SUSE-SU-2016:2251-1: important: Security update for Chromium

sle-security-updates at sle-security-updates at
Tue Sep 6 13:09:12 MDT 2016

   SUSE Security Update: Security update for Chromium

Announcement ID:    SUSE-SU-2016:2251-1
Rating:             important
References:         #995932 #996032 #99606 #996648 
Cross-References:   CVE-2016-5147 CVE-2016-5148 CVE-2016-5149
                    CVE-2016-5150 CVE-2016-5151 CVE-2016-5152
                    CVE-2016-5153 CVE-2016-5154 CVE-2016-5155
                    CVE-2016-5156 CVE-2016-5157 CVE-2016-5158
                    CVE-2016-5159 CVE-2016-5160 CVE-2016-5161
                    CVE-2016-5162 CVE-2016-5163 CVE-2016-5164
                    CVE-2016-5165 CVE-2016-5166
Affected Products:
                    SUSE Package Hub for SUSE Linux Enterprise 12

   An update that fixes 20 vulnerabilities is now available.


   Chromium was updated to 53.0.2785.89 to fix a number of security issues.

   The following vulnerabilities were fixed: (boo#996648)

   - CVE-2016-5147: Universal XSS in Blink.
   - CVE-2016-5148: Universal XSS in Blink.
   - CVE-2016-5149: Script injection in extensions.
   - CVE-2016-5150: Use after free in Blink.
   - CVE-2016-5151: Use after free in PDFium.
   - CVE-2016-5152: Heap overflow in PDFium.
   - CVE-2016-5153: Use after destruction in Blink.
   - CVE-2016-5154: Heap overflow in PDFium.
   - CVE-2016-5155: Address bar spoofing.
   - CVE-2016-5156: Use after free in event bindings.
   - CVE-2016-5157: Heap overflow in PDFium.
   - CVE-2016-5158: Heap overflow in PDFium.
   - CVE-2016-5159: Heap overflow in PDFium.
   - CVE-2016-5161: Type confusion in Blink.
   - CVE-2016-5162: Extensions web accessible resources bypass.
   - CVE-2016-5163: Address bar spoofing.
   - CVE-2016-5164: Universal XSS using DevTools.
   - CVE-2016-5165: Script injection in DevTools.
   - CVE-2016-5166: SMB Relay Attack via Save Page As.
   - CVE-2016-5160: Extensions web accessible resources bypass.

   A number of tracked build system fixes are included. (boo#996032,
   boo#99606, boo#995932)

Patch Instructions:

   To install this SUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - SUSE Package Hub for SUSE Linux Enterprise 12:

      zypper in -t patch 5568=1

   To bring your system up-to-date, use "zypper patch".

Package List:

   - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64):



More information about the sle-security-updates mailing list