Date: Wed, 6 Sep 2017 12:01:30 +0000 (UTC) From: "Carlos J. Puga Medina" <cpm@FreeBSD.org> To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r449343 - head/security/vuxml Message-ID: <201709061201.v86C1U5n029432@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: cpm Date: Wed Sep 6 12:01:29 2017 New Revision: 449343 URL: https://svnweb.freebsd.org/changeset/ports/449343 Log: Document new vulnerabilities in www/chromium < 61.0.3163.79 Obtained from: https://chromereleases.googleblog.com/2017/09/stable-channel-update-for-desktop.html Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Wed Sep 6 12:00:27 2017 (r449342) +++ head/security/vuxml/vuln.xml Wed Sep 6 12:01:29 2017 (r449343) @@ -58,6 +58,64 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="e1100e63-92f7-11e7-bd95-e8e0b747a45a"> + <topic>chromium -- multiple vulnerabilities</topic> + <affects> + <package> + <name>chromium</name> + <range><lt>61.0.3163.79</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>Google Chrome releases reports:</p> + <blockquote cite="https://chromereleases.googleblog.com/2017/09/stable-channel-update-for-desktop.html"> + <p>22 security fixes in this release, including:</p> + <ul> + <li>[737023] High CVE-2017-5111: Use after free in PDFium. Reported by + Luat Nguyen on KeenLab, Tencent on 2017-06-27</li> + <li>[740603] High CVE-2017-5112: Heap buffer overflow in WebGL. Reported by + Tobias Klein on 2017-07-10</li> + <li>[747043] High CVE-2017-5113: Heap buffer overflow in Skia. Reported by + Anonymous on 2017-07-20</li> + <li>[752829] High CVE-2017-5114: Memory lifecycle issue in PDFium. Reported by + Ke Liu of Tencent's Xuanwu LAB on 2017-08-07</li> + <li>[744584] High CVE-2017-5115: Type confusion in V8. Reported by + Marco Giovannini on 2017-07-17</li> + <li>[759624] High CVE-2017-5116: Type confusion in V8. Reported by + Anonymous on 2017-08-28</li> + <li>[739190] Medium CVE-2017-5117: Use of uninitialized value in Skia. Reported by + Tobias Klein on 2017-07-04</li> + <li>[747847] Medium CVE-2017-5118: Bypass of Content Security Policy in Blink. Reported by + WenXu Wu of Tencent's Xuanwu Lab on 2017-07-24</li> + <li>[725127] Medium CVE-2017-5119: Use of uninitialized value in Skia. Reported by + Anonymous on 2017-05-22</li> + <li>[718676] Low CVE-2017-5120: Potential HTTPS downgrade during redirect navigation. Reported by + Xiaoyin Liu on 2017-05-05</li> + <li>[762099] Various fixes from internal audits, fuzzing and other initiatives</li> + </ul> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2017-5111</cvename> + <cvename>CVE-2017-5112</cvename> + <cvename>CVE-2017-5113</cvename> + <cvename>CVE-2017-5114</cvename> + <cvename>CVE-2017-5115</cvename> + <cvename>CVE-2017-5116</cvename> + <cvename>CVE-2017-5117</cvename> + <cvename>CVE-2017-5118</cvename> + <cvename>CVE-2017-5119</cvename> + <cvename>CVE-2017-5120</cvename> + <url>https://chromereleases.googleblog.com/2017/09/stable-channel-update-for-desktop.html</url> + </references> + <dates> + <discovery>2017-09-05</discovery> + <entry>2017-09-06</entry> + </dates> + </vuln> + <vuln vid="44101b31-8ffd-11e7-b5af-a4badb2f4699"> <cancelled/> </vuln>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201709061201.v86C1U5n029432>