From nobody Wed May 15 17:56:07 2024 X-Original-To: dev-commits-ports-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4VfgrR2t7Nz49ymQ; Wed, 15 May 2024 17:56:07 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4VfgrR1pHlz4lF3; Wed, 15 May 2024 17:56:07 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1715795767; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Buuq/HBDu/tJ6GGPoVOvyY/z1qWBWSAhkAfj3s7PMf8=; b=csJsV+529ONjLDM8LQDBVY1ZpDNqv/4NbvaKvf1xL6ZEPWlk1F8a408iG3yhcgSJX5O6YN YbpKi2iqGTcIFs420y/jEZDW5YDXIZCMldeITLGqlwx+HcgaLVuGtugQHCOC4KuaU5fHxh PtYW50Yb2Rz+nlNjwxvcZymYri/3sxDIomDErilBIoA/gH7vi7SRGd6hx8y/GkEp3b7EEp PQWc4g5wN1FhrCkfedATnT479ggta9oI4TkowKNcib82/hJm5zrIc3mF1xq5ZhwLLtadDb suHne5UPG+xTJtmcIvt4NtFHWpeP0/Rj93um3LSwGvH/GZcJSXVGXY28Keb02g== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1715795767; a=rsa-sha256; cv=none; b=p1/iBwzj3UoPDsrFPhtoyrcaOWXuSY3vOH1g9wnDc9Ca4l7J6OHsDZYcY3OGOFUeeTrItP X4Dw5P9nV3TH3unco23NwDL6g5+7xz8vxelhyARWRn0E0C5cByVVbXrh3dWlUW0kDsHI07 WfEutivSu7hqrpRlzxSZ/xcGv1AVDeGHR66+WKN9miKhxBO8+cACktJeQeVlmaU7x4Jj6U GmfJbdJMXeKqt+e+FDAzwLGSjzwyvHbCVag6tepuLcBbrZo6RQP/DwSJAcwy+4DObLeOVy VzA9z1wCbwhboxe85JvY0eLWELhQyMqPCMrr+klIPG0kknSlaE6tFOmdghPhug== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1715795767; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Buuq/HBDu/tJ6GGPoVOvyY/z1qWBWSAhkAfj3s7PMf8=; b=CQSwAZLp9vdq3TMjWt/naZCb5dknMPNMDAy/NId4SeMjy8ZXWpn3JcShtZ6QJl7uyb+NWv onHtgmZcecd70qVTzQLrpKtqtZ306ziZex29K5V+PpgjH6U4hBoRZrQgnv3a2r5KK2TaMp XrbM9ogd3pZ97rO40fQV2W67StKtB6jm62IUpN4OmuA3U74JQL1uBU0bq7CWYFdwCMYqUx 7XVKG+OLhIztoTnLRHDFdjk/V01+yuH3PF8I0o+SOmJNiAGUwzIAZvjEowXnPQVRRysZzd IPiG2IPtuUePjD8yHP0926I3AsOFLJ6dlqECAryFVKYQ1Kmu6aYDSAGiO3dsSw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4VfgrR1PmpzQGr; Wed, 15 May 2024 17:56:07 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.17.1/8.17.1) with ESMTP id 44FHu7S9057401; Wed, 15 May 2024 17:56:07 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.17.1/8.17.1/Submit) id 44FHu7RU057398; Wed, 15 May 2024 17:56:07 GMT (envelope-from git) Date: Wed, 15 May 2024 17:56:07 GMT Message-Id: <202405151756.44FHu7RU057398@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org From: "Jason E. Hale" Subject: git: e40c4fb1d038 - main - security/vuxml: Document www/qt6-webengine vulnerabilities List-Id: Commit messages for all branches of the ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-ports-all@freebsd.org Sender: owner-dev-commits-ports-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: jhale X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: e40c4fb1d038856c1bad8a2efec52e4947c33f1c Auto-Submitted: auto-generated The branch main has been updated by jhale: URL: https://cgit.FreeBSD.org/ports/commit/?id=e40c4fb1d038856c1bad8a2efec52e4947c33f1c commit e40c4fb1d038856c1bad8a2efec52e4947c33f1c Author: Jason E. Hale AuthorDate: 2024-05-15 17:45:26 +0000 Commit: Jason E. Hale CommitDate: 2024-05-15 17:55:48 +0000 security/vuxml: Document www/qt6-webengine vulnerabilities --- security/vuxml/vuln/2024.xml | 59 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 59 insertions(+) diff --git a/security/vuxml/vuln/2024.xml b/security/vuxml/vuln/2024.xml index 7963d21f7237..471272bdd971 100644 --- a/security/vuxml/vuln/2024.xml +++ b/security/vuxml/vuln/2024.xml @@ -1,3 +1,62 @@ + + qt6-webengine -- Multiple vulnerabilities + + + qt6-webengine + 6.7.0 + + + + +

Qt qtwebengine-chromium repo reports:

+
+

Backports for 16 security bugs in Chromium:

+
    +
  • CVE-2024-2625: Object lifecycle issue in V8
    • +
  • CVE-2024-2626: Out of bounds read in Swiftshader
    • +
  • CVE-2024-2885: Use after free in Dawn
    • +
  • CVE-2024-2887: Type Confusion in WebAssembly
    • +
  • CVE-2024-3157: Out of bounds write in Compositing
    • +
  • CVE-2024-3159: Out of bounds memory access in V8
    • +
  • CVE-2024-3516: Heap buffer overflow in ANGLE
    • +
  • CVE-2024-3837: Use after free in QUIC
    • +
  • CVE-2024-3839: Out of bounds read in Fonts
    • +
  • CVE-2024-3914: Use after free in V8
    • +
  • CVE-2024-3840: Insufficient policy enforcement in Site Isolation
    • +
  • CVE-2024-4058: Type Confusion in ANGLE
    • +
  • CVE-2024-4060: Use after free in Dawn
    • +
  • CVE-2024-4331: Use after free in Picture In Picture
    • +
  • CVE-2024-4368: Use after free in Dawn
    • +
  • CVE-2024-4671: Use after free in Visuals
    • +
+
+ + + + CVE-2024-2625 + CVE-2024-2626 + CVE-2024-2885 + CVE-2024-2887 + CVE-2024-3157 + CVE-2024-3159 + CVE-2024-3516 + CVE-2024-3837 + CVE-2024-3839 + CVE-2024-3914 + CVE-2024-3840 + CVE-2024-4058 + CVE-2024-4060 + CVE-2024-4331 + CVE-2024-4368 + CVE-2024-4671 + https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=118-based + + + 2024-04-03 + 2024-05-15 + + + qt6-base (core module) -- Invalid pointer in QStringConverter