Change logs for chromium-browser source package in Zesty

  • chromium-browser (63.0.3239.84-0ubuntu0.17.04.1) zesty; urgency=medium
    
      * Upstream release: 63.0.3239.84
        - CVE-2017-15407: Out of bounds write in QUIC.
        - CVE-2017-15408: Heap buffer overflow in PDFium.
        - CVE-2017-15409: Out of bounds write in Skia.
        - CVE-2017-15410: Use after free in PDFium.
        - CVE-2017-15411: Use after free in PDFium.
        - CVE-2017-15412: Use after free in libXML.
        - CVE-2017-15413: Type confusion in WebAssembly.
        - CVE-2017-15415: Pointer information disclosure in IPC call.
        - CVE-2017-15416: Out of bounds read in Blink.
        - CVE-2017-15417: Cross origin information disclosure in Skia.
        - CVE-2017-15418: Use of uninitialized value in Skia.
        - CVE-2017-15419: Cross origin leak of redirect URL in Blink.
        - CVE-2017-15420: URL spoofing in Omnibox.
        - CVE-2017-15422: Integer overflow in ICU.
        - CVE-2017-15423: Issue with SPAKE implementation in BoringSSL.
        - CVE-2017-15424: URL Spoof in Omnibox.
        - CVE-2017-15425: URL Spoof in Omnibox.
        - CVE-2017-15426: URL Spoof in Omnibox.
        - CVE-2017-15427: Insufficient blocking of JavaScript in Omnibox.
      * debian/rules:
        - replace allow_posix_link_time_opt=false by use_lld=false, is_cfi=false
          and use_thin_lto=false
        - rename use_vulcanize GN flag to optimize_webui
        - generate the man page as it's not being built with chromium any
          longer (since commit 64b961499bebc54fe48478f5e37477252c7887fa)
        - build gn with clang
      * debian/patches/arm-neon.patch: refreshed
      * debian/patches/disable-sse2: refreshed
      * debian/patches/fix-gn-bootstrap.patch: removed, no longer needed
      * debian/patches/fix_building_widevinecdm_with_chromium.patch: replaced by
        debian/patches/widevine-revision.patch
      * debian/patches/revert-Xclang-instcombine-lower-dbg-declare.patch: added
      * debian/patches/search-credit.patch: refreshed
      * debian/patches/set-rpath-on-chromium-executables.patch: updated
      * debian/patches/suppress-newer-clang-warning-flags.patch: updated
      * debian/patches/touch-v35: refreshed
      * debian/patches/widevine-other-locations: updated (LP: #1652110)
      * debian/patches/widevine-revision.patch: added (LP: #1652110)
    
     -- Olivier Tilloy <email address hidden>  Thu, 07 Dec 2017 13:35:57 +0100
  • chromium-browser (62.0.3202.94-0ubuntu0.17.04.1388) zesty; urgency=medium
    
      * Upstream release: 62.0.3202.94
    
     -- Olivier Tilloy <email address hidden>  Mon, 13 Nov 2017 23:39:47 +0100
  • chromium-browser (62.0.3202.89-0ubuntu0.17.04.1386) zesty; urgency=medium
    
      * Upstream release: 62.0.3202.89
        - CVE-2017-15398: Stack buffer overflow in QUIC.
        - CVE-2017-15399: Use after free in V8.
    
     -- Olivier Tilloy <email address hidden>  Mon, 06 Nov 2017 22:49:46 +0100
  • chromium-browser (62.0.3202.75-0ubuntu0.17.04.1384) zesty; urgency=medium
    
      * Upstream release: 62.0.3202.75
        - CVE-2017-15396: Stack overflow in V8.
      * debian/control: bump Standards-Version to 4.1.1
      * debian/patches/set-rpath-on-chromium-executables.patch: updated
      * debian/tests/*:
        - removed stale autopkgtests
        - added new autopkgtests based on chromium's new headless mode
      * debian/source/include-binaries: updated to reflect new binary data in tests
    
     -- Olivier Tilloy <email address hidden>  Fri, 27 Oct 2017 19:22:48 +0200
  • chromium-browser (62.0.3202.62-0ubuntu0.17.04.1379) zesty; urgency=medium
    
      * Upstream release: 62.0.3202.62
        - CVE-2017-5124: UXSS with MHTML.
        - CVE-2017-5125: Heap overflow in Skia.
        - CVE-2017-5126: Use after free in PDFium.
        - CVE-2017-5127: Use after free in PDFium.
        - CVE-2017-5128: Heap overflow in WebGL.
        - CVE-2017-5129: Use after free in WebAudio.
        - CVE-2017-5132: Incorrect stack manipulation in WebAssembly.
        - CVE-2017-5130: Heap overflow in libxml2.
        - CVE-2017-5131: Out of bounds write in Skia.
        - CVE-2017-5133: Out of bounds write in Skia.
        - CVE-2017-15386: UI spoofing in Blink.
        - CVE-2017-15387: Content security bypass.
        - CVE-2017-15388: Out of bounds read in Skia.
        - CVE-2017-15389: URL spoofing in OmniBox.
        - CVE-2017-15390: URL spoofing in OmniBox.
        - CVE-2017-15391: Extension limitation bypass in Extensions.
        - CVE-2017-15392: Incorrect registry key handling in PlatformIntegration.
        - CVE-2017-15393: Referrer leak in Devtools.
        - CVE-2017-15394: URL spoofing in extensions UI.
        - CVE-2017-15395: Null pointer dereference in ImageCapture.
      * debian/control: bump Standards-Version to 4.1.0
      * debian/patches/additional-search-engines.patch: refreshed
      * debian/patches/disable-sse2: refreshed
      * debian/patches/enable-chromecast-by-default.patch: refreshed
      * debian/patches/fix-compilation-for-atk.patch: removed, no longer needed
      * debian/patches/fix-gn-bootstrap.patch: updated
      * debian/patches/fix_building_widevinecdm_with_chromium.patch: refreshed
      * debian/patches/make-base-numerics-build-with-gcc.patch: removed, no longer
        needed
      * debian/patches/revert-clang-nostdlib++.patch: added
      * debian/patches/search-credit.patch: refreshed
      * debian/patches/set-rpath-on-chromium-executables.patch: refreshed
      * debian/patches/suppress-newer-clang-warning-flags.patch: added
      * debian/patches/title-bar-default-system.patch-v35: refreshed
      * debian/patches/widevine-other-locations: refreshed
    
     -- Olivier Tilloy <email address hidden>  Wed, 18 Oct 2017 22:19:17 +0200
  • chromium-browser (61.0.3163.100-0ubuntu0.17.04.1377) zesty; urgency=medium
    
      * debian/patches/set-rpath-on-chromium-executables.patch: added
        (LP: #1718885)
      * debian/chromium-browser.sh.in: remove LD_LIBRARY_PATH manipulation,
        made unnecessary by patch above
    
     -- Olivier Tilloy <email address hidden>  Tue, 26 Sep 2017 09:48:13 -0400
  • chromium-browser (61.0.3163.79-0ubuntu0.17.04.1371) zesty; urgency=medium
    
      * Upstream release: 61.0.3163.79
        - CVE-2017-5111: Use after free in PDFium.
        - CVE-2017-5112: Heap buffer overflow in WebGL.
        - CVE-2017-5113: Heap buffer overflow in Skia.
        - CVE-2017-5114: Memory lifecycle issue in PDFium.
        - CVE-2017-5115: Type confusion in V8.
        - CVE-2017-5116: Type confusion in V8.
        - CVE-2017-5117: Use of uninitialized value in Skia.
        - CVE-2017-5118: Bypass of Content Security Policy in Blink.
        - CVE-2017-5119: Use of uninitialized value in Skia.
        - CVE-2017-5120: Potential HTTPS downgrade during redirect navigation.
      * debian/control:
        - bump Standards-Version to 4.0.0
        - add build dependency on llvm
      * debian/rules: build with is_component_build=false, is_official_build=true,
        allow_posix_link_time_opt=false and fatal_linker_warnings=false
      * debian/patches/additional-search-engines.patch: refreshed
      * debian/patches/define__libc_malloc.patch: added
      * debian/patches/disable-sse2: refreshed
      * debian/patches/enable-chromecast-by-default.patch: refreshed
      * debian/patches/fix-compilation-for-atk.patch: added
      * debian/patches/fix-gn-bootstrap.patch: updated
      * debian/patches/fix_building_widevinecdm_with_chromium.patch: refreshed
      * debian/patches/make-base-numerics-build-with-gcc.patch: added
      * debian/patches/revert-llvm-ar.patch: removed, no longer needed
      * debian/patches/search-credit.patch: refreshed
      * debian/patches/skia-undef-HWCAP_CRC32.patch: added
      * debian/patches/title-bar-default-system.patch-v35: refreshed
    
     -- Olivier Tilloy <email address hidden>  Mon, 11 Sep 2017 22:39:06 +0200
  • chromium-browser (60.0.3112.113-0ubuntu0.17.04.1369) zesty; urgency=medium
    
      * Upstream release: 60.0.3112.113
    
     -- Olivier Tilloy <email address hidden>  Fri, 25 Aug 2017 07:59:14 +0200
  • chromium-browser (60.0.3112.78-0ubuntu0.17.04.1363) zesty; urgency=medium
    
      * Upstream release: 60.0.3112.78
        - CVE-2017-5091: Use after free in IndexedDB.
        - CVE-2017-5092: Use after free in PPAPI.
        - CVE-2017-5093: UI spoofing in Blink.
        - CVE-2017-5094: Type confusion in extensions.
        - CVE-2017-5095: Out-of-bounds write in PDFium.
        - CVE-2017-5096: User information leak via Android intents.
        - CVE-2017-5097: Out-of-bounds read in Skia.
        - CVE-2017-5098: Use after free in V8.
        - CVE-2017-5099: Out-of-bounds write in PPAPI.
        - CVE-2017-5100: Use after free in Chrome Apps.
        - CVE-2017-5101: URL spoofing in OmniBox.
        - CVE-2017-5102: Uninitialized use in Skia.
        - CVE-2017-5103: Uninitialized use in Skia.
        - CVE-2017-5104: UI spoofing in browser.
        - CVE-2017-5105: URL spoofing in OmniBox.
        - CVE-2017-5106: URL spoofing in OmniBox.
        - CVE-2017-5107: User information leak via SVG.
        - CVE-2017-5108: Type confusion in PDFium.
        - CVE-2017-5109: UI spoofing in browser.
        - CVE-2017-5110: UI spoofing in payments dialog.
        - CVE-2017-7000: Pointer disclosure in SQLite.
      * debian/patches/additional-search-engines.patch: refreshed
      * debian/patches/default-allocator: refreshed
      * debian/patches/disable-sse2: refreshed
      * debian/patches/fix_building_widevinecdm_with_chromium.patch: refreshed
      * debian/patches/fix-gn-bootstrap.patch: added
      * debian/patches/last-commit-position: refreshed
      * debian/patches/linux-dma-buf.patch: removed, no longer needed
      * debian/patches/memory-free-assertion-failure: removed, no longer needed
      * debian/patches/revert-llvm-ar.patch: refreshed
      * debian/patches/search-credit.patch: refreshed
      * debian/patches/snapshot-library-link: removed, no longer needed
      * debian/patches/stdatomic: removed, no longer needed
      * debian/patches/title-bar-default-system.patch-v35: refreshed
      * debian/patches/use-gcc-versioned: removed, no longer needed
    
     -- Olivier Tilloy <email address hidden>  Mon, 31 Jul 2017 17:04:59 +0200
  • chromium-browser (59.0.3071.109-0ubuntu0.17.04.1360) zesty; urgency=medium
    
      * Upstream release: 59.0.3071.109
    
     -- Olivier Tilloy <email address hidden>  Wed, 21 Jun 2017 06:37:28 +0200
  • chromium-browser (58.0.3029.110-0ubuntu0.17.04.1354) zesty; urgency=medium
    
      * Upstream release: 58.0.3029.110
      * debian/control: bump Standards-Version to 3.9.8
    
     -- Olivier Tilloy <email address hidden>  Wed, 10 May 2017 06:34:09 +0200
  • chromium-browser (58.0.3029.96-0ubuntu0.17.04.1352) zesty; urgency=medium
    
      * Upstream release: 58.0.3029.96
        - CVE-2017-5068: Race condition in WebRTC.
    
     -- Olivier Tilloy <email address hidden>  Wed, 03 May 2017 06:28:55 +0200
  • chromium-browser (58.0.3029.81-0ubuntu2.17.04.1350) zesty; urgency=medium
    
      * Upstream release: 58.0.3029.81
        - CVE-2017-5057: Type confusion in PDFium.
        - CVE-2017-5058: Heap use after free in Print Preview.
        - CVE-2017-5059: Type confusion in Blink.
        - CVE-2017-5060: URL spoofing in Omnibox.
        - CVE-2017-5061: URL spoofing in Omnibox.
        - CVE-2017-5062: Use after free in Chrome Apps.
        - CVE-2017-5063: Heap overflow in Skia.
        - CVE-2017-5064: Use after free in Blink.
        - CVE-2017-5065: Incorrect UI in Blink.
        - CVE-2017-5066: Incorrect signature handing in Networking.
        - CVE-2017-5067: URL spoofing in Omnibox.
        - CVE-2017-5069: Cross-origin bypass in Blink.
      * debian/patches/arm.patch: removed, no longer needed
      * debian/patches/gtk-ui-stdmove: removed, no longer needed (upstreamed)
      * debian/patches/screen_capturer: removed, no longer needed (upstreamed)
      * debian/patches/default-allocator: refreshed
      * debian/patches/disable-sse2: refreshed
      * debian/patches/enable-chromecast-by-default: refreshed
      * debian/patches/fix_building_widevinecdm_with_chromium.patch: refreshed
      * debian/patches/search-credit.patch: refreshed
      * debian/patches/snapshot-library-link: refreshed
      * debian/patches/title-bar-default-system.patch-v35: refreshed
      * debian/patches/fix-gn-bootstrap.patch: added
      * debian/rules: disable the use of Vulcanize, the required node.js modules
        are not readily available
    
     -- Olivier Tilloy <email address hidden>  Mon, 24 Apr 2017 22:34:45 +0200
  • chromium-browser (57.0.2987.98-0ubuntu1.1348) zesty; urgency=medium
    
      * Upstream release: 57.0.2987.98.
        - CVE-2017-5030: Memory corruption in V8.
        - CVE-2017-5031: Use after free in ANGLE.
        - CVE-2017-5032: Out of bounds write in PDFium.
        - CVE-2017-5029: Integer overflow in libxslt.
        - CVE-2017-5034: Use after free in PDFium.
        - CVE-2017-5035: Incorrect security UI in Omnibox.
        - CVE-2017-5036: Use after free in PDFium.
        - CVE-2017-5037: Multiple out of bounds writes in ChunkDemuxer.
        - CVE-2017-5039: Use after free in PDFium.
        - CVE-2017-5040: Information disclosure in V8.
        - CVE-2017-5041: Address spoofing in Omnibox.
        - CVE-2017-5033: Bypass of Content Security Policy in Blink.
        - CVE-2017-5042: Incorrect handling of cookies in Cast.
        - CVE-2017-5038: Use after free in GuestView.
        - CVE-2017-5043: Use after free in GuestView.
        - CVE-2017-5044: Heap overflow in Skia.
        - CVE-2017-5045: Information disclosure in XSS Auditor.
        - CVE-2017-5046: Information disclosure in Blink.
      * debian/patches/arm64-support no longer needed
      * debian/patches/stdatomic: Support gcc48.
      * debian/patches/snapshot-library-link: Add missing libsnapshot link
      * debian/patches/gtk-ui-stdmove: fix && pointer return with std::move
      * debian/rules: Fix armhf float ABI and remove unnecessary envvars.
        (LP: #1673276)
      * debian/rules, debian/control: Use clang.
    
     -- Chad MILLER <email address hidden>  Wed, 15 Mar 2017 21:12:35 -0400
  • chromium-browser (56.0.2924.76-0ubuntu2.1343) zesty; urgency=medium
    
      * debian/control: Drop binary arch "any" and explicitly list four.
      * debian/patches/arm64-support: arm64 gcc needs toolchain information.
    
     -- Chad MILLER <email address hidden>  Thu, 02 Mar 2017 15:32:01 -0500
  • chromium-browser (55.0.2883.87-0ubuntu2.1329) zesty; urgency=medium
    
      * No-change rebuild against libnspr4
    
     -- Andy Whitcroft <email address hidden>  Fri, 24 Feb 2017 11:10:02 +0000
  • chromium-browser (55.0.2883.87-0ubuntu2.1328) zesty; urgency=medium
    
      * debian/rules: Build extra codecs as part of main chromium program,
        and libre/crippled/h.264less on its own. Seems to make h.264 work
        again. Weird.
      * debian/chromium-browser.links: Make link to ./ instead of / to fix
        path problems that codec-using other apps might see.
    
     -- Chad MILLER <email address hidden>  Sat, 17 Dec 2016 12:05:53 -0500
  • chromium-browser (55.0.2883.87-0ubuntu1.1326) zesty; urgency=medium
    
      * Upstream release of 55.0.2883.87:
        - Change Flash running default to important content only.
      * debian/chromium-browser.sh.in: Insert the Flash version if empty and
        detectable.
      * debian/rules, debian/control: Use gcc/g++ 4.8 to build.
      * Upstream release of 55.0.2883.75:
        - CVE-2016-9651: Private property access in V8.
        - CVE-2016-5208: Universal XSS in Blink.
        - CVE-2016-5207: Universal XSS in Blink.
        - CVE-2016-5206: Same-origin bypass in PDFium.
        - CVE-2016-5205: Universal XSS in Blink.
        - CVE-2016-5204: Universal XSS in Blink.
        - CVE-2016-5209: Out of bounds write in Blink.
        - CVE-2016-5203: Use after free in PDFium.
        - CVE-2016-5210: Out of bounds write in PDFium.
        - CVE-2016-5212: Local file disclosure in DevTools.
        - CVE-2016-5211: Use after free in PDFium.
        - CVE-2016-5213: Use after free in V8.
        - CVE-2016-5214: File download protection bypass.
        - CVE-2016-5216: Use after free in PDFium.
        - CVE-2016-5215: Use after free in Webaudio.
        - CVE-2016-5217: Use of unvalidated data in PDFium.
        - CVE-2016-5218: Address spoofing in Omnibox.
        - CVE-2016-5219: Use after free in V8.
        - CVE-2016-5221: Integer overflow in ANGLE.
        - CVE-2016-5220: Local file access in PDFium.
        - CVE-2016-5222: Address spoofing in Omnibox.
        - CVE-2016-9650: CSP Referrer disclosure.
        - CVE-2016-5223: Integer overflow in PDFium.
        - CVE-2016-5226: Limited XSS in Blink.
        - CVE-2016-5225: CSP bypass in Blink.
        - CVE-2016-5224: Same-origin bypass in SVG
        - CVE-2016-9652: Various fixes from internal audits, fuzzing and other
          initiatives
      * Upstream release of 54.0.2840.100:
        - CVE-2016-5199: Heap corruption in FFmpeg.
        - CVE-2016-5200: Out of bounds memory access in V8.
        - CVE-2016-5201: Info leak in extensions.
        - CVE-2016-5202: Various fixes from internal audits, fuzzing and other
          initiatives
      * Move to using GN to build chromium.
        - debian/known_gn_gen_args
        - debian/rules
        patches
      * debian/rules, lintians, installs, script: Move component libs out of
        libs/, to /usr/lib/chromium-browser/ only.
      * debian/patches/do-not-use-bundled-clang: Use clang from path.
      * debian/control: Express that binary packages could be on "any"
        architecture.
      * debian/control: additionally build-dep on libgtk-3-dev
      * debian/patches/arm64-support: Fail nicer if aarch64/arm64 mismatch.
      * Upstrem release of 54.0.2840.59:
        - CVE-2016-5181: Universal XSS in Blink.
        - CVE-2016-5182: Heap overflow in Blink.
        - CVE-2016-5183: Use after free in PDFium.
        - CVE-2016-5184: Use after free in PDFium.
        - CVE-2016-5185: Use after free in Blink.
        - CVE-2016-5187: URL spoofing.
        - CVE-2016-5188: UI spoofing.
        - CVE-2016-5192: Cross-origin bypass in Blink.
        - CVE-2016-5189: URL spoofing.
        - CVE-2016-5186: Out of bounds read in DevTools.
        - CVE-2016-5191: Universal XSS in Bookmarks.
        - CVE-2016-5190: Use after free in Internals.
        - CVE-2016-5193: Scheme bypass.
        - CVE-2016-5194: Various fixes from internal audits, fuzzing and other
          initiatives
      * debian/patches/allow-component-build: Hard-code, override
        release -> no component logic.
      * debian/known_gyp_flags: Remove old GYP known-flags list.
      * debian/default-allocator: Insist on not using tcmalloc allocator.
      * debian/rules: Set LDFLAGS to limit memory usage.
      * debian/control: Remove extraneous dependencies.
    
     -- Chad MILLER <email address hidden>  Sat, 03 Dec 2016 09:55:37 -0500
  • chromium-browser (53.0.2785.143-0ubuntu1.1307) yakkety; urgency=medium
    
      * Upstream release 53.0.2785.143:
        - CVE-2016-5177: Use after free in V8.
        - CVE-2016-5178: Various fixes from internal audits, fuzzing and other
          initiatives.
      * Upstream release 53.0.2785.113:
        - CVE-2016-5170: Use after free in Blink.
        - CVE-2016-5171: Use after free in Blink.
        - CVE-2016-5172: Arbitrary Memory Read in v8.
        - CVE-2016-5173: Extension resource access.
        - CVE-2016-5174: Popup not correctly suppressed.
        - CVE-2016-5175: Various fixes from internal audits, fuzzing and other
          initiatives.
      * Upstream release 53.0.2785.89:
        - CVE-2016-5147: Universal XSS in Blink.
        - CVE-2016-5148: Universal XSS in Blink.
        - CVE-2016-5149: Script injection in extensions.
        - CVE-2016-5150: Use after free in Blink.
        - CVE-2016-5151: Use after free in PDFium.
        - CVE-2016-5152: Heap overflow in PDFium.
        - CVE-2016-5153: Use after destruction in Blink.
        - CVE-2016-5154: Heap overflow in PDFium.
        - CVE-2016-5155: Address bar spoofing.
        - CVE-2016-5156: Use after free in event bindings.
        - CVE-2016-5157: Heap overflow in PDFium.
        - CVE-2016-5158: Heap overflow in PDFium.
        - CVE-2016-5159: Heap overflow in PDFium.
        - CVE-2016-5161: Type confusion in Blink.
        - CVE-2016-5162: Extensions web accessible resources bypass.
        - CVE-2016-5163: Address bar spoofing.
        - CVE-2016-5164: Universal XSS using DevTools.
        - CVE-2016-5165: Script injection in DevTools.
        - CVE-2016-5166: SMB Relay Attack via Save Page As.
        - CVE-2016-5160: Extensions web accessible resources bypass.
        - CVE-2016-5167: Various fixes from internal audits, fuzzing and other
          initiatives.
      * debian/patches/cups-include-deprecated-ppd, debian/rules: include cups
        functions.
      * debian/rules, debian/control: Force using gcc-5 compiler.
      * Use system libraries for expat, speex, zlib, opus, png, jpeg.
      * Also build for arm64 architecture.
      * Don't compile in cups support by default on all architectures.
      * Upstream release 52.0.2743.116:
        - CVE-2016-5141 Address bar spoofing.
        - CVE-2016-5142 Use-after-free in Blink.
        - CVE-2016-5139 Heap overflow in pdfium.
        - CVE-2016-5140 Heap overflow in pdfium.
        - CVE-2016-5145 Same origin bypass for images in Blink.
        - CVE-2016-5143 Parameter sanitization failure in DevTools.
        - CVE-2016-5144 Parameter sanitization failure in DevTools.
        - CVE-2016-5146: Various fixes from internal audits, fuzzing and other
          initiatives.
      * Exclude harfbuzz and libxslt from system-library use.
      * Upstream release 52.0.2743.82:
        - CVE-2016-1706: Sandbox escape in PPAPI.
        - CVE-2016-1707: URL spoofing on iOS.
        - CVE-2016-1708: Use-after-free in Extensions.
        - CVE-2016-1709: Heap-buffer-overflow in sfntly.
        - CVE-2016-1710: Same-origin bypass in Blink.
        - CVE-2016-1711: Same-origin bypass in Blink.
        - CVE-2016-5127: Use-after-free in Blink.
        - CVE-2016-5128: Same-origin bypass in V8.
        - CVE-2016-5129: Memory corruption in V8.
        - CVE-2016-5130: URL spoofing.
        - CVE-2016-5131: Use-after-free in libxml.
        - CVE-2016-5132: Limited same-origin bypass in Service Workers.
        - CVE-2016-5133: Origin confusion in proxy authentication.
        - CVE-2016-5134: URL leakage via PAC script.
        - CVE-2016-5135: Content-Security-Policy bypass.
        - CVE-2016-5136: Use after free in extensions.
        - CVE-2016-5137: History sniffing with HSTS and CSP.
        - CVE-2016-1705: Various fixes from internal audits, fuzzing and other
          initiatives
      * Upstream release 51.0.2704.106
      * Upstream release 51.0.2704.103:
        - CVE-2016-1704: Various fixes from internal audits, fuzzing and other
          initiatives.
      * debian/control: remvove build-dep on clang.
      * debian/rules: Disable Google Now. Creepy. Might mean downloads of opaque
        programs too.
      * debian/rules: Disable Wallet service.
      * debian/rules: Remove precise-specific conditions. More simple.
      * debian/rules: In install-validation, don't use mktemp. Hard-code
        destination.
      * debian/patches/gsettings-display-scaling: Disable because code moved and
        needs refactoring.
      * debian/patches/display-scaling-default-value: Disable because probbly not
        needed any more.
      * debian/rules: widevine cdm is not really available in this source. No
        longer lie about that.
      * Set new GOOG keys to bisect service overuse problem.
      * debian/patches/linux45-madvfree: If MADV_FREE is not defined, do not allow
        it in sandbox filter. Also, undefine it so we don't use MADV_FREE and
        thereby depend on it at runtime.
      * debian/rules: Use gold ld to link.
      * debian/rules: Kill delete-null-pointer-checks. In the javascript engine,
        we can not assume a memory access to address zero always results in a
        trap.
      * debian/patches/gsettings-display-scaling,
        debian/patches/display-scaling-default-value, reenable DPI scaling taken
        from dconf.
      * debian/rules: explicitly set target arch for arm64.
      * debian/patches/series, debian/rules: Re-enable widevine component.
    
     -- Chad MILLER <email address hidden>  Thu, 29 Sep 2016 16:54:11 -0400