Browser Security

WetGeek

It's all over the news today that both Chrome and Firefox have been found to have serious security issues, that the respective companies are rushing to fix. Is this a work in progress here at Solus? And are we sure about the extent of the problem?

I suspect that Chrome and Firefox are in the news because they're popular browsers that broadcasters are aware of. But does that mean that Chromium, Vivaldi, and other browsers that we use are not compromised?

EbonJaeger

If you're talking about the webp and libvpx vulnerabilities from a few weeks ago and last week, respectively, both of them were patched in Solus soon after they were announced.

WetGeek

EbonJaeger patched in Solus soon after they were announced

Thanks. I'm not sure of what vulnerabilities they are, as the news broadcasters didn't identify them in detail. But today is the first day those reports have appeared in the news. PCMatic has a new commercial out today about it.

Hopefully they are talking about the already-patched problems, and not something new.

davidjharder

There are essentially three flavors of browser on linux: Firefox, Chrome(ium), and Other. A Chrome CVE almost certainly affects Vivaldi, Brave, and friends, as they are Chromium based.

When these are hit with a CVE we sit and wait for a release, then cherry-pick it to Stable once built.

EbonJaeger

WetGeek I checked ArsTechnica and see no new articles, and they're usually quick to report on serious vulnerabilities, so hopefully it's just about the other ones over the last few weeks.

WetGeek

EbonJaeger I checked ArsTechnica and see no new articles

In the news, a talking tech head explained that as soon as your computer says an update is available, you need to stop whatever you're doing and install it. And Google announced that they're not going to release more technical details until most folks have been updated. (Presumably not to spread a how-to for other hackers.) Apparently it's already being exploited, thus the rush for updates. Fingers crossed ...

WetGeek

Here's something I just found with a web search.

EbonJaeger

Yeah for some reason, people in the infosec community reverse engineered the vulnerabilities from the fix patches and release proof of concept articles right after the fixes were released, thus making it way easier for actual bad actors to create attacks exploiting them. Hopefully people learn from this one...

EDIT: WetGeek yep, thats the libvpx one. Patched on Solus. 🙂