Arch Linux Security Advisory ASA-202108-4 ========================================= Severity: High Date : 2021-08-03 CVE-ID : CVE-2021-30590 CVE-2021-30591 CVE-2021-30592 CVE-2021-30593 CVE-2021-30594 CVE-2021-30596 CVE-2021-30597 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2246 Summary ======= The package chromium before version 92.0.4515.131-1 is vulnerable to multiple issues including arbitrary code execution, information disclosure and content spoofing. Resolution ========== Upgrade to 92.0.4515.131-1. # pacman -Syu "chromium>=92.0.4515.131-1" The problems have been fixed upstream in version 92.0.4515.131. Workaround ========== None. Description =========== - CVE-2021-30590 (arbitrary code execution) A heap buffer overflow security issue has been found in the Bookmarks component of the Chromium browser engine before version 92.0.4515.131. - CVE-2021-30591 (arbitrary code execution) A use after free security issue has been found in the File System API component of the Chromium browser engine before version 92.0.4515.131. - CVE-2021-30592 (arbitrary code execution) An out of bounds write security issue has been found in the Tab Groups component of the Chromium browser engine before version 92.0.4515.131. - CVE-2021-30593 (information disclosure) An out of bounds read security issue has been found in the Tab Strip component of the Chromium browser engine before version 92.0.4515.131. - CVE-2021-30594 (arbitrary code execution) A use after free security issue has been found in the Page Info UI component of the Chromium browser engine before version 92.0.4515.131. - CVE-2021-30596 (content spoofing) An incorrect security UI security issue has been found in the Navigation component of the Chromium browser engine before version 92.0.4515.131. - CVE-2021-30597 (arbitrary code execution) A use after free security issue has been found in the Browser UI component of the Chromium browser engine before version 92.0.4515.131. Impact ====== A remote attacker could execute arbitrary code, disclose sensitive information, or spoof content through crafted web pages. References ========== https://chromereleases.googleblog.com/2021/08/the-stable-channel-has-been-up... https://crbug.com/1227777 https://crbug.com/1229298 https://crbug.com/1209469 https://crbug.com/1209616 https://crbug.com/1218468 https://crbug.com/1214481 https://crbug.com/1232617 https://security.archlinux.org/CVE-2021-30590 https://security.archlinux.org/CVE-2021-30591 https://security.archlinux.org/CVE-2021-30592 https://security.archlinux.org/CVE-2021-30593 https://security.archlinux.org/CVE-2021-30594 https://security.archlinux.org/CVE-2021-30596 https://security.archlinux.org/CVE-2021-30597