#17028 closed enhancement (fixed)
Update qtwebengine to 5.15.11
Reported by: | Douglas R. Reno | Owned by: | Douglas R. Reno |
---|---|---|---|
Priority: | high | Milestone: | 11.3 |
Component: | BOOK | Version: | git |
Severity: | critical | Keywords: | |
Cc: |
Description (last modified by ) ¶
Looking over at https://code.qt.io/cgit/qt/qtwebengine.git/log/?h=5.15, I see that 5.15.11 has been tagged - and there's another Chromium update above it that contains urgent security fixes.
This would fix the following CVEs:
[Backport] CVE-2022-2610: Insufficient policy enforcement in Background Fetch [Backport] CVE-2022-2477 : Use after free in Guest View [Backport] CVE-2022-27406 [Backport] CVE-2022-27405 [Backport] CVE-2022-27404 [Backport] CVE-2022-2294: Heap buffer overflow in WebRTC (2/2) [Backport] CVE-2022-2294: Heap buffer overflow in WebRTC (1/2) [Backport] CVE-2022-2295: Type Confusion in V8 [Backport] CVE-2022-2160: Insufficient policy enforcement in DevTools [Backport] CVE-2022-2162: Insufficient policy enforcement in File System API [Backport] CVE-2022-2158: Type Confusion in V8 [Backport] Security bug 1316578 [Backport] CVE-2022-2008: Out of bounds memory access in WebGL [Backport] CVE-2022-2010: Out of bounds read in compositing [Backport] CVE-2022-1854: Use after free in ANGLE. [Backport] CVE-2022-1857: Insufficient policy enforcement in File System API [Backport] CVE-2022-1855: Use after free in Messaging
Several of the security vulnerabilities in this list are rated as 8.8 High, with a few also being 9.8 Critical and known to be actively exploited in the wild. I am setting the priority to High and the severity to Critical as a result of this
Change History (6)
comment:1 by , 3 years ago
comment:2 by , 3 years ago
Owner: | changed from | to
---|---|
Status: | new → assigned |
comment:5 by , 3 years ago
Resolution: | → fixed |
---|---|
Status: | assigned → closed |
Fixed at ea11b87ae121c25f38d9a5219b074d032d96ab03
Security advisory coming shortly
Note:
See TracTickets
for help on using tickets.
I am aware of this, but do not yet have a current system.