From owner-svn-ports-all@freebsd.org Tue Jun 6 15:05:43 2017 Return-Path: Delivered-To: svn-ports-all@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id A9394BEECCD; Tue, 6 Jun 2017 15:05:43 +0000 (UTC) (envelope-from cpm@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 7FB1C6FE11; Tue, 6 Jun 2017 15:05:43 +0000 (UTC) (envelope-from cpm@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id v56F5giE055012; Tue, 6 Jun 2017 15:05:42 GMT (envelope-from cpm@FreeBSD.org) Received: (from cpm@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id v56F5gvQ055010; Tue, 6 Jun 2017 15:05:42 GMT (envelope-from cpm@FreeBSD.org) Message-Id: <201706061505.v56F5gvQ055010@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: cpm set sender to cpm@FreeBSD.org using -f From: "Carlos J. Puga Medina" Date: Tue, 6 Jun 2017 15:05:42 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r442778 - head/security/vuxml X-SVN-Group: ports-head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-all@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: SVN commit messages for the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Jun 2017 15:05:43 -0000 Author: cpm Date: Tue Jun 6 15:05:42 2017 New Revision: 442778 URL: https://svnweb.freebsd.org/changeset/ports/442778 Log: Document new vulnerabilities in www/chromium < 59.0.3071.86 Obtained from: https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop.html Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Tue Jun 6 15:05:16 2017 (r442777) +++ head/security/vuxml/vuln.xml Tue Jun 6 15:05:42 2017 (r442778) @@ -58,6 +58,83 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> + + chromium -- multiple vulnerabilities + + + chromium + chromium-pulse + 59.0.3071.86 + + + + +

Google Chrome releases reports:

+
30 security fixes in this release, including:
+
+
[722756] High CVE-2017-5070: Type confusion in V8. Reported by + Zhao Qixun of Qihoo 360 Vulcan Team on 2017-05-16
+
[715582] High CVE-2017-5071: Out of bounds read in V8. Reported by + Choongwood Han on 2017-04-26
+
[709417] High CVE-2017-5072: Address spoofing in Omnibox. Reported by + Rayyan Bijoora on 2017-04-07
+
[716474] High CVE-2017-5073: Use after free in print preview. Reported by + Khalil Zhani on 2017-04-28
+
[700040] High CVE-2017-5074: Use after free in Apps Bluetooth. Reported by + anonymous on 2017-03-09
+
[678776] Medium CVE-2017-5075: Information leak in CSP reporting. Reported by + Emmanuel Gil Peyrot on 2017-01-05
+
[722639] Medium CVE-2017-5086: Address spoofing in Omnibox. Reported by + Rayyan Bijoora on 2017-05-16
+
[719199] Medium CVE-2017-5076: Address spoofing in Omnibox. Reported by + Samuel Erb on 2017-05-06
+
[716311] Medium CVE-2017-5077: Heap buffer overflow in Skia. Reported by + Sweetchip on 2017-04-28
+
[711020] Medium CVE-2017-5078: Possible command injection in mailto handling. + Reported by Jose Carlos Exposito Bueno on 2017-04-12
+
[713686] Medium CVE-2017-5079: UI spoofing in Blink. Reported by + Khalil Zhani on 2017-04-20
+
[708819] Medium CVE-2017-5080: Use after free in credit card autofill. + Reported by Khalil Zhani on 2017-04-05
+
[672008] Medium CVE-2017-5081: Extension verification bypass. Reported by + Andrey Kovalev of Yandex Security Team on 2016-12-07
+
[721579] Low CVE-2017-5082: Insufficient hardening in credit card editor. + Reported by Nightwatch Cybersecurity Research on 2017-05-11
+
[714849] Low CVE-2017-5083: UI spoofing in Blink. Reported by + Khalil Zhani on 2017-04-24
+
[692378] Low CVE-2017-5085: Inappropriate javascript execution on WebUI pages. + Reported by Zhiyang Zeng of Tencent security platform department on 2017-02-15
+
[729639] Various fixes from internal audits, fuzzing and other initiatives
+
+

+ + + + CVE-2017-5070 + CVE-2017-5071 + CVE-2017-5072 + CVE-2017-5073 + CVE-2017-5074 + CVE-2017-5075 + CVE-2017-5086 + CVE-2017-5076 + CVE-2017-5077 + CVE-2017-5078 + CVE-2017-5079 + CVE-2017-5080 + CVE-2017-5081 + CVE-2017-5082 + CVE-2017-5083 + CVE-2017-5085 + https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop.html + + + 2017-06-05 + 2017-06-06 + + + ansible -- Input validation flaw in jinja2 templating system