openSUSE-SU-2025:0115-1

See a problem?
Import Source
https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2025:0115-1.json
JSON Data
https://api.test.osv.dev/v1/vulns/openSUSE-SU-2025:0115-1
Upstream
CVE (9)
Related
CVE (9)
Published
2025-04-06T23:02:41Z
Modified
2026-03-11T07:35:36Z
Summary
Security update for chromium, gn
Details

This update for chromium, gn fixes the following issues:

Changes in chromium:

  • Chromium 135.0.7049.52 (stable release 2025-04-01) (boo#1240555)
    • CVE-2025-3066: Use after free in Navigations
    • CVE-2025-3067: Inappropriate implementation in Custom Tabs
    • CVE-2025-3068: Inappropriate implementation in Intents
    • CVE-2025-3069: Inappropriate implementation in Extensions
    • CVE-2025-3070: Insufficient validation of untrusted input in Extensions
    • CVE-2025-3071: Inappropriate implementation in Navigations
    • CVE-2025-3072: Inappropriate implementation in Custom Tabs
    • CVE-2025-3073: Inappropriate implementation in Autofill
    • CVE-2025-3074: Inappropriate implementation in Downloads

Changes in gn:

  • Update to version 0.20250306:
    • Remove deps from rust executable to module's pcm files
    • Update test for rust executable deps
    • Add toolchain for cxx modules in TestWithScope
    • Apply the latest clang-format
    • Update reference for {rustdeps}
    • Always generate a .toolchain file even if it is empty.
    • Pass --with-lg-page=16 when building jemalloc for arm64.
    • Remove obsolete debug checks.
    • Make default vs ide version on Windows as 2022
    • Reland 'Adds a path_exists() function'
    • Revert 'Adds a path_exists() function'
    • Adds a path_exists() function
    • Revert 'Speed-up GN with custom OutputStream interface.'
    • Speed-up GN with custom OutputStream interface.
    • Add exec_script_allowlist to replace exec_script_whitelist.
    • Retry ReplaceFile in case of failure
    • Fix crash when NinjaBuildWriter::RunAndWriteFile fails
    • fix include for escape.h
    • fix exit code for gn gen failure
    • misc: Use html.escape instead of cgi.escape
    • Do not copy parent build_dependency_files_ in Scope constructors.
    • Improve error message for duplicated items
    • [rust-project] Always use forward slashes in sysroot paths
    • Update all_dependent_configs docs.
    • set 'no_stamp_files' by default
    • fix a typo
    • Stop using transitional LFS64 APIs
    • do not use tool prefix for phony rule
    • [rust] Add sysroot_src to rust-project.json
    • Implement and enable 'no_stamp_files'
    • Add Target::dependency_output_alias()
    • Add 'outputs' to generated_file documentation.
    • Update bug database link.
    • remove a trailing space after variable bindings
    • fix tool name in error
    • remove unused includes
    • Markdown optimization (follow-up)
    • Support link_output, depend_output in Rust linked tools.
    • Properly verify runtime_outputs in rust tool definitions.
    • BugFix: Syntax error in gen.py file
    • generated_file: add output to input deps of stamp
    • Markdown optimization:
    • Revert 'Rust: link_output, depend_output and runtime_outputs for dylibs'
    • hint using nogncheck on disallowed includes
References

Affected packages

SUSE:Package Hub 15 SP6 / chromium

Package

Name
chromium
Purl
pkg:rpm/suse/chromium&distro=SUSE%20Package%20Hub%2015%20SP6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
135.0.7049.52-bp156.2.102.2

Ecosystem specific 

{
    "binaries":  [
        {
            "chromedriver":  "135.0.7049.52-bp156.2.102.2",
            "chromium":  "135.0.7049.52-bp156.2.102.2",
            "gn":  "0.20250306-bp156.2.6.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2025:0115-1.json"

SUSE:Package Hub 15 SP6 / gn

Package

Name
gn
Purl
pkg:rpm/suse/gn&distro=SUSE%20Package%20Hub%2015%20SP6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.20250306-bp156.2.6.1

Ecosystem specific 

{
    "binaries":  [
        {
            "chromedriver":  "135.0.7049.52-bp156.2.102.2",
            "chromium":  "135.0.7049.52-bp156.2.102.2",
            "gn":  "0.20250306-bp156.2.6.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2025:0115-1.json"

openSUSE:Leap 15.6 / chromium

Package

Name
chromium
Purl
pkg:rpm/opensuse/chromium&distro=openSUSE%20Leap%2015.6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
135.0.7049.52-bp156.2.102.2

Ecosystem specific 

{
    "binaries":  [
        {
            "chromedriver":  "135.0.7049.52-bp156.2.102.2",
            "chromium":  "135.0.7049.52-bp156.2.102.2",
            "gn":  "0.20250306-bp156.2.6.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2025:0115-1.json"

openSUSE:Leap 15.6 / gn

Package

Name
gn
Purl
pkg:rpm/opensuse/gn&distro=openSUSE%20Leap%2015.6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.20250306-bp156.2.6.1

Ecosystem specific 

{
    "binaries":  [
        {
            "chromedriver":  "135.0.7049.52-bp156.2.102.2",
            "chromium":  "135.0.7049.52-bp156.2.102.2",
            "gn":  "0.20250306-bp156.2.6.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2025:0115-1.json"