From owner-svn-ports-head@freebsd.org Fri Jan 22 20:37:54 2021 Return-Path: Delivered-To: svn-ports-head@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 1C00E4FE065; Fri, 22 Jan 2021 20:37:54 +0000 (UTC) (envelope-from rene@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4DMrg60H69z3vkX; Fri, 22 Jan 2021 20:37:54 +0000 (UTC) (envelope-from rene@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id F0A36246E6; Fri, 22 Jan 2021 20:37:53 +0000 (UTC) (envelope-from rene@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id 10MKbrQ2018660; Fri, 22 Jan 2021 20:37:53 GMT (envelope-from rene@FreeBSD.org) Received: (from rene@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id 10MKbrj0018659; Fri, 22 Jan 2021 20:37:53 GMT (envelope-from rene@FreeBSD.org) Message-Id: <202101222037.10MKbrj0018659@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: rene set sender to rene@FreeBSD.org using -f From: Rene Ladan Date: Fri, 22 Jan 2021 20:37:53 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r562336 - head/security/vuxml X-SVN-Group: ports-head X-SVN-Commit-Author: rene X-SVN-Commit-Paths: head/security/vuxml X-SVN-Commit-Revision: 562336 X-SVN-Commit-Repository: ports MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-head@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: SVN commit messages for the ports tree for head List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Jan 2021 20:37:54 -0000 Author: rene Date: Fri Jan 22 20:37:53 2021 New Revision: 562336 URL: https://svnweb.freebsd.org/changeset/ports/562336 Log: Document new vulnerabilities in www/chromium < 88.0.4324.96 Obtained from: https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop_19.html Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Fri Jan 22 20:13:47 2021 (r562335) +++ head/security/vuxml/vuln.xml Fri Jan 22 20:37:53 2021 (r562336) @@ -77,6 +77,123 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> + + chromium -- multiple vulnerabilities + + + chromium + 88.0.4324.96 + + + + +

Chrome Releases reports:

+
This release contains 36 security fixes, including:
+
+
[1137179] Critical CVE-2021-21117: Insufficient policy + enforcement in Cryptohome. Reported by Rory McNamara on + 2020-10-10
+
[1161357] High CVE-2021-21118: Insufficient data validation in + V8. Reported by Tyler Nighswander (@tylerni7) of Theori on + 2020-12-23
+
[1160534] High CVE-2021-21119: Use after free in Media. Reported + by Anonymous on 2020-12-20
+
[1160602] High CVE-2021-21120: Use after free in WebSQL. + Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Alpha + Lab on 2020-12-21
+
[1161143] High CVE-2021-21121: Use after free in Omnibox. + Reported by Leecraso and Guang Gong of 360 Alpha Lab on + 2020-12-22
+
[1162131] High CVE-2021-21122: Use after free in Blink. Reported + by Renata Hodovan on 2020-12-28
+
[1137247] High CVE-2021-21123: Insufficient data validation in + File System API. Reported by Maciej Pulikowski on 2020-10-11
+
[1131346] High CVE-2021-21124: Potential user after free in + Speech Recognizer. Reported by Chaoyang Ding(@V4kst1z) from + Codesafe Team of Legendsec at Qi'anxin Group on 2020-09-23
+
[1152327] High CVE-2021-21125: Insufficient policy enforcement + in File System API. Reported by Ron Masas (Imperva) on + 2020-11-24
+
[1163228] High CVE-2020-16044: Use after free in WebRTC. + Reported by Ned Williamson of Project Zero on 2021-01-05
+
[1108126] Medium CVE-2021-21126: Insufficient policy enforcement + in extensions. Reported by David Erceg on 2020-07-22
+
[1115590] Medium CVE-2021-21127: Insufficient policy enforcement + in extensions. Reported by Jasminder Pal Singh, Web Services Point + WSP, Kotkapura on 2020-08-12
+
[1138877] Medium CVE-2021-21128: Heap buffer overflow in Blink. + Reported by Liang Dong on 2020-10-15
+
[1140403] Medium CVE-2021-21129: Insufficient policy enforcement + in File System API. Reported by Maciej Pulikowski on + 2020-10-20
+
[1140410] Medium CVE-2021-21130: Insufficient policy enforcement + in File System API. Reported by Maciej Pulikowski on + 2020-10-20
+
[1140417] Medium CVE-2021-21131: Insufficient policy enforcement + in File System API. Reported by Maciej Pulikowski on + 2020-10-20
+
[1128206] Medium CVE-2021-21132: Inappropriate implementation in + DevTools. Reported by David Erceg on 2020-09-15
+
[1157743] Medium CVE-2021-21133: Insufficient policy enforcement + in Downloads. Reported by wester0x01 + (https://twitter.com/wester0x01) on 2020-12-11
+
[1157800] Medium CVE-2021-21134: Incorrect security UI in Page + Info. Reported by wester0x01 (https://twitter.com/wester0x01) on + 2020-12-11
+
[1157818] Medium CVE-2021-21135: Inappropriate implementation in + Performance API. Reported by ndevtk on 2020-12-11
+
[1038002] Low CVE-2021-21136: Insufficient policy enforcement in + WebView. Reported by Shiv Sahni, Movnavinothan V and Imdad + Mohammed on 2019-12-27
+
[1093791] Low CVE-2021-21137: Inappropriate implementation in + DevTools. Reported by bobblybear on 2020-06-11
+
[1122487] Low CVE-2021-21138: Use after free in DevTools. + Reported by Weipeng Jiang (@Krace) from Codesafe Team of Legendsec + at Qi'anxin Group on 2020-08-27
+
[1136327] Low CVE-2021-21140: Uninitialized Use in USB. Reported + by David Manouchehri on 2020-10-08
+
[1140435] Low CVE-2021-21141: Insufficient policy enforcement in + File System API. Reported by Maciej Pulikowski on 2020-10-20
+
+

+ + + + CVE-2020-16044 + CVE-2021-21117 + CVE-2021-21118 + CVE-2021-21119 + CVE-2021-21120 + CVE-2021-21121 + CVE-2021-21122 + CVE-2021-21123 + CVE-2021-21124 + CVE-2021-21125 + CVE-2021-21126 + CVE-2021-21127 + CVE-2021-21128 + CVE-2021-21129 + CVE-2021-21130 + CVE-2021-21131 + CVE-2021-21132 + CVE-2021-21133 + CVE-2021-21134 + CVE-2021-21135 + CVE-2021-21136 + CVE-2021-21137 + CVE-2021-21138 + CVE-2021-21139 + CVE-2021-21140 + CVE-2021-21141 + https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop_19.html + + + 2021-01-19 + 2021-01-22 + + + chocolate-doom -- Arbitrary code execution