Date: Sat, 5 Mar 2016 20:39:49 +0000 (UTC) From: Christoph Moench-Tegeder <cmt@FreeBSD.org> To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r410211 - head/security/vuxml Message-ID: <201603052039.u25KdnpA057560@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: cmt Date: Sat Mar 5 20:39:49 2016 New Revision: 410211 URL: https://svnweb.freebsd.org/changeset/ports/410211 Log: Document recent chromium vulnerabilities Approved by: miwi (mentor), rene (mentor) Obtained from: http://googlechromereleases.blogspot.de/2016/03/stable-channel-update.html Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Sat Mar 5 20:36:18 2016 (r410210) +++ head/security/vuxml/vuln.xml Sat Mar 5 20:39:49 2016 (r410211) @@ -58,6 +58,59 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="f85fa236-e2a6-412e-b5c7-c42120892de5"> + <topic>chromium -- multiple vulnerabilities</topic> + <affects> + <package> + <name>chromium</name> + <name>chromium-npapi</name> + <name>chromium-pulse</name> + <range><lt>49.0.2623.75</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>Google Chrome Releases reports:</p> + <blockquote cite="http://googlechromereleases.blogspot.de/2016/03/stable-channel-update.html"> + <p>[560011] High CVE-2016-1630: Same-origin bypass in Blink.</p> + <p>[569496] High CVE-2016-1631: Same-origin bypass in Pepper Plugin.</p> + <p>[549986] High CVE-2016-1632: Bad cast in Extensions.</p> + <p>[572537] High CVE-2016-1633: Use-after-free in Blink.</p> + <p>[559292] High CVE-2016-1634: Use-after-free in Blink.</p> + <p>[585268] High CVE-2016-1635: Use-after-free in Blink.</p> + <p>[584155] High CVE-2016-1636: SRI Validation Bypass.</p> + <p>[555544] Medium CVE-2016-1637: Information Leak in Skia.</p> + <p>[585282] Medium CVE-2016-1638: WebAPI Bypass.</p> + <p>[572224] Medium CVE-2016-1639: Use-after-free in WebRTC.</p> + <p>[550047] Medium CVE-2016-1640: Origin confusion in Extensions UI.</p> + <p>[583718] Medium CVE-2016-1641: Use-after-free in Favicon.</p> + <p>[591402] CVE-2016-1642: Various fixes from internal audits, fuzzing and other initiatives.</p> + <p>Multiple vulnerabilities in V8 fixed.</p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2016-1630</cvename> + <cvename>CVE-2016-1631</cvename> + <cvename>CVE-2016-1632</cvename> + <cvename>CVE-2016-1633</cvename> + <cvename>CVE-2016-1634</cvename> + <cvename>CVE-2016-1635</cvename> + <cvename>CVE-2016-1636</cvename> + <cvename>CVE-2016-1637</cvename> + <cvename>CVE-2016-1638</cvename> + <cvename>CVE-2016-1639</cvename> + <cvename>CVE-2016-1640</cvename> + <cvename>CVE-2016-1641</cvename> + <cvename>CVE-2016-1642</cvename> + <url>http://googlechromereleases.blogspot.de/2016/03/stable-channel-update.html</url> + </references> + <dates> + <discovery>2016-03-02</discovery> + <entry>2016-03-05</entry> + </dates> + </vuln> + <vuln vid="6b3591ea-e2d2-11e5-a6be-5453ed2e2b49"> <topic>libssh -- weak Diffie-Hellman secret generation</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201603052039.u25KdnpA057560>