Skip site navigation (1)Skip section navigation (2)
Date:      Sat, 5 Jan 2019 13:10:56 +0000 (UTC)
From:      "Carlos J. Puga Medina" <cpm@FreeBSD.org>
To:        ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org
Subject:   svn commit: r489329 - head/security/vuxml
Message-ID:  <201901051310.x05DAuDx058124@repo.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: cpm
Date: Sat Jan  5 13:10:55 2019
New Revision: 489329
URL: https://svnweb.freebsd.org/changeset/ports/489329

Log:
  Document new vulnerabilities in www/chromium < 71.0.3578.80
  
  Obtained from:	https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html

Modified:
  head/security/vuxml/vuln.xml

Modified: head/security/vuxml/vuln.xml
==============================================================================
--- head/security/vuxml/vuln.xml	Sat Jan  5 12:05:12 2019	(r489328)
+++ head/security/vuxml/vuln.xml	Sat Jan  5 13:10:55 2019	(r489329)
@@ -58,6 +58,96 @@ Notes:
   * Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
 -->
 <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">;
+  <vuln vid="546d4dd4-10ea-11e9-b407-080027ef1a23">
+    <topic>chromium -- multiple vulnerabilities</topic>
+    <affects>
+      <package>
+	<name>chromium</name>
+	<range><lt>71.0.3578.80</lt></range>
+      </package>
+    </affects>
+    <description>
+      <body xmlns="http://www.w3.org/1999/xhtml">;
+	<p>Google Chrome Releases reports:</p>
+	<blockquote cite="https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html">;
+	  <p>43 security fixes in this release, including:</p>
+	  <ul>
+	    <li>High CVE-2018-17480: Out of bounds write in V8</li>
+	    <li>High CVE-2018-17481: Use after free in PDFium</li>
+	    <li>High CVE-2018-18335: Heap buffer overflow in Skia</li>
+	    <li>High CVE-2018-18336: Use after free in PDFium</li>
+	    <li>High CVE-2018-18337: Use after free in Blink</li>
+	    <li>High CVE-2018-18338: Heap buffer overflow in Canvas</li>
+	    <li>High CVE-2018-18339: Use after free in WebAudio</li>
+	    <li>High CVE-2018-18340: Use after free in MediaRecorder</li>
+	    <li>High CVE-2018-18341: Heap buffer overflow in Blink</li>
+	    <li>High CVE-2018-18342: Out of bounds write in V8</li>
+	    <li>High CVE-2018-18343: Use after free in Skia</li>
+	    <li>High CVE-2018-18344: Inappropriate implementation in Extensions</li>
+	    <li>High To be allocated: Multiple issues in SQLite via WebSQL</li>
+	    <li>Medium CVE-2018-18345: Inappropriate implementation in Site Isolation</li>
+	    <li>Medium CVE-2018-18346: Incorrect security UI in Blink</li>
+	    <li>Medium CVE-2018-18347: Inappropriate implementation in Navigation</li>
+	    <li>Medium CVE-2018-18348: Inappropriate implementation in Omnibox</li>
+	    <li>Medium CVE-2018-18349: Insufficient policy enforcement in Blink</li>
+	    <li>Medium CVE-2018-18350: Insufficient policy enforcement in Blink</li>
+	    <li>Medium CVE-2018-18351: Insufficient policy enforcement in Navigation</li>
+	    <li>Medium CVE-2018-18352: Inappropriate implementation in Media</li>
+	    <li>Medium CVE-2018-18353: Inappropriate implementation in Network Authentication</li>
+	    <li>Medium CVE-2018-18354: Insufficient data validation in Shell Integration</li>
+	    <li>Medium CVE-2018-18355: Insufficient policy enforcement in URL Formatter</li>
+	    <li>Medium CVE-2018-18356: Use after free in Skia</li>
+	    <li>Medium CVE-2018-18357: Insufficient policy enforcement in URL Formatter</li>
+	    <li>Medium CVE-2018-18358: Insufficient policy enforcement in Proxy</li>
+	    <li>Medium CVE-2018-18359: Out of bounds read in V8</li>
+	    <li>Low To be allocated: Inappropriate implementation in PDFium</li>
+	    <li>Low To be allocated: Use after free in Extensions</li>
+	    <li>Low To be allocated: Inappropriate implementation in Navigation</li>
+	    <li>Low To be allocated: Inappropriate implementation in Navigation</li>
+	    <li>Low To be allocated: Insufficient policy enforcement in Navigation</li>
+	    <li>Low To be allocated: Insufficient policy enforcement in URL Formatter</li>
+	    <li>Medium To be allocated: Insufficient policy enforcement in Payments</li>
+	    <li>Various fixes from internal audits, fuzzing and other initiatives</li>
+	  </ul>
+	</blockquote>
+      </body>
+    </description>
+    <references>
+      <cvename>CVE-2018-17480</cvename>
+      <cvename>CVE-2018-17481</cvename>
+      <cvename>CVE-2018-18335</cvename>
+      <cvename>CVE-2018-18336</cvename>
+      <cvename>CVE-2018-18337</cvename>
+      <cvename>CVE-2018-18338</cvename>
+      <cvename>CVE-2018-18339</cvename>
+      <cvename>CVE-2018-18340</cvename>
+      <cvename>CVE-2018-18341</cvename>
+      <cvename>CVE-2018-18342</cvename>
+      <cvename>CVE-2018-18343</cvename>
+      <cvename>CVE-2018-18344</cvename>
+      <cvename>CVE-2018-18345</cvename>
+      <cvename>CVE-2018-18346</cvename>
+      <cvename>CVE-2018-18347</cvename>
+      <cvename>CVE-2018-18348</cvename>
+      <cvename>CVE-2018-18349</cvename>
+      <cvename>CVE-2018-18350</cvename>
+      <cvename>CVE-2018-18351</cvename>
+      <cvename>CVE-2018-18352</cvename>
+      <cvename>CVE-2018-18353</cvename>
+      <cvename>CVE-2018-18354</cvename>
+      <cvename>CVE-2018-18355</cvename>
+      <cvename>CVE-2018-18356</cvename>
+      <cvename>CVE-2018-18357</cvename>
+      <cvename>CVE-2018-18358</cvename>
+      <cvename>CVE-2018-18359</cvename>
+      <url>https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html</url>;
+    </references>
+    <dates>
+      <discovery>2018-12-04</discovery>
+      <entry>2019-01-05</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="3e41c1a6-10bc-11e9-bd85-fcaa147e860e">
     <topic>Django -- Content spoofing possibility in the default 404 page</topic>
     <affects>



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201901051310.x05DAuDx058124>