Date: Wed, 17 Feb 2021 12:47:30 +0000 (UTC) From: Rene Ladan <rene@FreeBSD.org> To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r565499 - head/security/vuxml Message-ID: <202102171247.11HClU7h085085@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: rene Date: Wed Feb 17 12:47:30 2021 New Revision: 565499 URL: https://svnweb.freebsd.org/changeset/ports/565499 Log: Document new vulnerabilities in www/chromium < 88.0.4324.182 Obtained from: https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-desktop_16.html Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Wed Feb 17 11:54:48 2021 (r565498) +++ head/security/vuxml/vuln.xml Wed Feb 17 12:47:30 2021 (r565499) @@ -77,6 +77,62 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">; + <vuln vid="48514901-711d-11eb-9846-e09467587c17"> + <topic>chromium -- multiple vulnerabilities</topic> + <affects> + <package> + <name>chromium</name> + <range><lt>88.0.4324.182</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>Chrome Releases reports:</p> + <blockquote cite="https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-desktop_16.html">; + <p>This release contains 10 security fixes, including:</p> + <ul> + <li>[1138143] High CVE-2021-21149: Stack overflow in Data Transfer. + Reported by Ryoya Tsukasaki on 2020-10-14</li> + <li>[1172192] High CVE-2021-21150: Use after free in Downloads. + Reported by Woojin Oh(@pwn_expoit) of STEALIEN on 2021-01-29</li> + <li>[1165624] High CVE-2021-21151: Use after free in Payments. + Reported by Khalil Zhani on 2021-01-12</li> + <li>[1166504] High CVE-2021-21152: Heap buffer overflow in Media. + Reported by Anonymous on 2021-01-14</li> + <li>[1155974] High CVE-2021-21153: Stack overflow in GPU Process. + Reported by Jan Ruge of ERNW GmbH on 2020-12-06</li> + <li>[1173269] High CVE-2021-21154: Heap buffer overflow in Tab + Strip. Reported by Abdulrahman Alqabandi, Microsoft Browser + Vulnerability Research on 2021-02-01</li> + <li>[1175500] High CVE-2021-21155: Heap buffer overflow in Tab + Strip. Reported by Khalil Zhani on 2021-02-07</li> + <li>[1177341] High CVE-2021-21156: Heap buffer overflow in V8. + Reported by Sergei Glazunov of Google Project Zero on + 2021-02-11</li> + <li>[1170657] Medium CVE-2021-21157: Use after free in Web + Sockets. Reported by Anonymous on 2021-01-26</li> + </ul> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2021-21149</cvename> + <cvename>CVE-2021-21150</cvename> + <cvename>CVE-2021-21151</cvename> + <cvename>CVE-2021-21152</cvename> + <cvename>CVE-2021-21153</cvename> + <cvename>CVE-2021-21154</cvename> + <cvename>CVE-2021-21155</cvename> + <cvename>CVE-2021-21156</cvename> + <cvename>CVE-2021-21157</cvename> + <url>https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-desktop_16.html</url>; + </references> + <dates> + <discovery>2021-02-16</discovery> + <entry>2021-02-17</entry> + </dates> + </vuln> + <vuln vid="96a21236-707b-11eb-96d8-d4c9ef517024"> <topic>OpenSSL -- Multiple vulnerabilities</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202102171247.11HClU7h085085>