545 21369564 debug optional chromium-shell-dbgsym_104.0.5112.101-1~deb11u1_i386.deb 7885aa25a4aaf33886daf5cf658a1fef 45665088 web optional chromium-shell_104.0.5112.101-1~deb11u1_i386.deb c9e64c4975de2c001efc2c8882c2ec07 23567 web optional chromium_104.0.5112.101-1~deb11u1_i386-buildd.buildinfo 49e3a03d23f111373306c807dfe0d4f4 65601872 web optional chromium_104.0.5112.101-1~deb11u1_i386.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEZ+kjGN6s2Ioxmya1SqddLxw5rsoFAmL9AMgACgkQSqddLxw5 rsqJIBAA3KO3CU3juteFGX2G+n+ggh+U1cIUrCGnwwIj3namKJkTaf0aRGyydYuv rHZFny/H4ena2rWdwODOYDX/XqApvb6PXC/762y5xIJnhZUuFErqNu6iqm9WSxz+ /D7tQcZZ9brT0ix98j4BWYVKsTnVaXWqgPKDPKxQLef+Jpl4gyOPq67577HNV6E4 5Mm3Fb10kr3LX/VUgQ49Q92jl58w589SR4EQuwrU+1tDDU17TDTgvZeIyQs7SCQ2 UI5lVDgxrlyLIF0Odxxq49DTTYz7/RQBTX3coA1FECxVrELWjQ9ndRuYe1avWRDQ InwVCC6HD0V3ikOzBoyVlKS7MjkmyVNT6RC3XVwSx584CW10WiUMzgU1naIy8SHD W+TOvkC6rP85f9dc2BHLHE4s1pKjSkfN1T6Ss16ddKk3JjmXAI7FhXJYqiG5JVlb rqRd69+23/m3wrF42oJnIh2G5mHUEwVfDZIsFA1k+wXQZQoyqfBNKYXKnZSZP/f4 5FJxUSyGbztYPx3epHjICtIqedfvxwFImxyo1amFyyqly/RlUJE9ibcNYEqWnl/n VX72VitRCs7daRaaWUGXYa/j6Vzt2ghNBYfql9dJqwOFupKxVrj1n0GU8P0iCy3V oOlIXdGf9BomrufdRjzR4h6bUseBZHRg1AYrA8HWpyU+X2POjz0= =Lqf5 -----END PGP SIGNATURE-----