* Tue Dec 13 2016 idonmez@suse.com
- python-html5lib now depends on six, so preserve that too for SLE
builds.
* Fri Dec 09 2016 astieger@suse.com
- Obsolete ffmpeg and ffmpegsumo package in addition to conflict
* Mon Dec 05 2016 astieger@suse.com
- record minimum version for harfbuzz, incuding runtime
Chromium will crash with harfbuzz < 1.3.0
* Sat Dec 03 2016 tchvatal@suse.com
- Chromium 55.0.2883.75 bnc#1013236:
CVE-2016-9651 CVE-2016-5208 CVE-2016-5207 CVE-2016-5206 CVE-2016-5205
CVE-2016-5204 CVE-2016-5209 CVE-2016-5203 CVE-2016-5210 CVE-2016-5212
CVE-2016-5211 CVE-2016-5213 CVE-2016-5214 CVE-2016-5216 CVE-2016-5215
CVE-2016-5217 CVE-2016-5218 CVE-2016-5219 CVE-2016-5221 CVE-2016-5220
CVE-2016-5222 CVE-2016-9650 CVE-2016-5223 CVE-2016-5226 CVE-2016-5225
CVE-2016-5224 CVE-2016-9652
- Switch to system libraries: harfbuzz, zlib, ffmpeg, ...
- Refreshed patches:
* chromium-system-ffmpeg-r3.patch
* chromium-system-jinja-r13.patch
- Use system ffmpeg unless on 13.2 that didn't include it
* chromium-54-ffmpeg2compat.patch
* Remove upstreamed chromium-more-codec-aliases.patch
- Remove bookmarks override as discussed with artwork simply just set
homepage to our openSUSE one and that is all
* Sat Nov 12 2016 astieger@suse.com
- Chromium 54.0.2840.100:
* CVE-2016-5199: Heap corruption in FFmpeg (boo#1009892)
* CVE-2016-5200: out of bounds memory access in v8 (boo#1009893)
* CVE-2016-5201: info leak in extensions (boo#1009894)
* CVE-2016-5202: various fixes from internal audits (boo#1009895)
Version: 100.0.4896.88-bp153.2.82.1
* Tue Apr 12 2022 Andreas Stieger <andreas.stieger@gmx.de>
- Chromium 100.0.4896.88 (boo#1198361)
* CVE-2022-1305: Use after free in storage
* CVE-2022-1306: Inappropriate implementation in compositing
* CVE-2022-1307: Inappropriate implementation in full screen
* CVE-2022-1308: Use after free in BFCache
* CVE-2022-1309: Insufficient policy enforcement in developer tools
* CVE-2022-1310: Use after free in regular expressions
* CVE-2022-1311: Use after free in Chrome OS shell
* CVE-2022-1312: Use after free in storage
* CVE-2022-1313: Use after free in tab groups
* CVE-2022-1314: Type Confusion in V8
* Various fixes from internal audits, fuzzing and other initiatives
* Sun Apr 10 2022 Callum Farmer <gmbr3@opensuse.org>
- Patches for GCC 12:
* chromium-fix-swiftshader-template.patch
* chromium-missing-include-tuple.patch
* chromium-webrtc-stats-missing-vector.patch
* Tue Apr 05 2022 Andreas Stieger <andreas.stieger@gmx.de>
- Chromium 100.0.4896.75:
* CVE-2022-1232: Type Confusion in V8 (boo#1198053)
* Wed Mar 30 2022 Callum Farmer <gmbr3@opensuse.org>
- Chromium 100.0.4896.60 (boo#1197680)
* CVE-2022-1125: Use after free in Portals
* CVE-2022-1127: Use after free in QR Code Generator
* CVE-2022-1128: Inappropriate implementation in Web Share API
* CVE-2022-1129: Inappropriate implementation in Full Screen Mode
* CVE-2022-1130: Insufficient validation of untrusted input in WebOTP
* CVE-2022-1131: Use after free in Cast UI
* CVE-2022-1132: Inappropriate implementation in Virtual Keyboard
* CVE-2022-1133: Use after free in WebRTC
* CVE-2022-1134: Type Confusion in V8
* CVE-2022-1135: Use after free in Shopping Cart
* CVE-2022-1136: Use after free in Tab Strip
* CVE-2022-1137: Inappropriate implementation in Extensions
* CVE-2022-1138: Inappropriate implementation in Web Cursor
* CVE-2022-1139: Inappropriate implementation in Background Fetch API
* CVE-2022-1141: Use after free in File Manager
* CVE-2022-1142: Heap buffer overflow in WebUI
* CVE-2022-1143: Heap buffer overflow in WebUI
* CVE-2022-1144: Use after free in WebUI
* CVE-2022-1145: Use after free in Extensions
* CVE-2022-1146: Inappropriate implementation in Resource Timing
- Added patches:
* chromium-100-compiler.patch
* chromium-100-GLImplementationParts-constexpr.patch
* chromium-100-InMilliseconds-constexpr.patch
* chromium-100-SCTHashdanceMetadata-move.patch
* chromium-100-macro-typo.patch
- Removed patches:
* chromium-98-compiler.patch
* chromium-86-nearby-explicit.patch
* chromium-glibc-2.34.patch
* chromium-v8-missing-utility-include.patch
* chromium-99-AutofillAssistantModelExecutor-NoDestructor.patch
* Tue Mar 29 2022 Andreas Schwab <schwab@suse.de>
- Update disk constraints
Version: 51.0.2704.103-85.3
* Fri Jun 17 2016 astieger@suse.com
- Update to Chromium 51.0.2704.103
* Security fixes:
- CVE-2016-1704: Various fixes from internal audits, fuzzing and
other initiatives (boo#985397)
* Tue Jun 07 2016 tittiatcoke@gmail.com
- Update to Chromium 51.0.2704.84
* No further changelog
* Thu Jun 02 2016 astieger@suse.com
- Update to Chromium 51.0.2704.79 [boo#982719]
* Security fixes:
- CVE-2016-1696: Cross-origin bypass in Extension bindings
- CVE-2016-1697: Cross-origin bypass in Blink
- CVE-2016-1698: Information leak in Extension bindings
- CVE-2016-1699: Parameter sanitization failure in DevTools
- CVE-2016-1700: Use-after-free in Extensions
- CVE-2016-1701: Use-after-free in Autofill
- CVE-2016-1702: Out-of-bounds read in Skia
- CVE-2016-1703: Various fixes from internal audits, fuzzing
and other initiatives.
* Thu May 26 2016 tittiatcoke@gmail.com
- Update to Chromium 51.0.2704.63 [boo#981886]
* Security fixes:
- CVE-2016-1672: Cross-origin bypass in extension bindings
- CVE-2016-1673: Cross-origin bypass in Blink
- CVE-2016-1674: Cross-origin bypass in extensions
- CVE-2016-1675: Cross-origin bypass in Blink
- CVE-2016-1676: Cross-origin bypass in extension bindings
- CVE-2016-1677: Type confusion in V8
- CVE-2016-1678: Heap overflow in V8
- CVE-2016-1679: Heap use-after-free in V8 bindings
- CVE-2016-1680: Heap use-after-free in Skia
- CVE-2016-1681: Heap overflow in PDFium
- CVE-2016-1682: CSP bypass for ServiceWorker
- CVE-2016-1683: Out-of-bounds access in libxslt
- CVE-2016-1684: Integer overflow in libxslt
- CVE-2016-1685: Out-of-bounds read in PDFium
- CVE-2016-1686: Out-of-bounds read in PDFium
- CVE-2016-1687: Information leak in extensions
- CVE-2016-1688: Out-of-bounds read in V8
- CVE-2016-1689: Heap buffer overflow in media
- CVE-2016-1690: Heap use-after-free in Autofill
- CVE-2016-1691: Heap buffer-overflow in Skia
- CVE-2016-1692: Limited cross-origin bypass in ServiceWorker
- CVE-2016-1693: HTTP Download of Software Removal Tool
- CVE-2016-1694: HPKP pins removed on cache clearance
- CVE-2016-1695: Various fixes from internal audits, fuzzing
and other initiatives
- drop chromium-50.0.2661.75-export_blink_Platform_symbols_in_shared_library_builds.patch
now upstream
* Fri May 13 2016 astieger@suse.com
- Update to Chromium 50.0.2661.102 (boo#979859)
* Security fixes:
- CVE-2016-1667: Same origin bypass in DOM
- CVE-2016-1668: Same origin bypass in Blink V8 bindings
- CVE-2016-1669: Buffer overflow in V8
- CVE-2016-1670: Race condition in loader
* Fri Apr 29 2016 astieger@suse.com
- Update to Chromium 50.0.2661.94 (boo#977830)
* Security fixes:
- CVE-2016-1660: Out-of-bounds write in Blink
- CVE-2016-1661: Memory corruption in cross-process frames
- CVE-2016-1662: Use-after-free in extensions
- CVE-2016-1663: Use-after-free in Blink?s V8 bindings
- CVE-2016-1664: Address bar spoofing
- CVE-2016-1665: Information leak in V8
- CVE-2016-1666: Various fixes from internal audits, fuzzing and other initiatives
* Fri Apr 22 2016 jslaby@suse.com
- _constraints: increase memory. It takes 1.2G to build some .o, and
with -j4 this results in OOM.
* Thu Apr 14 2016 tittiatcoke@gmail.com
- Update to Chromium 50.0.2661.75 (boo#975572)
* Security Fixes:
- CVE-2016-1652: Universal XSS in extension bindings
- CVE-2016-1653: Out-of-bounds write in V8
- CVE-2016-1651: Out-of-bounds read in Pdfium JPEG2000 decoding
- CVE-2016-1654: Uninitialized memory read in media
- CVE-2016-1655: Use-after-free related to extensions
- CVE-2016-1656: Android downloaded file path restriction bypass
- CVE-2016-1657: Address bar spoofing
- CVE-2016-1658: Potential leak of sensitive information to
malicious extensions
- CVE-2016-1659: Various fixes from internal audits, fuzzing
and other initiatives
- add patch to fix GCC builds with component=shared_library:
chromium-50.0.2661.75-export_blink_Platform_symbols_in_shared_library_builds.patch
* Fri Apr 08 2016 astieger@suse.com
- Update to Chromium 49.0.2623.112
* Block user removal when login attempt is in progress
* Add the SuppressUnsupportedOSWarning policy setting
* Fix how Save-Page-As responds to web requests blocked by extensions
* Fix preferred width calculation for 8bit ltr runs in rtl blocks
* Wed Mar 30 2016 tittiatcoke@gmail.com
- Update to Chromium 49.0.2623.110
* No changelog available
* Mon Mar 28 2016 tittiatcoke@gmail.com
- Update to Chromium 49.0.2623.108
* Security fixes (boo#972834):
- CVE-2016-1646: Out-of-bounds read in V8
- CVE-2016-1647: Use-after-free in Navigation
- CVE-2016-1648: Use-after-free in Extensions
- CVE-2016-1649: Buffer overflow in libANGLE
- CVE-2016-1650: Various fixes from internal audits, fuzzing
and other initiatives
- CVE-2016-3679: Multiple vulnerabilities in V8 fixed at the
tip of the 4.9 branch (currently 4.9.385.33).
* Wed Mar 09 2016 tittiatcoke@gmail.com
- Update to Chromium 49.0.2623.87
* Security fixes:
- CVE-2016-1643: Type confusion in Blink (boo#970514)
- CVE-2016-1644: Use-after-free in Blink (boo#970509)
- CVE-2016-1645: Out-of-bounds write in PDFium (boo#970511)
* Tue Mar 08 2016 tittiatcoke@gmail.com
- Change the build method used on Packman.
* Drop patch no-clang-on-packman.diff . This is no longer required
as that ninja is respecting the build flags correctly.
- Drop unused patch skia.patch
* Fri Mar 04 2016 tittiatcoke@gmail.com
- Update to Chromium 49.0.2623.75
* 26 security fixes, with the most important ones being:
- CVE-2016-1630: Same-origin bypass in Blink
- CVE-2016-1631: Same-origin bypass in Pepper Plugin
- CVE-2016-1632: Bad cast in Extensions
- CVE-2016-1633: Use-after-free in Blink
- CVE-2016-1634: Use-after-free in Blink
- CVE-2016-1635: Use-after-free in Blink
- CVE-2016-1636: SRI Validation Bypass
- CVE-2015-8126: Out-of-bounds access in libpng
- CVE-2016-1637: Information Leak in Skia
- CVE-2016-1638: WebAPI Bypass
- CVE-2016-1639: Use-after-free in WebRTC
- CVE-2016-1640: Origin confusion in Extensions UI
- CVE-2016-1641: Use-after-free in Favicon
- CVE-2016-1642: Various fixes from internal audits, fuzzing
and other initiatives
- Multiple vulnerabilities in V8 fixed at the tip of the 4.9
branch (currently 4.9.385.26)
(boo#969333)
* Fri Feb 19 2016 tittiatcoke@gmail.com
- Update to Chromium 48.0.2564.116
* Fixes a critical security flaw:
- CVE-2016-1629: Same-origin bypass in Blink and Sandbox
escape in Chrome. (boo#967376)
* Mon Feb 15 2016 tittiatcoke@gmail.com
- Update to Chromium 48.0.2564.109
* Security fixes (boo#965999)
- CVE-2016-1622: Same-origin bypass in Extensions
- CVE-2016-1623: Same-origin bypass in DOM
- CVE-2016-1624: Buffer overflow in Brotli
- CVE-2016-1625: Navigation bypass in Chrome Instant
- CVE-2016-1626: Out-of-bounds read in PDFium
- CVE-2016-1627: Various fixes from internal audits, fuzzing
and other initiatives
* Sat Feb 13 2016 tittiatcoke@gmail.com
- Drop the libva support completely. It seems that this is causing
more issues than it actually resolves. (boo#965566)
* Drop chromium-enable-vaapi.patch
* Thu Feb 11 2016 tittiatcoke@gmail.com
- Don't build with libva support for openSUSE 13.2 and lower
(boo#966082)
* Tue Feb 09 2016 tittiatcoke@gmail.com
- Drop completely the option to build with system libraries. This
could lead to issues (boo#965738)
* Fri Feb 05 2016 tittiatcoke@gmail.com
- Update to Chromium 48.0.2564.103
* No chnagelog available
Version: 52.0.2743.82-89.1
* Thu Jul 21 2016 tittiatcoke@gmail.com
- Temporarily disable fix_network_api_crash.patch. Upstream has
changed part of their code, so hopefully that resolved the issue
* Thu Jul 21 2016 tittiatcoke@gmail.com
- Update to Chromium 52.0.2743.82
* Security fixes (boo#989901):
+ CVE-2016-1706: Sandbox escape in PPAPI
+ CVE-2016-1707: URL spoofing on iOS
+ CVE-2016-1708: Use-after-free in Extensions
+ CVE-2016-1709: Heap-buffer-overflow in sfntly
+ CVE-2016-1710: Same-origin bypass in Blink
+ CVE-2016-1711: Same-origin bypass in Blink
+ CVE-2016-5127: Use-after-free in Blink
+ CVE-2016-5128: Same-origin bypass in V8
+ CVE-2016-5129: Memory corruption in V8
+ CVE-2016-5130: URL spoofing
+ CVE-2016-5131: Use-after-free in libxml
+ CVE-2016-5132: Limited same-origin bypass in Service Workers
+ CVE-2016-5133: Origin confusion in proxy authentication
+ CVE-2016-5134: URL leakage via PAC script
+ CVE-2016-5135: Content-Security-Policy bypass
+ CVE-2016-5136: Use after free in extensions
+ CVE-2016-5137: History sniffing with HSTS and CSP
+ CVE-2016-1705: Various fixes from internal audits, fuzzing
and other initiatives
* Mon Jul 11 2016 Nick_Levinson@yahoo.com
- Clarification/correction to chromium-desktop-gnome and
chromium-desktop-kde software descriptions due to passwords
preservation reported by Chromium developer
* Fri Jun 24 2016 tittiatcoke@gmail.com
- Update to Chromium 51.0.2704.106
* No changelog indicated
* Thu Jun 23 2016 tittiatcoke@gmail.com
- Add gcc60-fixes.diff to resolve the crashes observed with
chromium when compiled with GCC6
Version: 53.0.2785.113-100.1
* Wed Sep 14 2016 tchvatal@suse.com
- Version update to 53.0.2785.113 bnc#998743:
* CVE-2016-5170 Use after free in Blink
* CVE-2016-5171 Use after free in Blink
* CVE-2016-5172 Arbitrary Memory Read in v8
* CVE-2016-5173 Extension resource access
* CVE-2016-5174 Popup not correctly suppressed
* CVE-2016-5175 Various fixes from internal audits
* Mon Sep 12 2016 tchvatal@suse.com
- Reenable widevine build again bnc#998328
* Sat Sep 10 2016 tchvatal@suse.com
- Stable channel update to 53.0.2785.101
* SPDY crasher fixes
* Disable NV12 DXGI video on AMD
* Forward --password-store switch to os_crypt
* Tell the kernel to discard USB requests when they time out.
* Wed Sep 07 2016 astieger@suse.com
- Update to Chromium 53.0.2785.92:
* Revert of support relocatable RPM packages
* disallow WKBackForwardListItem navigations for pushState pages
* arc: bluetooth: Fix advertised uuid
* fix conflicting PendingIntent for stop button and swipe away
Version: 53.0.2785.143-106.1
* Fri Sep 30 2016 tchvatal@suse.com
- Version update to 53.0.2785.143 bnc#1002140:
* CVE-2016-5177: Use after free in V8
* CVE-2016-5178: Various fixes from internal audits
* Mon Sep 26 2016 dimstar@opensuse.org
- Export GDK_BACKEND=x11 before starting chromium, ensuring that
it's started as an Xwayland client (boo#1001135).
* Sat Sep 17 2016 tchvatal@suse.com
- Apply sandbox patch to fix crashers on tumbleweed bnc#999091
* chromium-sandbox.patch
* Thu Sep 15 2016 tchvatal@suse.com
- Version update stable channel 53.0.2785.116
* Just smal bugfixes around
Version: 53.0.2785.89-96.1
* Thu Sep 01 2016 tittiatcoke@gmail.com
- Update to Chromium 53.0.2785.89
- Improvements to the GN build system (boo#996032, boo#99606, boo#995932)
- Security fixes (boo#996648)
* CVE-2016-5147: Universal XSS in Blink.
* CVE-2016-5148: Universal XSS in Blink.
* CVE-2016-5149: Script injection in extensions.
* CVE-2016-5150: Use after free in Blink.
* CVE-2016-5151: Use after free in PDFium.
* CVE-2016-5152: Heap overflow in PDFium.
* CVE-2016-5153: Use after destruction in Blink.
* CVE-2016-5154: Heap overflow in PDFium.
* CVE-2016-5155: Address bar spoofing.
* CVE-2016-5156: Use after free in event bindings.
* CVE-2016-5157: Heap overflow in PDFium.
* CVE-2016-5158: Heap overflow in PDFium.
* CVE-2016-5159: Heap overflow in PDFium.
* CVE-2016-5161: Type confusion in Blink.
* CVE-2016-5162: Extensions web accessible resources bypass.
* CVE-2016-5163: Address bar spoofing.
* CVE-2016-5164: Universal XSS using DevTools.
* CVE-2016-5165: Script injection in DevTools.
* CVE-2016-5166: SMB Relay Attack via Save Page As.
* CVE-2016-5160: Extensions web accessible resources bypass.
- Drop patches chromium-snapshot-toolchain-r1.patch
* Sat Aug 27 2016 tittiatcoke@gmail.com
- Make it build on ARM.
* Add build patch arm_use_right_compiler.patch
- Drop unnecessary patches:
* chromium-arm-r0.patch
* Mon Aug 22 2016 tittiatcoke@gmail.com
- Change buildsystem to GN, which is the new upstream default
* Make Ninja only use 4 buildprocesses for building Chromium itself
* Drop unnecessary patches
- chromium-gcc-fixes.patch
- adjust-ldflags-no-keep-memory.patch
- gcc50-fixes.diff
* Add patches to ensure correct build
- chromium-last-commit-position-r0.patch
- chromium-snapshot-toolchain-r1.patch
* Drop unnecessary sourcefiles
- courgette.tar.xz
- depot_tools.tar.xz
- gn-binaries.tar.xz
* Fri Aug 12 2016 tittiatcoke@gmail.com
- Use an explicit number of ninja build processes (-j 4), to
further reduce the memory used.