Arch Linux Security Advisory ASA-202107-30 ========================================== Severity: High Date : 2021-07-16 CVE-ID : CVE-2021-30541 CVE-2021-30559 CVE-2021-30560 CVE-2021-30561 CVE-2021-30562 CVE-2021-30563 CVE-2021-30564 Package : chromium Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2166 Summary ======= The package chromium before version 91.0.4472.164-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 91.0.4472.164-1. # pacman -Syu "chromium>=91.0.4472.164-1" The problems have been fixed upstream in version 91.0.4472.164. Workaround ========== None. Description =========== - CVE-2021-30541 (arbitrary code execution) A use after free security issue has been found in the V8 component of the Chromium browser engine before version 91.0.4472.164. - CVE-2021-30559 (arbitrary code execution) An out of bounds write security issue has been found in the ANGLE component of the Chromium browser engine before version 91.0.4472.164. - CVE-2021-30560 (arbitrary code execution) A use after free security issue has been found in the Blink XSLT component of the Chromium browser engine before version 91.0.4472.164. - CVE-2021-30561 (arbitrary code execution) A type confusion security issue has been found in the V8 component of the Chromium browser engine before version 91.0.4472.164. - CVE-2021-30562 (arbitrary code execution) A use after free security issue has been found in the WebSerial component of the Chromium browser engine before version 91.0.4472.164. - CVE-2021-30563 (arbitrary code execution) A type confusion security issue has been found in the V8 component of the Chromium browser engine before version 91.0.4472.164. Google is aware of reports that an exploit for CVE-2021-30563 exists in the wild. - CVE-2021-30564 (arbitrary code execution) A heap buffer overflow security issue has been found in the WebXR component of the Chromium browser engine before version 91.0.4472.164. Impact ====== A remote attacker could execute arbitrary code through a crafted web page. Google is aware that an exploit for one of the security issues exists in the wild. References ========== https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-desk... https://crbug.com/1214842 https://crbug.com/1219082 https://crbug.com/1219209 https://crbug.com/1219630 https://crbug.com/1220078 https://crbug.com/1228407 https://crbug.com/1221309 https://security.archlinux.org/CVE-2021-30541 https://security.archlinux.org/CVE-2021-30559 https://security.archlinux.org/CVE-2021-30560 https://security.archlinux.org/CVE-2021-30561 https://security.archlinux.org/CVE-2021-30562 https://security.archlinux.org/CVE-2021-30563 https://security.archlinux.org/CVE-2021-30564