openSUSE Security Update: chromium to 32.0.1700.102
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2014:0243-1
Rating:             important
References:         #861013 
Cross-References:   CVE-2013-6641 CVE-2013-6643 CVE-2013-6644
                    CVE-2013-6645 CVE-2013-6646 CVE-2013-6649
                    CVE-2013-6650
Affected Products:
                    openSUSE 13.1
                    openSUSE 12.3
______________________________________________________________________________

   An update that fixes 7 vulnerabilities is now available.

Description:


   Chromium was updated to version 32.0.1700.102: Stable
   channel update:
   - Security Fixes:
   * CVE-2013-6649: Use-after-free in SVG images
   * CVE-2013-6650: Memory corruption in V8
   * and 12 other fixes
   - Other:
   * Mouse Pointer disappears after exiting full-screen
   mode
   * Drag and drop files into Chromium may not work
   properly
   * Quicktime Plugin crashes in Chromium
   * Chromium becomes unresponsive
   * Trackpad users may not be able to scroll horizontally
   * Scrolling does not work in combo box
   * Chromium does not work with all CSS minifiers such
   as  whitespace around a media query's `and` keyword

   - Update to Chromium 32.0.1700.77 Stable channel update:
   - Security fixes:
   * CVE-2013-6646: Use-after-free in web workers
   * CVE-2013-6641: Use-after-free related to forms
   * CVE-2013-6643: Unprompted sync with an attacker’s
   Google account
   * CVE-2013-6645: Use-after-free related to speech
   input  elements
   * CVE-2013-6644: Various fixes from internal audits,
   fuzzing  and other initiatives
   - Other:
   * Tab indicators for sound, webcam and casting
   * Automatically blocking malware files
   * Lots of under the hood changes for stability and
   performance
   - Remove patch chromium-fix-chromedriver-build.diff as
   that  chromedriver is fixed upstream

   - Updated ExcludeArch to exclude aarch64, ppc, ppc64 and
   ppc64le.  This is based on missing build requires
   (valgrind, v8, etc)


Patch Instructions:

   To install this openSUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - openSUSE 13.1:

      zypper in -t patch openSUSE-2014-135

   - openSUSE 12.3:

      zypper in -t patch openSUSE-2014-135

   To bring your system up-to-date, use "zypper patch".


Package List:

   - openSUSE 13.1 (i586 x86_64):

      chromedriver-32.0.1700.102-17.2
      chromedriver-debuginfo-32.0.1700.102-17.2
      chromium-32.0.1700.102-17.2
      chromium-debuginfo-32.0.1700.102-17.2
      chromium-debugsource-32.0.1700.102-17.2
      chromium-desktop-gnome-32.0.1700.102-17.2
      chromium-desktop-kde-32.0.1700.102-17.2
      chromium-ffmpegsumo-32.0.1700.102-17.2
      chromium-ffmpegsumo-debuginfo-32.0.1700.102-17.2
      chromium-suid-helper-32.0.1700.102-17.2
      chromium-suid-helper-debuginfo-32.0.1700.102-17.2

   - openSUSE 12.3 (i586 x86_64):

      chromedriver-32.0.1700.102-1.25.2
      chromedriver-debuginfo-32.0.1700.102-1.25.2
      chromium-32.0.1700.102-1.25.2
      chromium-debuginfo-32.0.1700.102-1.25.2
      chromium-debugsource-32.0.1700.102-1.25.2
      chromium-desktop-gnome-32.0.1700.102-1.25.2
      chromium-desktop-kde-32.0.1700.102-1.25.2
      chromium-ffmpegsumo-32.0.1700.102-1.25.2
      chromium-ffmpegsumo-debuginfo-32.0.1700.102-1.25.2
      chromium-suid-helper-32.0.1700.102-1.25.2
      chromium-suid-helper-debuginfo-32.0.1700.102-1.25.2


References:

   http://support.novell.com/security/cve/CVE-2013-6641.html
   http://support.novell.com/security/cve/CVE-2013-6643.html
   http://support.novell.com/security/cve/CVE-2013-6644.html
   http://support.novell.com/security/cve/CVE-2013-6645.html
   http://support.novell.com/security/cve/CVE-2013-6646.html
   http://support.novell.com/security/cve/CVE-2013-6649.html
   http://support.novell.com/security/cve/CVE-2013-6650.html
   https://bugzilla.novell.com/861013

-- 
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-security-announce+help@opensuse.org