From owner-svn-ports-all@freebsd.org Sun Apr 12 10:06:01 2020 Return-Path: Delivered-To: svn-ports-all@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 688D72B86D1; Sun, 12 Apr 2020 10:06:01 +0000 (UTC) (envelope-from rene@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 490S7Y24rhz3Qrw; Sun, 12 Apr 2020 10:06:01 +0000 (UTC) (envelope-from rene@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4290227A74; Sun, 12 Apr 2020 10:06:01 +0000 (UTC) (envelope-from rene@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id 03CA612O053793; Sun, 12 Apr 2020 10:06:01 GMT (envelope-from rene@FreeBSD.org) Received: (from rene@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id 03CA6030053792; Sun, 12 Apr 2020 10:06:00 GMT (envelope-from rene@FreeBSD.org) Message-Id: <202004121006.03CA6030053792@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: rene set sender to rene@FreeBSD.org using -f From: Rene Ladan Date: Sun, 12 Apr 2020 10:06:00 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r531501 - head/security/vuxml X-SVN-Group: ports-head X-SVN-Commit-Author: rene X-SVN-Commit-Paths: head/security/vuxml X-SVN-Commit-Revision: 531501 X-SVN-Commit-Repository: ports MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-all@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: SVN commit messages for the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 12 Apr 2020 10:06:01 -0000 Author: rene Date: Sun Apr 12 10:06:00 2020 New Revision: 531501 URL: https://svnweb.freebsd.org/changeset/ports/531501 Log: Document new vulnerabilities in www/chromium < 81.0.4044.92 Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Sun Apr 12 10:05:03 2020 (r531500) +++ head/security/vuxml/vuln.xml Sun Apr 12 10:06:00 2020 (r531501) @@ -58,6 +58,112 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> + + chromium -- multiple vulnerabilities + + + chromium + 81.0.4044.92 + + + + +

Google Chrome Releases reports:

+
This updates includes 32 security fixes, including:
+
+
[1019161] High CVE-2020-6454: Use after free in extensions. + Reported by Leecraso and Guang Gong of Alpha Lab, Qihoo 360 on + 2019-10-29
+
[1043446] High CVE-2020-6423: Use after free in audio. + Reported by Anonymous on 2020-01-18
+
[1059669] High CVE-2020-6455: Out of bounds read in WebSQL. + Reported by Nan Wang(@eternalsakura13) and Guang Gong of Alpha Lab, + Qihoo 360 on 2020-03-09
+
[1031479] Medium CVE-2020-6430: Type Confusion in V8. + Reported by Avihay Cohen @ SeraphicAlgorithms on 2019-12-06
+
[1040755] Medium CVE-2020-6456: Insufficient validation of + untrusted input in clipboard. Reported by Michał Bentkowski of + Securitum on 2020-01-10
+
[852645] Medium CVE-2020-6431: Insufficient policy + enforcement in full screen. Reported by Luan Herrera (@lbherrera_) + on 2018-06-14
+
[965611] Medium CVE-2020-6432: Insufficient policy + enforcement in navigations. Reported by David Erceg on + 2019-05-21
+
[1043965] Medium CVE-2020-6433: Insufficient policy + enforcement in extensions. Reported by David Erceg on + 2020-01-21
+
[1048555] Medium CVE-2020-6434: Use after free in devtools. + Reported by HyungSeok Han (DaramG) of Theori on 2020-02-04
+
[1032158] Medium CVE-2020-6435: Insufficient policy + enforcement in extensions. Reported by Sergei Glazunov of Google + Project Zero on 2019-12-09
+
[1034519] Medium CVE-2020-6436: Use after free in window + management. Reported by Igor Bukanov from Vivaldi on 2019-12-16
+
[639173] Low CVE-2020-6437: Inappropriate implementation in + WebView. Reported by Jann Horn on 2016-08-19
+
[714617] Low CVE-2020-6438: Insufficient policy enforcement in + extensions. Reported by Ng Yik Phang on 2017-04-24
+
[868145] Low CVE-2020-6439: Insufficient policy enforcement in + navigations. Reported by remkoboonstra on 2018-07-26
+
[894477] Low CVE-2020-6440: Inappropriate implementation in + extensions. Reported by David Erceg on 2018-10-11
+
[959571] Low CVE-2020-6441: Insufficient policy enforcement in + omnibox. Reported by David Erceg on 2019-05-04
+
[1013906] Low CVE-2020-6442: Inappropriate implementation in + cache. Reported by B@rMey on 2019-10-12
+
[1040080] Low CVE-2020-6443: Insufficient data validation in + developer tools. Reported by @lovasoa (Ophir LOJKINE) on + 2020-01-08
+
[922882] Low CVE-2020-6444: Uninitialized Use in WebRTC. + Reported by mlfbrown on 2019-01-17
+
[933171] Low CVE-2020-6445: Insufficient policy enforcement in + trusted types. Reported by Jun Kokatsu, Microsoft Browser + Vulnerability Research on 2019-02-18
+
[933172] Low CVE-2020-6446: Insufficient policy enforcement in + trusted types. Reported by Jun Kokatsu, Microsoft Browser + Vulnerability Research on 2019-02-18
+
[991217] Low CVE-2020-6447: Inappropriate implementation in + developer tools. Reported by David Erceg on 2019-08-06
+
[1037872] Low CVE-2020-6448: Use after free in V8. Reported by + Guang Gong of Alpha Lab, Qihoo 360 on 2019-12-26
+
+

+ + + + CVE-2020-6423 + CVE-2020-6430 + CVE-2020-6431 + CVE-2020-6432 + CVE-2020-6433 + CVE-2020-6434 + CVE-2020-6435 + CVE-2020-6436 + CVE-2020-6437 + CVE-2020-6438 + CVE-2020-6439 + CVE-2020-6440 + CVE-2020-6441 + CVE-2020-6442 + CVE-2020-6443 + CVE-2020-6444 + CVE-2020-6445 + CVE-2020-6446 + CVE-2020-6447 + CVE-2020-6448 + CVE-2020-6454 + CVE-2020-6455 + CVE-2020-6456 + https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_7.html + + + 2020-04-07 + 2020-04-12 + + + chromium -- multiple vulnerabilities