From nobody Sun Apr 9 10:03:09 2023 X-Original-To: dev-commits-ports-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4PvSNG61SMz44CMP; Sun, 9 Apr 2023 10:03:10 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4PvSNG12nzz3lhv; Sun, 9 Apr 2023 10:03:10 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1681034590; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=FVOzNrRqfxSrV1RY+hf454CWKCKlJoy3TpZxb1ZzTmw=; b=OMJvIX1s4LkTjbmJSR8ieVRLUXdRL1tr0GIkrAKu+TyAg2TraurZKPrHWiiTctob8K9wC8 Hbgwde6bFyQ4MspwZQ4U4s1LhbQKFvL2/DngiqgcZAkgiwMlRy/Tn9Fl8irOA2EBcnutq1 0EWNXLM730nObHzRwSUrM9pB7pGMOFJLXdAWaAyyDhtcWiCBiUIOXIehq6S4bLkJ7sxxdz 1VY76E68YsqVxkdJqjOQrXdpsiaNbtFKZ51MQ4STQZnBqIXoqJCtVrUZXqLfMgdfzNvYi6 2OVtz+rMJCbugPoIlEs+aHyQ9VG4n/Ily8FfYMRd17F/z4H0G7AJvoIfBMukmA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1681034590; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=FVOzNrRqfxSrV1RY+hf454CWKCKlJoy3TpZxb1ZzTmw=; b=rKdDpluUi5vCN0GS3K5XivJVPxY7PTOQhl4i9vzmhMgrGctwKT5z6srYPLrp/oLlOMSlpT z9GO3Ta56/EnKPA4fB6lqnXdsumTp76HLIEbWYIPGhF4tnvWnP/aW/trwQGpJXvGJ23XM6 2gSohoPliURHDOPnPQhhD3G/HO27vr7EwotjtDljBa82i4kkSVpTHRj7TP7K2ooQfQz/9D YJv1i3rC5SEjzA0rqN4zRgtcO58T+4W2OuC0WOb5ASgIhcWn9fgwGwcZM1SbpAP8Pi7flM T5FPrZQdjhkromlF66wnMY1fz1lz9Lyha3l8qgUi+UPQ+0Pg0TMjBeHNWGakRw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1681034590; a=rsa-sha256; cv=none; b=Vif4SCIuSRbLQ2onFYG4/1I6EMaTXn8apr0oEw8bB8W8Toux5Y4zL+B0ThZUI5apEMKq/q tsmf+L2ACD6YtvqQseNJLy5p6H3BhCwzYU5/1QN4OHmusqSvcd/8HRWlhddHeF0ySp/ByG Mm1CjMH5bxXvIL0inimI0+58aGigJwXnaPHDp190kE2RBUr9ey3EnvBpb3TFS8E5+L8Wyf EpbFqMUuzrAYaQv5rBGM5qOBN15IjdAmxUvIldomtnibUAVs6sTZafV0FyCSkd7FsmqsrY 3R7hR4/ZHGuOeTn+BbRfXx6tMmUcvYOfuOdm7u8bX2KQS66mA5/HMmBypK5q6w== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4PvSNG06pcz143m; Sun, 9 Apr 2023 10:03:10 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 339A39cZ031170; Sun, 9 Apr 2023 10:03:09 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 339A39fx031169; Sun, 9 Apr 2023 10:03:09 GMT (envelope-from git) Date: Sun, 9 Apr 2023 10:03:09 GMT Message-Id: <202304091003.339A39fx031169@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org From: Robert Nagy Subject: git: 5a8a8de350e5 - main - security/vuxml: add www/*chromium < 112.0.5615.49 List-Id: Commit messages for all branches of the ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-ports-all@freebsd.org X-BeenThere: dev-commits-ports-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: rnagy X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 5a8a8de350e505169c15278c5398d7026bf85368 Auto-Submitted: auto-generated X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by rnagy: URL: https://cgit.FreeBSD.org/ports/commit/?id=5a8a8de350e505169c15278c5398d7026bf85368 commit 5a8a8de350e505169c15278c5398d7026bf85368 Author: Robert Nagy AuthorDate: 2023-04-09 10:02:35 +0000 Commit: Robert Nagy CommitDate: 2023-04-09 10:02:35 +0000 security/vuxml: add www/*chromium < 112.0.5615.49 Approved by: rene (mentor) Obtained from: https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop.html Differential Revision: https://reviews.freebsd.org/D39423 --- security/vuxml/vuln/2023.xml | 59 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 59 insertions(+) diff --git a/security/vuxml/vuln/2023.xml b/security/vuxml/vuln/2023.xml index 13c4ea5fec0f..51a973a648f8 100644 --- a/security/vuxml/vuln/2023.xml +++ b/security/vuxml/vuln/2023.xml @@ -1,3 +1,62 @@ + + chromium -- multiple vulnerabilities + + + chromium + 112.0.5615.49 + + + ungoogled-chromium + 112.0.5615.49 + + + + +

Chrome Releases reports:

+
+

This update includes 16 security fixes:

+
    +
  • [1414018] High CVE-2023-1810: Heap buffer overflow in Visuals. Reported by Weipeng Jiang (@Krace) of VRI on 2023-02-08
    • +
  • [1420510] High CVE-2023-1811: Use after free in Frames. Reported by Thomas Orlita on 2023-03-01
    • +
  • [1418224] Medium CVE-2023-1812: Out of bounds memory access in DOM Bindings. Reported by Shijiang Yu on 2023-02-22
    • +
  • [1423258] Medium CVE-2023-1813: Inappropriate implementation in Extensions. Reported by Axel Chong on 2023-03-10
    • +
  • [1417325] Medium CVE-2023-1814: Insufficient validation of untrusted input in Safe Browsing. Reported by Young Min Kim (@ylemkimon), CompSec Lab at Seoul National University on 2023-02-18
    • +
  • [1278708] Medium CVE-2023-1815: Use after free in Networking APIs. Reported by DDV_UA on 2021-12-10
    • +
  • [1413919] Medium CVE-2023-1816: Incorrect security UI in Picture In Picture. Reported by NDevTK on 2023-02-08
    • +
  • [1418061] Medium CVE-2023-1817: Insufficient policy enforcement in Intents. Reported by Axel Chong on 2023-02-22
    • +
  • [1223346] Medium CVE-2023-1818: Use after free in Vulkan. Reported by Abdulrahman Alqabandi, Microsoft Browser Vulnerability Research, Eric Lawrence, Microsoft, Patrick Walker (@HomeSen), and Kirtikumar Anandrao Ramchandani on 2021-06-24
    • +
  • [1406588] Medium CVE-2023-1819: Out of bounds read in Accessibility. Reported by Microsoft Edge Team on 2023-01-12
    • +
  • [1408120] Medium CVE-2023-1820: Heap buffer overflow in Browser History. Reported by raven at KunLun lab on 2023-01-17
    • +
  • [1413618] Low CVE-2023-1821: Inappropriate implementation in WebShare. Reported by Axel Chong on 2023-02-07
    • +
  • [1066555] Low CVE-2023-1822: Incorrect security UI in Navigation. Reported by 강우진 on 2020-04-01
    • +
  • [1406900] Low CVE-2023-1823: Inappropriate implementation in FedCM. Reported by Jasper Rebane (popstonia) on 2023-01-13
    • +
+
+ + + + CVE-2023-1810 + CVE-2023-1811 + CVE-2023-1812 + CVE-2023-1813 + CVE-2023-1814 + CVE-2023-1815 + CVE-2023-1816 + CVE-2023-1817 + CVE-2023-1818 + CVE-2023-1819 + CVE-2023-1820 + CVE-2023-1821 + CVE-2023-1822 + CVE-2023-1823 + https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop.html + + + 2023-04-05 + 2023-04-05 + + + go -- multiple vulnerabilities