Linux · Ubuntu · Package update · September 26, 2022

chromium-codecs-ffmpeg-extra 105.0.5195.102-0ubuntu0.18.04.1: chromium-codecs-ffmpeg-extra 105.0.5195.102-0ubuntu0.18.04.1 for Ubuntu 18.04.6 LTS (bionic)

chromium-codecs-ffmpeg-extra 105.0.5195.102-0ubuntu0.18.04.1, released September 26, 2022, fixes 23 CVEs in chromium-codecs-ffmpeg-extra. 2 of them are being exploited (CVE-2022-3038); 2 on CISA KEV. Patch Radar priority: Patch now. The product is no longer supported.

Patch now2 on CISA KEVUnsupported product
CVEs closed
23
1 rated Critical
Exploited
2
CVE-2022-3038
Highest CVSS
9.6
Base score, 0 to 10
Highest EPSS
0.2493
97th percentile

Priority of the 23 CVEs

Patch now 2 Urgent 0 High 14 Routine 7

Fixed package versions

ProductReleaseFixed in
chromium-codecs-ffmpeg-extraUbuntu 18.04.6 LTS (bionic)105.0.5195.102-0ubuntu0.18.04.1

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
Patch now CVE-2022-3038 Chromium: CVE-2022-3038 Use after free in Network Service8.8 0.2493 KEVExploited
Patch now CVE-2022-3075 Chromium: CVE-2022-3075 Insufficient data validation in Mojo9.6 0.0577 KEVExploited
High CVE-2022-3045 Chromium: CVE-2022-3045 Insufficient validation of untrusted input in V88.8 0.0116 None reported
High CVE-2022-3040 Chromium: CVE-2022-3040 Use after free in Layout8.8 0.0107 None reported
High CVE-2022-3041 Chromium: CVE-2022-3041 Use after free in WebSQL8.8 0.0107 None reported
High CVE-2022-3046 Chromium: CVE-2022-3046 Use after free in Browser Tag8.8 0.0096 None reported
High CVE-2022-3052 chromium: Heap buffer overflow in Window Manager in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote...8.8 0.0096 None reported
High CVE-2022-3039 Chromium: CVE-2022-3039 Use after free in WebSQL8.8 0.0096 None reported
High CVE-2022-3050 chromium: Heap buffer overflow in WebUI in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a remote attacker who conv...8.8 0.0092 None reported
High CVE-2022-3043 chromium: Heap buffer overflow in Screen Capture in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a remote attacker...8.8 0.0085 None reported
High CVE-2022-3055 Chromium: CVE-2022-3055 Use after free in Passwords8.8 0.0084 None reported
High CVE-2022-3051 chromium: Heap buffer overflow in Exosphere in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attac...8.8 0.0083 None reported
High CVE-2022-3058 Chromium: CVE-2022-3058 Use after free in Sign-In Flow8.8 0.0081 None reported
High CVE-2022-3049 chromium: Use after free in SplitScreen in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker...8.8 0.0066 None reported
High CVE-2022-3042 chromium: Use after free in PhoneHub in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a remote attacker to potentia...8.8 0.0062 None reported
High CVE-2022-3071 chromium: Use after free in Tab Strip in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker wh...8.8 0.0056 None reported
Routine CVE-2022-3056 Chromium: CVE-2022-3056 Insufficient policy enforcement in Content Security Policy6.5 0.0112 None reported
Routine CVE-2022-3044 Chromium: CVE-2022-3044 Inappropriate implementation in Site Isolation6.5 0.0107 None reported
Routine CVE-2022-3054 Chromium: CVE-2022-3054 Insufficient policy enforcement in DevTools6.5 0.0079 None reported
Routine CVE-2022-3053 Chromium: CVE-2022-3053 Inappropriate implementation in Pointer Lock4.3 0.0067 None reported
Routine CVE-2022-3057 Chromium: CVE-2022-3057 Inappropriate implementation in iframe Sandbox6.5 0.0066 None reported
Routine CVE-2022-3047 Chromium: CVE-2022-3047 Insufficient policy enforcement in Extensions API6.5 0.0058 None reported
Routine CVE-2022-3048 chromium: Inappropriate implementation in Chrome OS lockscreen in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a l...6.8 0.0038 None reported
Showing 1 to 23 of 23 1

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.