-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Tue, 27 Sep 2022 14:14:44 -0400 Source: chromium Architecture: source Version: 106.0.5249.61-1~deb11u1 Distribution: bullseye-security Urgency: high Maintainer: Debian Chromium Team <chromium@packages.debian.org> Changed-By: Andres Salomon <dilinger@debian.org> Changes: chromium (106.0.5249.61-1~deb11u1) bullseye-security; urgency=high . * New upstream stable release. - CVE-2022-3304: Use after free in CSS. Reported by Anonymous. - CVE-2022-3201: Insufficient validation of untrusted input in Developer Tools. Reported by NDevTK. - CVE-2022-3305: Use after free in Survey. Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Vulnerability Research Institute. - CVE-2022-3306: Use after free in Survey. Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Vulnerability Research Institute. - CVE-2022-3307: Use after free in Media. Reported by Anonymous Telecommunications Corp. Ltd. - CVE-2022-3308: Insufficient policy enforcement in Developer Tools. Reported by Andrea Cappa (zi0Black) @ Shielder. - CVE-2022-3309: Use after free in Assistant. Reported by zh1x1an1221 of Ant Group Tianqiong Security Lab. - CVE-2022-3310: Insufficient policy enforcement in Custom Tabs. Reported by Ashwin Agrawal from Optus, Sydney. - CVE-2022-3311: Use after free in Import. Reported by Samet Bekmezci @sametbekmezci. - CVE-2022-3312: Insufficient validation of untrusted input in VPN. Reported by Andr.Ess. - CVE-2022-3313: Incorrect security UI in Full Screen. Reported by Irvan Kurniawan (sourc7). - CVE-2022-3314: Use after free in Logging. Reported by Anonymous. - CVE-2022-3315: Type confusion in Blink. Reported by Anonymous. - CVE-2022-3316: Insufficient validation of untrusted input in Safe Browsing. Reported by Sven Dysthe (@svn_dy). - CVE-2022-3317: Insufficient validation of untrusted input in Intents. Reported by Hafiizh. - CVE-2022-3318: Use after free in ChromeOS Notifications. Reported by GraVity0. * debian/patches: - disable/angle-perftests.patch: drop most of patch. build_angle_perftests=false is set in d/rules, so no need to patch it and its dependencies. - upstream/browser-finder.patch: drop, merged upstream. - upstream/disk-cache.patch: drop, merged upstream. - upstream/masklayer-geom.patch: drop, merged upstream. - fixes/tflite.patch: drop, merged upstream. - bullseye/clang13.patch: update for upstream switching from one unsupported clang warning flag to another. - disable/catapult.patch: refresh. - disable/installer.patch: drop, as there's no real need to delete chrome/install_static; there's no licensing issues and it's only actually built on windows. - upstream/fix-missing-cmath.patch: added from upstream to fix ftbfs. - upstream/fix-nullptr-qual.patch: added from upstream to fix ftbfs. - fixes/fix-arm-vfpv3-d16-libaom.patch: add to fix a problem that was currently papered over by disabling libaom on arm. This new patch (hopefully) allows libaom to be built for the armhf arch. - disable/libaom-arm.patch: drop now that we've fixed libaom on arm. - system/event.patch: remove some old unused bits that patch gn. * Stop deleting chrome/install_static in d/copyright, and also start deleting third party libraries that we began linking to in v105 as well as tools/gn. Checksums-Sha1: 1a2382845a5cb5890e029fef787f412221cce208 3703 chromium_106.0.5249.61-1~deb11u1.dsc 7a4e624a907d1d3a3cece2eca9b420e838d8b895 647344332 chromium_106.0.5249.61.orig.tar.xz f83a6f3bbd994f318ed6e315876c88e4716283cf 212036 chromium_106.0.5249.61-1~deb11u1.debian.tar.xz efa26d7b7ecf09ed1f6e14334ee8835b0ac0ec97 21201 chromium_106.0.5249.61-1~deb11u1_source.buildinfo Checksums-Sha256: 6c99ec07764a99fb1ca2c00e2a090afacc1857ce6417ab02b0287bf42fa2517a 3703 chromium_106.0.5249.61-1~deb11u1.dsc 06fdc419b7af543cc870581a34d205401c294e79b2b88d0c5307fbd33d94c4e0 647344332 chromium_106.0.5249.61.orig.tar.xz 414fab1ae33c94820755665b44400aca3b746e2f0403687ca34f3c10589a8788 212036 chromium_106.0.5249.61-1~deb11u1.debian.tar.xz e4977dad2250b67652687594069bd30bdbb27d5c99e40d21de189e808216a613 21201 chromium_106.0.5249.61-1~deb11u1_source.buildinfo Files: fb88cc0f2a7a213e3c45eadd7cec9a41 3703 web optional chromium_106.0.5249.61-1~deb11u1.dsc 203e7beced2de971b2ff4b0cc474cd1c 647344332 web optional chromium_106.0.5249.61.orig.tar.xz 7f8841e8eca37378ff9fe042a65f41a0 212036 web optional chromium_106.0.5249.61-1~deb11u1.debian.tar.xz b402f6cf65fe9a7389ab3877dd8cc9cc 21201 web optional chromium_106.0.5249.61-1~deb11u1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQJIBAEBCAAyFiEEUAUk+X1YiTIjs19qZF0CR8NudjcFAmMzRhwUHGRpbGluZ2Vy QGRlYmlhbi5vcmcACgkQZF0CR8NudjdLGw/+K04sG08C20sDDfyy3CSqQrQQ+NDL sMyL1Bm6QmEM1QvWrn2amMzJS1iTIpmODOzSZkuBdUgFULtdpDjgxEWFXYxazVqw wXqXL8ZTiVzR9W4WW505SOk37MMHpQBYXfzgHd+eTlbQJzRPh2WrPGTuF+zGmKcl JrRqMdhwU0d2qnR4nKddXFDRFtBVYoMdhgQVKx6qsj0C4UPSYC1XFjOK6KHbUv6z Xel3P3FU3y8L4MX1dhtena8PZ6IgF6nY2EVUtjV4Z4+38yvm29DPzFKPL+xEiCnO taEQmOkphdM+67j7+7yKNekdC17u33+Jxf8ZeoeLEQmczoL/TEcdaPNIvYJcB83/ 4N8wF+2p049ZD3KdnfXiiHQh74DLr0dHmvYtIRS4MmLFqh+9s7yBy8UCZ5G0MfH+ ebU1nfTrCTv8soJ8qW2Rz0n6Vju8UaP9o3lE6DM1Zeut/G/SXDlDg4fhEhqZUEYz J7IHNLzMHn/wchQBVS0di5Riy04il9arK/UDPwjt8NOaHm+wgZPufnjavAIKrBvw LMDTYfF4oIIx7Nxzn05uelU1QFwos8RgU3JgTuJC2Df/fIPX2k/v+WUO6zlGJzFr Ddxy0dmU2zkorF3iHaGVKkZFGIxwhY1dicq7PpjCFW54oNLJIDACbb3n5DkJqUBy AkedCJrqRypLdc4= =hhom -----END PGP SIGNATURE-----