Date: Tue, 28 Nov 2017 23:00:47 +0000 (UTC) From: Tobias Kortkamp <tobik@FreeBSD.org> To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r455083 - head/security/vuxml Message-ID: <201711282300.vASN0lJn028455@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: tobik Date: Tue Nov 28 23:00:46 2017 New Revision: 455083 URL: https://svnweb.freebsd.org/changeset/ports/455083 Log: Document www/palemoon vulnerabilities PR: 223934 Security: CVE-2017-7832 Security: CVE-2017-7835 Security: CVE-2017-7840 Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Tue Nov 28 21:56:02 2017 (r455082) +++ head/security/vuxml/vuln.xml Tue Nov 28 23:00:46 2017 (r455083) @@ -58,6 +58,35 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">; + <vuln vid="6056bf68-f570-4e70-b740-b9f606971283"> + <topic>palemoon -- multiple vulnerabilities</topic> + <affects> + <package> + <name>palemoon</name> + <range><lt>27.6.2</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>Pale Moon reports:</p> + <blockquote cite="http://www.palemoon.org/releasenotes.shtml">; + <p>CVE-2017-7832: Domain spoofing through use of dotless 'i' character followed by accent markers</p> + <p>CVE-2017-7835: Mixed content blocking incorrectly applies with redirects</p> + <p>CVE-2017-7840: Exported bookmarks do not strip script elements from user-supplied tags</p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2017-7832</cvename> + <cvename>CVE-2017-7835</cvename> + <cvename>CVE-2017-7840</cvename> + </references> + <dates> + <discovery>2017-11-14</discovery> + <entry>2017-11-28</entry> + </dates> + </vuln> + <vuln vid="68b29058-d348-11e7-b9fe-c13eb7bcbf4f"> <topic>exim -- remote code execution, deny of service in BDAT</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201711282300.vASN0lJn028455>