Date: Fri, 1 Nov 2024 00:44:14 GMT From: "Jason E. Hale" <jhale@FreeBSD.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org Subject: git: 6892e780d7d0 - main - security/vuxml: Add www/qt5-webengine < 5.15.18p2 Message-ID: <202411010044.4A10iEiK052656@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by jhale: URL: https://cgit.FreeBSD.org/ports/commit/?id=6892e780d7d0e0840ce737cbe41589f2468bc2a2 commit 6892e780d7d0e0840ce737cbe41589f2468bc2a2 Author: Jason E. Hale <jhale@FreeBSD.org> AuthorDate: 2024-11-01 00:41:09 +0000 Commit: Jason E. Hale <jhale@FreeBSD.org> CommitDate: 2024-11-01 00:41:09 +0000 security/vuxml: Add www/qt5-webengine < 5.15.18p2 Fix indentation issues caught by `make validate` for previous entry. --- security/vuxml/vuln/2024.xml | 78 +++++++++++++++++++++++++++++++++++++------- 1 file changed, 67 insertions(+), 11 deletions(-) diff --git a/security/vuxml/vuln/2024.xml b/security/vuxml/vuln/2024.xml index b3bbd1b07135..a74986da6255 100644 --- a/security/vuxml/vuln/2024.xml +++ b/security/vuxml/vuln/2024.xml @@ -1,22 +1,78 @@ + <vuln vid="3092668e-97e4-11ef-bdd9-4ccc6adda413"> + <topic>qt5-webengine -- Multiple vulnerabilities</topic> + <affects> + <package> + <name>qt5-webengine</name> + <range><lt>5.15.18p2</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <blockquote cite="https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=87-based">; + <p>Backports for 15 security bugs in Chromium:</p> + <ul> + <li>CVE-2024-4761: Out of bounds write in V8</li> + <li>CVE-2024-5158: Type confusion in V8</li> + <li>CVE-2024-7532: Out of bounds memory access in ANGLE</li> + <li>CVE-2024-7965: Inappropriate implementation in V8</li> + <li>CVE-2024-7967: Heap buffer overflow in Fonts</li> + <li>CVE-2024-7971: Type confusion in V8</li> + <li>CVE-2024-8198: Heap buffer overflow in Skia</li> + <li>CVE-2024-8636: Heap buffer overflow in Skia</li> + <li>CVE-2024-9123: Integer overflow in Skia</li> + <li>CVE-2024-9602: Type confusion in V8</li> + <li>CVE-2024-9603: Type confusion in V8</li> + <li>CVE-2024-10229: Inappropriate implementation in Extensions</li> + <li>CVE-2024-45490: Negative length in libexpat</li> + <li>CVE-2024-45491: Integer overflow in libexpat</li> + <li>CVE-2024-45492: Integer overflow in libexpat</li> + </ul> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2024-4761</cvename> + <cvename>CVE-2024-5158</cvename> + <cvename>CVE-2024-7532</cvename> + <cvename>CVE-2024-7965</cvename> + <cvename>CVE-2024-7967</cvename> + <cvename>CVE-2024-7971</cvename> + <cvename>CVE-2024-8198</cvename> + <cvename>CVE-2024-8636</cvename> + <cvename>CVE-2024-9123</cvename> + <cvename>CVE-2024-9602</cvename> + <cvename>CVE-2024-9603</cvename> + <cvename>CVE-2024-10229</cvename> + <cvename>CVE-2024-45490</cvename> + <cvename>CVE-2024-45491</cvename> + <cvename>CVE-2024-45492</cvename> + <url>https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=87-based</url>; + </references> + <dates> + <discovery>2024-09-18</discovery> + <entry>2024-10-31</entry> + </dates> + </vuln> + <vuln vid="fd538d14-5778-4764-b321-2ddd61a8a58f"> <topic>keycloak -- Missing server identity checks when sending mails via SMTPS</topic> <affects> <package> - <name>keycloak</name> - <range><lt>26.0.4</lt></range> + <name>keycloak</name> + <range><lt>26.0.4</lt></range> </package> </affects> <description> <body xmlns="http://www.w3.org/1999/xhtml">; - <p>Red Hat reports:</p> - <blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=2315808">; - <p>A vulnerability was found in Apache Sling Commons Messaging - Mail(angus-mail), which provides a simple interface for sending - emails via SMTPS in OSGi, does not offer an option to enable - server identity checks, leaving connections vulnerable to - "man-in-the-middle" attacks and can allow insecure email - communication.</p> - </blockquote> + <p>Red Hat reports:</p> + <blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=2315808">; + <p>A vulnerability was found in Apache Sling Commons Messaging + Mail(angus-mail), which provides a simple interface for sending + emails via SMTPS in OSGi, does not offer an option to enable + server identity checks, leaving connections vulnerable to + "man-in-the-middle" attacks and can allow insecure email + communication.</p> + </blockquote> </body> </description> <references>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202411010044.4A10iEiK052656>