Date: Sat, 5 Jan 2019 13:10:56 +0000 (UTC) From: "Carlos J. Puga Medina" <cpm@FreeBSD.org> To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r489329 - head/security/vuxml Message-ID: <201901051310.x05DAuDx058124@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: cpm Date: Sat Jan 5 13:10:55 2019 New Revision: 489329 URL: https://svnweb.freebsd.org/changeset/ports/489329 Log: Document new vulnerabilities in www/chromium < 71.0.3578.80 Obtained from: https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Sat Jan 5 12:05:12 2019 (r489328) +++ head/security/vuxml/vuln.xml Sat Jan 5 13:10:55 2019 (r489329) @@ -58,6 +58,96 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">; + <vuln vid="546d4dd4-10ea-11e9-b407-080027ef1a23"> + <topic>chromium -- multiple vulnerabilities</topic> + <affects> + <package> + <name>chromium</name> + <range><lt>71.0.3578.80</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>Google Chrome Releases reports:</p> + <blockquote cite="https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html">; + <p>43 security fixes in this release, including:</p> + <ul> + <li>High CVE-2018-17480: Out of bounds write in V8</li> + <li>High CVE-2018-17481: Use after free in PDFium</li> + <li>High CVE-2018-18335: Heap buffer overflow in Skia</li> + <li>High CVE-2018-18336: Use after free in PDFium</li> + <li>High CVE-2018-18337: Use after free in Blink</li> + <li>High CVE-2018-18338: Heap buffer overflow in Canvas</li> + <li>High CVE-2018-18339: Use after free in WebAudio</li> + <li>High CVE-2018-18340: Use after free in MediaRecorder</li> + <li>High CVE-2018-18341: Heap buffer overflow in Blink</li> + <li>High CVE-2018-18342: Out of bounds write in V8</li> + <li>High CVE-2018-18343: Use after free in Skia</li> + <li>High CVE-2018-18344: Inappropriate implementation in Extensions</li> + <li>High To be allocated: Multiple issues in SQLite via WebSQL</li> + <li>Medium CVE-2018-18345: Inappropriate implementation in Site Isolation</li> + <li>Medium CVE-2018-18346: Incorrect security UI in Blink</li> + <li>Medium CVE-2018-18347: Inappropriate implementation in Navigation</li> + <li>Medium CVE-2018-18348: Inappropriate implementation in Omnibox</li> + <li>Medium CVE-2018-18349: Insufficient policy enforcement in Blink</li> + <li>Medium CVE-2018-18350: Insufficient policy enforcement in Blink</li> + <li>Medium CVE-2018-18351: Insufficient policy enforcement in Navigation</li> + <li>Medium CVE-2018-18352: Inappropriate implementation in Media</li> + <li>Medium CVE-2018-18353: Inappropriate implementation in Network Authentication</li> + <li>Medium CVE-2018-18354: Insufficient data validation in Shell Integration</li> + <li>Medium CVE-2018-18355: Insufficient policy enforcement in URL Formatter</li> + <li>Medium CVE-2018-18356: Use after free in Skia</li> + <li>Medium CVE-2018-18357: Insufficient policy enforcement in URL Formatter</li> + <li>Medium CVE-2018-18358: Insufficient policy enforcement in Proxy</li> + <li>Medium CVE-2018-18359: Out of bounds read in V8</li> + <li>Low To be allocated: Inappropriate implementation in PDFium</li> + <li>Low To be allocated: Use after free in Extensions</li> + <li>Low To be allocated: Inappropriate implementation in Navigation</li> + <li>Low To be allocated: Inappropriate implementation in Navigation</li> + <li>Low To be allocated: Insufficient policy enforcement in Navigation</li> + <li>Low To be allocated: Insufficient policy enforcement in URL Formatter</li> + <li>Medium To be allocated: Insufficient policy enforcement in Payments</li> + <li>Various fixes from internal audits, fuzzing and other initiatives</li> + </ul> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2018-17480</cvename> + <cvename>CVE-2018-17481</cvename> + <cvename>CVE-2018-18335</cvename> + <cvename>CVE-2018-18336</cvename> + <cvename>CVE-2018-18337</cvename> + <cvename>CVE-2018-18338</cvename> + <cvename>CVE-2018-18339</cvename> + <cvename>CVE-2018-18340</cvename> + <cvename>CVE-2018-18341</cvename> + <cvename>CVE-2018-18342</cvename> + <cvename>CVE-2018-18343</cvename> + <cvename>CVE-2018-18344</cvename> + <cvename>CVE-2018-18345</cvename> + <cvename>CVE-2018-18346</cvename> + <cvename>CVE-2018-18347</cvename> + <cvename>CVE-2018-18348</cvename> + <cvename>CVE-2018-18349</cvename> + <cvename>CVE-2018-18350</cvename> + <cvename>CVE-2018-18351</cvename> + <cvename>CVE-2018-18352</cvename> + <cvename>CVE-2018-18353</cvename> + <cvename>CVE-2018-18354</cvename> + <cvename>CVE-2018-18355</cvename> + <cvename>CVE-2018-18356</cvename> + <cvename>CVE-2018-18357</cvename> + <cvename>CVE-2018-18358</cvename> + <cvename>CVE-2018-18359</cvename> + <url>https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html</url>; + </references> + <dates> + <discovery>2018-12-04</discovery> + <entry>2019-01-05</entry> + </dates> + </vuln> + <vuln vid="3e41c1a6-10bc-11e9-bd85-fcaa147e860e"> <topic>Django -- Content spoofing possibility in the default 404 page</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201901051310.x05DAuDx058124>