Date: Tue, 27 Feb 2018 20:15:40 +0000 (UTC) From: Thomas Zander <riggs@FreeBSD.org> To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r463159 - head/security/vuxml Message-ID: <201802272015.w1RKFeiQ083051@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: riggs Date: Tue Feb 27 20:15:39 2018 New Revision: 463159 URL: https://svnweb.freebsd.org/changeset/ports/463159 Log: Document multiple vulnerabilities in chromium 64.0.3282.119 Reported by: Tommi Pernila <tommi.pernila@iki.fi> (via e-mail) Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Tue Feb 27 20:03:56 2018 (r463158) +++ head/security/vuxml/vuln.xml Tue Feb 27 20:15:39 2018 (r463159) @@ -58,6 +58,82 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">; + <vuln vid="8e986b2b-1baa-11e8-a944-54ee754af08e"> + <topic>chromium -- multiple vulnerabilities</topic> + <affects> + <package> + <name>chromium</name> + <range><lt>64.0.3282.119</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>Google Chrome Releases reports:</p> + <blockquote cite="https://chromereleases.googleblog.com/2018/01/stable-channel-update-for-desktop_24.html">; + <p>Several security fixes in this release, including:</p> + <ul> + <li>[780450] High CVE-2018-6031: Use after free in PDFium. Reported by Anonymous on 2017-11-01</li> + <li>[787103] High CVE-2018-6032: Same origin bypass in Shared Worker. Reported by Jun Kokatsu (@shhnjk) on 2017-11-20</li> + <li>[793620] High CVE-2018-6033: Race when opening downloaded files. Reported by Juho Nurminen on 2017-12-09</li> + <li>[784183] Medium CVE-2018-6034: Integer overflow in Blink. Reported by Tobias Klein (www.trapkit.de) on 2017-11-12</li> + <li>[797500] Medium CVE-2018-6035: Insufficient isolation of devtools from extensions. Reported by Rob Wu on 2017-12-23</li> + <li>[797500] Medium CVE-2018-6035: Insufficient isolation of devtools from extensions. Reported by Rob Wu on 2017-12-23</li> + <li>[753645] Medium CVE-2018-6037: Insufficient user gesture requirements in autofill. Reported by Paul Stone of Context Information Security on + 2017-08-09</li> + <li>[774174] Medium CVE-2018-6038: Heap buffer overflow in WebGL. Reported by cloudfuzzer on 2017-10-12</li> + <li>[775527] Medium CVE-2018-6039: XSS in DevTools. Reported by Juho Nurminen on 2017-10-17</li> + <li>[778658] Medium CVE-2018-6040: Content security policy bypass. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-10-26</li> + <li>[760342] Medium CVE-2018-6041: URL spoof in Navigation. Reported by Luan Herrera on 2017-08-29</li> + <li>[773930] Medium CVE-2018-6042: URL spoof in OmniBox. Reported by Khalil Zhani on 2017-10-12</li> + <li>[785809] Medium CVE-2018-6043: Insufficient escaping with external URL handlers. Reported by 0x09AL on 2017-11-16</li> + <li>[797497] Medium CVE-2018-6045: Insufficient isolation of devtools from extensions. Reported by Rob Wu on 2017-12-23</li> + <li>[798163] Medium CVE-2018-6046: Insufficient isolation of devtools from extensions. Reported by Rob Wu on 2017-12-31</li> + <li>[799847] Medium CVE-2018-6047: Cross origin URL leak in WebGL. Reported by Masato Kinugawa on 2018-01-08</li> + <li>[763194] Low CVE-2018-6048: Referrer policy bypass in Blink. Reported by Jun Kokatsu (@shhnjk) on 2017-09-08</li> + <li>[771848] Low CVE-2017-15420: URL spoofing in Omnibox. Reported by Drew Springall (@_aaspring_) on 2017-10-05</li> + <li>[774438] Low CVE-2018-6049: UI spoof in Permissions. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-10-13</li> + <li>[774842] Low CVE-2018-6050: URL spoof in OmniBox. Reported by Jonathan Kew on 2017-10-15</li> + <li>[441275] Low CVE-2018-6051: Referrer leak in XSS Auditor. Reported by Antonio Sanso (@asanso) on 2014-12-11</li> + <li>[615608] Low CVE-2018-6052: Incomplete no-referrer policy implementation. Reported by Tanner Emek on 2016-05-28</li> + <li>[758169] Low CVE-2018-6053: Leak of page thumbnails in New Tab Page. Reported by Asset Kabdenov on 2017-08-23</li> + <li>[797511] Low CVE-2018-6054: Use after free in WebUI. Reported by Rob Wu on 2017-12-24</li> + </ul> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2018-6031</cvename> + <cvename>CVE-2018-6032</cvename> + <cvename>CVE-2018-6033</cvename> + <cvename>CVE-2018-6034</cvename> + <cvename>CVE-2018-6035</cvename> + <cvename>CVE-2018-6036</cvename> + <cvename>CVE-2018-6037</cvename> + <cvename>CVE-2018-6038</cvename> + <cvename>CVE-2018-6039</cvename> + <cvename>CVE-2018-6040</cvename> + <cvename>CVE-2018-6041</cvename> + <cvename>CVE-2018-6042</cvename> + <cvename>CVE-2018-6043</cvename> + <cvename>CVE-2018-6045</cvename> + <cvename>CVE-2018-6046</cvename> + <cvename>CVE-2018-6047</cvename> + <cvename>CVE-2018-6048</cvename> + <cvename>CVE-2017-15420</cvename> + <cvename>CVE-2018-6049</cvename> + <cvename>CVE-2018-6050</cvename> + <cvename>CVE-2018-6051</cvename> + <cvename>CVE-2018-6052</cvename> + <cvename>CVE-2018-6053</cvename> + <cvename>CVE-2018-6054</cvename> + <url>https://chromereleases.googleblog.com/2018/01/stable-channel-update-for-desktop_24.html</url>; + </references> + <dates> + <discovery>2017-08-09</discovery> + <entry>2018-02-27</entry> + </dates> + </vuln> + <vuln vid="55c4233e-1844-11e8-a712-0025908740c2"> <topic>tomcat -- Security constraints ignored or applied too late</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201802272015.w1RKFeiQ083051>