Skip site navigation (1)Skip section navigation (2)
Date:      Wed, 6 Sep 2017 12:01:30 +0000 (UTC)
From:      "Carlos J. Puga Medina" <cpm@FreeBSD.org>
To:        ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org
Subject:   svn commit: r449343 - head/security/vuxml
Message-ID:  <201709061201.v86C1U5n029432@repo.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: cpm
Date: Wed Sep  6 12:01:29 2017
New Revision: 449343
URL: https://svnweb.freebsd.org/changeset/ports/449343

Log:
  Document new vulnerabilities in www/chromium < 61.0.3163.79
  
  Obtained from:	https://chromereleases.googleblog.com/2017/09/stable-channel-update-for-desktop.html

Modified:
  head/security/vuxml/vuln.xml

Modified: head/security/vuxml/vuln.xml
==============================================================================
--- head/security/vuxml/vuln.xml	Wed Sep  6 12:00:27 2017	(r449342)
+++ head/security/vuxml/vuln.xml	Wed Sep  6 12:01:29 2017	(r449343)
@@ -58,6 +58,64 @@ Notes:
   * Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
 -->
 <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">;
+  <vuln vid="e1100e63-92f7-11e7-bd95-e8e0b747a45a">
+    <topic>chromium -- multiple vulnerabilities</topic>
+    <affects>
+      <package>
+	<name>chromium</name>
+	<range><lt>61.0.3163.79</lt></range>
+      </package>
+    </affects>
+    <description>
+      <body xmlns="http://www.w3.org/1999/xhtml">;
+	<p>Google Chrome releases reports:</p>
+	<blockquote cite="https://chromereleases.googleblog.com/2017/09/stable-channel-update-for-desktop.html">;
+	  <p>22 security fixes in this release, including:</p>
+	  <ul>
+	    <li>[737023] High CVE-2017-5111: Use after free in PDFium. Reported by
+	      Luat Nguyen on KeenLab, Tencent on 2017-06-27</li>
+	    <li>[740603] High CVE-2017-5112: Heap buffer overflow in WebGL. Reported by
+	      Tobias Klein on 2017-07-10</li>
+	    <li>[747043] High CVE-2017-5113: Heap buffer overflow in Skia. Reported by
+	      Anonymous on 2017-07-20</li>
+	    <li>[752829] High CVE-2017-5114: Memory lifecycle issue in PDFium. Reported by
+	      Ke Liu of Tencent's Xuanwu LAB on 2017-08-07</li>
+	    <li>[744584] High CVE-2017-5115: Type confusion in V8. Reported by
+	      Marco Giovannini on 2017-07-17</li>
+	    <li>[759624] High CVE-2017-5116: Type confusion in V8. Reported by
+	      Anonymous on 2017-08-28</li>
+	    <li>[739190] Medium CVE-2017-5117: Use of uninitialized value in Skia. Reported by
+	      Tobias Klein on 2017-07-04</li>
+	    <li>[747847] Medium CVE-2017-5118: Bypass of Content Security Policy in Blink. Reported by
+	      WenXu Wu of Tencent's Xuanwu Lab on 2017-07-24</li>
+	    <li>[725127] Medium CVE-2017-5119: Use of uninitialized value in Skia. Reported by
+	      Anonymous on 2017-05-22</li>
+	    <li>[718676] Low CVE-2017-5120: Potential HTTPS downgrade during redirect navigation. Reported by
+	      Xiaoyin Liu on 2017-05-05</li>
+	    <li>[762099] Various fixes from internal audits, fuzzing and other initiatives</li>
+	  </ul>
+	</blockquote>
+      </body>
+    </description>
+    <references>
+      <cvename>CVE-2017-5111</cvename>
+      <cvename>CVE-2017-5112</cvename>
+      <cvename>CVE-2017-5113</cvename>
+      <cvename>CVE-2017-5114</cvename>
+      <cvename>CVE-2017-5115</cvename>
+      <cvename>CVE-2017-5116</cvename>
+      <cvename>CVE-2017-5117</cvename>
+      <cvename>CVE-2017-5118</cvename>
+      <cvename>CVE-2017-5119</cvename>
+      <cvename>CVE-2017-5120</cvename>
+      <url>https://chromereleases.googleblog.com/2017/09/stable-channel-update-for-desktop.html</url>;
+    </references>
+    <dates>
+      <discovery>2017-09-05</discovery>
+      <entry>2017-09-06</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="44101b31-8ffd-11e7-b5af-a4badb2f4699">
     <cancelled/>
   </vuln>



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201709061201.v86C1U5n029432>