Commit graph

84 commits

Author SHA1 Message Date
Ivan Kozik 67ced10c23 chromium: 75.0.3770.80 -> 75.0.3770.90
CVE-2019-5842
2019-06-14 21:17:45 +00:00
Ivan Kozik 8c78ae27f6 chromium: 74.0.3729.157 -> 75.0.3770.80
CVE-2019-5828 CVE-2019-5829 CVE-2019-5830 CVE-2019-5831
CVE-2019-5832 CVE-2019-5833 CVE-2019-5834 CVE-2019-5835
CVE-2019-5836 CVE-2019-5837 CVE-2019-5838 CVE-2019-5839
CVE-2019-5840

Update a patch for Python 3, fixes #62347.

Update a GN arg to fix this warning:

warning: The GN arg 'remove_webcore_debug_symbols' is deprecated and
warning: will be removed April 15, 2019. Please change your args.gn
warning: to use 'blink_symbol_level = 0'. https://crbug.com/943869
2019-06-05 09:27:52 +00:00
Ivan Kozik 2db1a06136 chromium: 74.0.3729.131 -> 74.0.3729.157
Fixes a security bug with no CVE at this time:
https://chromereleases.googleblog.com/2019/05/stable-channel-update-for-desktop.html
2019-05-15 05:41:40 +00:00
Ivan Kozik f15adc548f chromium: 74.0.3729.108 -> 74.0.3729.131
CVE-2019-5827 CVE-2019-5824
2019-05-04 22:46:24 +00:00
Herwig Hochleitner d77256c604 chromium: 73.0.3683.103 -> 74.0.3729.108
CVE-2019-5805 CVE-2019-5806 CVE-2019-5807 CVE-2019-5808 CVE-2019-5809
CVE-2019-5810 CVE-2019-5811 CVE-2019-5812 CVE-2019-5813 CVE-2019-5814
CVE-2019-5815 CVE-2019-5816 CVE-2019-5817 CVE-2019-5818 CVE-2019-5819
CVE-2019-5820 CVE-2019-5821 CVE-2019-5822 CVE-2019-5823
2019-04-24 22:01:45 +02:00
Herwig Hochleitner a5960f765a chromium: 73.0.3683.86 -> 73.0.3683.103 2019-04-05 16:53:36 +02:00
Herwig Hochleitner ea34ad0e43 chromium: 73.0.3683.75 -> 73.0.3683.86 2019-03-22 19:33:30 +01:00
Herwig Hochleitner 006a699e69 chromium: 72.0.3626.121 -> 73.0.3683.75
CVE-2019-5787 CVE-2019-5788 CVE-2019-5789 CVE-2019-5790 CVE-2019-5791
CVE-2019-5792 CVE-2019-5793 CVE-2019-5794 CVE-2019-5795 CVE-2019-5796
CVE-2019-5797 CVE-2019-5798 CVE-2019-5799 CVE-2019-5800 CVE-2019-5801
CVE-2019-5802 CVE-2019-5803 CVE-2019-5804
2019-03-13 16:19:29 +01:00
Ivan Kozik 2129c6ec05 chromium: fix sha256 for 72.0.3626.121
The sha256 was previously unchanged from 72.0.3626.119
2019-03-07 00:37:01 +00:00
Herwig Hochleitner 9a6e64691c chromium: 72.0.3626.119 -> 72.0.3626.121
CVE-2019-5786
2019-03-02 05:19:53 +01:00
Herwig Hochleitner 338dc47d5f chromium: 72.0.3626.109 -> 72.0.3626.119 2019-02-25 02:01:30 +01:00
Herwig Hochleitner c414e5bd08 chromium: 72.0.3626.96 -> 72.0.3626.109 2019-02-19 04:44:37 +01:00
Ivan Kozik 0811bbcaa4 chromium: 72.0.3626.81 -> 72.0.3626.96
CVE-2019-5784
2019-02-10 02:38:22 +00:00
Herwig Hochleitner 6b27008fb5 chromium: 71.0.3578.98 -> 72.0.3626.81
CVE-2019-5754 CVE-2019-5782 CVE-2019-5755 CVE-2019-5756 CVE-2019-5757
CVE-2019-5758 CVE-2019-5759 CVE-2019-5760 CVE-2019-5761 CVE-2019-5762
CVE-2019-5763 CVE-2019-5764 CVE-2019-5765 CVE-2019-5766 CVE-2019-5767
CVE-2019-5768 CVE-2019-5769 CVE-2019-5770 CVE-2019-5771 CVE-2019-5772
CVE-2019-5773 CVE-2019-5774 CVE-2019-5775 CVE-2019-5776 CVE-2019-5777
CVE-2019-5778 CVE-2019-5779 CVE-2019-5780 CVE-2019-5781
2019-01-31 01:20:23 +01:00
Herwig Hochleitner 327f7da260 chromium: 71.0.3578.80 -> 71.0.3578.98
CVE-2018-17481
2018-12-20 20:44:24 +01:00
Herwig Hochleitner 8942a3e00c chromium: 70.0.3538.110 -> 71.0.3578.80
CVE-2018-17480 CVE-2018-17481 CVE-2018-18335 CVE-2018-18336
CVE-2018-18337 CVE-2018-18338 CVE-2018-18339 CVE-2018-18340
CVE-2018-18341 CVE-2018-18342 CVE-2018-18343 CVE-2018-18344
CVE-2018-18345 CVE-2018-18346 CVE-2018-18347 CVE-2018-18348
CVE-2018-18349 CVE-2018-18350 CVE-2018-18351 CVE-2018-18352
CVE-2018-18353 CVE-2018-18354 CVE-2018-18355 CVE-2018-18356
CVE-2018-18357 CVE-2018-18358 CVE-2018-18359
2018-12-06 00:36:33 +01:00
Herwig Hochleitner 7c79a0d4ac chromium: 70.0.3538.102 -> 70.0.3538.110
CVE-2018-17479
2018-11-19 23:52:22 +01:00
Herwig Hochleitner 4b5ffcb964 chromium: 70.0.3538.77 -> 70.0.3538.102 2018-11-14 02:51:13 +01:00
Herwig Hochleitner 17585ff6d8 chromium: 70.0.3538.67 -> 70.0.3538.77 2018-10-28 16:00:46 +01:00
Herwig Hochleitner bb03fbc2c8 chromium: 69.0.3497.100 -> 70.0.3538.67 2018-10-24 19:38:51 +02:00
Will Dietz ce6db5e36e chromium: update to 69.0.3497.100 (and others), ran update.sh 2018-10-12 12:20:35 +02:00
Yuriy Taraday c098f143b4 chromium: 68.0.3440.106 -> 69.0.3497.81
Also update to build with external gn.
2018-09-07 23:34:47 +04:00
Herwig Hochleitner d127b54a29 chromium: 68.0.3440.75 -> 68.0.3440.106
cc @aszlig @YorikSar
2018-08-17 12:48:59 +02:00
Yuriy Taraday cd3283f921 chromium: 67.0.3396.99 -> 68.0.3440.75 2018-07-27 14:38:23 +02:00
Yuriy Taraday c283323c1e chromium: 67.0.3396.87 -> 67.0.3396.99 2018-07-14 01:38:41 +04:00
Yuriy Taraday d23da8229b chromium: 67.0.3396.62 -> 67.0.3396.87
Contains fixes for CVE-2018-6148 [0] and CVE-2018-6149 [1].

Also add a patch to fix one problem with 68 (Beta) build. I'm still
working on fixing Beta.

[0] https://chromereleases.googleblog.com/2018/06/stable-channel-update-for-desktop.html
[1] https://chromereleases.googleblog.com/2018/06/stable-channel-update-for-desktop_12.html
2018-06-13 16:28:18 +04:00
Yuriy Taraday a3efa24da9 chromium: bump dev version 2018-05-31 02:50:27 +04:00
Yuriy Taraday 7acec16226 chromium: 66.0.3359.181 -> 67.0.3396.62
New stable version, with 34 security fixes and site isolation. See
https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop_58.html
2018-05-31 00:27:36 +04:00
Yuriy Taraday 272987524a chromium: 66.0.3359.170 -> 66.0.3359.181 2018-05-15 23:58:50 +04:00
Yuriy Taraday 18370267ef chromium: 66.0.3359.139 -> 66.0.3359.170
Update includes 4 security fixes, including one critical (see [0]):

* [835887] Critical: Chain leading to sandbox escape. Reported by Anonymous on 2018-04-23:
* [836858] High CVE-2018-6121: Privilege Escalation in extensions.
* [836141] High CVE-2018-6122: Type confusion in V8.
* [$5000][833721] High CVE-2018-6120: Heap buffer overflow in PDFium.  Reported by Zhou Aiting(@zhouat1) of Qihoo 360 Vulcan Team on 2018-04-17

[0] https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop.html

PS: Didn't build Beta and Dev, verified only Stable for now

cc @bendlas @aszlig
2018-05-12 02:12:04 +04:00
Herwig Hochleitner c07c23b914 chromium: 66.0.3359.117 -> 66.0.3359.139 2018-05-02 02:44:15 +02:00
Herwig Hochleitner 2b29e40153 chromium: 65.0.3325.181 -> 66.0.3359.117
Critical CVE-2018-6085: Use after free in Disk Cache. Reported by Ned Williamson on 2018-03-28
Critical CVE-2018-6086: Use after free in Disk Cache. Reported by Ned Williamson on 2018-03-30
High CVE-2018-6087: Use after free in WebAssembly. Reported by Anonymous on 2018-02-20
High CVE-2018-6088: Use after free in PDFium. Reported by Anonymous on 2018-03-15
High CVE-2018-6089: Same origin policy bypass in Service Worker. Reported by Rob Wu on 2018-02-04
High CVE-2018-6090: Heap buffer overflow in Skia. Reported by ZhanJia Song on 2018-03-12
High CVE-2018-6091: Incorrect handling of plug-ins by Service Worker. Reported by Jun Kokatsu (@shhnjk) on 2017-10-05
High CVE-2018-6092: Integer overflow in WebAssembly. Reported by Natalie Silvanovich of Google Project Zero on 2018-03-08
Medium CVE-2018-6093: Same origin bypass in Service Worker. Reported by Jun Kokatsu (@shhnjk) on 2017-11-01
Medium CVE-2018-6094: Exploit hardening regression in Oilpan. Reported by Chris Rohlf on 2016-08-01
Medium CVE-2018-6095: Lack of meaningful user interaction requirement before file upload. Reported by Abdulrahman Alqabandi (@qab) on 2016-08-11
Medium CVE-2018-6096: Fullscreen UI spoof. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-10-19
Medium CVE-2018-6097: Fullscreen UI spoof. Reported by xisigr of Tencent's Xuanwu Lab on 2018-01-26
Medium CVE-2018-6098: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-01-03
Medium CVE-2018-6099: CORS bypass in ServiceWorker. Reported by Jun Kokatsu (@shhnjk) on 2018-02-03
Medium CVE-2018-6100: URL spoof in Omnibox. Reported by Lnyas Zhang on 2018-02-11
Medium CVE-2018-6101: Insufficient protection of remote debugging prototol in DevTools . Reported by Rob Wu on 2018-02-19
Medium CVE-2018-6102: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-02-20
Medium CVE-2018-6103: UI spoof in Permissions. Reported by Khalil Zhani on 2018-02-24
Medium CVE-2018-6104: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-03-08
Medium CVE-2018-6105: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-01-18
Medium CVE-2018-6106: Incorrect handling of promises in V8. Reported by lokihardt of Google Project Zero on 2018-01-25
Medium CVE-2018-6107: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-02-02
Medium CVE-2018-6108: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-02-27
Low CVE-2018-6109: Incorrect handling of files by FileAPI. Reported by Dominik Weber (@DoWeb_) on 2017-04-10
Low CVE-2018-6110: Incorrect handling of plaintext files via file:// . Reported by Wenxiang Qian (aka blastxiang) on 2017-10-24
Low CVE-2018-6111: Heap-use-after-free in DevTools. Reported by Khalil Zhani on 2017-11-02
Low CVE-2018-6112: Incorrect URL handling in DevTools. Reported by Rob Wu on 2017-12-29
Low CVE-2018-6113: URL spoof in Navigation. Reported by Khalil Zhani on 2018-01-25
Low CVE-2018-6114: CSP bypass. Reported by Lnyas Zhang on 2018-02-13
Low CVE-2018-6115: SmartScreen bypass in downloads. Reported by James Feher on 2018-03-07
Low CVE-2018-6116: Incorrect low memory handling in WebAssembly. Reported by Jin from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd. on 2018-03-15
Low CVE-2018-6117: Confusing autofill settings. Reported by Spencer Dailey on 2018-03-15
Low CVE-2018-6084: Incorrect use of Distributed Objects in Google Software Updater on MacOS. Reported by Ian Beer of Google Project Zero on 2018-03-15
2018-04-21 14:57:45 +02:00
Herwig Hochleitner 8cbf295b6c chromium: 65.0.3325.162 -> 65.0.3325.181
dev: 66 -> 67

cc @YorikSar @aszlig
2018-03-26 01:52:11 +02:00
Yuriy Taraday 6b0732a956 chromium: 65.0.3325.146 -> 65.0.3325.162
Also bump dev branch to ensure that next beta will work.
2018-03-18 19:15:32 +02:00
Herwig Hochleitner 9b4ffd98a4 chromium: 64.0.3282.186 -> 65.0.3325.146
see https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html

cc @aszlig @YorikSar

CVE-2017-11215
CVE-2017-11225
CVE-2018-6060
CVE-2018-6061
CVE-2018-6062
CVE-2018-6057
CVE-2018-6063
CVE-2018-6064
CVE-2018-6065
CVE-2018-6066
CVE-2018-6067
CVE-2018-6068
CVE-2018-6069
CVE-2018-6070
CVE-2018-6071
CVE-2018-6072
CVE-2018-6073
CVE-2018-6074
CVE-2018-6075
CVE-2018-6076
CVE-2018-6077
CVE-2018-6078
CVE-2018-6079
CVE-2018-6080
CVE-2018-6081
CVE-2018-6082
CVE-2018-6083
2018-03-09 03:02:49 +01:00
Herwig Hochleitner 3bae30289c chromium: 64.0.3282.167 -> 64.0.3282.186 2018-02-25 23:56:58 +01:00
Herwig Hochleitner 0d20bf0287 chromium: 64.0.3282.140 -> 64.0.3282.167
[806388] High CVE-2018-6056: Incorrect derived class instantiation in V8. Reported by lokihardt of Google Project Zero on 2018-01-26
2018-02-15 01:22:46 +01:00
Herwig Hochleitner 8c8e8823bb chromium: 64.0.3282.119 -> 64.0.3282.140
[security] https://crbug.com/808163
2018-02-04 17:47:51 +01:00
Herwig Hochleitner 7a2662569d chromium: 63.0.3239.132 -> 64.0.3282.119
CVE-2018-6031
CVE-2018-6032
CVE-2018-6033
CVE-2018-6034
CVE-2018-6035
CVE-2018-6036
CVE-2018-6037
CVE-2018-6038
CVE-2018-6039
CVE-2018-6040
CVE-2018-6041
CVE-2018-6042
CVE-2018-6043
CVE-2018-6045
CVE-2018-6046
CVE-2018-6047
CVE-2018-6048
CVE-2017-15420
CVE-2018-6049
CVE-2018-6050
CVE-2018-6051
CVE-2018-6052
CVE-2018-6053
CVE-2018-6054
2018-01-25 20:34:04 +01:00
Herwig Hochleitner dbb774c5e1 chromium: update 63.0.3239.108 -> 63.0.3239.132
this introduces a standard approach to playing with patches from the
gentoo repository.

the patches for 64 are a first guess during a build in progress

cc @YorikSar @aszlig
2018-01-09 02:20:07 +01:00
Yuriy Taraday 2733530a66 chromium: 63.0.3239.84 -> 63.0.3239.108
New stable release with 2 security fixes [0].

Version 64 has been promoted to Beta, build still doesn't work.

[0] https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop_14.html
2017-12-15 22:22:55 +04:00
Yuriy Taraday 994a614ca3 chromium: 62.0.3202.94 -> 63.0.3239.84
New stable release with bunch of security fixes and other changes [0]

Also:
* remove patch for dev already landed upstream
* remove patches specific to version 62
* dev is broken again, need to investigate failures

[0] https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html
2017-12-09 01:12:32 +01:00
Yuriy Taraday a472c57ffc chromium: 62.0.3202.89 -> 62.0.3202.94
Also bump beta version.
2017-11-15 01:18:01 +01:00
Yuriy Taraday 7105bb68cc chromium: 62.0.3202.75 -> 62.0.3202.89
Includes security fixes for CVE-2017-15398 and CVE-2017-15399.

Also fixes builds for beta and dev branches:
- backport https://webrtc-review.googlesource.com/9384 to fix build for
  new webrtc revision
- for dev branch fix gn bootstrap, see
  https://chromium-review.googlesource.com/758584
- for 63+ manpage now is not generated during ninja build, it is
  processed with sed using packagers tools included in sources
2017-11-10 01:19:23 +01:00
Yuriy Taraday da3c404e58 chromium: 62.0.3202.62 -> 62.0.3202.75
also fix beta/dev build - use harfbuzz from sources

Unfortunatelly after [0] chromium doesn't support using harfbuzz provided by
system while using vendored version of freetype.
Disabling usage of separate harfbuzz for now.

[0] https://chromium-review.googlesource.com/c/chromium/src/+/696241
2017-10-28 11:45:31 +02:00
Yuriy Taraday f0a0f02b22 chromium: 61.0.3163.100 -> 62.0.3202.62
Also updated most of patches according to their state in Gentoo
repository, deleted ones that are not applicable anymore.
2017-10-21 15:55:42 +02:00
Herwig Hochleitner e78bf2d1e9 chromium: 61.0.3163.79 -> 61.0.3163.100 2017-09-28 19:53:20 +02:00
Herwig Hochleitner 2773508b5d chromium: 60.0.3112.113 -> 61.0.3163.79
CVE-2017-5111
CVE-2017-5112
CVE-2017-5113
CVE-2017-5114
CVE-2017-5115
CVE-2017-5116
CVE-2017-5117
CVE-2017-5118
CVE-2017-5119
CVE-2017-5120
2017-09-14 20:15:57 +02:00
Kirill Boltaev 73af0b1696 chromium: 60.0.3112.90 -> 60.0.3112.113 2017-09-14 00:40:57 +02:00
Herwig Hochleitner e8f1ddcbd1 chromium: 60.0.3112.78 -> 60.0.3112.90 2017-08-11 11:17:14 +02:00