From owner-freebsd-chromium@FreeBSD.ORG Wed Mar 4 21:54:20 2015 Return-Path: Delivered-To: freebsd-chromium@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id B4D2ACC6; Wed, 4 Mar 2015 21:54:20 +0000 (UTC) Received: from imap1-2.ox.privateemail.com (imap1-2.ox.privateemail.com [192.64.116.200]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "privateemail.com", Issuer "COMODO RSA Domain Validation Secure Server CA" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 7546C86D; Wed, 4 Mar 2015 21:54:19 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by mail.privateemail.com (Postfix) with ESMTP id 17169B0008F; Wed, 4 Mar 2015 16:54:12 -0500 (EST) X-Virus-Scanned: Debian amavisd-new at imap1.ox.privateemail.com Received: from mail.privateemail.com ([127.0.0.1]) by localhost (imap1.ox.privateemail.com [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 6LctnmYJwcUK; Wed, 4 Mar 2015 16:54:11 -0500 (EST) Received: from localhost (unknown [77.229.99.246]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.privateemail.com (Postfix) with ESMTPSA id 2EBA1B00068; Wed, 4 Mar 2015 16:54:10 -0500 (EST) Date: Wed, 4 Mar 2015 22:50:48 +0100 From: Carlos Jacobo Puga Medina To: freebsd-chromium@freebsd.org Subject: Document new vulnerabilities in www/chromium < 41.0.2272.76 Message-Id: <20150304225048.e041eda2d40562f31323156a@fbsd.es> X-Mailer: Sylpheed 3.4.2 (GTK+ 2.24.25; i386-portbld-freebsd11.0) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-BeenThere: freebsd-chromium@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: FreeBSD-specific Chromium issues List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 04 Mar 2015 21:54:20 -0000 Current chromium port is marked as vulnerable on Google Chrome website [1] --- vuln.xml.old 2015-03-04 22:14:52.603195000 +0100 +++ vuln.xml 2015-03-04 22:44:47.160901000 +0100 @@ -57,6 +57,93 @@ --> + + chromium -- multiple vulnerabilities + + + chromium + 41.0.2272.76 + + + + +

Chrome Releases reports:

+
51 security fixes in this release, including:
+
+
[456516] High CVE-2015-1212: Out-of-bounds write in media. + Credit to anonymous.
+
[448423] High CVE-2015-1213: Out-of-bounds write in skia filters. + Credit to cloudfuzzer.
+
[445810] High CVE-2015-1214: Out-of-bounds write in skia filters. + Credit to cloudfuzzer.
+
[445809] High CVE-2015-1215: Out-of-bounds write in skia filters. + Credit to cloudfuzzer.
+
[454954] High CVE-2015-1216: Use-after-free in v8 bindings. + Credit to anonymous.
+
[456192] High CVE-2015-1217: Type confusion in v8 bindings. + Credit to anonymous.
+
[456059] High CVE-2015-1218: Use-after-free in dom. + Credit to cloudfuzzer.
+
[446164] High CVE-2015-1219: Integer overflow in webgl. + Credit to Chen Zhang (demi6od) of NSFOCUS Security Team.
+
[437651] High CVE-2015-1220: Use-after-free in gif decoder. + Credit to Aki Helin of OUSPG.
+
[455368] High CVE-2015-1221: Use-after-free in web databases. + Credit to Collin Payne.
+
[448082] High CVE-2015-1222: Use-after-free in service workers. + Credit to Collin Payne.
+
[454231] High CVE-2015-1223: Use-after-free in dom. + Credit to Maksymillian Motyl.
+
High CVE-2015-1230: Type confusion in v8. + Credit to Skylined working with HP's Zero Day Initiative.
+
[449958] Medium CVE-2015-1224: Out-of-bounds read in vpxdecoder. + Credit to Aki Helin of OUSPG.
+
[446033] Medium CVE-2015-1225: Out-of-bounds read in pdfium. + Credit to cloudfuzzer.
+
[456841] Medium CVE-2015-1226: Validation issue in debugger. + Credit to Rob Wu.
+
[450389] Medium CVE-2015-1227: Uninitialized value in blink. + Credit to Christoph Diehl.
+
[444707] Medium CVE-2015-1228: Uninitialized value in rendering. + Credit to miaubiz.
+
[431504] Medium CVE-2015-1229: Cookie injection via proxies. + Credit to iliwoy.
+
[463349] CVE-2015-1231: Various fixes from internal audits, fuzzing + and other initiatives.
+
+

+ + + + CVE-2015-1212 + CVE-2015-1213 + CVE-2015-1214 + CVE-2015-1215 + CVE-2015-1216 + CVE-2015-1217 + CVE-2015-1218 + CVE-2015-1219 + CVE-2015-1220 + CVE-2015-1221 + CVE-2015-1222 + CVE-2015-1223 + CVE-2015-1224 + CVE-2015-1225 + CVE-2015-1226 + CVE-2015-1227 + CVE-2015-1228 + CVE-2015-1229 + CVE-2015-1230 + CVE-2015-1231 + http://googlechromereleases.blogspot.nl + + + 2015-03-03 + 2015-03-04 + + + jenkins -- multiple vulnerabilities [1] http://googlechromereleases.blogspot.nl -- Carlos Jacobo Puga Medina From owner-freebsd-chromium@FreeBSD.ORG Sat Mar 7 02:05:06 2015 Return-Path: Delivered-To: freebsd-chromium@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 278F1636 for ; Sat, 7 Mar 2015 02:05:06 +0000 (UTC) Received: from ns354937.ovh.net (sphereinfo.fr [91.121.115.180]) by mx1.freebsd.org (Postfix) with ESMTP id CC7DF697 for ; Sat, 7 Mar 2015 02:05:04 +0000 (UTC) Received: from newsletter.love4aviation.aero (newsletter.love4aviation.aero [176.31.32.3]) by ns354937.ovh.net (Postfix) with ESMTPA id 3F5ED10261C for ; Sat, 7 Mar 2015 02:55:47 +0100 (CET) Date: Sat, 7 Mar 2015 02:55:47 +0100 To: freebsd-chromium@freebsd.org From: "newsletter@love4aviation.aero" Reply-To: "newsletter@love4aviation.aero" Subject: EchoFive by Love4aviation. Message-ID: <930d2f928b83395b9c50e25b9edb39ef@localhost.localdomain> X-Priority: 3 X-Mailer: PHPMailer 5.2.5 (https://github.com/Synchro/PHPMailer/) X-phpList-version: 3.0.6 X-MessageID: 16 X-ListMember: freebsd-chromium@freebsd.org Precedence: bulk Bounces-To: newsletter@love4aviation.aero List-Owner: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-Content-Filtered-By: Mailman/MimeDel 2.1.18-1 X-BeenThere: freebsd-chromium@freebsd.org X-Mailman-Version: 2.1.18-1 List-Id: FreeBSD-specific Chromium issues List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 07 Mar 2015 02:05:06 -0000 EchoFive by Love4aviation EchoFive, our new video. Gigabits of recordings provided by pilots from all over the world were necessary for the making of this video. We hope you enjoy it and become contributors by sending us your raw video files. EchoFive, notre nouvelle vid=C3=A9o. Des gigabits d'enregistrements envoy=C3=A9s par des pilotes du monde entier ont =C3=A9t=C3=A9 n=C3=A9cessa= ires pour la cr=C3=A9ation de cette vid=C3=A9o. Nous esp=C3=A9rons que vous l'appr=C3= =A9cierez et que vous deviendrez contributeurs en nous envoyant vos enregistrements vid=C3=A9o natifs. **Watch it now on:** **Stay with us:** =20 =20 This message was sent to freebsd-chromium@freebsd.org by=0Anewsletter@love= 4aviation.aero To change your email address or select HTML or text, visit your personal preferences page=0A Or you can opt-out completely=0A from all future mailings. [USERTRACK] =20