From owner-svn-ports-all@freebsd.org Wed May 30 21:47:41 2018 Return-Path: Delivered-To: svn-ports-all@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 1925BF71497; Wed, 30 May 2018 21:47:41 +0000 (UTC) (envelope-from cpm@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id C07697C598; Wed, 30 May 2018 21:47:40 +0000 (UTC) (envelope-from cpm@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id A17D410E1B; Wed, 30 May 2018 21:47:40 +0000 (UTC) (envelope-from cpm@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id w4ULleC6014773; Wed, 30 May 2018 21:47:40 GMT (envelope-from cpm@FreeBSD.org) Received: (from cpm@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id w4ULleS7014772; Wed, 30 May 2018 21:47:40 GMT (envelope-from cpm@FreeBSD.org) Message-Id: <201805302147.w4ULleS7014772@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: cpm set sender to cpm@FreeBSD.org using -f From: "Carlos J. Puga Medina" Date: Wed, 30 May 2018 21:47:40 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r471178 - head/security/vuxml X-SVN-Group: ports-head X-SVN-Commit-Author: cpm X-SVN-Commit-Paths: head/security/vuxml X-SVN-Commit-Revision: 471178 X-SVN-Commit-Repository: ports MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-all@freebsd.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: SVN commit messages for the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 May 2018 21:47:41 -0000 Author: cpm Date: Wed May 30 21:47:40 2018 New Revision: 471178 URL: https://svnweb.freebsd.org/changeset/ports/471178 Log: Document new vulnerabilities in www/chromium < 67.0.3396.62 Obtained from: https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop_58.html Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Wed May 30 21:47:20 2018 (r471177) +++ head/security/vuxml/vuln.xml Wed May 30 21:47:40 2018 (r471178) @@ -58,6 +58,82 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> + + chromium -- multiple vulnerabilities + + + chromium + 67.0.3396.62 + + + + +

Google Chrome Releases reports:

+
34 security fixes in this release, including:
+
+
[835639] High CVE-2018-6123: Use after free in Blink. Reported by Looben Yang on 2018-04-22
+
[840320] High CVE-2018-6124: Type confusion in Blink. Reported by Guang Gong of Alpha Team, Qihoo 360 on 2018-05-07
+
[818592] High CVE-2018-6125: Overly permissive policy in WebUSB. Reported by Yubico, Inc on 2018-03-05
+
[844457] High CVE-2018-6126: Heap buffer overflow in Skia. Reported by Ivan Fratric of Google Project Zero on 2018-05-18
+
[842990] High CVE-2018-6127: Use after free in indexedDB. Reported by Looben Yang on 2018-05-15
+
[841105] High CVE-2018-6128: uXSS in Chrome on iOS. Reported by Tomasz Bojarski on 2018-05-09
+
[838672] High CVE-2018-6129: Out of bounds memory access in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-05-01
+
[838402] High CVE-2018-6130: Out of bounds memory access in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-04-30
+
[826434] High CVE-2018-6131: Incorrect mutability protection in WebAssembly. Reported by Natalie Silvanovich of Google Project Zero on 2018-03-27
+
[839960] Medium CVE-2018-6132: Use of uninitialized memory in WebRTC. Reported by Ronald E. Crane on 2018-05-04
+
[817247] Medium CVE-2018-6133: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-02-28
+
[797465] Medium CVE-2018-6134: Referrer Policy bypass in Blink. Reported by Jun Kokatsu (@shhnjk) on 2017-12-23
+
[823353] Medium CVE-2018-6135: UI spoofing in Blink. Reported by Jasper Rebane on 2018-03-19
+
[831943] Medium CVE-2018-6136: Out of bounds memory access in V8. Reported by Peter Wong on 2018-04-12
+
[835589] Medium CVE-2018-6137: Leak of visited status of page in Blink. Reported by Michael Smith (spinda.net) on 2018-04-21
+
[810220] Medium CVE-2018-6138: Overly permissive policy in Extensions. Reported by Francois Lajeunesse-Robert on 2018-02-08
+
[805224] Medium CVE-2018-6139: Restrictions bypass in the debugger extension API. Reported by Rob Wu on 2018-01-24
+
[798222] Medium CVE-2018-6140: Restrictions bypass in the debugger extension API. Reported by Rob Wu on 2018-01-01
+
[796107] Medium CVE-2018-6141: Heap buffer overflow in Skia. Reported by Yangkang (@dnpushme) and Wanglu of Qihoo360 Qex Team on 2017-12-19
+
[837939] Medium CVE-2018-6142: Out of bounds memory access in V8. Reported by Choongwoo Han of Naver Corporation on 2018-04-28
+
[843022] Medium CVE-2018-6143: Out of bounds memory access in V8. Reported by Guang Gong of Alpha Team, Qihoo 360 on 2018-05-15
+
[828049] Low CVE-2018-6144: Out of bounds memory access in PDFium. Reported by pdknsk on 2018-04-02
+
[805924] Low CVE-2018-6145: Incorrect escaping of MathML in Blink. Reported by Masato Kinugawa on 2018-01-25
+
[818133] Low CVE-2018-6147: Password fields not taking advantage of OS protections in Views. Reported by Michail Pishchagin (Yandex) on 2018-03-02
+
[847542] Various fixes from internal audits, fuzzing and other initiatives
+
+

+ + + + CVE-2018-6123 + CVE-2018-6124 + CVE-2018-6125 + CVE-2018-6126 + CVE-2018-6127 + CVE-2018-6128 + CVE-2018-6129 + CVE-2018-6130 + CVE-2018-6131 + CVE-2018-6132 + CVE-2018-6133 + CVE-2018-6134 + CVE-2018-6135 + CVE-2018-6136 + CVE-2018-6137 + CVE-2018-6138 + CVE-2018-6139 + CVE-2018-6140 + CVE-2018-6141 + CVE-2018-6142 + CVE-2018-6143 + CVE-2018-6144 + CVE-2018-6145 + CVE-2018-6147 + https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop_58.html + + + 2018-05-29 + 2018-05-30 + + + BIND -- multiple vulnerabilities