From owner-svn-ports-head@freebsd.org Wed Dec 2 21:49:52 2015 Return-Path: Delivered-To: svn-ports-head@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id C49BDA3F7BD; Wed, 2 Dec 2015 21:49:52 +0000 (UTC) (envelope-from rene@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 8099A14FD; Wed, 2 Dec 2015 21:49:52 +0000 (UTC) (envelope-from rene@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id tB2LnpA3033940; Wed, 2 Dec 2015 21:49:51 GMT (envelope-from rene@FreeBSD.org) Received: (from rene@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id tB2Lnp0p033938; Wed, 2 Dec 2015 21:49:51 GMT (envelope-from rene@FreeBSD.org) Message-Id: <201512022149.tB2Lnp0p033938@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: rene set sender to rene@FreeBSD.org using -f From: Rene Ladan Date: Wed, 2 Dec 2015 21:49:51 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r402855 - head/security/vuxml X-SVN-Group: ports-head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-head@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: SVN commit messages for the ports tree for head List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 02 Dec 2015 21:49:52 -0000 Author: rene Date: Wed Dec 2 21:49:51 2015 New Revision: 402855 URL: https://svnweb.freebsd.org/changeset/ports/402855 Log: Doument new vulnerabilities in www/chromium < 47.0.2526.73 Obtained from: http://googlechromereleases.blogspot.nl/2015/12/stable-channel-update.html Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Wed Dec 2 21:41:17 2015 (r402854) +++ head/security/vuxml/vuln.xml Wed Dec 2 21:49:51 2015 (r402855) @@ -1,4 +1,3 @@ - + + chromium -- multiple vulnerabilities + + + chromium + + chromium-npapi + chromium-pulse + 47.0.2526.73 + + + + +

Google Chrome Releases reports:

+
41 security fixes in this release, inclduding:
+
+
[558589] Critical CVE-2015-6765: Use-after-free in AppCache. + Credit to anonymous.
+
[551044] High CVE-2015-6766: Use-after-free in AppCache. + Credit to anonymous.
+
[554908] High CVE-2015-6767: Use-after-free in AppCache. + Credit to anonymous.
+
[556724] High CVE-2015-6768: Cross-origin bypass in DOM. + Credit to Mariusz Mlynski.
+
[534923] High CVE-2015-6769: Cross-origin bypass in core. + Credit to Mariusz Mlynski.
+
[541206] High CVE-2015-6770: Cross-origin bypass in DOM. + Credit to Mariusz Mlynski.
+
[544991] High CVE-2015-6771: Out of bounds access in v8. + Credit to anonymous.
+
[546545] High CVE-2015-6772: Cross-origin bypass in DOM. + Credit to Mariusz Mlynski.
+
[554946] High CVE-2015-6764: Out of bounds access in v8. + Credit to Guang Gong of Qihoo 360 via pwn2own.
+
[491660] High CVE-2015-6773: Out of bounds access in Skia. + Credit to cloudfuzzer.
+
[549251] High CVE-2015-6774: Use-after-free in Extensions. + Credit to anonymous.
+
[529012] High CVE-2015-6775: Type confusion in PDFium. + Credit to Atte Kettunen of OUSPG.
+
[457480] High CVE-2015-6776: Out of bounds access in PDFium. + Credit to Hanno Böck.
+
[544020] High CVE-2015-6777: Use-after-free in DOM. + Credit to Long Liu of Qihoo 360Vulcan Team.
+
[514891] Medium CVE-2015-6778: Out of bounds access in PDFium. + Credit to Karl Skomski.
+
[528505] Medium CVE-2015-6779: Scheme bypass in PDFium. + Credit to Til Jasper Ullrich.
+
[490492] Medium CVE-2015-6780: Use-after-free in Infobars. + Credit to Khalil Zhani.
+
[497302] Medium CVE-2015-6781: Integer overflow in Sfntly. + Credit to miaubiz.
+
[536652] Medium CVE-2015-6782: Content spoofing in Omnibox. + Credit to Luan Herrera.
+
[537205] Medium CVE-2015-6783: Signature validation issue in + Android Crazy Linker. Credit to Michal Bednarski.
+
[503217] Low CVE-2015-6784: Escaping issue in saved pages. + Credit to Inti De Ceukelaire.
+
[534542] Low CVE-2015-6785: Wildcard matching issue in CSP. + Credit to Michael Ficarra / Shape Security.
+
[534570] Low CVE-2015-6786: Scheme bypass in CSP. Credit to + Michael Ficarra / Shape Security.
+
[563930] CVE-2015-6787: Various fixes from internal audits, + fuzzing and other initiatives.
+
Multiple vulnerabilities in V8 fixed at the tip of the 4.7 + branch (currently 4.7.80.23).
+
+

+ + + + CVE-2015-6765 + CVE-2015-6766 + CVE-2015-6767 + CVE-2015-6768 + CVE-2015-6769 + CVE-2015-6770 + CVE-2015-6771 + CVE-2015-6772 + CVE-2015-6773 + CVE-2015-6774 + CVE-2015-6775 + CVE-2015-6776 + CVE-2015-6777 + CVE-2015-6778 + CVE-2015-6779 + CVE-2015-6780 + CVE-2015-6781 + CVE-2015-6782 + CVE-2015-6783 + CVE-2015-6784 + CVE-2015-6785 + CVE-2015-6786 + CVE-2015-6787 + http://googlechromereleases.blogspot.nl/2015/12/stable-channel-update.html + + + 2015-12-01 + 2015-12-02 + + + piwik -- multiple vulnerabilities