GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

OPENSUSE-SU-2022:10131-1

Vulnerability from csaf_opensuse - Published: 2022-09-27 10:01 - Updated: 2022-09-27 10:01
Summary
Security update for opera
Severity
Important
Notes
Title of the patch: Security update for opera
Description of the patch: This update for opera fixes the following issues: Update to 91.0.4516.20 - CHR-9019 Update chromium on desktop-stable-105-4516 to 105.0.5195.127 - DNA-101312 Allow changing logged in user with BrowserAPI - The update to chromium 105.0.5195.127 fixes following issues: CVE-2022-3196, CVE-2022-3197, CVE-2022-3198, CVE-2022-3199, CVE-2022-3200, CVE-2022-3201 Update to 91.0.4516.16 - CHR-9010 Update chromium on desktop-stable-105-4516 to 105.0.5195.102 - DNA-101447 Incorrect translation in Russian - DNA-101482 Crash at ProfileKey::GetProtoDatabaseProvider() - DNA-101495 Performance Stint 2022 - DNA-101551 Add version number info to browser API - DNA-101662 Suppress 'Allowing special test code paths' warning on buildbot - DNA-101753 News don't show after close browser - DNA-101760 Translations for O91 - DNA-101799 Crash at opera::SuggestionList::SortAndCull - DNA-101812 Sponsored site gets chosen as default entry when typing part of top-level domain - DNA-101876 Promote 91 to stable - Complete Opera 91.0 changelog at: https://blogs.opera.com/desktop/changelog-for-91/ - Update to 90.0.4480.107 - DNA-100664 Shopping corner widget - DNA-101495 Performance Stint 2022 - DNA-101753 News don’t show after close browser - DNA-101799 Crash at opera::SuggestionList::SortAndCull
Patchnames: openSUSE-2022-10131
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2022-3196
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Leap 15.4 NonFree:opera-91.0.4516.20-lp154.2.23.1.x86_64 —
Vendor Fix
Threats
Impact important
CVE-2022-3197
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Recommended 1 product, the same list as for CVE-2022-3196
Threats
Impact important
CVE-2022-3198
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Recommended 1 product, the same list as for CVE-2022-3196
Threats
Impact important
CVE-2022-3199
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Recommended 1 product, the same list as for CVE-2022-3196
Threats
Impact important
CVE-2022-3200
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Recommended 1 product, the same list as for CVE-2022-3196
Threats
Impact important
CVE-2022-3201
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Affected products
Recommended 1 product, the same list as for CVE-2022-3196
Threats
Impact important
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for opera",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for opera fixes the following issues:\n\nUpdate to 91.0.4516.20\n\n  - CHR-9019 Update chromium on desktop-stable-105-4516 to\n    105.0.5195.127\n  - DNA-101312 Allow changing logged in user with BrowserAPI\n\n- The update to chromium 105.0.5195.127 fixes following issues:  \n  CVE-2022-3196, CVE-2022-3197, CVE-2022-3198, CVE-2022-3199,\n  CVE-2022-3200, CVE-2022-3201\n  \n\nUpdate to 91.0.4516.16\n\n  - CHR-9010 Update chromium on desktop-stable-105-4516 to\n    105.0.5195.102\n  - DNA-101447 Incorrect translation in Russian\n  - DNA-101482 Crash at ProfileKey::GetProtoDatabaseProvider()\n  - DNA-101495 Performance Stint 2022\n  - DNA-101551 Add version number info to browser API\n  - DNA-101662 Suppress \u0027Allowing special test code paths\u0027\n    warning on buildbot\n  - DNA-101753 News don\u0027t show after close browser\n  - DNA-101760 Translations for O91\n  - DNA-101799 Crash at opera::SuggestionList::SortAndCull\n  - DNA-101812 Sponsored site gets chosen as default entry\n    when typing part of top-level domain\n  - DNA-101876 Promote 91 to stable\n\n- Complete Opera 91.0 changelog at:\n  https://blogs.opera.com/desktop/changelog-for-91/\n\n- Update to 90.0.4480.107\n\n  - DNA-100664 Shopping corner widget\n  - DNA-101495 Performance Stint 2022\n  - DNA-101753 News don\u2019t show after close browser\n  - DNA-101799 Crash at opera::SuggestionList::SortAndCull\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-2022-10131",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2022_10131-1.json"
      },
      {
        "category": "self",
        "summary": "URL for openSUSE-SU-2022:10131-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/G6TT4MGVDNPD2HCAIKGPG7EJ4Z5DSRJL/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for openSUSE-SU-2022:10131-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/G6TT4MGVDNPD2HCAIKGPG7EJ4Z5DSRJL/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-3196 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-3196/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-3197 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-3197/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-3198 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-3198/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-3199 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-3199/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-3200 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-3200/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-3201 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-3201/"
      }
    ],
    "title": "Security update for opera",
    "tracking": {
      "current_release_date": "2022-09-27T10:01:38Z",
      "generator": {
        "date": "2022-09-27T10:01:38Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2022:10131-1",
      "initial_release_date": "2022-09-27T10:01:38Z",
      "revision_history": [
        {
          "date": "2022-09-27T10:01:38Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "opera-91.0.4516.20-lp154.2.23.1.x86_64",
                "product": {
                  "name": "opera-91.0.4516.20-lp154.2.23.1.x86_64",
                  "product_id": "opera-91.0.4516.20-lp154.2.23.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.4 NonFree",
                "product": {
                  "name": "openSUSE Leap 15.4 NonFree",
                  "product_id": "openSUSE Leap 15.4 NonFree",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.4"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "opera-91.0.4516.20-lp154.2.23.1.x86_64 as component of openSUSE Leap 15.4 NonFree",
          "product_id": "openSUSE Leap 15.4 NonFree:opera-91.0.4516.20-lp154.2.23.1.x86_64"
        },
        "product_reference": "opera-91.0.4516.20-lp154.2.23.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.4 NonFree"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-3196",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-3196"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Use after free in PDF in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: High)",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.4 NonFree:opera-91.0.4516.20-lp154.2.23.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-3196",
          "url": "https://www.suse.com/security/cve/CVE-2022-3196"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1203419 for CVE-2022-3196",
          "url": "https://bugzilla.suse.com/1203419"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.4 NonFree:opera-91.0.4516.20-lp154.2.23.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.4 NonFree:opera-91.0.4516.20-lp154.2.23.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-09-27T10:01:38Z",
          "details": "important"
        }
      ],
      "title": "CVE-2022-3196"
    },
    {
      "cve": "CVE-2022-3197",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-3197"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Use after free in PDF in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: High)",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.4 NonFree:opera-91.0.4516.20-lp154.2.23.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-3197",
          "url": "https://www.suse.com/security/cve/CVE-2022-3197"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1203419 for CVE-2022-3197",
          "url": "https://bugzilla.suse.com/1203419"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.4 NonFree:opera-91.0.4516.20-lp154.2.23.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.4 NonFree:opera-91.0.4516.20-lp154.2.23.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-09-27T10:01:38Z",
          "details": "important"
        }
      ],
      "title": "CVE-2022-3197"
    },
    {
      "cve": "CVE-2022-3198",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-3198"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Use after free in PDF in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: High)",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.4 NonFree:opera-91.0.4516.20-lp154.2.23.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-3198",
          "url": "https://www.suse.com/security/cve/CVE-2022-3198"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1203419 for CVE-2022-3198",
          "url": "https://bugzilla.suse.com/1203419"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.4 NonFree:opera-91.0.4516.20-lp154.2.23.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.4 NonFree:opera-91.0.4516.20-lp154.2.23.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-09-27T10:01:38Z",
          "details": "important"
        }
      ],
      "title": "CVE-2022-3198"
    },
    {
      "cve": "CVE-2022-3199",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-3199"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Use after free in Frames in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.4 NonFree:opera-91.0.4516.20-lp154.2.23.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-3199",
          "url": "https://www.suse.com/security/cve/CVE-2022-3199"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1203419 for CVE-2022-3199",
          "url": "https://bugzilla.suse.com/1203419"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.4 NonFree:opera-91.0.4516.20-lp154.2.23.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.4 NonFree:opera-91.0.4516.20-lp154.2.23.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-09-27T10:01:38Z",
          "details": "important"
        }
      ],
      "title": "CVE-2022-3199"
    },
    {
      "cve": "CVE-2022-3200",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-3200"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Heap buffer overflow in Internals in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.4 NonFree:opera-91.0.4516.20-lp154.2.23.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-3200",
          "url": "https://www.suse.com/security/cve/CVE-2022-3200"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1203419 for CVE-2022-3200",
          "url": "https://bugzilla.suse.com/1203419"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.4 NonFree:opera-91.0.4516.20-lp154.2.23.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.4 NonFree:opera-91.0.4516.20-lp154.2.23.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-09-27T10:01:38Z",
          "details": "important"
        }
      ],
      "title": "CVE-2022-3200"
    },
    {
      "cve": "CVE-2022-3201",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-3201"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Insufficient validation of untrusted input in DevTools in Google Chrome on Chrome OS prior to 105.0.5195.125 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: High)",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.4 NonFree:opera-91.0.4516.20-lp154.2.23.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-3201",
          "url": "https://www.suse.com/security/cve/CVE-2022-3201"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1203419 for CVE-2022-3201",
          "url": "https://bugzilla.suse.com/1203419"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1203808 for CVE-2022-3201",
          "url": "https://bugzilla.suse.com/1203808"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.4 NonFree:opera-91.0.4516.20-lp154.2.23.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.4 NonFree:opera-91.0.4516.20-lp154.2.23.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-09-27T10:01:38Z",
          "details": "important"
        }
      ],
      "title": "CVE-2022-3201"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.