Date: Sun, 12 Mar 2017 20:18:59 +0000 (UTC) From: "Carlos J. Puga Medina" <cpm@FreeBSD.org> To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r436024 - head/security/vuxml Message-ID: <201703122018.v2CKIxwJ036670@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: cpm Date: Sun Mar 12 20:18:59 2017 New Revision: 436024 URL: https://svnweb.freebsd.org/changeset/ports/436024 Log: Document new vulnerabilities in www/chromium < 57.0.2987.98 Obtained from: https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Sun Mar 12 20:15:40 2017 (r436023) +++ head/security/vuxml/vuln.xml Sun Mar 12 20:18:59 2017 (r436024) @@ -58,6 +58,90 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">; + <vuln vid="a505d397-0758-11e7-8d8b-e8e0b747a45a"> + <topic>chromium -- multiple vulnerabilities</topic> + <affects> + <package> + <name>chromium</name> + <name>chromium-npapi</name> + <name>chromium-pulse</name> + <range><lt>57.0.2987.98</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>Google Chrome Releases reports:</p> + <blockquote cite="https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html">; + <p>36 security fixes in this release, including:</p> + <ul> + <li>[682194] High CVE-2017-5030: Memory corruption in V8. Credit to + Brendon Tiszka</li> + <li>[682020] High CVE-2017-5031: Use after free in ANGLE. Credit to + Looben Yang</li> + <li>[668724] High CVE-2017-5032: Out of bounds write in PDFium. Credit to + Ashfaq Ansari - Project Srishti</li> + <li>[676623] High CVE-2017-5029: Integer overflow in libxslt. Credit to + Holger Fuhrmannek</li> + <li>[678461] High CVE-2017-5034: Use after free in PDFium. Credit to + Ke Liu of Tencent's Xuanwu Lab</li> + <li>[688425] High CVE-2017-5035: Incorrect security UI in Omnibox. Credit to + Enzo Aguado</li> + <li>[691371] High CVE-2017-5036: Use after free in PDFium. Credit to + Anonymous</li> + <li>[679640] High CVE-2017-5037: Multiple out of bounds writes in ChunkDemuxer. + Credit to Yongke Wang of Tecent's Xuanwu Lab</li> + <li>[679649] High CVE-2017-5039: Use after free in PDFium. Credit to + jinmo123</li> + <li>[691323] Medium CVE-2017-5040: Information disclosure in V8. Credit to + Choongwoo Han</li> + <li>[642490] Medium CVE-2017-5041: Address spoofing in Omnibox. Credit to + Jordi Chancel</li> + <li>[669086] Medium CVE-2017-5033: Bypass of Content Security Policy in Blink. + Credit to Nicolai Grodum</li> + <li>[671932] Medium CVE-2017-5042: Incorrect handling of cookies in Cast. + Credit to Mike Ruddy</li> + <li>[695476] Medium CVE-2017-5038: Use after free in GuestView. Credit to + Anonymous</li> + <li>[683523] Medium CVE-2017-5043: Use after free in GuestView. Credit to + Anonymous</li> + <li>[688987] Medium CVE-2017-5044: Heap overflow in Skia. Credit to + Kushal Arvind Shah of Fortinet's FortiGuard Labs</li> + <li>[667079] Medium CVE-2017-5045: Information disclosure in XSS Auditor. + Credit to Dhaval Kapil</li> + <li>[680409] Medium CVE-2017-5046: Information disclosure in Blink. Credit to + Masato Kinugawa</li> + <li>[699618] Various fixes from internal audits, fuzzing and other initiatives</li> + </ul> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2017-5030</cvename> + <cvename>CVE-2017-5031</cvename> + <cvename>CVE-2017-5032</cvename> + <cvename>CVE-2017-5029</cvename> + <cvename>CVE-2017-5034</cvename> + <cvename>CVE-2017-5035</cvename> + <cvename>CVE-2017-5036</cvename> + <cvename>CVE-2017-5037</cvename> + <cvename>CVE-2017-5039</cvename> + <cvename>CVE-2017-5040</cvename> + <cvename>CVE-2017-5041</cvename> + <cvename>CVE-2017-5033</cvename> + <cvename>CVE-2017-5042</cvename> + <cvename>CVE-2017-5038</cvename> + <cvename>CVE-2017-5043</cvename> + <cvename>CVE-2017-5044</cvename> + <cvename>CVE-2017-5045</cvename> + <cvename>CVE-2017-5046</cvename> + <url>https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html</url>; + </references> + <dates> + <discovery>2017-03-09</discovery> + <entry>2017-03-12</entry> + </dates> + </vuln> + <vuln vid="89cf8cd2-0698-11e7-aa3f-001b216d295b"> <topic>Several Security Defects in the Bouncy Castle Crypto APIs</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201703122018.v2CKIxwJ036670>