From owner-svn-ports-all@freebsd.org Sat May 28 10:14:13 2016 Return-Path: Delivered-To: svn-ports-all@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 840AAB4D390; Sat, 28 May 2016 10:14:13 +0000 (UTC) (envelope-from rene@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 4DE7B151E; Sat, 28 May 2016 10:14:13 +0000 (UTC) (envelope-from rene@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id u4SAECrn046601; Sat, 28 May 2016 10:14:12 GMT (envelope-from rene@FreeBSD.org) Received: (from rene@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id u4SAECTe046600; Sat, 28 May 2016 10:14:12 GMT (envelope-from rene@FreeBSD.org) Message-Id: <201605281014.u4SAECTe046600@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: rene set sender to rene@FreeBSD.org using -f From: Rene Ladan Date: Sat, 28 May 2016 10:14:12 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r415981 - head/security/vuxml X-SVN-Group: ports-head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-all@freebsd.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: SVN commit messages for the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 28 May 2016 10:14:13 -0000 Author: rene Date: Sat May 28 10:14:12 2016 New Revision: 415981 URL: https://svnweb.freebsd.org/changeset/ports/415981 Log: Document vulnerabilities in www/chromium: < 50.0.2661.94 < 50.0.2661.102 < 51.0.2704.63 Obtained from: http://googlechromereleases.blogspot.nl/ Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Sat May 28 09:47:40 2016 (r415980) +++ head/security/vuxml/vuln.xml Sat May 28 10:14:12 2016 (r415981) @@ -58,6 +58,201 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> + + chromium -- multiple vulnerabilities + + + chromium + chromium-npapi + chromium-pulse + 51.0.2704.63 + + + + +

Google Chrome Releases reports:

+
42 security fixes in this release, including:
+
+
[590118] High CVE-2016-1672: Cross-origin bypass in extension + bindings. Credit to Mariusz Mlynski.
+
[597532] High CVE-2016-1673: Cross-origin bypass in Blink. + Credit to Mariusz Mlynski.
+
[598165] High CVE-2016-1674: Cross-origin bypass in extensions.i + Credit to Mariusz Mlynski.
+
[600182] High CVE-2016-1675: Cross-origin bypass in Blink. + Credit to Mariusz Mlynski.
+
[604901] High CVE-2016-1676: Cross-origin bypass in extension + bindings. Credit to Rob Wu.
+
[602970] Medium CVE-2016-1677: Type confusion in V8. Credit to + Guang Gong of Qihoo 360.
+
[595259] High CVE-2016-1678: Heap overflow in V8. Credit to + Christian Holler.
+
[606390] High CVE-2016-1679: Heap use-after-free in V8 + bindings. Credit to Rob Wu.
+
[589848] High CVE-2016-1680: Heap use-after-free in Skia. + Credit to Atte Kettunen of OUSPG.
+
[613160] High CVE-2016-1681: Heap overflow in PDFium. Credit to + Aleksandar Nikolic of Cisco Talos.
+
[579801] Medium CVE-2016-1682: CSP bypass for ServiceWorker. + Credit to KingstonTime.
+
[583156] Medium CVE-2016-1683: Out-of-bounds access in libxslt. + Credit to Nicolas Gregoire.
+
[583171] Medium CVE-2016-1684: Integer overflow in libxslt. + Credit to Nicolas Gregoire.
+
[601362] Medium CVE-2016-1685: Out-of-bounds read in PDFium. + Credit to Ke Liu of Tencent's Xuanwu LAB.
+
[603518] Medium CVE-2016-1686: Out-of-bounds read in PDFium. + Credit to Ke Liu of Tencent's Xuanwu LAB.
+
[603748] Medium CVE-2016-1687: Information leak in extensions. + Credit to Rob Wu.
+
[604897] Medium CVE-2016-1688: Out-of-bounds read in V8. + Credit to Max Korenko.
+
[606185] Medium CVE-2016-1689: Heap buffer overflow in media. + Credit to Atte Kettunen of OUSPG.
+
[608100] Medium CVE-2016-1690: Heap use-after-free in Autofill. + Credit to Rob Wu.
+
[597926] Low CVE-2016-1691: Heap buffer-overflow in Skia. + Credit to Atte Kettunen of OUSPG.
+
[598077] Low CVE-2016-1692: Limited cross-origin bypass in + ServiceWorker. Credit to Til Jasper Ullrich.
+
[598752] Low CVE-2016-1693: HTTP Download of Software Removal + Tool. Credit to Khalil Zhani.
+
[603682] Low CVE-2016-1694: HPKP pins removed on cache + clearance. Credit to Ryan Lester and Bryant Zadegan.
+
[614767] CVE-2016-1695: Various fixes from internal audits, + fuzzing and other initiatives.
+
+

+ + + + CVE-2016-1672 + CVE-2016-1673 + CVE-2016-1674 + CVE-2016-1675 + CVE-2016-1672 + CVE-2016-1677 + CVE-2016-1678 + CVE-2016-1679 + CVE-2016-1680 + CVE-2016-1681 + CVE-2016-1682 + CVE-2016-1683 + CVE-2016-1684 + CVE-2016-1685 + CVE-2016-1686 + CVE-2016-1687 + CVE-2016-1688 + CVE-2016-1689 + CVE-2016-1690 + CVE-2016-1691 + CVE-2016-1692 + CVE-2016-1693 + CVE-2016-1694 + CVE-2016-1695 + http://googlechromereleases.blogspot.nl/2016/05/stable-channel-update_25.html + + + 2016-05-25 + 2016-05-28 + + + + + chromium -- multiple vulnerabilities + + + chromium + chromium-npapi + chromium-pulse + 50.0.2661.102 + + + + +

Google Chrome Releases reports:

+
5 security fixes in this release, including:
+
+
[605766] High CVE-2016-1667: Same origin bypass in DOM. Credit + to Mariusz Mlynski.
+
[605910] High CVE-2016-1668: Same origin bypass in Blink V8 + bindings. Credit to Mariusz Mlynski.
+
[606115] High CVE-2016-1669: Buffer overflow in V8. Credit to + Choongwoo Han.
+
[578882] Medium CVE-2016-1670: Race condition in loader. Credit + to anonymous.
+
[586657] Medium CVE-2016-1671: Directory traversal using the + file scheme on Android. Credit to Jann Horn.
+
+

+ + + + CVE-2016-1667 + CVE-2016-1668 + CVE-2016-1669 + CVE-2016-1670 + CVE-2016-1671 + http://googlechromereleases.blogspot.nl/2016/05/stable-channel-update.html + + + 2016-05-11 + 2016-05-28 + + + + + chromium -- multiple vulnerablities + + + chromium + chromium-npapi + chromium-pulse + 50.0.2661.94 + + + + +

Google Chrome Releases reports:

+
9 security fixes in this release, including:
+
+
[574802] High CVE-2016-1660: Out-of-bounds write in Blink. + Credit to Atte Kettunen of OUSPG.
+
[601629] High CVE-2016-1661: Memory corruption in cross-process + frames. Credit to Wadih Matar.
+
[603732] High CVE-2016-1662: Use-after-free in extensions. + Credit to Rob Wu.
+
[603987] High CVE-2016-1663: Use-after-free in Blink's V8 + bindings. Credit to anonymous.
+
[597322] Medium CVE-2016-1664: Address bar spoofing. Credit to + Wadih Matar.
+
[606181] Medium CVE-2016-1665: Information leak in V8. Credit + to HyungSeok Han.
+
[607652] CVE-2016-1666: Various fixes from internal audits, + fuzzing and other initiatives.
+
+

+ + + + CVE-2016-1660 + CVE-2016-1661 + CVE-2016-1662 + CVE-2016-1663 + CVE-2016-1664 + CVE-2016-1665 + CVE-2016-1666 + http://googlechromereleases.blogspot.nl/2016/04/stable-channel-update_28.html + + + 2016-04-28 + 2016-05-28 + + + php -- multiple vulnerabilities