Arch Linux Security Advisory ASA-202107-31 ========================================== Severity: High Date : 2021-07-16 CVE-ID : CVE-2021-30541 CVE-2021-30559 CVE-2021-30560 CVE-2021-30561 CVE-2021-30562 CVE-2021-30563 CVE-2021-30564 Package : vivaldi Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2167 Summary ======= The package vivaldi before version 4.0.2312.41-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 4.0.2312.41-1. # pacman -Syu "vivaldi>=4.0.2312.41-1" The problems have been fixed upstream in version 4.0.2312.41. Workaround ========== None. Description =========== - CVE-2021-30541 (arbitrary code execution) A use after free security issue has been found in the V8 component of the Chromium browser engine before version 91.0.4472.164. - CVE-2021-30559 (arbitrary code execution) An out of bounds write security issue has been found in the ANGLE component of the Chromium browser engine before version 91.0.4472.164. - CVE-2021-30560 (arbitrary code execution) A use after free security issue has been found in the Blink XSLT component of the Chromium browser engine before version 91.0.4472.164. - CVE-2021-30561 (arbitrary code execution) A type confusion security issue has been found in the V8 component of the Chromium browser engine before version 91.0.4472.164. - CVE-2021-30562 (arbitrary code execution) A use after free security issue has been found in the WebSerial component of the Chromium browser engine before version 91.0.4472.164. - CVE-2021-30563 (arbitrary code execution) A type confusion security issue has been found in the V8 component of the Chromium browser engine before version 91.0.4472.164. Google is aware of reports that an exploit for CVE-2021-30563 exists in the wild. - CVE-2021-30564 (arbitrary code execution) A heap buffer overflow security issue has been found in the WebXR component of the Chromium browser engine before version 91.0.4472.164. Impact ====== A remote attacker could execute arbitrary code through a crafted web page. Google is aware that an exploit for one of the security issues exists in the wild. References ========== https://vivaldi.com/blog/desktop/minor-update-3-for-vivaldi-desktop-browser-... https://vivaldi.com/blog/desktop/minor-update-6-for-desktop-4-0/ https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-desk... https://crbug.com/1214842 https://crbug.com/1219082 https://crbug.com/1219209 https://crbug.com/1219630 https://crbug.com/1220078 https://crbug.com/1228407 https://crbug.com/1221309 https://security.archlinux.org/CVE-2021-30541 https://security.archlinux.org/CVE-2021-30559 https://security.archlinux.org/CVE-2021-30560 https://security.archlinux.org/CVE-2021-30561 https://security.archlinux.org/CVE-2021-30562 https://security.archlinux.org/CVE-2021-30563 https://security.archlinux.org/CVE-2021-30564