-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2013.1154
                     chromium-browser security update
                              26 August 2013

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           chromium-browser
Publisher:         Debian
Operating System:  Debian GNU/Linux 7
Impact/Access:     Denial of Service        -- Remote with User Interaction
                   Access Confidential Data -- Existing Account            
                   Reduced Security         -- Unknown/Unspecified         
Resolution:        Patch/Upgrade
CVE Names:         CVE-2013-2905 CVE-2013-2904 CVE-2013-2903
                   CVE-2013-2902 CVE-2013-2901 CVE-2013-2900
                   CVE-2013-2887  

Reference:         ASB-2013.0103

Original Bulletin: 
   http://www.debian.org/security/2013/dsa-2741

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- - -------------------------------------------------------------------------
Debian Security Advisory DSA-2741-1                   security@debian.org
http://www.debian.org/security/                           Michael Gilbert
August 25, 2013                        http://www.debian.org/security/faq
- - -------------------------------------------------------------------------

Package        : chromium-browser
Vulnerability  : several
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2013-2887 CVE-2013-2900 CVE-2013-2901 CVE-2013-2902
                 CVE-2013-2903 CVE-2013-2904 CVE-2013-2905

Several vulnerabilities have been discovered in the Chromium web browser.

CVE-2013-2887

    The chrome 29 development team found various issues from internal
    fuzzing, audits, and other studies.

CVE-2013-2900

    Krystian Bigaj discovered a file handling path sanitization issue.

CVE-2013-2901

    Alex Chapman discovered an integer overflow issue in ANGLE, the
    Almost Native Graphics Layer.

CVE-2013-2902

    cloudfuzzer discovered a use-after-free issue in XSLT.

CVE-2013-2903

    cloudfuzzer discovered a use-after-free issue in HTMLMediaElement.

CVE-2013-2904

    cloudfuzzer discovered a use-after-free issue in XML document
    parsing.

CVE-2013-2905

    Christian Jaeger discovered an information leak due to insufficient
    file permissions.

For the stable distribution (wheezy), these problems have been fixed in
version 29.0.1547.57-1~deb7u1.

For the testing distribution (jessie), these problems will be fixed soon.

For the unstable distribution (sid), these problems have been fixed in
version 29.0.1547.57-1.

We recommend that you upgrade your chromium-browser packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (GNU/Linux)

iQQcBAEBCgAGBQJSGm5GAAoJELjWss0C1vRzPeQf/RRCxx42uQSyFbV5PPEZgrcw
/pD1tgiM3RIPEQhPlzG6tAXEAV8F44bOeT1XUjUAW5+tfDd+nTrv9kKVQbq5Bt21
zBKBSv5ukZ00pesctK1c1Xmeyg1MkujhC7IOId9yGV1CVXUox0Me8J+FOCBWLtUg
KccHpeh/DkK2/S23Avjc4WysjlPyMWB3aulxZ1BhY2MqOgL1IstlpoDIZB5KO7s3
AiTRdwSH0YXMmjLkvyx8Kdy+rGr2bixameEJp0CO68XWRXd5TF9E/JBgyNi7yW9V
XiPmnjsO39ZXVRAZ5zOkLjC9ZCh9zcYoPEFOl4ZazF+XA8bs0eZtwgLCIFAJbA66
8lT4dGYuXEWPIClNS9UJOO+OoNemYfHFHfJ6zjolijNopsotaFSLLf09JB6aEdBh
D0ag8WZCgQr945wfr4FfrfZ5YJ9m1duUZvhnkJRoQHfPL0EaDEfMkfOTSmIGg/ku
XcWRTgVu/uvqnyz2132j1NHNuScWFVV7YDB2UY/UtfjX0f+3h2xC2DFmOnIuOIBh
4C95GlCXDcAWaxVxByzJMKQaYGuPdc+nbnA2IpAUc+Ge7dXu/MVx8QQgQHqwmNd+
8bfCuwSZz7VrMRflJ1of4fxZB71RGbxvWSYFf64KmHCYY6bwLKCWJ3s4WSBQTpdt
1q6IqhNvKqAqdHam1w4BmJ6yyAPJ+U/JKZZLzat1d/AE4D6p01lS9GfY4ewNyQhf
fQYuNwwzWZScYgtXmOD29QfAagzL3JhxGoc3eKbnwfp7z5DbaUxnj8NSxyRCO1qg
oTyOmialp+7u8rF9es6TaG8ddEklN3hZ5is92qWcydXhBrLakbGMDHu0uVZai1pe
sM3BiogPOwks3gIyLyH5q4+tsEU9hxSZgymLYnlz4lkyFs8Dpd/ZhYX52btcVneG
xIx9GnmwpYKQAV6g0mwHaL+0IXj5RfrKCMpmqHCzDWGxZ7lFilmRKIJmyrI02LN0
eQ6HUreYyphev8yZa69OSJwUnWy88WSxX2PH/oKy+tP9XoYLwQoJjCikI21CrJj8
ydaV6wjVA474HAwTQSF9zbllLdDwfswGSJ29Qzx80Pgf7MUZuDCYVWvqMNtJ44cp
2Hyxc3d8KjPERRda62VQnVPMwhs1kEnEwWSCK8SDpI21bY0756m6GKUVLw0dBf54
mmhwPoU/cVRyHeataY1gkkDl5gAB4VE14GxipNv/ge0AJGIF2YsC6ZP2SaVMkB2x
/gBEBer1gggyTwNKb2gkalyXjXVHns1CFQKSlcEm93W3ychtVVykObRt3+cmZCUU
xOZMWWsUnwzbessCPz3B44sK+4MM9GDqAfQsvBoaU5AnYiLDBKh5KtStENoH5/0=
=ABUv
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBUhqwhBLndAQH1ShLAQLutQ//USX8v+vwIrR7FzjtKFiHpk+nwkx3TX8W
3BI+Ufw5SR9RUuZ1e2ZaAXzbBmL7Q/A0NYYM6WeuTXMtjFTNDfR4VOO17hroICgQ
N3T/fVebzIKhT4i7Z6ZfPNNtaqdhYB3QZB+9FbFPZER/N4kfP2d0oDXFTdf7qT+v
HrfL1SN2vypFl3Xcq0BpSWn54ZSOUtWufWnRrtvqIqZztesUveac9E88RWs1tYhL
6Kk9GH52gN03Pzi8wexh/1Ns9jo4/j+KtdnXSuhxJZBWEa+grNlcy3GqLozrbgrP
6i/6qjRI7/KctpzLcU/f5VF6KwAMK01z1mTVE71EepkfjkY3r4LApCpdAkDMyEaX
6Ri2ERtf5nBrGXWtJYWS7aVgBYXPLqRlrYUamfYCw3TxCiIWOJpA6DlNlheTdB0r
U+P+W904vqk38be67WxVKCjMcDXHGguLaDz3oqgm9BzHu1xPXbkfp27co5h8tv0m
D0DbrIM82DVPfr2Z6JRMmyT15r5UrfiFUyRUEorwlKj/ur3BbKy50zzE79mMaI9n
WQhelas+LaFrj+u8e3xafFS/F1m6aqNRUtGUONIigfnaGSwU6/+Oq9nbSprQdp3n
5g/0PKCIaEXj600DX82PUAuBc7V488y9xjMCtzKEvF/elXzYR/hKRphRtolLI/Ep
SiwLK0pRR5M=
=251e
-----END PGP SIGNATURE-----