Date: Tue, 24 Apr 2018 18:07:21 +0000 (UTC) From: Thomas Zander <riggs@FreeBSD.org> To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r468227 - head/security/vuxml Message-ID: <201804241807.w3OI7LEO058193@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: riggs Date: Tue Apr 24 18:07:21 2018 New Revision: 468227 URL: https://svnweb.freebsd.org/changeset/ports/468227 Log: Document vulnerabilities in chromium before 66.0.3359.117 Submitted by: tommi.pernila@iki.fi (via mail to ports-secteam) Reviewed by: riggs Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Tue Apr 24 18:05:23 2018 (r468226) +++ head/security/vuxml/vuln.xml Tue Apr 24 18:07:21 2018 (r468227) @@ -58,6 +58,101 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">; + <vuln vid="36ff7a74-47b1-11e8-a7d6-54e1ad544088"> + <topic>chromium -- vulnerability</topic> + <affects> + <package> + <name>chromium</name> + <range><lt>66.0.3359.117</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>Google Chrome Releases reports:</p> + <blockquote cite="https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html">; + <p>62 security fixes in this release:</p> + <ul> + <li>[826626] Critical CVE-2018-6085: Use after free in Disk Cache. Reported by Ned Williamson on 2018-03-28</li> + <li>[827492] Critical CVE-2018-6086: Use after free in Disk Cache. Reported by Ned Williamson on 2018-03-30</li> + <li>[813876] High CVE-2018-6087: Use after free in WebAssembly. Reported by Anonymous on 2018-02-20</li> + <li>[822091] High CVE-2018-6088: Use after free in PDFium. Reported by Anonymous on 2018-03-15</li> + <li>[808838] High CVE-2018-6089: Same origin policy bypass in Service Worker. Reported by Rob Wu on 2018-02-04</li> + <li>[820913] High CVE-2018-6090: Heap buffer overflow in Skia. Reported by ZhanJia Song on 2018-03-12</li> + <li>[771933] High CVE-2018-6091: Incorrect handling of plug-ins by Service Worker. Reported by Jun Kokatsu (@shhnjk) on 2017-10-05</li> + <li>[819869] High CVE-2018-6092: Integer overflow in WebAssembly. Reported by Natalie Silvanovich of Google Project Zero on 2018-03-08</li> + <li>[780435] Medium CVE-2018-6093: Same origin bypass in Service Worker. Reported by Jun Kokatsu (@shhnjk) on 2017-11-01</li> + <li>[633030] Medium CVE-2018-6094: Exploit hardening regression in Oilpan. Reported by Chris Rohlf on 2016-08-01</li> + <li>[637098] Medium CVE-2018-6095: Lack of meaningful user interaction requirement before file upload. Reported by Abdulrahman Alqabandi (@qab) on 2016-08-11</li> + <li>[776418] Medium CVE-2018-6096: Fullscreen UI spoof. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-10-19</li> + <li>[806162] Medium CVE-2018-6097: Fullscreen UI spoof. Reported by xisigr of Tencent's Xuanwu Lab on 2018-01-26</li> + <li>[798892] Medium CVE-2018-6098: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-01-03</li> + <li>[808825] Medium CVE-2018-6099: CORS bypass in ServiceWorker. Reported by Jun Kokatsu (@shhnjk) on 2018-02-03</li> + <li>[811117] Medium CVE-2018-6100: URL spoof in Omnibox. Reported by Lnyas Zhang on 2018-02-11</li> + <li>[813540] Medium CVE-2018-6101: Insufficient protection of remote debugging prototol in DevTools . Reported by Rob Wu on 2018-02-19</li> + <li>[813814] Medium CVE-2018-6102: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-02-20</li> + <li>[816033] Medium CVE-2018-6103: UI spoof in Permissions. Reported by Khalil Zhani on 2018-02-24</li> + <li>[820068] Medium CVE-2018-6104: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-03-08</li> + <li>[803571] Medium CVE-2018-6105: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-01-18</li> + <li>[805729] Medium CVE-2018-6106: Incorrect handling of promises in V8. Reported by lokihardt of Google Project Zero on 2018-01-25</li> + <li>[808316] Medium CVE-2018-6107: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-02-02</li> + <li>[816769] Medium CVE-2018-6108: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-02-27</li> + <li>[710190] Low CVE-2018-6109: Incorrect handling of files by FileAPI. Reported by Dominik Weber (@DoWeb_) on 2017-04-10</li> + <li>[777737] Low CVE-2018-6110: Incorrect handling of plaintext files via file:// . Reported by Wenxiang Qian (aka blastxiang) on 2017-10-24</li> + <li>[780694] Low CVE-2018-6111: Heap-use-after-free in DevTools. Reported by Khalil Zhani on 2017-11-02</li> + <li>[798096] Low CVE-2018-6112: Incorrect URL handling in DevTools. Reported by Rob Wu on 2017-12-29</li> + <li>[805900] Low CVE-2018-6113: URL spoof in Navigation. Reported by Khalil Zhani on 2018-01-25</li> + <li>[811691] Low CVE-2018-6114: CSP bypass. Reported by Lnyas Zhang on 2018-02-13</li> + <li>[819809] Low CVE-2018-6115: SmartScreen bypass in downloads. Reported by James Feher on 2018-03-07</li> + <li>[822266] Low CVE-2018-6116: Incorrect low memory handling in WebAssembly. Reported by Jin from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd. on 2018-03-15</li> + <li>[822465] Low CVE-2018-6117: Confusing autofill settings. Reported by Spencer Dailey on 2018-03-15</li> + <li>[822424] Low CVE-2018-6084: Incorrect use of Distributed Objects in Google Software Updater on MacOS. Reported by Ian Beer of Google Project Zero on 2018-03-15</li> + </ul> + </blockquote> + </body> + </description> + <references> + <url>https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html</url>; + <cvename>CVE-2018-6085</cvename> + <cvename>CVE-2018-6086</cvename> + <cvename>CVE-2018-6087</cvename> + <cvename>CVE-2018-6088</cvename> + <cvename>CVE-2018-6089</cvename> + <cvename>CVE-2018-6090</cvename> + <cvename>CVE-2018-6091</cvename> + <cvename>CVE-2018-6092</cvename> + <cvename>CVE-2018-6093</cvename> + <cvename>CVE-2018-6094</cvename> + <cvename>CVE-2018-6095</cvename> + <cvename>CVE-2018-6096</cvename> + <cvename>CVE-2018-6097</cvename> + <cvename>CVE-2018-6098</cvename> + <cvename>CVE-2018-6099</cvename> + <cvename>CVE-2018-6100</cvename> + <cvename>CVE-2018-6101</cvename> + <cvename>CVE-2018-6102</cvename> + <cvename>CVE-2018-6103</cvename> + <cvename>CVE-2018-6104</cvename> + <cvename>CVE-2018-6105</cvename> + <cvename>CVE-2018-6106</cvename> + <cvename>CVE-2018-6107</cvename> + <cvename>CVE-2018-6108</cvename> + <cvename>CVE-2018-6109</cvename> + <cvename>CVE-2018-6110</cvename> + <cvename>CVE-2018-6111</cvename> + <cvename>CVE-2018-6112</cvename> + <cvename>CVE-2018-6113</cvename> + <cvename>CVE-2018-6114</cvename> + <cvename>CVE-2018-6115</cvename> + <cvename>CVE-2018-6116</cvename> + <cvename>CVE-2018-6117</cvename> + <cvename>CVE-2018-6084</cvename> + </references> + <dates> + <discovery>2017-04-10</discovery> + <entry>2018-04-24</entry> + </dates> + </vuln> + <vuln vid="d8382a69-4728-11e8-ba83-0011d823eebd"> <topic>mbed TLS (PolarSSL) -- multiple vulnerabilities</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201804241807.w3OI7LEO058193>