Date: Fri, 30 Aug 2024 08:34:35 +0200 From: =?UTF-8?Q?Fernando_Apestegu=C3=ADa?= <fernape@freebsd.org> To: Ronald Klop <ronald-lists@klop.ws> Cc: ports-committers@freebsd.org, dev-commits-ports-main@freebsd.org, dev-commits-ports-all@freebsd.org Subject: Re: git: 4453cf7eef05 - main - security/vuxml: Record firefox multiple vulnerabilites Message-ID: <CAGwOe2Z8b%2B11dSVgRmXFTSND_PmcvJJ9CYdd9qWffWEhsCmefw@mail.gmail.com> In-Reply-To: <1673063164.6537.1724964124887@localhost> References: <202408291747.47THltnT050010@gitrepo.freebsd.org> <1673063164.6537.1724964124887@localhost>
next in thread | previous in thread | raw e-mail | index | archive | help
--000000000000a9a84f0620e0c93b Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Thu, Aug 29, 2024 at 10:42=E2=80=AFPM Ronald Klop <ronald-lists@klop.ws>= wrote: > Hi, > > When I read the CVE documents they mention that these are about Firefox > for iOS. > The advisory page of Mozilla also talks about Firefox for iOS. > https://www.mozilla.org/en-US/security/advisories/mfsa2024-36/ > > So I doubt that this is applicable to the FreeBSD package. But you might > know things I don't know. > You're right, it seems those are only for iOS. They should have been discarded along CVE-2024-7523... I'll revert the commit and commit the pending CVEs: CVE-2024-0745 CVE-2024-6608 CVE-2024-6609 CVE-2024-6610 CVE-2024-7524 Thanks for the heads up. > > Regards, > Ronald. > > > > *Van:* "Fernando Apestegu=C3=ADa" <fernape@FreeBSD.org> > *Datum:* donderdag, 29 augustus 2024 19:47 > *Aan:* ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, > dev-commits-ports-main@FreeBSD.org > *Onderwerp:* git: 4453cf7eef05 - main - security/vuxml: Record firefox > multiple vulnerabilites > > The branch main has been updated by fernape: > > URL: > https://cgit.FreeBSD.org/ports/commit/?id=3D4453cf7eef05f9ac2b27bda7a87af= b7da713f1c4 > > commit 4453cf7eef05f9ac2b27bda7a87afb7da713f1c4 > Author: Fernando Apestegu=C3=ADa <fernape@FreeBSD.org> > AuthorDate: 2024-08-29 17:43:33 +0000 > Commit: Fernando Apestegu=C3=ADa <fernape@FreeBSD.org> > CommitDate: 2024-08-29 17:47:42 +0000 > > security/vuxml: Record firefox multiple vulnerabilites > > CVE-2024-43111 > * Base Score: 6.1 MEDIUM > * Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N > > CVE-2024-43112 > * Base Score: 6.1 MEDIUM > * Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N > > CVE-2024-43113 > * Base Score: 6.1 MEDIUM > * Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N > --- > security/vuxml/vuln/2024.xml | 39 ++++++++++++++++++++++++++++++++++++++= + > 1 file changed, 39 insertions(+) > > diff --git a/security/vuxml/vuln/2024.xml b/security/vuxml/vuln/2024.xml > index 7dd64a18968f..e9606c88bfca 100644 > --- a/security/vuxml/vuln/2024.xml > +++ b/security/vuxml/vuln/2024.xml > @@ -1,3 +1,42 @@ > + <vuln vid=3D"44de1b82-662d-11ef-a51b-b42e991fc52e"> > + <topic>firefox -- multiple vulnerabilities</topic> > + <affects> > + <package> > + <name>firefox</name> > + <range><lt>129</lt></range> > + </package> > + </affects> > + <description> > + <bodyhttp://www.w3.org/1999/xhtml">http://www.w3.org/1999/xhtml">; > + <p>security@mozilla.org reports:</p> > + <blockquote cite=3D"https://bugzilla.mozilla.org/show_bug.cgi?id=3D18= 74964 > "> > + <p>This update includes 3 CVEs:</p> > + <ul> > + <li>The contextual menu for links could provide an > + opportunity for cross-site scripting attacks.</li> > + <li>Long pressing on a download link could potentially > + provide a means for cross-site scripting.</li> > + <li>Long pressing on a download link could potentially > + allow Javascript commands to be executed within the > + browser.</li> > + </ul> > + </blockquote> > + </body> > + </description> > + <references> > + <cvename>CVE-2024-43113</cvename> > + <url>https://nvd.nist.gov/vuln/detail/CVE-2024-43113</url>; > + <cvename>CVE-2024-43112</cvename> > + <url>https://nvd.nist.gov/vuln/detail/CVE-2024-43112</url>; > + <cvename>CVE-2024-43111</cvename> > + <url>https://nvd.nist.gov/vuln/detail/CVE-2024-43111</url>; > + </references> > + <dates> > + <discovery>2024-08-06</discovery> > + <entry>2024-08-29</entry> > + </dates> > + </vuln> > + > <vuln vid=3D"6f2545bb-65e8-11ef-8a0f-a8a1599412c6"> > <topic>chromium -- multiple security fixes</topic> > <affects> > ------------------------------ > > > > --000000000000a9a84f0620e0c93b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr"><div dir=3D"ltr"><br></div><br><div class=3D"gmail_quote">= <div dir=3D"ltr" class=3D"gmail_attr">On Thu, Aug 29, 2024 at 10:42=E2=80= =AFPM Ronald Klop <<a href=3D"mailto:ronald-lists@klop.ws">ronald-lists@= klop.ws</a>> wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"= margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-lef= t:1ex"><div>Hi,<br> <br> When I read the CVE documents they mention that these are about Firefox for= iOS.<br> The advisory page of Mozilla also talks about Firefox for iOS.<br> <a href=3D"https://www.mozilla.org/en-US/security/advisories/mfsa2024-36/" = target=3D"_blank">https://www.mozilla.org/en-US/security/advisories/mfsa202= 4-36/</a><br> <br> So I doubt that this is applicable to the FreeBSD package. But you might kn= ow things I don't know.<br></div></blockquote><div><br></div><div>You&#= 39;re right, it seems those are only for iOS.</div><div>They should have be= en discarded along CVE-2024-7523...</div><div><br></div><div>I'll rever= t the commit and commit the pending CVEs:</div><div>CVE-2024-0745</div><div= >CVE-2024-6608</div><div>CVE-2024-6609</div><div>CVE-2024-6610</div><div>CV= E-2024-7524</div><div>=C2=A0</div><div>Thanks for the heads up.<br></div><b= lockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-le= ft:1px solid rgb(204,204,204);padding-left:1ex"><div> <br> Regards,<br> Ronald.<br> <br> =C2=A0 <p><b>Van:</b> "Fernando Apestegu=C3=ADa" <fernape@FreeBSD.org= ><br> <b>Datum:</b> donderdag, 29 augustus 2024 19:47<br> <b>Aan:</b> ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org= , dev-commits-ports-main@FreeBSD.org<br> <b>Onderwerp:</b> git: 4453cf7eef05 - main - security/vuxml: Record firefox= multiple vulnerabilites</p> <blockquote style=3D"padding-right:0px;padding-left:5px;margin-left:5px;bor= der-left:2px solid rgb(0,0,0);margin-right:0px"> <div id=3D"m_2438876645244164614P"> <div id=3D"m_2438876645244164614P.P">The branch main has been updated by fe= rnape:<br> <br> URL: <a href=3D"https://cgit.FreeBSD.org/ports/commit/?id=3D4453cf7eef05f9a= c2b27bda7a87afb7da713f1c4" target=3D"_blank">https://cgit.FreeBSD.org/ports= /commit/?id=3D4453cf7eef05f9ac2b27bda7a87afb7da713f1c4</a><br> <br> commit 4453cf7eef05f9ac2b27bda7a87afb7da713f1c4<br> Author: =C2=A0=C2=A0=C2=A0=C2=A0Fernando Apestegu=C3=ADa <fernape@FreeBS= D.org><br> AuthorDate: 2024-08-29 17:43:33 +0000<br> Commit: =C2=A0=C2=A0=C2=A0=C2=A0Fernando Apestegu=C3=ADa <fernape@FreeBS= D.org><br> CommitDate: 2024-08-29 17:47:42 +0000<br> <br> =C2=A0=C2=A0=C2=A0=C2=A0security/vuxml: Record firefox multiple vulnerabili= tes<br> =C2=A0=C2=A0=C2=A0=C2=A0<br> =C2=A0=C2=A0=C2=A0=C2=A0CVE-2024-43111<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0* Base Score: =C2=A06.1 MEDIUM<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0* Vector: =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0CVSS:= 3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N<br> =C2=A0=C2=A0=C2=A0=C2=A0<br> =C2=A0=C2=A0=C2=A0=C2=A0CVE-2024-43112<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0* Base Score: =C2=A06.1 MEDIUM<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0* Vector: =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0CVSS:= 3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N<br> =C2=A0=C2=A0=C2=A0=C2=A0<br> =C2=A0=C2=A0=C2=A0=C2=A0CVE-2024-43113<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0* Base Score: =C2=A06.1 MEDIUM<br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0* Vector: =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0CVSS:= 3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N<br> ---<br> =C2=A0security/vuxml/vuln/2024.xml | 39 +++++++++++++++++++++++++++++++++++= ++++<br> =C2=A01 file changed, 39 insertions(+)<br> <br> diff --git a/security/vuxml/vuln/2024.xml b/security/vuxml/vuln/2024.xml<br= > index 7dd64a18968f..e9606c88bfca 100644<br> --- a/security/vuxml/vuln/2024.xml<br> +++ b/security/vuxml/vuln/2024.xml<br> @@ -1,3 +1,42 @@<br> + =C2=A0<vuln vid=3D"44de1b82-662d-11ef-a51b-b42e991fc52e">= <br> + =C2=A0=C2=A0=C2=A0<topic>firefox -- multiple vulnerabilities</to= pic><br> + =C2=A0=C2=A0=C2=A0<affects><br> + =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0<package><br> + =C2=A0=C2=A0<name>firefox</name><br> + =C2=A0=C2=A0<range><lt>129</lt></range><br> + =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0</package><br> + =C2=A0=C2=A0=C2=A0</affects><br> + =C2=A0=C2=A0=C2=A0<description><br> + =C2=A0=C2=A0<bodyhttp://<a href=3D"http://www.w3.org/1999/xhtml" targe= t=3D"_blank">www.w3.org/1999/xhtml</a>"><a href=3D"http://www.w3.or= g/1999/xhtml" target=3D"_blank">http://www.w3.org/1999/xhtml</a>"><= br> + =C2=A0=C2=A0<p><a href=3D"mailto:security@mozilla.org" target=3D"_b= lank">security@mozilla.org</a> reports:</p><br> + =C2=A0=C2=A0<blockquote cite=3D"<a href=3D"https://bugzilla.mozil= la.org/show_bug.cgi?id=3D1874964" target=3D"_blank">https://bugzilla.mozill= a.org/show_bug.cgi?id=3D1874964</a>"><br> + =C2=A0=C2=A0=C2=A0=C2=A0<p>This update includes 3 CVEs:</p><b= r> + =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0<ul><br> + =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0<li>The contextual = menu for links could provide an<br> + =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0opportunity for cross-site scripting = attacks.</li><br> + =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0<li>Long pressing o= n a download link could potentially<br> + =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0provide a means for cross-site script= ing.</li><br> + =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0<li>Long pressing o= n a download link could potentially<br> + =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0allow Javascript commands to be execu= ted within the<br> + =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0browser.</li><br> + =C2=A0=C2=A0</ul><br> + =C2=A0=C2=A0</blockquote><br> + =C2=A0=C2=A0</body><br> + =C2=A0=C2=A0=C2=A0</description><br> + =C2=A0=C2=A0=C2=A0<references><br> + =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0<cvename>CVE-2024-43113</cvename&g= t;<br> + =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0<url><a href=3D"https://nvd.nist.gov/= vuln/detail/CVE-2024-43113%3C/url" target=3D"_blank">https://nvd.nist.gov/v= uln/detail/CVE-2024-43113</url</a>><br> + =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0<cvename>CVE-2024-43112</cvename&g= t;<br> + =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0<url><a href=3D"https://nvd.nist.gov/= vuln/detail/CVE-2024-43112%3C/url" target=3D"_blank">https://nvd.nist.gov/v= uln/detail/CVE-2024-43112</url</a>><br> + =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0<cvename>CVE-2024-43111</cvename&g= t;<br> + =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0<url><a href=3D"https://nvd.nist.gov/= vuln/detail/CVE-2024-43111%3C/url" target=3D"_blank">https://nvd.nist.gov/v= uln/detail/CVE-2024-43111</url</a>><br> + =C2=A0=C2=A0=C2=A0</references><br> + =C2=A0=C2=A0=C2=A0<dates><br> + =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0<discovery>2024-08-06</discovery&g= t;<br> + =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0<entry>2024-08-29</entry><br> + =C2=A0=C2=A0=C2=A0</dates><br> + =C2=A0</vuln><br> +<br> =C2=A0=C2=A0=C2=A0<vuln vid=3D"6f2545bb-65e8-11ef-8a0f-a8a1599412c6= "><br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0<topic>chromium -- multiple security fi= xes</topic><br> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0<affects></div> <hr></div> </blockquote> <br> =C2=A0</div></blockquote></div></div> --000000000000a9a84f0620e0c93b--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAGwOe2Z8b%2B11dSVgRmXFTSND_PmcvJJ9CYdd9qWffWEhsCmefw>