Date: Fri, 22 Jul 2016 20:30:16 +0000 (UTC) From: Rene Ladan <rene@FreeBSD.org> To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r418932 - head/security/vuxml Message-ID: <201607222030.u6MKUGHF061412@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: rene Date: Fri Jul 22 20:30:16 2016 New Revision: 418932 URL: https://svnweb.freebsd.org/changeset/ports/418932 Log: Document new vulnerabilities in www/chromium < 52.0.2743.82 Obtained from: https://googlechromereleases.blogspot.nl/2016/07/stable-channel-update.html Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Fri Jul 22 20:28:01 2016 (r418931) +++ head/security/vuxml/vuln.xml Fri Jul 22 20:30:16 2016 (r418932) @@ -58,6 +58,86 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">; + <vuln vid="6fae9fe1-5048-11e6-8aa7-3065ec8fd3ec"> + <topic>chromium -- multiple vulnerabilities</topic> + <affects> + <package> + <name>chromium</name> + <name>chromium-npapi</name> + <name>chromium-pulse</name> + <range><lt>52.0.2743.82</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>Google Chrome Releases reports:</p> + <blockquote cite="https://googlechromereleases.blogspot.nl/2016/07/stable-channel-update.html">; + <p>48 security fixes in this release, including:</p> + <ul> + <li>[610600] High CVE-2016-1706: Sandbox escape in PPAPI. Credit to + Pinkie Pie xisigr of Tencent's Xuanwu Lab</li> + <li>[613949] High CVE-2016-1708: Use-after-free in Extensions. + Credit to Adam Varsan</li> + <li>[614934] High CVE-2016-1709: Heap-buffer-overflow in sfntly. + Credit to ChenQin of Topsec Security Team</li> + <li>[616907] High CVE-2016-1710: Same-origin bypass in Blink. + Credit to Mariusz Mlynski</li> + <li>[617495] High CVE-2016-1711: Same-origin bypass in Blink. + Credit to Mariusz Mlynski</li> + <li>[618237] High CVE-2016-5127: Use-after-free in Blink. Credit + to cloudfuzzer</li> + <li>[619166] High CVE-2016-5128: Same-origin bypass in V8. Credit + to Anonymous</li> + <li>[620553] High CVE-2016-5129: Memory corruption in V8. Credit to + Jeonghoon Shin</li> + <li>[623319] High CVE-2016-5130: URL spoofing. Credit to Wadih + Matar</li> + <li>[623378] High CVE-2016-5131: Use-after-free in libxml. Credit + to Nick Wellnhofer</li> + <li>[607543] Medium CVE-2016-5132: Limited same-origin bypass in + Service Workers. Credit to Ben Kelly</li> + <li>[613626] Medium CVE-2016-5133: Origin confusion in proxy + authentication. Credit to Patch Eudor</li> + <li>[593759] Medium CVE-2016-5134: URL leakage via PAC script. + Credit to Paul Stone</li> + <li>[605451] Medium CVE-2016-5135: Content-Security-Policy bypass. + Credit to kingxwy</li> + <li>[625393] Medium CVE-2016-5136: Use after free in extensions. + Credit to Rob Wu</li> + <li>[625945] Medium CVE-2016-5137: History sniffing with HSTS and + CSP. Credit to Xiaoyin Liu</li> + <li>[629852] CVE-2016-1705: Various fixes from internal audits, + fuzzing and other initiatives.</li> + </ul> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2016-1705</cvename> + <cvename>CVE-2016-1706</cvename> + <cvename>CVE-2016-1708</cvename> + <cvename>CVE-2016-1709</cvename> + <cvename>CVE-2016-1710</cvename> + <cvename>CVE-2016-1711</cvename> + <cvename>CVE-2016-5127</cvename> + <cvename>CVE-2016-5128</cvename> + <cvename>CVE-2016-5129</cvename> + <cvename>CVE-2016-5130</cvename> + <cvename>CVE-2016-5131</cvename> + <cvename>CVE-2016-5132</cvename> + <cvename>CVE-2016-5133</cvename> + <cvename>CVE-2016-5134</cvename> + <cvename>CVE-2016-5135</cvename> + <cvename>CVE-2016-5136</cvename> + <cvename>CVE-2016-5137</cvename> + <url>https://googlechromereleases.blogspot.nl/2016/07/stable-channel-update.html</url>; + </references> + <dates> + <discovery>2016-07-20</discovery> + <entry>2016-07-22</entry> + </dates> + </vuln> + <vuln vid="62d45229-4fa0-11e6-9d13-206a8a720317"> <topic>krb5 -- KDC denial of service vulnerability</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201607222030.u6MKUGHF061412>