Date: Fri, 27 Jul 2018 12:34:57 +0000 (UTC) From: "Carlos J. Puga Medina" <cpm@FreeBSD.org> To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r475430 - head/security/vuxml Message-ID: <201807271234.w6RCYv1C033563@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: cpm Date: Fri Jul 27 12:34:57 2018 New Revision: 475430 URL: https://svnweb.freebsd.org/changeset/ports/475430 Log: Document new vulnerabilites in www/chromium < 68.0.3440.75 Obtained from: https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Fri Jul 27 12:24:57 2018 (r475429) +++ head/security/vuxml/vuln.xml Fri Jul 27 12:34:57 2018 (r475430) @@ -58,6 +58,98 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">; + <vuln vid="b9c525d9-9198-11e8-beba-080027ef1a23"> + <topic>chromium -- multiple vulnerabilities</topic> + <affects> + <package> + <name>chromium</name> + <range><lt>68.0.3440.75</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>Google Chrome Releases reports:</p> + <blockquote cite="https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html">; + <p>42 security fixes in this release, including:</p> + <ul> + <li>[850350] High CVE-2018-6153: Stack buffer overflow in Skia. Reported by Zhen Zhou of NSFOCUS Security Team on 2018-06-07</li> + <li>[848914] High CVE-2018-6154: Heap buffer overflow in WebGL. Reported by Omair on 2018-06-01</li> + <li>[842265] High CVE-2018-6155: Use after free in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-05-11</li> + <li>[841962] High CVE-2018-6156: Heap buffer overflow in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-05-10</li> + <li>[840536] High CVE-2018-6157: Type confusion in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-05-07</li> + <li>[812667] Medium CVE-2018-6150: Cross origin information disclosure in Service Workers. Reported by Rob Wu on 2018-02-15</li> + <li>[805905] Medium CVE-2018-6151: Bad cast in DevTools. Reported by Rob Wu on 2018-01-25</li> + <li>[805445] Medium CVE-2018-6152: Local file write in DevTools. Reported by Rob Wu on 2018-01-24</li> + <li>[841280] Medium CVE-2018-6158: Use after free in Blink. Reported by Zhe Jin, Luyao Liu from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd on 2018-05-09</li> + <li>[837275] Medium CVE-2018-6159: Same origin policy bypass in ServiceWorker. Reported by Jun Kokatsu (@shhnjk) on 2018-04-26</li> + <li>[839822] Medium CVE-2018-6160: URL spoof in Chrome on iOS. Reported by evi1m0 of Bilibili Security Team on 2018-05-04</li> + <li>[826552] Medium CVE-2018-6161: Same origin policy bypass in WebAudio. Reported by Jun Kokatsu (@shhnjk) on 2018-03-27</li> + <li>[804123] Medium CVE-2018-6162: Heap buffer overflow in WebGL. Reported by Omair on 2018-01-21</li> + <li>[849398] Medium CVE-2018-6163: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-06-04</li> + <li>[848786] Medium CVE-2018-6164: Same origin policy bypass in ServiceWorker. Reported by Jun Kokatsu (@shhnjk) on 2018-06-01</li> + <li>[847718] Medium CVE-2018-6165: URL spoof in Omnibox. Reported by evi1m0 of Bilibili Security Team on 2018-05-30</li> + <li>[835554] Medium CVE-2018-6166: URL spoof in Omnibox. Reported by Lnyas Zhang on 2018-04-21</li> + <li>[833143] Medium CVE-2018-6167: URL spoof in Omnibox. Reported by Lnyas Zhang on 2018-04-15</li> + <li>[828265] Medium CVE-2018-6168: CORS bypass in Blink. Reported by Gunes Acar and Danny Y. Huang of Princeton University, Frank Li of UC Berkeley on 2018-04-03</li> + <li>[394518] Medium CVE-2018-6169: Permissions bypass in extension installation. Reported by Sam P on 2014-07-16</li> + <li>[862059] Medium CVE-2018-6170: Type confusion in PDFium. Reported by Anonymous on 2018-07-10</li> + <li>[851799] Medium CVE-2018-6171: Use after free in WebBluetooth. Reported by amazon@mimetics.ca on 2018-06-12</li> + <li>[847242] Medium CVE-2018-6172: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-05-28</li> + <li>[836885] Medium CVE-2018-6173: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-04-25</li> + <li>[835299] Medium CVE-2018-6174: Integer overflow in SwiftShader. Reported by Mark Brand of Google Project Zero on 2018-04-20</li> + <li>[826019] Medium CVE-2018-6175: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-03-26</li> + <li>[666824] Medium CVE-2018-6176: Local user privilege escalation in Extensions. Reported by Jann Horn of Google Project Zero on 2016-11-18</li> + <li>[826187] Low CVE-2018-6177: Cross origin information leak in Blink. Reported by Ron Masas (Imperva) on 2018-03-27</li> + <li>[823194] Low CVE-2018-6178: UI spoof in Extensions. Reported by Khalil Zhani on 2018-03-19</li> + <li>[816685] Low CVE-2018-6179: Local file information leak in Extensions. Reported by Anonymous on 2018-02-26</li> + <li>[797461] Low CVE-2018-6044: Request privilege escalation in Extensions. Reported by Wob Wu on 2017-12-23</li> + <li>[791324] Low CVE-2018-4117: Cross origin information leak in Blink. Reported by AhsanEjaz - @AhsanEjazA on 2017-12-03</li> + <li>[866821] Various fixes from internal audits, fuzzing and other initiatives</li> + </ul> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2018-4117</cvename> + <cvename>CVE-2018-6044</cvename> + <cvename>CVE-2018-6150</cvename> + <cvename>CVE-2018-6151</cvename> + <cvename>CVE-2018-6152</cvename> + <cvename>CVE-2018-6153</cvename> + <cvename>CVE-2018-6154</cvename> + <cvename>CVE-2018-6155</cvename> + <cvename>CVE-2018-6156</cvename> + <cvename>CVE-2018-6157</cvename> + <cvename>CVE-2018-6158</cvename> + <cvename>CVE-2018-6159</cvename> + <cvename>CVE-2018-6160</cvename> + <cvename>CVE-2018-6161</cvename> + <cvename>CVE-2018-6162</cvename> + <cvename>CVE-2018-6163</cvename> + <cvename>CVE-2018-6164</cvename> + <cvename>CVE-2018-6165</cvename> + <cvename>CVE-2018-6166</cvename> + <cvename>CVE-2018-6167</cvename> + <cvename>CVE-2018-6168</cvename> + <cvename>CVE-2018-6169</cvename> + <cvename>CVE-2018-6170</cvename> + <cvename>CVE-2018-6171</cvename> + <cvename>CVE-2018-6172</cvename> + <cvename>CVE-2018-6173</cvename> + <cvename>CVE-2018-6174</cvename> + <cvename>CVE-2018-6175</cvename> + <cvename>CVE-2018-6176</cvename> + <cvename>CVE-2018-6177</cvename> + <cvename>CVE-2018-6178</cvename> + <cvename>CVE-2018-6179</cvename> + <url>https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html</url>; + </references> + <dates> + <discovery>2018-07-24</discovery> + <entry>2018-07-27</entry> + </dates> + </vuln> + <vuln vid="3849e28f-8693-11e8-9610-9c5c8e75236a"> <topic>curl -- SMTP send heap buffer overflow</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201807271234.w6RCYv1C033563>