From owner-svn-ports-all@freebsd.org Wed Aug 2 00:28:30 2017 Return-Path: Delivered-To: svn-ports-all@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id D3D8DDC112B; Wed, 2 Aug 2017 00:28:30 +0000 (UTC) (envelope-from cpm@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 9478B6E96F; Wed, 2 Aug 2017 00:28:30 +0000 (UTC) (envelope-from cpm@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id v720STmL019979; Wed, 2 Aug 2017 00:28:29 GMT (envelope-from cpm@FreeBSD.org) Received: (from cpm@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id v720STIN019977; Wed, 2 Aug 2017 00:28:29 GMT (envelope-from cpm@FreeBSD.org) Message-Id: <201708020028.v720STIN019977@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: cpm set sender to cpm@FreeBSD.org using -f From: "Carlos J. Puga Medina" Date: Wed, 2 Aug 2017 00:28:29 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r447083 - head/security/vuxml X-SVN-Group: ports-head X-SVN-Commit-Author: cpm X-SVN-Commit-Paths: head/security/vuxml X-SVN-Commit-Revision: 447083 X-SVN-Commit-Repository: ports MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-all@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: SVN commit messages for the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 02 Aug 2017 00:28:30 -0000 Author: cpm Date: Wed Aug 2 00:28:29 2017 New Revision: 447083 URL: https://svnweb.freebsd.org/changeset/ports/447083 Log: Document new vulnerabilities in www/chromium < 60.0.3112.78 Obtained from: https://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Tue Aug 1 22:33:36 2017 (r447082) +++ head/security/vuxml/vuln.xml Wed Aug 2 00:28:29 2017 (r447083) @@ -58,6 +58,98 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> + + chromium -- multiple vulnerabilities + + + chromium + chromium-pulse + 60.0.3112.78 + + + + +

Google Chrome releases reports:

+
40 security fixes in this release, including:
+
+
[728887] High CVE-2017-5091: Use after free in IndexedDB. Reported by + Ned Williamson on 2017-06-02
+
[733549] High CVE-2017-5092: Use after free un PPAPI. Reported by + Yu Zhou, Yuan Deng of Ant-financial Light-Year Security Lab on 2017-06-15
+
[550017] High CVE-2017-5093: UI spoofing in Blink. Reported by + Luan Herrera on 2015-10-31
+
[702946] High CVE-2017-5094: Type confusion in extensions. Reported by + Anonymous on 2017-03-19
+
[732661] High CVE-2017-5095: Out-of-bounds write in PDFium. Reported by + Anonymous on 2017-06-13
+
[714442] High CVE-2017-5096: User information leak via Android intents. Reported by + Takeshi Terada on 2017-04-23
+
[740789] High CVE-2017-5097: Out-of-bounds read in Skia. Reported by + Anonymous on 2017-07-11
+
[740803] High CVE-2017-5098: Use after free in V8. Reported by + Jihoon Kim on 2017-07-11
+
[733548] High CVE-2017-5099: Out-of-bounds write in PPAPI. Reported by + Yuan Deng, Yu Zhou of Ant-financial Light-Year Security Lab on 2017-06-15
+
[718292] Medium CVE-2017-5100: Use after free in Chrome Apps. Reported by + Anonymous on 2017-05-04
+
[681740] Medium CVE-2017-5101: URL spoofing in OmniBox. Reported by + Luan Herrera on 2017-01-17
+
[727678] Medium CVE-2017-5102: Uninitialized use in Skia. Reported by + Anonymous on 2017-05-30
+
[726199] Medium CVE-2017-5103: Uninitialized use in Skia. Reported by + Anonymous on 2017-05-25
+
[729105] Medium CVE-2017-5104: UI spoofing in browser. Reported by + Khalil Zhani on 2017-06-02
+
[742407] Medium CVE-2017-7000: Pointer disclosure in SQLite. Reported by + Chaitin Security Research Lab working with Trend Micro's Zero Day Initiative
+
[729979] Low CVE-2017-5105: URL spoofing in OmniBox. Reported by + Rayyan Bijoora on 2017-06-06
+
[714628] Medium CVE-2017-5106: URL spoofing in OmniBox. Reported by + Jack Zac on 2017-04-24
+
[686253] Low CVE-2017-5107: User information leak via SVG. Reported by + David Kohlbrenner of UC San Diego on 2017-01-27
+
[695830] Low CVE-2017-5108: Type of confusion in PDFium. Reported by + Guang Gong of Alpha Team, Qihoo 360 on 2017-02-24
+
[710400] Low CVE-2017-5109: UI spoofing in browser. Reported by + Jose Maria Acunia Morgado on 2017-04-11
+
[717476] Low CVE-2017-5110: UI spoofing in payments dialog. Reported by + xisigr of Tencent's Xuanwu Lab on 2017-05-02
+
[748565] Various fixes from internal audits, fuzzing and other initiatives
+
+

+ + + + CVE-2017-5091 + CVE-2017-5092 + CVE-2017-5093 + CVE-2017-5094 + CVE-2017-5095 + CVE-2017-5096 + CVE-2017-5097 + CVE-2017-5098 + CVE-2017-5099 + CVE-2017-5100 + CVE-2017-5101 + CVE-2017-5102 + CVE-2017-5103 + CVE-2017-5104 + CVE-2017-7000 + CVE-2017-5105 + CVE-2017-5106 + CVE-2017-5107 + CVE-2017-5108 + CVE-2017-5109 + CVE-2017-5110 + https://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html + + + 2017-07-25 + 2017-08-01 + + + Cacti -- Cross-site scripting (XSS) vulnerability in auth_profile.php