chromium: CVE-2021-21193 (RCE) in Blink

Debian Bug report logs - #985142
chromium: CVE-2021-21193 (RCE) in Blink

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Antonio Russo <aerusso@aerusso.net>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: chromium: CVE-2021-21193 (RCE) in Blink

Date: Sat, 13 Mar 2021 08:38:31 -0700

[Message part 1 (text/plain, inline)]

Package: chromium
Version: 89.0.4389.82-1
Severity: grave
Tags: upstream security
Justification: user security hole
X-Debbugs-Cc: aerusso@aerusso.net, Debian Security Team <team@security.debian.org>

Per [1] (or [2], and allegedly [3] which I cannot access):

> A use after free security issue was found in the Blink component of the
> Chromium browser before version 89.0.4389.90. Google is aware of reports
> that an exploit for this issue exists in the wild.

Does this also affect libqt5webengine5?  I know that its upstream derives
in part from the Chromium source tree.

Antonio

[1] https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop_12.html
[2] https://security.archlinux.org/CVE-2021-21193
[3] https://crbug.com/1186287

[OpenPGP_0xB01C53D5DED4A4EE.asc (application/pgp-keys, attachment)]

[OpenPGP_signature (application/pgp-signature, attachment)]

Message #10 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@inutil.org>

To: Antonio Russo <aerusso@aerusso.net>, 985142@bugs.debian.org

Cc: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: Re: Bug#985142: chromium: CVE-2021-21193 (RCE) in Blink

Date: Sat, 13 Mar 2021 18:04:26 +0100

On Sat, Mar 13, 2021 at 08:38:31AM -0700, Antonio Russo wrote:
> Package: chromium
> Version: 89.0.4389.82-1
> Severity: grave
> Tags: upstream security
> Justification: user security hole
> X-Debbugs-Cc: aerusso@aerusso.net, Debian Security Team <team@security.debian.org>
> 
> Per [1] (or [2], and allegedly [3] which I cannot access):
> 
> > A use after free security issue was found in the Blink component of the
> > Chromium browser before version 89.0.4389.90. Google is aware of reports
> > that an exploit for this issue exists in the wild.
> 
> Does this also affect libqt5webengine5?  I know that its upstream derives
> in part from the Chromium source tree.

qtwebengine is not covered by security support, see https://www.debian.org/releases/buster/amd64/release-notes/ch-information.en.html#browser-security

Cheers,
        Moritz

Send a report that this bug log contains spam.