Date: Wed, 30 May 2018 21:47:40 +0000 (UTC) From: "Carlos J. Puga Medina" <cpm@FreeBSD.org> To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r471178 - head/security/vuxml Message-ID: <201805302147.w4ULleS7014772@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: cpm Date: Wed May 30 21:47:40 2018 New Revision: 471178 URL: https://svnweb.freebsd.org/changeset/ports/471178 Log: Document new vulnerabilities in www/chromium < 67.0.3396.62 Obtained from: https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop_58.html Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Wed May 30 21:47:20 2018 (r471177) +++ head/security/vuxml/vuln.xml Wed May 30 21:47:40 2018 (r471178) @@ -58,6 +58,82 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">; + <vuln vid="427b0f58-644c-11e8-9e1b-e8e0b747a45a"> + <topic>chromium -- multiple vulnerabilities</topic> + <affects> + <package> + <name>chromium</name> + <range><lt>67.0.3396.62</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>Google Chrome Releases reports:</p> + <blockquote cite="https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop_58.html">; + <p>34 security fixes in this release, including:</p> + <ul> + <li>[835639] High CVE-2018-6123: Use after free in Blink. Reported by Looben Yang on 2018-04-22</li> + <li>[840320] High CVE-2018-6124: Type confusion in Blink. Reported by Guang Gong of Alpha Team, Qihoo 360 on 2018-05-07</li> + <li>[818592] High CVE-2018-6125: Overly permissive policy in WebUSB. Reported by Yubico, Inc on 2018-03-05</li> + <li>[844457] High CVE-2018-6126: Heap buffer overflow in Skia. Reported by Ivan Fratric of Google Project Zero on 2018-05-18</li> + <li>[842990] High CVE-2018-6127: Use after free in indexedDB. Reported by Looben Yang on 2018-05-15</li> + <li>[841105] High CVE-2018-6128: uXSS in Chrome on iOS. Reported by Tomasz Bojarski on 2018-05-09</li> + <li>[838672] High CVE-2018-6129: Out of bounds memory access in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-05-01</li> + <li>[838402] High CVE-2018-6130: Out of bounds memory access in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-04-30</li> + <li>[826434] High CVE-2018-6131: Incorrect mutability protection in WebAssembly. Reported by Natalie Silvanovich of Google Project Zero on 2018-03-27</li> + <li>[839960] Medium CVE-2018-6132: Use of uninitialized memory in WebRTC. Reported by Ronald E. Crane on 2018-05-04</li> + <li>[817247] Medium CVE-2018-6133: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-02-28</li> + <li>[797465] Medium CVE-2018-6134: Referrer Policy bypass in Blink. Reported by Jun Kokatsu (@shhnjk) on 2017-12-23</li> + <li>[823353] Medium CVE-2018-6135: UI spoofing in Blink. Reported by Jasper Rebane on 2018-03-19</li> + <li>[831943] Medium CVE-2018-6136: Out of bounds memory access in V8. Reported by Peter Wong on 2018-04-12</li> + <li>[835589] Medium CVE-2018-6137: Leak of visited status of page in Blink. Reported by Michael Smith (spinda.net) on 2018-04-21</li> + <li>[810220] Medium CVE-2018-6138: Overly permissive policy in Extensions. Reported by Francois Lajeunesse-Robert on 2018-02-08</li> + <li>[805224] Medium CVE-2018-6139: Restrictions bypass in the debugger extension API. Reported by Rob Wu on 2018-01-24</li> + <li>[798222] Medium CVE-2018-6140: Restrictions bypass in the debugger extension API. Reported by Rob Wu on 2018-01-01</li> + <li>[796107] Medium CVE-2018-6141: Heap buffer overflow in Skia. Reported by Yangkang (@dnpushme) and Wanglu of Qihoo360 Qex Team on 2017-12-19</li> + <li>[837939] Medium CVE-2018-6142: Out of bounds memory access in V8. Reported by Choongwoo Han of Naver Corporation on 2018-04-28</li> + <li>[843022] Medium CVE-2018-6143: Out of bounds memory access in V8. Reported by Guang Gong of Alpha Team, Qihoo 360 on 2018-05-15</li> + <li>[828049] Low CVE-2018-6144: Out of bounds memory access in PDFium. Reported by pdknsk on 2018-04-02</li> + <li>[805924] Low CVE-2018-6145: Incorrect escaping of MathML in Blink. Reported by Masato Kinugawa on 2018-01-25</li> + <li>[818133] Low CVE-2018-6147: Password fields not taking advantage of OS protections in Views. Reported by Michail Pishchagin (Yandex) on 2018-03-02</li> + <li>[847542] Various fixes from internal audits, fuzzing and other initiatives</li> + </ul> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2018-6123</cvename> + <cvename>CVE-2018-6124</cvename> + <cvename>CVE-2018-6125</cvename> + <cvename>CVE-2018-6126</cvename> + <cvename>CVE-2018-6127</cvename> + <cvename>CVE-2018-6128</cvename> + <cvename>CVE-2018-6129</cvename> + <cvename>CVE-2018-6130</cvename> + <cvename>CVE-2018-6131</cvename> + <cvename>CVE-2018-6132</cvename> + <cvename>CVE-2018-6133</cvename> + <cvename>CVE-2018-6134</cvename> + <cvename>CVE-2018-6135</cvename> + <cvename>CVE-2018-6136</cvename> + <cvename>CVE-2018-6137</cvename> + <cvename>CVE-2018-6138</cvename> + <cvename>CVE-2018-6139</cvename> + <cvename>CVE-2018-6140</cvename> + <cvename>CVE-2018-6141</cvename> + <cvename>CVE-2018-6142</cvename> + <cvename>CVE-2018-6143</cvename> + <cvename>CVE-2018-6144</cvename> + <cvename>CVE-2018-6145</cvename> + <cvename>CVE-2018-6147</cvename> + <url>https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop_58.html</url>; + </references> + <dates> + <discovery>2018-05-29</discovery> + <entry>2018-05-30</entry> + </dates> + </vuln> + <vuln vid="94599fe0-5ca3-11e8-8be1-d05099c0ae8c"> <topic>BIND -- multiple vulnerabilities</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201805302147.w4ULleS7014772>