From owner-svn-ports-head@freebsd.org Tue Jun 13 19:56:09 2017 Return-Path: Delivered-To: svn-ports-head@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 6CC24BFD69C; Tue, 13 Jun 2017 19:56:09 +0000 (UTC) (envelope-from jbeich@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 481E5660EB; Tue, 13 Jun 2017 19:56:09 +0000 (UTC) (envelope-from jbeich@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id v5DJu8Sg060793; Tue, 13 Jun 2017 19:56:08 GMT (envelope-from jbeich@FreeBSD.org) Received: (from jbeich@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id v5DJu8oW060791; Tue, 13 Jun 2017 19:56:08 GMT (envelope-from jbeich@FreeBSD.org) Message-Id: <201706131956.v5DJu8oW060791@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: jbeich set sender to jbeich@FreeBSD.org using -f From: Jan Beich Date: Tue, 13 Jun 2017 19:56:08 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r443537 - head/security/vuxml X-SVN-Group: ports-head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-head@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: SVN commit messages for the ports tree for head List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Jun 2017 19:56:09 -0000 Author: jbeich Date: Tue Jun 13 19:56:07 2017 New Revision: 443537 URL: https://svnweb.freebsd.org/changeset/ports/443537 Log: security/vuxml: mark firefox < 54 as vulnerable Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Tue Jun 13 19:55:46 2017 (r443536) +++ head/security/vuxml/vuln.xml Tue Jun 13 19:56:07 2017 (r443537) @@ -58,6 +58,96 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> + + mozilla -- multiple vulnerabilities + + + firefox + 54.0,1 + + + seamonkey + linux-seamonkey + 2.51 + + + firefox-esr + 52.2.0,1 + + + linux-firefox + 52.2.0,2 + + + libxul + thunderbird + linux-thunderbird + 52.2.0 + + + + +

Mozilla Foundation reports:

+
CVE-2017-5472: Use-after-free using destroyed node when regenerating trees
+
CVE-2017-7749: Use-after-free during docshell reloading
+
CVE-2017-7750: Use-after-free with track elements
+
CVE-2017-7751: Use-after-free with content viewer listeners
+
CVE-2017-7752: Use-after-free with IME input
+
CVE-2017-7754: Out-of-bounds read in WebGL with ImageInfo object
+
CVE-2017-7755: Privilege escalation through Firefox Installer with same directory DLL files
+
CVE-2017-7756: Use-after-free and use-after-scope logging XHR header errors
+
CVE-2017-7757: Use-after-free in IndexedDB
+
CVE-2017-7778: Vulnerabilities in the Graphite 2 library
+
CVE-2017-7758: Out-of-bounds read in Opus encoder
+
CVE-2017-7759: Android intent URLs can cause navigation to local file system
+
CVE-2017-7760: File manipulation and privilege escalation via callback parameter in Mozilla Windows Updater and Maintenance Service
+
CVE-2017-7761: File deletion and privilege escalation through Mozilla Maintenance Service helper.exe application
+
CVE-2017-7762: Addressbar spoofing in Reader mode
+
CVE-2017-7763: Mac fonts render some unicode characters as spaces
+
CVE-2017-7764: Domain spoofing with combination of Canadian Syllabics and other unicode blocks
+
CVE-2017-7765: Mark of the Web bypass when saving executable files
+
CVE-2017-7766: File execution and privilege escalation through updater.ini, Mozilla Windows Updater, and Mozilla Maintenance Service
+
CVE-2017-7767: Privilege escalation and arbitrary file overwrites through Mozilla Windows Updater and Mozilla Maintenance Service
+
CVE-2017-7768: 32 byte arbitrary file read through Mozilla Maintenance Service
+
CVE-2017-5471: Memory safety bugs fixed in Firefox 54
+
CVE-2017-5470: Memory safety bugs fixed in Firefox 54 and Firefox ESR 52.2
+

+ + + + CVE-2017-5470 + CVE-2017-5471 + CVE-2017-5472 + CVE-2017-7749 + CVE-2017-7750 + CVE-2017-7751 + CVE-2017-7752 + CVE-2017-7754 + CVE-2017-7755 + CVE-2017-7756 + CVE-2017-7757 + CVE-2017-7758 + CVE-2017-7759 + CVE-2017-7760 + CVE-2017-7761 + CVE-2017-7762 + CVE-2017-7763 + CVE-2017-7764 + CVE-2017-7765 + CVE-2017-7766 + CVE-2017-7767 + CVE-2017-7768 + CVE-2017-7778 + https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/ + https://www.mozilla.org/en-US/security/advisories/mfsa2017-16/ + + + 2017-06-13 + 2017-06-13 + + + roundcube -- arbitrary password resets