Date: Tue, 6 Jun 2017 15:05:42 +0000 (UTC) From: "Carlos J. Puga Medina" <cpm@FreeBSD.org> To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r442778 - head/security/vuxml Message-ID: <201706061505.v56F5gvQ055010@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: cpm Date: Tue Jun 6 15:05:42 2017 New Revision: 442778 URL: https://svnweb.freebsd.org/changeset/ports/442778 Log: Document new vulnerabilities in www/chromium < 59.0.3071.86 Obtained from: https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop.html Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Tue Jun 6 15:05:16 2017 (r442777) +++ head/security/vuxml/vuln.xml Tue Jun 6 15:05:42 2017 (r442778) @@ -58,6 +58,83 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">; + <vuln vid="52f4b48b-4ac3-11e7-99aa-e8e0b747a45a"> + <topic>chromium -- multiple vulnerabilities</topic> + <affects> + <package> + <name>chromium</name> + <name>chromium-pulse</name> + <range><lt>59.0.3071.86</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>Google Chrome releases reports:</p> + <blockquote cite="https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop.html">; + <p>30 security fixes in this release, including:</p> + <ul> + <li>[722756] High CVE-2017-5070: Type confusion in V8. Reported by + Zhao Qixun of Qihoo 360 Vulcan Team on 2017-05-16</li> + <li>[715582] High CVE-2017-5071: Out of bounds read in V8. Reported by + Choongwood Han on 2017-04-26</li> + <li>[709417] High CVE-2017-5072: Address spoofing in Omnibox. Reported by + Rayyan Bijoora on 2017-04-07</li> + <li>[716474] High CVE-2017-5073: Use after free in print preview. Reported by + Khalil Zhani on 2017-04-28</li> + <li>[700040] High CVE-2017-5074: Use after free in Apps Bluetooth. Reported by + anonymous on 2017-03-09</li> + <li>[678776] Medium CVE-2017-5075: Information leak in CSP reporting. Reported by + Emmanuel Gil Peyrot on 2017-01-05</li> + <li>[722639] Medium CVE-2017-5086: Address spoofing in Omnibox. Reported by + Rayyan Bijoora on 2017-05-16</li> + <li>[719199] Medium CVE-2017-5076: Address spoofing in Omnibox. Reported by + Samuel Erb on 2017-05-06</li> + <li>[716311] Medium CVE-2017-5077: Heap buffer overflow in Skia. Reported by + Sweetchip on 2017-04-28</li> + <li>[711020] Medium CVE-2017-5078: Possible command injection in mailto handling. + Reported by Jose Carlos Exposito Bueno on 2017-04-12</li> + <li>[713686] Medium CVE-2017-5079: UI spoofing in Blink. Reported by + Khalil Zhani on 2017-04-20</li> + <li>[708819] Medium CVE-2017-5080: Use after free in credit card autofill. + Reported by Khalil Zhani on 2017-04-05</li> + <li>[672008] Medium CVE-2017-5081: Extension verification bypass. Reported by + Andrey Kovalev of Yandex Security Team on 2016-12-07</li> + <li>[721579] Low CVE-2017-5082: Insufficient hardening in credit card editor. + Reported by Nightwatch Cybersecurity Research on 2017-05-11</li> + <li>[714849] Low CVE-2017-5083: UI spoofing in Blink. Reported by + Khalil Zhani on 2017-04-24</li> + <li>[692378] Low CVE-2017-5085: Inappropriate javascript execution on WebUI pages. + Reported by Zhiyang Zeng of Tencent security platform department on 2017-02-15</li> + <li>[729639] Various fixes from internal audits, fuzzing and other initiatives</li> + </ul> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2017-5070</cvename> + <cvename>CVE-2017-5071</cvename> + <cvename>CVE-2017-5072</cvename> + <cvename>CVE-2017-5073</cvename> + <cvename>CVE-2017-5074</cvename> + <cvename>CVE-2017-5075</cvename> + <cvename>CVE-2017-5086</cvename> + <cvename>CVE-2017-5076</cvename> + <cvename>CVE-2017-5077</cvename> + <cvename>CVE-2017-5078</cvename> + <cvename>CVE-2017-5079</cvename> + <cvename>CVE-2017-5080</cvename> + <cvename>CVE-2017-5081</cvename> + <cvename>CVE-2017-5082</cvename> + <cvename>CVE-2017-5083</cvename> + <cvename>CVE-2017-5085</cvename> + <url>https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop.html</url>; + </references> + <dates> + <discovery>2017-06-05</discovery> + <entry>2017-06-06</entry> + </dates> + </vuln> + <vuln vid="15a04b9f-47cb-11e7-a853-001fbc0f280f"> <topic>ansible -- Input validation flaw in jinja2 templating system</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201706061505.v56F5gvQ055010>