openSUSE-SU-2025:0145-1: important: Security update for chromium

openSUSE Security Update: Security update for chromium
_______________________________

Announcement ID: openSUSE-SU-2025:0145-1
Rating: important
References: #1242153
Cross-References: CVE-2025-4050 CVE-2025-4051 CVE-2025-4052
CVE-2025-4096
Affected Products:
openSUSE Backports SLE-15-SP6
_______________________________

An update that fixes four vulnerabilities is now available.

Description:

This update for chromium fixes the following issues:

- Chromium 136.0.7103.48 (stable release 2025-04-29) (boo#1242153)
* CVE-2025-4096: Heap buffer overflow in HTML. Reported by Anonymous on
2025-04-11
* CVE-2025-4050: Out of bounds memory access in DevTools. Reported by
Anonymous on 2025-04-09
* CVE-2025-4051: Insufficient data validation in DevTools. Reported by
Daniel Fr??jdendahl on 2025-03-1
* CVE-2025-4052: Inappropriate implementation in DevTools. Reported by
vanillawebdev on 2025-03-10
- bump esbuild from 0.24.0 to 0.25.1
* Fix incorrect paths in inline source maps (#4070, #4075, #4105)
* Fix invalid generated source maps (#4080, #4082, #4104, #4107)
* Fix a regression with non-file source map paths (#4078)
* Update Go from 1.23.5 to 1.23.7 (#4076, #4077)

- Chromium 135.0.7049.114 (stable release 2025-04-22)
* stability fixes

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Backports SLE-15-SP6:

zypper in -t patch openSUSE-2025-145=1

Package List:

- openSUSE Backports SLE-15-SP6 (aarch64 x86_64):

chromedriver-136.0.7103.59-bp156.2.113.2
chromium-136.0.7103.59-bp156.2.113.2

References:

https://www.suse.com/security/cve/CVE-2025-4050.html
https://www.suse.com/security/cve/CVE-2025-4051.html
https://www.suse.com/security/cve/CVE-2025-4052.html
https://www.suse.com/security/cve/CVE-2025-4096.html
https://bugzilla.suse.com/1242153

openSUSE-SU-2025:15052-1: moderate: grafana-11.5.4-1.1 on GA media

# grafana-11.5.4-1.1 on GA media

Announcement ID: openSUSE-SU-2025:15052-1
Rating: moderate

Cross-References:

* CVE-2024-6104
* CVE-2025-2703
* CVE-2025-29923
* CVE-2025-30204
* CVE-2025-3454

CVSS scores:

* CVE-2024-6104 ( SUSE ): 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
* CVE-2025-2703 ( SUSE ): 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
* CVE-2025-29923 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
* CVE-2025-30204 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2025-30204 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2025-3454 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected Products:

* openSUSE Tumbleweed

An update that solves 5 vulnerabilities can now be installed.

## Description:

These are all security issues fixed in the grafana-11.5.4-1.1 package on the GA media of openSUSE Tumbleweed.

## Package List:

* openSUSE Tumbleweed:
* grafana 11.5.4-1.1

## References:

* https://www.suse.com/security/cve/CVE-2024-6104.html
* https://www.suse.com/security/cve/CVE-2025-2703.html
* https://www.suse.com/security/cve/CVE-2025-29923.html
* https://www.suse.com/security/cve/CVE-2025-30204.html
* https://www.suse.com/security/cve/CVE-2025-3454.html