Date: Tue, 31 Mar 2015 18:40:30 +0000 (UTC) From: Jan Beich <jbeich@FreeBSD.org> To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r382858 - head/security/vuxml Message-ID: <201503311840.t2VIeUTG040460@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: jbeich Date: Tue Mar 31 18:40:29 2015 New Revision: 382858 URL: https://svnweb.freebsd.org/changeset/ports/382858 QAT: https://qat.redports.org/buildarchive/r382858/ Log: Document mozilla vulnerabilities Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Tue Mar 31 18:28:20 2015 (r382857) +++ head/security/vuxml/vuln.xml Tue Mar 31 18:40:29 2015 (r382858) @@ -57,6 +57,110 @@ Notes: --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">; + <vuln vid="d0c97697-df2c-4b8b-bff2-cec24dc35af8"> + <topic>mozilla -- multiple vulnerabilities</topic> + <affects> + <package> + <name>firefox</name> + <range><lt>37.0,1</lt></range> + </package> + <package> + <name>firefox-esr</name> + <range><lt>31.6.0,1</lt></range> + </package> + <package> + <name>linux-firefox</name> + <range><lt>37.0,1</lt></range> + </package> + <package> + <name>linux-seamonkey</name> + <range><lt>2.34</lt></range> + </package> + <package> + <name>linux-thunderbird</name> + <range><lt>31.6.0</lt></range> + </package> + <package> + <name>seamonkey</name> + <range><lt>2.34</lt></range> + </package> + <package> + <name>thunderbird</name> + <range><lt>31.6.0</lt></range> + </package> + <package> + <name>libxul</name> + <range><lt>31.6.0</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>The Mozilla Project reports:</p> + <blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/">; + <p>MFSA-2015-30 Miscellaneous memory safety hazards (rv:37.0 + / rv:31.6)</p> + <p>MFSA-2015-31 Use-after-free when using the Fluendo MP3 + GStreamer plugin</p> + <p>MFSA-2015-32 Add-on lightweight theme installation + approval bypassed through MITM attack</p> + <p>MFSA-2015-33 resource:// documents can load privileged + pages</p> + <p>MFSA-2015-34 Out of bounds read in QCMS library</p> + <p>MFSA-2015-35 Cursor clickjacking with flash and images</p> + <p>MFSA-2015-36 Incorrect memory management for simple-type + arrays in WebRTC</p> + <p>MFSA-2015-37 CORS requests should not follow 30x + redirections after preflight</p> + <p>MFSA-2015-38 Memory corruption crashes in Off Main Thread + Compositing</p> + <p>MFSA-2015-39 Use-after-free due to type confusion flaws</p> + <p>MFSA-2015-40 Same-origin bypass through anchor navigation</p> + <p>MFSA-2015-41 PRNG weakness allows for DNS poisoning on + Android</p> + <p>MFSA-2015-42 Windows can retain access to privileged + content on navigation to unprivileged pages</p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2012-2808</cvename> + <cvename>CVE-2015-0800</cvename> + <cvename>CVE-2015-0801</cvename> + <cvename>CVE-2015-0802</cvename> + <cvename>CVE-2015-0803</cvename> + <cvename>CVE-2015-0804</cvename> + <cvename>CVE-2015-0805</cvename> + <cvename>CVE-2015-0806</cvename> + <cvename>CVE-2015-0807</cvename> + <cvename>CVE-2015-0808</cvename> + <cvename>CVE-2015-0810</cvename> + <cvename>CVE-2015-0811</cvename> + <cvename>CVE-2015-0812</cvename> + <cvename>CVE-2015-0813</cvename> + <cvename>CVE-2015-0814</cvename> + <cvename>CVE-2015-0815</cvename> + <cvename>CVE-2015-0816</cvename> + <url>https://www.mozilla.org/security/advisories/mfsa2015-30/</url>; + <url>https://www.mozilla.org/security/advisories/mfsa2015-31/</url>; + <url>https://www.mozilla.org/security/advisories/mfsa2015-32/</url>; + <url>https://www.mozilla.org/security/advisories/mfsa2015-33/</url>; + <url>https://www.mozilla.org/security/advisories/mfsa2015-34/</url>; + <url>https://www.mozilla.org/security/advisories/mfsa2015-35/</url>; + <url>https://www.mozilla.org/security/advisories/mfsa2015-36/</url>; + <url>https://www.mozilla.org/security/advisories/mfsa2015-37/</url>; + <url>https://www.mozilla.org/security/advisories/mfsa2015-38/</url>; + <url>https://www.mozilla.org/security/advisories/mfsa2015-39/</url>; + <url>https://www.mozilla.org/security/advisories/mfsa2015-40/</url>; + <url>https://www.mozilla.org/security/advisories/mfsa2015-41/</url>; + <url>https://www.mozilla.org/security/advisories/mfsa2015-42/</url>; + <url>https://www.mozilla.org/security/advisories/</url>; + </references> + <dates> + <discovery>2015-03-31</discovery> + <entry>2015-03-31</entry> + </dates> + </vuln> + <vuln vid="f450587b-d7bd-11e4-b5a4-14dae9d5a9d2"> <topic>osc -- shell command injection via crafted _service files</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201503311840.t2VIeUTG040460>