ALT-BU-2022-4427-1
Branch sisyphus update bulletin.
Closed vulnerabilities
BDU:2020-04989
Уязвимость пользовательского интерфейса WebUI браузера Google Chrome, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
BDU:2020-05187
Уязвимость пользовательского интерфейса WebUI браузера Google Chrome, позволяющая нарушителю выполнить произвольный код
BDU:2022-01471
Уязвимость обработчика JavaScript-сценариев V8 браузеров Microsoft Edge и Google Chrome, позволяющая нарушителю выполнить произвольный код
BDU:2022-01904
Уязвимость компонента Web Cursor браузеров Google Chrome и Microsoft Edge, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
BDU:2022-01909
Уязвимость интерфейса Cast UI браузеров Google Chrome и Microsoft Edge, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
BDU:2022-01910
Уязвимость расширения QR Code Generator браузеров Google Chrome и Microsoft Edge, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
BDU:2022-01911
Уязвимость интерфейса WebOTP API браузеров Google Chrome и Microsoft Edge, позволяющая нарушителю выполнить произвольный код
BDU:2022-01912
Уязвимость реализации полноэкранного режима (Full Screen Mode) браузеров Google Chrome и Microsoft Edge, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
BDU:2022-01913
Уязвимость прикладного программного интерфейса для обмена данными Web Share браузеров Google Chrome и Microsoft Edge, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
BDU:2022-01917
Уязвимость компонента Shopping Cart браузеров Google Chrome и Microsoft Edge, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
BDU:2022-01918
Уязвимость расширения WebRTC браузеров Google Chrome и Microsoft Edge, позволяющая нарушителю выполнить произвольный код
BDU:2022-01919
Уязвимость обработчика JavaScript-сценариев V8 браузеров Google Chrome и Microsoft Edge, позволяющая нарушителю выполнить произвольный код
BDU:2022-01920
Уязвимость компонента Virtual Keyboard браузера Google Chrome, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
BDU:2022-01921
Уязвимость файлового менеджера(File Manager) браузера Google Chrome, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
BDU:2022-01922
Уязвимость программного интерфейса Background Fetch API браузеров Google Chrome и Microsoft Edge, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
BDU:2022-01939
Уязвимость компонента Portals браузеров Google Chrome и Microsoft Edge, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2022-01966
Уязвимость компонента Extensions браузеров Google Chrome и Microsoft Edge, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
BDU:2022-01967
Уязвимость пользовательского интерфейса WebUI браузеров Google Chrome и Microsoft Edge, позволяющая нарушителю выполнить произвольный код
BDU:2022-01968
Уязвимость элемента управления вкладками «Tab Strip» браузеров Google Chrome и Microsoft Edge, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
BDU:2022-01969
Уязвимость компонента Extensions браузеров Google Chrome и Microsoft Edge, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации или вызвать отказ в обслуживании
BDU:2022-01970
Уязвимость интерфейса Resource Timing API браузеров Google Chrome и Microsoft Edge связана, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
Modified: 2025-10-22
CVE-2022-1096
Type confusion in V8 in Google Chrome prior to 99.0.4844.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_25.html
- https://crbug.com/1309225
- https://security.gentoo.org/glsa/202208-25
- https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_25.html
- https://crbug.com/1309225
- https://security.gentoo.org/glsa/202208-25
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-1096
Modified: 2024-11-21
CVE-2022-1125
Use after free in Portals in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via user interaction.
- https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html
- https://crbug.com/1292261
- https://security.gentoo.org/glsa/202208-25
- https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html
- https://crbug.com/1292261
- https://security.gentoo.org/glsa/202208-25
Modified: 2024-11-21
CVE-2022-1127
Use after free in QR Code Generator in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via user interaction.
- https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html
- https://crbug.com/1291891
- https://security.gentoo.org/glsa/202208-25
- https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html
- https://crbug.com/1291891
- https://security.gentoo.org/glsa/202208-25
Modified: 2024-11-21
CVE-2022-1128
Inappropriate implementation in Web Share API in Google Chrome on Windows prior to 100.0.4896.60 allowed an attacker on the local network segment to leak cross-origin data via a crafted HTML page.
- https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html
- https://crbug.com/1301920
- https://security.gentoo.org/glsa/202208-25
- https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html
- https://crbug.com/1301920
- https://security.gentoo.org/glsa/202208-25
Modified: 2024-11-21
CVE-2022-1129
Inappropriate implementation in Full Screen Mode in Google Chrome on Android prior to 100.0.4896.60 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
- https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html
- https://crbug.com/1300253
- https://security.gentoo.org/glsa/202208-25
- https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html
- https://crbug.com/1300253
- https://security.gentoo.org/glsa/202208-25
Modified: 2024-11-21
CVE-2022-1130
Insufficient validation of trust input in WebOTP in Google Chrome on Android prior to 100.0.4896.60 allowed a remote attacker to send arbitrary intents from any app via a malicious app.
- https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html
- https://crbug.com/1142269
- https://security.gentoo.org/glsa/202208-25
- https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html
- https://crbug.com/1142269
- https://security.gentoo.org/glsa/202208-25
Modified: 2024-11-21
CVE-2022-1131
Use after free in Cast UI in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html
- https://crbug.com/1297404
- https://security.gentoo.org/glsa/202208-25
- https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html
- https://crbug.com/1297404
- https://security.gentoo.org/glsa/202208-25
Modified: 2024-11-21
CVE-2022-1132
Inappropriate implementation in Virtual Keyboard in Google Chrome on Chrome OS prior to 100.0.4896.60 allowed a local attacker to bypass navigation restrictions via physical access to the device.
- https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html
- https://crbug.com/1303410
- https://security.gentoo.org/glsa/202208-25
- https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html
- https://crbug.com/1303410
- https://security.gentoo.org/glsa/202208-25
Modified: 2024-11-21
CVE-2022-1133
Use after free in WebRTC Perf in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html
- https://crbug.com/1305776
- https://security.gentoo.org/glsa/202208-25
- https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html
- https://crbug.com/1305776
- https://security.gentoo.org/glsa/202208-25
Modified: 2024-11-21
CVE-2022-1134
Type confusion in V8 in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- http://packetstormsecurity.com/files/172851/Chrome-Renderer-Type-Confusion-Remote-Code-Execution.html
- https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html
- https://crbug.com/1308360
- https://security.gentoo.org/glsa/202208-25
- http://packetstormsecurity.com/files/172851/Chrome-Renderer-Type-Confusion-Remote-Code-Execution.html
- https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html
- https://crbug.com/1308360
- https://security.gentoo.org/glsa/202208-25
Modified: 2024-11-21
CVE-2022-1135
Use after free in Shopping Cart in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to potentially exploit heap corruption via standard feature user interaction.
- https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html
- https://crbug.com/1285601
- https://security.gentoo.org/glsa/202208-25
- https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html
- https://crbug.com/1285601
- https://security.gentoo.org/glsa/202208-25
Modified: 2024-11-21
CVE-2022-1136
Use after free in Tab Strip in Google Chrome prior to 100.0.4896.60 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via specific set of user gestures.
- https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html
- https://crbug.com/1280205
- https://security.gentoo.org/glsa/202208-25
- https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html
- https://crbug.com/1280205
- https://security.gentoo.org/glsa/202208-25
Modified: 2024-11-21
CVE-2022-1137
Inappropriate implementation in Extensions in Google Chrome prior to 100.0.4896.60 allowed an attacker who convinced a user to install a malicious extension to leak potentially sensitive information via a crafted HTML page.
- https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html
- https://crbug.com/1289846
- https://security.gentoo.org/glsa/202208-25
- https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html
- https://crbug.com/1289846
- https://security.gentoo.org/glsa/202208-25
Modified: 2024-11-21
CVE-2022-1138
Inappropriate implementation in Web Cursor in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who had compromised the renderer process to obscure the contents of the Omnibox (URL bar) via a crafted HTML page.
- https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html
- https://crbug.com/1246188
- https://security.gentoo.org/glsa/202208-25
- https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html
- https://crbug.com/1246188
- https://security.gentoo.org/glsa/202208-25
Modified: 2024-11-21
CVE-2022-1139
Inappropriate implementation in Background Fetch API in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
- https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html
- https://crbug.com/1268541
- https://security.gentoo.org/glsa/202208-25
- https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html
- https://crbug.com/1268541
- https://security.gentoo.org/glsa/202208-25
Modified: 2024-11-21
CVE-2022-1141
Use after free in File Manager in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via specific user gesture.
- https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html
- https://crbug.com/1303253
- https://security.gentoo.org/glsa/202208-25
- https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html
- https://crbug.com/1303253
- https://security.gentoo.org/glsa/202208-25
Modified: 2024-11-21
CVE-2022-1142
Heap buffer overflow in WebUI in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via specific input into DevTools.
- https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html
- https://crbug.com/1303613
- https://security.gentoo.org/glsa/202208-25
- https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html
- https://crbug.com/1303613
- https://security.gentoo.org/glsa/202208-25
Modified: 2024-11-21
CVE-2022-1143
Heap buffer overflow in WebUI in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via specific input into DevTools.
- https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html
- https://crbug.com/1303615
- https://security.gentoo.org/glsa/202208-25
- https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html
- https://crbug.com/1303615
- https://security.gentoo.org/glsa/202208-25
Modified: 2024-11-21
CVE-2022-1144
Use after free in WebUI in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via specific input into DevTools.
- https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html
- https://crbug.com/1304145
- https://security.gentoo.org/glsa/202208-25
- https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html
- https://crbug.com/1304145
- https://security.gentoo.org/glsa/202208-25
Modified: 2024-11-21
CVE-2022-1145
Use after free in Extensions in Google Chrome prior to 100.0.4896.60 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via specific user interaction and profile destruction.
- https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html
- https://crbug.com/1304545
- https://security.gentoo.org/glsa/202208-25
- https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html
- https://crbug.com/1304545
- https://security.gentoo.org/glsa/202208-25
Modified: 2024-11-21
CVE-2022-1146
Inappropriate implementation in Resource Timing in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
- https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html
- https://crbug.com/1290150
- https://security.gentoo.org/glsa/202208-25
- https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html
- https://crbug.com/1290150
- https://security.gentoo.org/glsa/202208-25
Closed bugs
chromium: лишний параметр сборки fieldtrial_testing_like_official_build
Package kde5-digikam updated to version 7.6.0-alt2 for branch sisyphus in task 297604.
Closed bugs
Приложение не корректно определяет текущую версию приложения