* Mon Sep 11 2017 tchvatal@suse.com
- Update to 61.0.3163.79 bsc#1057364:
* CVE-2017-5111: Use after free in PDFium.
* CVE-2017-5112: Heap buffer overflow in WebGL.
* CVE-2017-5113: Heap buffer overflow in Skia.
* CVE-2017-5114: Memory lifecycle issue in PDFium.
* CVE-2017-5115: Type confusion in V8.
* CVE-2017-5116: Type confusion in V8.
* CVE-2017-5117: Use of uninitialized value in Skia.
* CVE-2017-5118: Bypass of Content Security Policy in Blink.
* CVE-2017-5119: Use of uninitialized value in Skia.
* CVE-2017-5120: Potential HTTPS downgrade during redirect navigation.
- Rebase patch:
* fix-gn-bootstrap.diff
- Remove patches:
* chromium-gcc7.patch
* chromium-override.patch
- Add new patches:
* chromium-atk.patch
* chromium-gcc5.patch
* chromium-mojo-dep.patch
- Gtk3 is hard required from now on
- Version some of the required dependencies
* Mon Aug 28 2017 astieger@suse.com
- fix build with Factory glibc:
add chromium-60.0.3112.113-breakpad-ucontext.patch
* Fri Aug 25 2017 tchvatal@suse.com
- Version update to 60.0.3112.113:
* Various bugfixes
* Tue Aug 15 2017 tchvatal@suse.com
- Version update to 60.0.3112.101:
* various usability bugfixes
* Thu Aug 03 2017 tchvatal@suse.com
- Version update to 60.0.3112.90:
* Various usability bugfixes
* Mon Jul 24 2017 tchvatal@suse.com
- Recommend emoji fonts to make sure major web chats do not show
questionmarks
Version: 126.0.6478.126-bp155.2.94.1
* Tue Jul 09 2024 Callum Farmer <gmbr3@opensuse.org>
- Finalize 126
- Removed patches:
* chromium-125-debian-bad-font-gc2.patch
* chromium-125-debian-bad-font-gc3.patch
- Added patches:
* chromium-126-RealTimeReportingBindings-missing-decl.patch
* chromium-126-no-format.patch
* Mon Jul 01 2024 Andreas Stieger <andreas.stieger@gmx.de>
- Chromium 126.0.6478.126 (boo#1226504, boo#1226205, boo#1226933)
* CVE-2024-6290: Use after free in Dawn
* CVE-2024-6291: Use after free in Swiftshader
* CVE-2024-6292: Use after free in Dawn
* CVE-2024-6293: Use after free in Dawn
* CVE-2024-6100: Type Confusion in V8
* CVE-2024-6101: Inappropriate implementation in WebAssembly
* CVE-2024-6102: Out of bounds memory access in Dawn
* CVE-2024-6103: Use after free in Dawn
* CVE-2024-5830: Type Confusion in V8
* CVE-2024-5831: Use after free in Dawn
* CVE-2024-5832: Use after free in Dawn
* CVE-2024-5833: Type Confusion in V8
* CVE-2024-5834: Inappropriate implementation in Dawn
* CVE-2024-5835: Heap buffer overflow in Tab Groups
* CVE-2024-5836: Inappropriate Implementation in DevTools
* CVE-2024-5837: Type Confusion in V8
* CVE-2024-5838: Type Confusion in V8
* CVE-2024-5839: Inappropriate Implementation in Memory Allocator
* CVE-2024-5840: Policy Bypass in CORS
* CVE-2024-5841: Use after free in V8
* CVE-2024-5842: Use after free in Browser UI
* CVE-2024-5843: Inappropriate implementation in Downloads
* CVE-2024-5844: Heap buffer overflow in Tab Strip
* CVE-2024-5845: Use after free in Audio
* CVE-2024-5846: Use after free in PDFium
* CVE-2024-5847: Use after free in PDFium
- drop patches:
* chromium-disable-parallel-gold.patch
* chromium-125-appservice-include.patch
* chromium-125-lens-include.patch
* chromium-125-mojo-bindings-include.patch
* chromium-125-no-vector-consts.patch
* chromium-125-vulkan-include.patch
* chromium-125-ninja.patch
* chromium-125-no_matching_constructor.patch
* chromium-125-missing-header-files.patch
- add patches:
* chromium-126-missing-header-files.patch
* chromium-126-quiche-interator.patch
* chromium-126-no_matching_constructor.patch
* Wed Jun 12 2024 Callum Farmer <gmbr3@opensuse.org>
- Amend fix_building_widevinecdm_with_chromium.patch to allow
Widevine on ARM64 (bsc#1226170)
Version: 124.0.6367.201-bp155.2.78.1
* Fri May 10 2024 Andreas Stieger <andreas.stieger@gmx.de>
- Chromium 124.0.6367.201 (boo#1224208)
* CVE-2024-4671: Use after free in Visuals
- Chromium 124.0.6367.155 (boo#1224045)
* CVE-2024-4558: Use after free in ANGLE
* CVE-2024-4559: Heap buffer overflow in WebAudio
* Fri May 03 2024 ro@suse.de
- drop patches:
* chromium-123-WebUI-static_assert.patch
* Thu May 02 2024 Andreas Stieger <andreas.stieger@gmx.de>
- Chromium 124.0.6367.118 (boo#1223846)
* CVE-2024-4331: Use after free in Picture In Picture
* CVE-2024-4368: Use after free in Dawn
* Wed May 01 2024 Callum Farmer <gmbr3@opensuse.org>
- Add patches:
* chromium-123-missing-QtGui.patch
- Restore libxml 2.12 check for chromium-124-system-libxml.patch
which replaced chromium-121-blink-libxml-const.patch
* Fri Apr 26 2024 ro@suse.de
- Chromium 124.0.6367.78 (boo#1223845)
* CVE-2024-4058: Type Confusion in ANGLE
* CVE-2024-4059: Out of bounds read in V8 API
* CVE-2024-4060: Use after free in Dawn
* Wed Apr 17 2024 ro@suse.de
- Chromium 124.0.6367.60 (boo#1222958)
* CVE-2024-3832: Object corruption in V8.
* CVE-2024-3833: Object corruption in WebAssembly.
* CVE-2024-3834: Use after free in Downloads. Reported by ChaobinZhang
* CVE-2024-3837: Use after free in QUIC.
* CVE-2024-3838: Inappropriate implementation in Autofill.
* CVE-2024-3839: Out of bounds read in Fonts.
* CVE-2024-3840: Insufficient policy enforcement in Site Isolation.
* CVE-2024-3841: Insufficient data validation in Browser Switcher.
* CVE-2024-3843: Insufficient data validation in Downloads.
* CVE-2024-3844: Inappropriate implementation in Extensions.
* CVE-2024-3845: Inappropriate implementation in Network.
* CVE-2024-3846: Inappropriate implementation in Prompts.
* CVE-2024-3847: Insufficient policy enforcement in WebUI.
- drop patches:
* chromium-123-optional2.patch
* chromium-122-avoid-SFINAE-TypeConverter.patch
* chromium-123-PA-InternalAllocator.patch
- rediff patches:
* chromium-110-compiler.patch
* chromium-120-emplace.patch
* chromium-122-no_matching_constructor.patch
* chromium-122-lp155-typename.patch
- add patches: from debian/fixes
* chromium-123-stats-collector.patch
- add patches: from debian/upstream
* chromium-124-angle-powf.patch
* chromium-124-atomic.patch
* chromium-124-extractor-bitset.patch
* chromium-124-fps-optional.patch
* chromium-124-span-optional.patch
* chromium-124-uint-includes.patch
* chromium-124-webgpu-optional.patch
- add patches:
* chromium-123-WebUI-static_assert.patch
workaround for compile issue in webui_contents_wrapper.h
* chromium-124-system-libxml.patch (from fedora)
* Sun Apr 14 2024 Andreas Stieger <andreas.stieger@gmx.de>
- Chromium 123.0.6312.122 (boo#1222707)
* CVE-2024-3157: Out of bounds write in Compositing
* CVE-2024-3516: Heap buffer overflow in ANGLE
* CVE-2024-3515: Use after free in Dawn
- Chromium 123.0.6312.105 (boo#1222260)
* CVE-2024-3156: Inappropriate implementation in V8
* CVE-2024-3158: Use after free in Bookmarks
* CVE-2024-3159: Out of bounds memory access in V8
- Chromium 123.0.6312.86 (boo#1222035)
* CVE-2024-2883: Use after free in ANGLE
* CVE-2024-2885: Use after free in Dawn
* CVE-2024-2886: Use after free in WebCodecs
* CVE-2024-2887: Type Confusion in WebAssembly
- Chromium 123.0.6312.58 (boo#1221732)
* CVE-2024-2625: Object lifecycle issue in V8
* CVE-2024-2626: Out of bounds read in Swiftshader
* CVE-2024-2627: Use after free in Canvas
* CVE-2024-2628: Inappropriate implementation in Downloads
- drop patches:
* chromium-117-blink-BUILD-mnemonic.patch
* chromium-121-blink-libxml-const.patch
* chromium-122-BookmarkNode-missing-operator.patch
* chromium-122-WebUI-static_assert.patch
* chromium-122-PA-undo-internal-alloc.patch
* Mon Mar 18 2024 Callum Farmer <gmbr3@opensuse.org>
- Use Python 3.11 on Leap
- Rename chromium-122-skip_bubble_contents_wrapper_static_assert.patch
to chromium-122-WebUI-static_assert.patch
- Rename chromium-122-disable-FFmpegAllowLists.patch to
chromium-disable-FFmpegAllowLists.patch
- Rename chromium-122-static-assert.patch to
chromium-122-BookmarkNode-missing-operator.patch
- Rename chromium-122-undo-internal-alloc.patch to
chromium-122-PA-undo-internal-alloc.patch
- Rename chromium-122-typename.patch to
chromium-122-lp155-typename.patch
- Removed patches:
* chromium-121-v8-c++20-p1.patch
* chromium-121-v8-c++20.patch
* chromium-122-unique_ptr.patch
* chromium-122-python3-assignment-expressions.patch
* chromium-122-el8-support-64kpage.patch
* chromium-122-el7-inline-function.patch
* chromium-122-el7-extra-operator.patch
* chromium-122-el7-default-constructor-involving-anonymous-union.patch
* chromium-122-constexpr.patch
* chromium-122-clang-build-flags.patch
* chromium-122-clang16-disable-auto-upgrade-debug-info.patch
* chromium-122-clang16-buildflags.patch
* chromium-122-arm64-memory_tagging.patch
* chromium-121-el7-clang-version-warning.patch
* chromium-116-lp155-url_load_stats-size-t.patch
* chromium-icu72-2.patch
* chromium-122-debian-upstream-mojo.patch
- Patches merged into other patches:
* chromium-122-debian-upstream-bitset.patch
* chromium-122-debian-upstream-optional.patch
* chromium-122-debian-upstream-uniqptr.patch
* chromium-122-debian-fixes-optional.patch
* chromium-122-norar.patch
- Restore time clamper change to
chromium-122-missing-header-files.patch
- Fix missing/invalid casting in
chromium-122-no_matching_constructor.patch
Version: 122.0.6261.128-bp155.2.75.1
* Wed Mar 13 2024 Andreas Stieger <andreas.stieger@gmx.de>
- Chromium 122.0.6261.128 (boo#1221335)
* CVE-2024-2400: Use after free in Performance Manager
* Fri Mar 08 2024 ro@suse.de
- Chromium 122.0.6261.111 (boo#1220131,boo#1220604,boo#1221105)
* New upstream security release.
* CVE-2024-2173: Out of bounds memory access in V8.
* CVE-2024-2174: Inappropriate implementation in V8.
* CVE-2024-2176: Use after free in FedCM.
- Chromium 122.0.6261.94
* CVE-2024-1669: Out of bounds memory access in Blink.
* CVE-2024-1670: Use after free in Mojo.
* CVE-2024-1671: Inappropriate implementation in Site Isolation.
* CVE-2024-1672: Inappropriate implementation in Content Security Policy.
* CVE-2024-1673: Use after free in Accessibility.
* CVE-2024-1674: Inappropriate implementation in Navigation.
* CVE-2024-1675: Insufficient policy enforcement in Download.
* CVE-2024-1676: Inappropriate implementation in Navigation.
* Type Confusion in V8
* rediff chromium-disable-GlobalMediaControlsCastStartStop.patch
* drop chromium-114-lld-argument.patch
replaced by chromium-122-clang16-disable-auto-upgrade-debug-info.patch
* drop chromium-121-no_matching_constructor.patch
replaced by chromium-122-no_matching_constructor.patch
* drop chromium-113-webview-namespace.patch (obsolete)
* reduce chromium-norar.patch
by the hunks in chromium-122-norar.patch
* drop chromium-114-revert-av1enc-lp154.patch
replaced by chromium-122-revert-av1enc-el9.patch
* drop chromium-115-lp155-typename.patch
chromium-116-lp155-typenames.patch
chromium-117-lp155-typename.patch
chromium-120-lp155-typename.patch
replaced by chromium-122-typename.patch
* drop chromium-121-missing-header-files.patch
replaced by chromium-122-missing-header-files.patch
* drop chromium-121-workaround_clang_bug-structured_binding.patch
replaced by chromium-122-workaround_clang_bug-structured_binding.patch
* drop chromium-121-no_matching_constructor.patch
replaced by chromium-122-no_matching_constructor.patch
* drop chromium-121-python3-invalid-escape-sequence.patch (upstream)
* drop chromium-disable-FFmpegAllowLists.patch
replaced by chromium-122-disable-FFmpegAllowLists.patch
* drop chromium-121-avoid-SFINAE-TypeConverter.patch
replaced by chromium-122-avoid-SFINAE-TypeConverter.patch
* add buildrequires for rust
* add patches from fedora package for 121 and 122
* chromium-121-el7-clang-version-warning.patch
* chromium-121-v8-c++20-p1.patch
* chromium-121-v8-c++20.patch
* chromium-122-arm64-memory_tagging.patch
* chromium-122-clang16-buildflags.patch
* chromium-122-clang16-disable-auto-upgrade-debug-info.patch
* chromium-122-clang-build-flags.patch
* chromium-122-constexpr.patch
* chromium-122-disable-FFmpegAllowLists.patch
* chromium-122-el7-default-constructor-involving-anonymous-union.patch
* chromium-122-el7-extra-operator.patch
* chromium-122-el7-inline-function.patch
* chromium-122-el8-support-64kpage.patch
* chromium-122-missing-header-files.patch
* chromium-122-no_matching_constructor.patch
* chromium-122-norar.patch
* chromium-122-python3-assignment-expressions.patch
* chromium-122-revert-av1enc-el9.patch
* chromium-122-static-assert.patch
* chromium-122-typename.patch
* chromium-122-unique_ptr.patch
* chromium-122-workaround_clang_bug-structured_binding.patch
* from debian add
* chromium-122-undo-internal-alloc.patch
* chromium-122-debian-upstream-bitset.patch
* chromium-122-debian-upstream-mojo.patch
* chromium-122-debian-upstream-optional.patch
* chromium-122-debian-upstream-uniqptr.patch
* chromium-122-debian-fixes-optional.patch
* added compile fix needed on code15
chromium-122-skip_bubble_contents_wrapper_static_assert.patch
to prevent "static assertion expression is not an integral constant expression"
"in call to 'operator+(&"."[0], ShoppingInsightsSidePanelUI::GetWebUIName())'"
in bubble_contents_wrapper.h:153
- replace Cr121-ffmpeg-new-channel-layout.patch by
Cr122-ffmpeg-new-channel-layout.patch (rediff against 122)
- drop chromium-121-system-old-ffmpeg.patch
* Fri Mar 08 2024 Callum Farmer <gmbr3@opensuse.org>
- Add Cr121-ffmpeg-new-channel-layout.patch to rollback more FFmpeg
changes so that FFmpeg 4 will work on Leap
- Prepare for libxml 2.12
* Sat Mar 02 2024 Callum Farmer <gmbr3@opensuse.org>
- Chromium 121.0.6167.184 (boo#1219118, boo#1219387, boo#1219661)
* CVE-2024-1284: Use after free in Mojo
* CVE-2024-1283: Heap buffer overflow in Skia
* CVE-2024-1060: Use after free in Canvas
* CVE-2024-1059: Use after free in WebRTC
* CVE-2024-1077: Use after free in Network
* CVE-2024-0807: Use after free in WebAudio
* CVE-2024-0812: Inappropriate implementation in Accessibility
* CVE-2024-0808: Integer underflow in WebUI
* CVE-2024-0810: Insufficient policy enforcement in DevTools
* CVE-2024-0814: Incorrect security UI in Payments
* CVE-2024-0813: Use after free in Reading Mode
* CVE-2024-0806: Use after free in Passwords
* CVE-2024-0805: Inappropriate implementation in Downloads
* CVE-2024-0804: Insufficient policy enforcement in iOS Security UI
* CVE-2024-0811: Inappropriate implementation in Extensions API
* CVE-2024-0809: Inappropriate implementation in Autofill
- Removed patches:
* chromium-117-includes.patch
* chromium-118-includes.patch
* chromium-119-dont-redefine-ATSPI-version-macros.patch
* chromium-120-missing-header-files.patch
* chromium-120-no_matching_constructor.patch
* chromium-120-nullptr_t-without-namespace-std.patch
* chromium-120-workaround_clang_bug-structured_binding.patch
* gcc13-fix.patch
* chromium-113-webauth-include-variant.patch
* chromium-110-system-libffi.patch
- Added patches:
* chromium-121-no_matching_constructor.patch
* chromium-121-nullptr_t-without-namespace-std.patch
* chromium-121-workaround_clang_bug-structured_binding.patch
* chromium-121-missing-header-files.patch
* chromium-121-rust-clang_lib.patch
* chromium-121-python3-invalid-escape-sequence.patch
* chromium-121-rust-clang_lib.patch
* chromium-121-avoid-SFINAE-TypeConverter.patch
* chromium-121-blink-libxml-const.patch
- Add patch chromium-disable-FFmpegAllowLists.patch:
disable codec checker this will always fail (bsc#1219070)
Version: 116.0.5845.96-bp154.2.105.1
* Mon Aug 14 2023 Andreas Stieger <andreas.stieger@gmx.de>
- Chromium 116.0.5845.96
* New CSS features: Motion Path, and "display" and
"content-visibility" animations
* Web APIs: AbortSignal.any(), BYOB support for Fetch, Back/
forward cache NotRestoredReason API, Document Picture-in-
Picture, Expanded Wildcards in Permissions Policy Origins,
FedCM bundle: Login Hint API, User Info API, and RP Context API,
Non-composed Mouse and Pointer enter/leave events,
Remove document.open sandbox inheritance,
Report Critical-CH caused restart in NavigationTiming
- fix a number of security issues (boo#1214301):
* CVE-2023-2312: Use after free in Offline
* CVE-2023-4349: Use after free in Device Trust Connectors
* CVE-2023-4350: Inappropriate implementation in Fullscreen
* CVE-2023-4351: Use after free in Network
* CVE-2023-4352: Type Confusion in V8
* CVE-2023-4353: Heap buffer overflow in ANGLE
* CVE-2023-4354: Heap buffer overflow in Skia
* CVE-2023-4355: Out of bounds memory access in V8
* CVE-2023-4356: Use after free in Audio
* CVE-2023-4357: Insufficient validation of untrusted input in XML
* CVE-2023-4358: Use after free in DNS
* CVE-2023-4359: Inappropriate implementation in App Launcher
* CVE-2023-4360: Inappropriate implementation in Color
* CVE-2023-4361: Inappropriate implementation in Autofill
* CVE-2023-4362: Heap buffer overflow in Mojom IDL
* CVE-2023-4363: Inappropriate implementation in WebShare
* CVE-2023-4364: Inappropriate implementation in Permission Prompts
* CVE-2023-4365: Inappropriate implementation in Fullscreen
* CVE-2023-4366: Use after free in Extensions
* CVE-2023-4367: Insufficient policy enforcement in Extensions API
* CVE-2023-4368: Insufficient policy enforcement in Extensions API
- drop patches:
* chromium-115-add_BoundSessionRefreshCookieFetcher::Result.patch
* chromium-115-verify_name_match-include.patch
* chromium-86-fix-vaapi-on-intel.patch
* chromium-115-skia-include.patch
* chromium-115-dont-pass-nullptr-to-construct-re2-StringPiece.patch
- add patches:
* chromium-116-profile-view-utils-vector-include.patch
* chromium-116-blink-variant-include.patch
* chromium-116-lp155-url_load_stats-size-t.patch
* chromium-116-abseil-limits-include.patch
* chromium-116-lp155-typenames.patch
* chromium-116-lp155-constuctors.patch
- Build with bundled re2 on Leap
* Wed Aug 09 2023 Andreas Stieger <andreas.stieger@gmx.de>
- Fix crash with extensions (boo#1214003)
chromium-115-dont-pass-nullptr-to-construct-re2-StringPiece.patch
Version: 114.0.5735.106-bp154.2.90.1
* Tue Jun 06 2023 Andreas Stieger <andreas.stieger@gmx.de>
- Fix Leap 15.4 build - chromium-114-revert-av1enc-lp154.patch
* Tue Jun 06 2023 Andreas Stieger <andreas.stieger@gmx.de>
- Chromium 114.0.5735.106 (boo#1212044):
* CVE-2023-3079: Type Confusion in V8
* Sun Jun 04 2023 Callum Farmer <gmbr3@opensuse.org>
- Chromium 114.0.5735.90 (boo#1211843):
* CSS text-wrap: balance is available
* Cookies partitioned by top level site (CHIPS)
* New Popover API
- Security fixes:
* CVE-2023-2929: Out of bounds write in Swiftshader
* CVE-2023-2930: Use after free in Extensions
* CVE-2023-2931: Use after free in PDF
* CVE-2023-2932: Use after free in PDF
* CVE-2023-2933: Use after free in PDF
* CVE-2023-2934: Out of bounds memory access in Mojo
* CVE-2023-2935: Type Confusion in V8
* CVE-2023-2936: Type Confusion in V8
* CVE-2023-2937: Inappropriate implementation in Picture In Picture
* CVE-2023-2938: Inappropriate implementation in Picture In Picture
* CVE-2023-2939: Insufficient data validation in Installer
* CVE-2023-2940: Inappropriate implementation in Downloads
* CVE-2023-2941: Inappropriate implementation in Extensions API
- Drop patches:
* chromium-103-VirtualCursor-std-layout.patch
* chromium-113-system-zlib.patch
* chromium-113-workaround_clang_bug-structured_binding.patch
- Add patches
* chromium-114-workaround_clang_bug-structured_binding.patch
* chromium-114-lld-argument.patch
* Tue May 30 2023 Callum Farmer <gmbr3@opensuse.org>
- Un-bundle zlib again
- Remove un-needed patches:
* chromium-112-default-comparison-operators.patch
* chromium-109-clang-lp154.patch
* chromium-clang-nomerge.patch
* chromium-ffmpeg-lp152.patch
* chromium-lp151-old-drm.patch
- Added patches:
* chromium-113-system-zlib.patch
Version: 113.0.5672.126-bp154.2.87.1
* Sun May 28 2023 Andreas Stieger <andreas.stieger@gmx.de>
- build with llvm15 on Leap
* Tue May 16 2023 Andreas Stieger <Andreas.Stieger@gmx.de>
- Chromium 113.0.5672.126 (boo#1211442):
* CVE-2023-2721: Use after free in Navigation
* CVE-2023-2722: Use after free in Autofill UI
* CVE-2023-2723: Use after free in DevTools
* CVE-2023-2724: Type Confusion in V8
* CVE-2023-2725: Use after free in Guest View
* CVE-2023-2726: Inappropriate implementation in WebApp Installs
* Various fixes from internal audits, fuzzing and other initiatives
* Tue May 09 2023 Andreas Stieger <Andreas.Stieger@gmx.de>
- Chromium 113.0.5672.92 (boo#1211211)
- Multiple security fixes (boo#1211036):
* CVE-2023-2459: Inappropriate implementation in Prompts
* CVE-2023-2460: Insufficient validation of untrusted input in Extensions
* CVE-2023-2461: Use after free in OS Inputs
* CVE-2023-2462: Inappropriate implementation in Prompts
* CVE-2023-2463: Inappropriate implementation in Full Screen Mode
* CVE-2023-2464: Inappropriate implementation in PictureInPicture
* CVE-2023-2465: Inappropriate implementation in CORS
* CVE-2023-2466: Inappropriate implementation in Prompts
* CVE-2023-2467: Inappropriate implementation in Prompts
* CVE-2023-2468: Inappropriate implementation in PictureInPicture
- drop chromium-94-sql-no-assert.patch
- drop no-location-leap151.patch
- add chromium-113-webview-namespace.patch
- add chromium-113-webauth-include-variant.patch
- add chromium-113-typename.patch
- add chromium-113-workaround_clang_bug-structured_binding.patch
Version: 112.0.5615.121-bp154.2.79.1
* Sun Apr 16 2023 Andreas Stieger <andreas.stieger@gmx.de>
- Fix Leap 15.4 build failures from default comparison operators
defined outside of the class definition, a C++20 feature
adding chromium-112-default-comparison-operators.patch
* Sat Apr 15 2023 Andreas Stieger <andreas.stieger@gmx.de>
- Chromium 112.0.5615.121:
* CVE-2023-2033: Type Confusion in V8 (boo#1210478)
* Fri Apr 07 2023 Andreas Stieger <andreas.stieger@gmx.de>
- Revert a breaking change with chromium-112-feed_protos.patch
* Tue Apr 04 2023 Andreas Stieger <andreas.stieger@gmx.de>
- Chromium 112.0.5615.49
* CSS now supports nesting rules.
* The algorithm to set the initial focus on <dialog> elements was updated.
* No-op fetch() handlers on service workers are skipped from now on to make navigations faster
* The setter for document.domain is now deprecated.
* The recorder in devtools can now record with pierce selectors.
* Security fixes (boo#1210126):
* CVE-2023-1810: Heap buffer overflow in Visuals
* CVE-2023-1811: Use after free in Frames
* CVE-2023-1812: Out of bounds memory access in DOM Bindings
* CVE-2023-1813: Inappropriate implementation in Extensions
* CVE-2023-1814: Insufficient validation of untrusted input in Safe Browsing
* CVE-2023-1815: Use after free in Networking APIs
* CVE-2023-1816: Incorrect security UI in Picture In Picture
* CVE-2023-1817: Insufficient policy enforcement in Intents
* CVE-2023-1818: Use after free in Vulkan
* CVE-2023-1819: Out of bounds read in Accessibility
* CVE-2023-1820: Heap buffer overflow in Browser History
* CVE-2023-1821: Inappropriate implementation in WebShare
* CVE-2023-1822: Incorrect security UI in Navigation
* CVE-2023-1823: Inappropriate implementation in FedCM
* Mon Mar 27 2023 Andreas Stieger <andreas.stieger@gmx.de>
- Chromium 111.0.5563.147:
* nth-child() validation performance regression for SAP apps
* Thu Mar 23 2023 Guillaume GARDET <guillaume.gardet@opensuse.org>
- Update gcc13-fix.patch with few fixes required for aarch64,
borrowed from Fedora's gcc13 patch
Version: 111.0.5563.110-bp154.2.76.1
* Wed Mar 22 2023 Andreas Stieger <andreas.stieger@gmx.de>
- Chromium 111.0.5563.110 (boo#1209598)
* CVE-2023-1528: Use after free in Passwords
* CVE-2023-1529: Out of bounds memory access in WebHID
* CVE-2023-1530: Use after free in PDF
* CVE-2023-1531: Use after free in ANGLE
* CVE-2023-1532: Out of bounds read in GPU Video
* CVE-2023-1533: Use after free in WebProtect
* CVE-2023-1534: Out of bounds read in ANGLE
* Mon Mar 20 2023 Martin Liška <mliska@suse.cz>
- Add gcc13-fix.patch in order to support GCC 13.
* Thu Mar 09 2023 Callum Farmer <gmbr3@opensuse.org>
- Revert back to GCC 11 on 15.4 as Clang 13 doesn't support GCC 12
* Thu Mar 09 2023 Callum Farmer <gmbr3@opensuse.org>
- Bump Leap's GCC to 12 as Chromium really likes newer standards
Version: 60.0.3112.78-26.1
* Wed Jul 26 2017 tchvatal@suse.com
- Version update to 60.0.3112.78 bsc#1050537:
* CVE-2017-5091: Use after free in IndexedDB
* CVE-2017-5092: Use after free in PPAPI
* CVE-2017-5093: UI spoofing in Blink
* CVE-2017-5094: Type confusion in extensions
* CVE-2017-5095: Out-of-bounds write in PDFium
* CVE-2017-5096: User information leak via Android intents
* CVE-2017-5097: Out-of-bounds read in Skia
* CVE-2017-5098: Use after free in V8
* CVE-2017-5099: Out-of-bounds write in PPAPI
* CVE-2017-5100: Use after free in Chrome Apps
* CVE-2017-5101: URL spoofing in OmniBox
* CVE-2017-5102: Uninitialized use in Skia
* CVE-2017-5103: Uninitialized use in Skia
* CVE-2017-5104: UI spoofing in browser
* CVE-2017-7000: Pointer disclosure in SQLite
* CVE-2017-5105: URL spoofing in OmniBox
* CVE-2017-5106: URL spoofing in OmniBox
* CVE-2017-5107: User information leak via SVG
* CVE-2017-5108: Type confusion in PDFium
* CVE-2017-5109: UI spoofing in browser
* CVE-2017-5110: UI spoofing in payments dialog
* Various fixes from internal audits, fuzzing and other initiatives
- Add patch chromium-override.patch
- Remove patches chromium-fpermissive.patch chromium-system-ffmpeg-r3.patch
- Rebase patches:
* chromium-dma-buf.patch
* chromium-gcc7.patch
* chromium-last-commit-position-r0.patch
* fix-gn-bootstrap.diff
* Wed Jun 28 2017 tchvatal@suse.com
- Update to 59.0.3071.115:
* Various small fixes all around
* Fri Jun 23 2017 astieger@suse.com
- Update to 59.0.3071.109:
* ozone/drm: Only reuse ScanoutBuffers with compatible modifiers
* Fixing mouse focus on WebView
* Remove gtk dependency from gles tests
* Set build flag when using own FreeType
* Revert of [scheduler] Move some task types to suspendable task runner
* Fix an incorrect method name on the chrome://site-engagement WebUI page
* Linux/Windows: Removing Guest menu item for supervised profile
Version: 59.0.3071.86-20.1
* Tue Jun 06 2017 tchvatal@suse.com
- Update to 59.0.3071.86 bsc#1042833:
* CVE-2017-5070: Type confusion in V8. Reported by Zhao Qixun(@S0rryMybad) of Qihoo 360 Vulcan Team on 2017-05-16
* CVE-2017-5071: Out of bounds read in V8. Reported by Choongwoo Han on 2017-04-26
* CVE-2017-5072: Address spoofing in Omnibox. Reported by Rayyan Bijoora on 2017-04-07
* CVE-2017-5073: Use after free in print preview. Reported by Khalil Zhani on 2017-04-28
* CVE-2017-5074: Use after free in Apps Bluetooth. Reported by anonymous on 2017-03-09
* CVE-2017-5075: Information leak in CSP reporting. Reported by Emmanuel Gil Peyrot on 2017-01-05
* CVE-2017-5086: Address spoofing in Omnibox. Reported by Rayyan Bijoora on 2017-05-16
* CVE-2017-5076: Address spoofing in Omnibox. Reported by Samuel Erb on 2017-05-06
* CVE-2017-5077: Heap buffer overflow in Skia. Reported by Sweetchip on 2017-04-28
* CVE-2017-5078: Possible command injection in mailto handling. Reported by Jose Carlos Exposito Bueno on 2017-04-12
* CVE-2017-5079: UI spoofing in Blink. Reported by Khalil Zhani on 2017-04-20
* CVE-2017-5080: Use after free in credit card autofill. Reported by Khalil Zhani on 2017-04-05
* CVE-2017-5081: Extension verification bypass. Reported by Andrey Kovalev (@L1kvID) Yandex Security Team on 2016-12-07
* CVE-2017-5082: Insufficient hardening in credit card editor. Reported by Nightwatch Cybersecurity Research on 2017-05-11
* CVE-2017-5083: UI spoofing in Blink. Reported by Khalil Zhani on 2017-04-24
* CVE-2017-5085: Inappropriate javascript execution on WebUI pages. Reported by Zhiyang Zeng of Tencent security platform department on 2017-02-15
- Add patch to fix build with system dma:
* chromium-dma-buf.patch
- Drop no longer needed patches:
* chromium-linker-memory.patch
* chromium-system-jinja-r13.patch
- Refresh patches:
* chromium-gcc7.patch
* chromium-system-ffmpeg-r3.patch
* fix-gn-bootstrap.diff
- Use bundled libxml
* Upstream unfortunately uses git snapshot that is not api/abi compatible
* Mon Jun 05 2017 tchvatal@suse.com
- Add patch to build with gcc7:
* chromium-gcc7.patch
- Add patch for fpermissive build error:
* chromium-fpermissive.patch
* Wed May 10 2017 tchvatal@suse.com
- Version update to 58.0.3029.110:
* Various small bugfixes
* Wed Dec 21 2016 astieger@suse.com
- Chromium 55.0.2883.87:
* various fixes for crashes and specific wesites
* update Google pinned certificates
Version: 57.0.2987.133-11.1
* Thu Mar 30 2017 tchvatal@suse.com
- Version update to 57.0.2987.133 bsc#1031677:
* Critical CVE-2017-5055: Use after free in printing. Credit to Wadih Matar
* High CVE-2017-5054: Heap buffer overflow in V8. Credit to Nicolas Trippar of Zimperium zLabs
* High CVE-2017-5052: Bad cast in Blink. Credit to JeongHoon Shin
* High CVE-2017-5056: Use after free in Blink. Credit to anonymous
* High CVE-2017-5053: Out of bounds memory access in V8. Credit to Team Sniper (Keen Lab and PC Mgr) reported through ZDI (ZDI-CAN-4587)
* Fri Mar 24 2017 tchvatal@suse.com
- Drop the browser(npapi) provide which is not true
* Sun Mar 19 2017 tchvatal@suse.com
- Add patch to build with gcc4
* chromium-57-gcc4.patch
* Thu Mar 16 2017 tchvatal@suse.com
- Do not use gcc5 and newer as the compat was fixed again
- Update to 57.0.2987.110 with various other small tweaks
Version: 56.0.2924.87-5.1
* Wed Feb 15 2017 idonmez@suse.com
- Also add harfbuzz-ng to keeplibs for SLE
* Mon Feb 06 2017 tchvatal@suse.com
- Add condition for system harfbuzz to be disabled on SLE
* Mon Feb 06 2017 qvoheagbfovvhubzdxfx@posteo.net
- Fixed a typo in the build requirements for system minizip.
* Fri Feb 03 2017 tchvatal@suse.com
- Version update to 56.0.2924.87:
* Various small fixes
* Disabled option to enable/disable plugins in the chrome://plugins
* Thu Feb 02 2017 qvoheagbfovvhubzdxfx@posteo.net
- Added the package 'chromium-privacy' with multiple patches
sourced from the release version on https://github.com/
u4qo60z73t1c4hurv3ny/privacy_patches-oS_cr, which, when enabled
with the build option 'privacy', builds a version of Chromium
with less privacy implications due to Google services
integration.
* Wed Feb 01 2017 qvoheagbfovvhubzdxfx@posteo.net
- Changed the build requirement of libavformat to library version
57.41.100, as included in ffmpeg 3.1.1, as only this version
properly supports the public AVStream API 'codecpar'.
* Tue Jan 31 2017 tchvatal@suse.com
- Version update to 56.0.2924.76 bsc#1022049:
- CVE-2017-5007: Universal XSS in Blink
- CVE-2017-5006: Universal XSS in Blink
- CVE-2017-5008: Universal XSS in Blink
- CVE-2017-5010: Universal XSS in Blink
- CVE-2017-5011: Unauthorised file access in Devtools
- CVE-2017-5009: Out of bounds memory access in WebRTC
- CVE-2017-5012: Heap overflow in V8
- CVE-2017-5013: Address spoofing in Omnibox
- CVE-2017-5014: Heap overflow in Skia
- CVE-2017-5015: Address spoofing in Omnibox
- CVE-2017-5019: Use after free in Renderer
- CVE-2017-5016: UI spoofing in Blink
- CVE-2017-5017: Uninitialised memory access in webm video
- CVE-2017-5018: Universal XSS in chrome://apps
- CVE-2017-5020: Universal XSS in chrome://downloads
- CVE-2017-5021: Use after free in Extensions
- CVE-2017-5022: Bypass of Content Security Policy in Blink
- CVE-2017-5023: Type confusion in metrics
- CVE-2017-5024: Heap overflow in FFmpeg
- CVE-2017-5025: Heap overflow in FFmpeg
- CVE-2017-5026: UI spoofing. Credit to Ronni Skansing
- Add conditional to switch between system and bundled icu
- Raise dependency on harfbuzz to 1.3.1
- Also refresh patches:
chromium-prop-codecs.patch chromium-linker-memory.patch
* Sat Jan 28 2017 qvoheagbfovvhubzdxfx@posteo.net
- Added patch chromium-enable-vaapi-on-suse.patch to enable
VAAPI hardware accelerated video decoding.
* Wed Dec 21 2016 astieger@suse.com
- Chromium 55.0.2883.87:
* various fixes for crashes and specific wesites
* update Google pinned certificates
* Wed Dec 21 2016 tchvatal@suse.com
- Disable system icu on Factory, crashes autofill
Version: 55.0.2883.75-2.1
* Tue Dec 13 2016 idonmez@suse.com
- python-html5lib now depends on six, so preserve that too for SLE
builds.
* Fri Dec 09 2016 astieger@suse.com
- Obsolete ffmpeg and ffmpegsumo package in addition to conflict
* Mon Dec 05 2016 astieger@suse.com
- record minimum version for harfbuzz, incuding runtime
Chromium will crash with harfbuzz < 1.3.0
* Sat Dec 03 2016 tchvatal@suse.com
- Chromium 55.0.2883.75 bnc#1013236:
CVE-2016-9651 CVE-2016-5208 CVE-2016-5207 CVE-2016-5206 CVE-2016-5205
CVE-2016-5204 CVE-2016-5209 CVE-2016-5203 CVE-2016-5210 CVE-2016-5212
CVE-2016-5211 CVE-2016-5213 CVE-2016-5214 CVE-2016-5216 CVE-2016-5215
CVE-2016-5217 CVE-2016-5218 CVE-2016-5219 CVE-2016-5221 CVE-2016-5220
CVE-2016-5222 CVE-2016-9650 CVE-2016-5223 CVE-2016-5226 CVE-2016-5225
CVE-2016-5224 CVE-2016-9652
- Switch to system libraries: harfbuzz, zlib, ffmpeg, ...
- Refreshed patches:
* chromium-system-ffmpeg-r3.patch
* chromium-system-jinja-r13.patch
- Use system ffmpeg unless on 13.2 that didn't include it
* chromium-54-ffmpeg2compat.patch
* Remove upstreamed chromium-more-codec-aliases.patch
- Remove bookmarks override as discussed with artwork simply just set
homepage to our openSUSE one and that is all
* Sat Nov 12 2016 astieger@suse.com
- Chromium 54.0.2840.100:
* CVE-2016-5199: Heap corruption in FFmpeg (boo#1009892)
* CVE-2016-5200: out of bounds memory access in v8 (boo#1009893)
* CVE-2016-5201: info leak in extensions (boo#1009894)
* CVE-2016-5202: various fixes from internal audits (boo#1009895)
Version: 53.0.2785.89-96.1
* Thu Sep 01 2016 tittiatcoke@gmail.com
- Update to Chromium 53.0.2785.89
- Improvements to the GN build system (boo#996032, boo#99606, boo#995932)
- Security fixes (boo#996648)
* CVE-2016-5147: Universal XSS in Blink.
* CVE-2016-5148: Universal XSS in Blink.
* CVE-2016-5149: Script injection in extensions.
* CVE-2016-5150: Use after free in Blink.
* CVE-2016-5151: Use after free in PDFium.
* CVE-2016-5152: Heap overflow in PDFium.
* CVE-2016-5153: Use after destruction in Blink.
* CVE-2016-5154: Heap overflow in PDFium.
* CVE-2016-5155: Address bar spoofing.
* CVE-2016-5156: Use after free in event bindings.
* CVE-2016-5157: Heap overflow in PDFium.
* CVE-2016-5158: Heap overflow in PDFium.
* CVE-2016-5159: Heap overflow in PDFium.
* CVE-2016-5161: Type confusion in Blink.
* CVE-2016-5162: Extensions web accessible resources bypass.
* CVE-2016-5163: Address bar spoofing.
* CVE-2016-5164: Universal XSS using DevTools.
* CVE-2016-5165: Script injection in DevTools.
* CVE-2016-5166: SMB Relay Attack via Save Page As.
* CVE-2016-5160: Extensions web accessible resources bypass.
- Drop patches chromium-snapshot-toolchain-r1.patch
* Sat Aug 27 2016 tittiatcoke@gmail.com
- Make it build on ARM.
* Add build patch arm_use_right_compiler.patch
- Drop unnecessary patches:
* chromium-arm-r0.patch
* Mon Aug 22 2016 tittiatcoke@gmail.com
- Change buildsystem to GN, which is the new upstream default
* Make Ninja only use 4 buildprocesses for building Chromium itself
* Drop unnecessary patches
- chromium-gcc-fixes.patch
- adjust-ldflags-no-keep-memory.patch
- gcc50-fixes.diff
* Add patches to ensure correct build
- chromium-last-commit-position-r0.patch
- chromium-snapshot-toolchain-r1.patch
* Drop unnecessary sourcefiles
- courgette.tar.xz
- depot_tools.tar.xz
- gn-binaries.tar.xz
* Fri Aug 12 2016 tittiatcoke@gmail.com
- Use an explicit number of ninja build processes (-j 4), to
further reduce the memory used.
Version: 53.0.2785.143-106.1
* Fri Sep 30 2016 tchvatal@suse.com
- Version update to 53.0.2785.143 bnc#1002140:
* CVE-2016-5177: Use after free in V8
* CVE-2016-5178: Various fixes from internal audits
* Mon Sep 26 2016 dimstar@opensuse.org
- Export GDK_BACKEND=x11 before starting chromium, ensuring that
it's started as an Xwayland client (boo#1001135).
* Sat Sep 17 2016 tchvatal@suse.com
- Apply sandbox patch to fix crashers on tumbleweed bnc#999091
* chromium-sandbox.patch
* Thu Sep 15 2016 tchvatal@suse.com
- Version update stable channel 53.0.2785.116
* Just smal bugfixes around
Version: 53.0.2785.113-100.1
* Wed Sep 14 2016 tchvatal@suse.com
- Version update to 53.0.2785.113 bnc#998743:
* CVE-2016-5170 Use after free in Blink
* CVE-2016-5171 Use after free in Blink
* CVE-2016-5172 Arbitrary Memory Read in v8
* CVE-2016-5173 Extension resource access
* CVE-2016-5174 Popup not correctly suppressed
* CVE-2016-5175 Various fixes from internal audits
* Mon Sep 12 2016 tchvatal@suse.com
- Reenable widevine build again bnc#998328
* Sat Sep 10 2016 tchvatal@suse.com
- Stable channel update to 53.0.2785.101
* SPDY crasher fixes
* Disable NV12 DXGI video on AMD
* Forward --password-store switch to os_crypt
* Tell the kernel to discard USB requests when they time out.
* Wed Sep 07 2016 astieger@suse.com
- Update to Chromium 53.0.2785.92:
* Revert of support relocatable RPM packages
* disallow WKBackForwardListItem navigations for pushState pages
* arc: bluetooth: Fix advertised uuid
* fix conflicting PendingIntent for stop button and swipe away
Version: 52.0.2743.82-89.1
* Thu Jul 21 2016 tittiatcoke@gmail.com
- Temporarily disable fix_network_api_crash.patch. Upstream has
changed part of their code, so hopefully that resolved the issue
* Thu Jul 21 2016 tittiatcoke@gmail.com
- Update to Chromium 52.0.2743.82
* Security fixes (boo#989901):
+ CVE-2016-1706: Sandbox escape in PPAPI
+ CVE-2016-1707: URL spoofing on iOS
+ CVE-2016-1708: Use-after-free in Extensions
+ CVE-2016-1709: Heap-buffer-overflow in sfntly
+ CVE-2016-1710: Same-origin bypass in Blink
+ CVE-2016-1711: Same-origin bypass in Blink
+ CVE-2016-5127: Use-after-free in Blink
+ CVE-2016-5128: Same-origin bypass in V8
+ CVE-2016-5129: Memory corruption in V8
+ CVE-2016-5130: URL spoofing
+ CVE-2016-5131: Use-after-free in libxml
+ CVE-2016-5132: Limited same-origin bypass in Service Workers
+ CVE-2016-5133: Origin confusion in proxy authentication
+ CVE-2016-5134: URL leakage via PAC script
+ CVE-2016-5135: Content-Security-Policy bypass
+ CVE-2016-5136: Use after free in extensions
+ CVE-2016-5137: History sniffing with HSTS and CSP
+ CVE-2016-1705: Various fixes from internal audits, fuzzing
and other initiatives
* Mon Jul 11 2016 Nick_Levinson@yahoo.com
- Clarification/correction to chromium-desktop-gnome and
chromium-desktop-kde software descriptions due to passwords
preservation reported by Chromium developer
* Fri Jun 24 2016 tittiatcoke@gmail.com
- Update to Chromium 51.0.2704.106
* No changelog indicated
* Thu Jun 23 2016 tittiatcoke@gmail.com
- Add gcc60-fixes.diff to resolve the crashes observed with
chromium when compiled with GCC6
Version: 51.0.2704.103-85.3
* Fri Jun 17 2016 astieger@suse.com
- Update to Chromium 51.0.2704.103
* Security fixes:
- CVE-2016-1704: Various fixes from internal audits, fuzzing and
other initiatives (boo#985397)
* Tue Jun 07 2016 tittiatcoke@gmail.com
- Update to Chromium 51.0.2704.84
* No further changelog
* Thu Jun 02 2016 astieger@suse.com
- Update to Chromium 51.0.2704.79 [boo#982719]
* Security fixes:
- CVE-2016-1696: Cross-origin bypass in Extension bindings
- CVE-2016-1697: Cross-origin bypass in Blink
- CVE-2016-1698: Information leak in Extension bindings
- CVE-2016-1699: Parameter sanitization failure in DevTools
- CVE-2016-1700: Use-after-free in Extensions
- CVE-2016-1701: Use-after-free in Autofill
- CVE-2016-1702: Out-of-bounds read in Skia
- CVE-2016-1703: Various fixes from internal audits, fuzzing
and other initiatives.
* Thu May 26 2016 tittiatcoke@gmail.com
- Update to Chromium 51.0.2704.63 [boo#981886]
* Security fixes:
- CVE-2016-1672: Cross-origin bypass in extension bindings
- CVE-2016-1673: Cross-origin bypass in Blink
- CVE-2016-1674: Cross-origin bypass in extensions
- CVE-2016-1675: Cross-origin bypass in Blink
- CVE-2016-1676: Cross-origin bypass in extension bindings
- CVE-2016-1677: Type confusion in V8
- CVE-2016-1678: Heap overflow in V8
- CVE-2016-1679: Heap use-after-free in V8 bindings
- CVE-2016-1680: Heap use-after-free in Skia
- CVE-2016-1681: Heap overflow in PDFium
- CVE-2016-1682: CSP bypass for ServiceWorker
- CVE-2016-1683: Out-of-bounds access in libxslt
- CVE-2016-1684: Integer overflow in libxslt
- CVE-2016-1685: Out-of-bounds read in PDFium
- CVE-2016-1686: Out-of-bounds read in PDFium
- CVE-2016-1687: Information leak in extensions
- CVE-2016-1688: Out-of-bounds read in V8
- CVE-2016-1689: Heap buffer overflow in media
- CVE-2016-1690: Heap use-after-free in Autofill
- CVE-2016-1691: Heap buffer-overflow in Skia
- CVE-2016-1692: Limited cross-origin bypass in ServiceWorker
- CVE-2016-1693: HTTP Download of Software Removal Tool
- CVE-2016-1694: HPKP pins removed on cache clearance
- CVE-2016-1695: Various fixes from internal audits, fuzzing
and other initiatives
- drop chromium-50.0.2661.75-export_blink_Platform_symbols_in_shared_library_builds.patch
now upstream
* Fri May 13 2016 astieger@suse.com
- Update to Chromium 50.0.2661.102 (boo#979859)
* Security fixes:
- CVE-2016-1667: Same origin bypass in DOM
- CVE-2016-1668: Same origin bypass in Blink V8 bindings
- CVE-2016-1669: Buffer overflow in V8
- CVE-2016-1670: Race condition in loader
* Fri Apr 29 2016 astieger@suse.com
- Update to Chromium 50.0.2661.94 (boo#977830)
* Security fixes:
- CVE-2016-1660: Out-of-bounds write in Blink
- CVE-2016-1661: Memory corruption in cross-process frames
- CVE-2016-1662: Use-after-free in extensions
- CVE-2016-1663: Use-after-free in Blink?s V8 bindings
- CVE-2016-1664: Address bar spoofing
- CVE-2016-1665: Information leak in V8
- CVE-2016-1666: Various fixes from internal audits, fuzzing and other initiatives
* Fri Apr 22 2016 jslaby@suse.com
- _constraints: increase memory. It takes 1.2G to build some .o, and
with -j4 this results in OOM.
* Thu Apr 14 2016 tittiatcoke@gmail.com
- Update to Chromium 50.0.2661.75 (boo#975572)
* Security Fixes:
- CVE-2016-1652: Universal XSS in extension bindings
- CVE-2016-1653: Out-of-bounds write in V8
- CVE-2016-1651: Out-of-bounds read in Pdfium JPEG2000 decoding
- CVE-2016-1654: Uninitialized memory read in media
- CVE-2016-1655: Use-after-free related to extensions
- CVE-2016-1656: Android downloaded file path restriction bypass
- CVE-2016-1657: Address bar spoofing
- CVE-2016-1658: Potential leak of sensitive information to
malicious extensions
- CVE-2016-1659: Various fixes from internal audits, fuzzing
and other initiatives
- add patch to fix GCC builds with component=shared_library:
chromium-50.0.2661.75-export_blink_Platform_symbols_in_shared_library_builds.patch
* Fri Apr 08 2016 astieger@suse.com
- Update to Chromium 49.0.2623.112
* Block user removal when login attempt is in progress
* Add the SuppressUnsupportedOSWarning policy setting
* Fix how Save-Page-As responds to web requests blocked by extensions
* Fix preferred width calculation for 8bit ltr runs in rtl blocks
* Wed Mar 30 2016 tittiatcoke@gmail.com
- Update to Chromium 49.0.2623.110
* No changelog available
* Mon Mar 28 2016 tittiatcoke@gmail.com
- Update to Chromium 49.0.2623.108
* Security fixes (boo#972834):
- CVE-2016-1646: Out-of-bounds read in V8
- CVE-2016-1647: Use-after-free in Navigation
- CVE-2016-1648: Use-after-free in Extensions
- CVE-2016-1649: Buffer overflow in libANGLE
- CVE-2016-1650: Various fixes from internal audits, fuzzing
and other initiatives
- CVE-2016-3679: Multiple vulnerabilities in V8 fixed at the
tip of the 4.9 branch (currently 4.9.385.33).
* Wed Mar 09 2016 tittiatcoke@gmail.com
- Update to Chromium 49.0.2623.87
* Security fixes:
- CVE-2016-1643: Type confusion in Blink (boo#970514)
- CVE-2016-1644: Use-after-free in Blink (boo#970509)
- CVE-2016-1645: Out-of-bounds write in PDFium (boo#970511)
* Tue Mar 08 2016 tittiatcoke@gmail.com
- Change the build method used on Packman.
* Drop patch no-clang-on-packman.diff . This is no longer required
as that ninja is respecting the build flags correctly.
- Drop unused patch skia.patch
* Fri Mar 04 2016 tittiatcoke@gmail.com
- Update to Chromium 49.0.2623.75
* 26 security fixes, with the most important ones being:
- CVE-2016-1630: Same-origin bypass in Blink
- CVE-2016-1631: Same-origin bypass in Pepper Plugin
- CVE-2016-1632: Bad cast in Extensions
- CVE-2016-1633: Use-after-free in Blink
- CVE-2016-1634: Use-after-free in Blink
- CVE-2016-1635: Use-after-free in Blink
- CVE-2016-1636: SRI Validation Bypass
- CVE-2015-8126: Out-of-bounds access in libpng
- CVE-2016-1637: Information Leak in Skia
- CVE-2016-1638: WebAPI Bypass
- CVE-2016-1639: Use-after-free in WebRTC
- CVE-2016-1640: Origin confusion in Extensions UI
- CVE-2016-1641: Use-after-free in Favicon
- CVE-2016-1642: Various fixes from internal audits, fuzzing
and other initiatives
- Multiple vulnerabilities in V8 fixed at the tip of the 4.9
branch (currently 4.9.385.26)
(boo#969333)
* Fri Feb 19 2016 tittiatcoke@gmail.com
- Update to Chromium 48.0.2564.116
* Fixes a critical security flaw:
- CVE-2016-1629: Same-origin bypass in Blink and Sandbox
escape in Chrome. (boo#967376)
* Mon Feb 15 2016 tittiatcoke@gmail.com
- Update to Chromium 48.0.2564.109
* Security fixes (boo#965999)
- CVE-2016-1622: Same-origin bypass in Extensions
- CVE-2016-1623: Same-origin bypass in DOM
- CVE-2016-1624: Buffer overflow in Brotli
- CVE-2016-1625: Navigation bypass in Chrome Instant
- CVE-2016-1626: Out-of-bounds read in PDFium
- CVE-2016-1627: Various fixes from internal audits, fuzzing
and other initiatives
* Sat Feb 13 2016 tittiatcoke@gmail.com
- Drop the libva support completely. It seems that this is causing
more issues than it actually resolves. (boo#965566)
* Drop chromium-enable-vaapi.patch
* Thu Feb 11 2016 tittiatcoke@gmail.com
- Don't build with libva support for openSUSE 13.2 and lower
(boo#966082)
* Tue Feb 09 2016 tittiatcoke@gmail.com
- Drop completely the option to build with system libraries. This
could lead to issues (boo#965738)
* Fri Feb 05 2016 tittiatcoke@gmail.com
- Update to Chromium 48.0.2564.103
* No chnagelog available
Version: 100.0.4896.88-bp153.2.82.1
* Tue Apr 12 2022 Andreas Stieger <andreas.stieger@gmx.de>
- Chromium 100.0.4896.88 (boo#1198361)
* CVE-2022-1305: Use after free in storage
* CVE-2022-1306: Inappropriate implementation in compositing
* CVE-2022-1307: Inappropriate implementation in full screen
* CVE-2022-1308: Use after free in BFCache
* CVE-2022-1309: Insufficient policy enforcement in developer tools
* CVE-2022-1310: Use after free in regular expressions
* CVE-2022-1311: Use after free in Chrome OS shell
* CVE-2022-1312: Use after free in storage
* CVE-2022-1313: Use after free in tab groups
* CVE-2022-1314: Type Confusion in V8
* Various fixes from internal audits, fuzzing and other initiatives
* Sun Apr 10 2022 Callum Farmer <gmbr3@opensuse.org>
- Patches for GCC 12:
* chromium-fix-swiftshader-template.patch
* chromium-missing-include-tuple.patch
* chromium-webrtc-stats-missing-vector.patch
* Tue Apr 05 2022 Andreas Stieger <andreas.stieger@gmx.de>
- Chromium 100.0.4896.75:
* CVE-2022-1232: Type Confusion in V8 (boo#1198053)
* Wed Mar 30 2022 Callum Farmer <gmbr3@opensuse.org>
- Chromium 100.0.4896.60 (boo#1197680)
* CVE-2022-1125: Use after free in Portals
* CVE-2022-1127: Use after free in QR Code Generator
* CVE-2022-1128: Inappropriate implementation in Web Share API
* CVE-2022-1129: Inappropriate implementation in Full Screen Mode
* CVE-2022-1130: Insufficient validation of untrusted input in WebOTP
* CVE-2022-1131: Use after free in Cast UI
* CVE-2022-1132: Inappropriate implementation in Virtual Keyboard
* CVE-2022-1133: Use after free in WebRTC
* CVE-2022-1134: Type Confusion in V8
* CVE-2022-1135: Use after free in Shopping Cart
* CVE-2022-1136: Use after free in Tab Strip
* CVE-2022-1137: Inappropriate implementation in Extensions
* CVE-2022-1138: Inappropriate implementation in Web Cursor
* CVE-2022-1139: Inappropriate implementation in Background Fetch API
* CVE-2022-1141: Use after free in File Manager
* CVE-2022-1142: Heap buffer overflow in WebUI
* CVE-2022-1143: Heap buffer overflow in WebUI
* CVE-2022-1144: Use after free in WebUI
* CVE-2022-1145: Use after free in Extensions
* CVE-2022-1146: Inappropriate implementation in Resource Timing
- Added patches:
* chromium-100-compiler.patch
* chromium-100-GLImplementationParts-constexpr.patch
* chromium-100-InMilliseconds-constexpr.patch
* chromium-100-SCTHashdanceMetadata-move.patch
* chromium-100-macro-typo.patch
- Removed patches:
* chromium-98-compiler.patch
* chromium-86-nearby-explicit.patch
* chromium-glibc-2.34.patch
* chromium-v8-missing-utility-include.patch
* chromium-99-AutofillAssistantModelExecutor-NoDestructor.patch
* Tue Mar 29 2022 Andreas Schwab <schwab@suse.de>
- Update disk constraints