From nobody Fri Oct 29 19:33:59 2021 X-Original-To: dev-commits-ports-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id BEAE3181D731; Fri, 29 Oct 2021 19:33:59 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Hgt074rv5z3sd6; Fri, 29 Oct 2021 19:33:59 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 845A51CBAE; Fri, 29 Oct 2021 19:33:59 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 19TJXxEH056845; Fri, 29 Oct 2021 19:33:59 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 19TJXx8C056844; Fri, 29 Oct 2021 19:33:59 GMT (envelope-from git) Date: Fri, 29 Oct 2021 19:33:59 GMT Message-Id: <202110291933.19TJXx8C056844@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org From: Rene Ladan Subject: git: e3b412ec750d - main - security/vuxml: add www/chromium < 95.0.4638.69 List-Id: Commits to the main branch of the FreeBSD ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-ports-main@freebsd.org X-BeenThere: dev-commits-ports-main@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: rene X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: e3b412ec750d72264a29310c4bc7ea162d70ccba Auto-Submitted: auto-generated X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by rene: URL: https://cgit.FreeBSD.org/ports/commit/?id=e3b412ec750d72264a29310c4bc7ea162d70ccba commit e3b412ec750d72264a29310c4bc7ea162d70ccba Author: Rene Ladan AuthorDate: 2021-10-29 19:33:00 +0000 Commit: Rene Ladan CommitDate: 2021-10-29 19:33:45 +0000 security/vuxml: add www/chromium < 95.0.4638.69 Obtained from: https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop_28.html --- security/vuxml/vuln-2021.xml | 55 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 55 insertions(+) diff --git a/security/vuxml/vuln-2021.xml b/security/vuxml/vuln-2021.xml index ced576293f91..59cf97125ed7 100644 --- a/security/vuxml/vuln-2021.xml +++ b/security/vuxml/vuln-2021.xml @@ -1,3 +1,58 @@ + + chromium -- multiple vulnerabilities + + + chromium + 95.0.4638.69 + + + + +

Chrome Releases reports:

+
This release contains 8 security fixes, including:
+
+
[1259864] High CVE-2021-37997 : Use after free in Sign-In. + Reported by Wei Yuan of MoyunSec VLab on 2021-10-14
+
[1259587] High CVE-2021-37998 : Use after free in Garbage + Collection. Reported by Cassidy Kim of Amber Security Lab, OPPO + Mobile Telecommunications Corp. Ltd. on 2021-10-13
+
[1251541] High CVE-2021-37999 : Insufficient data validation in + New Tab Page. Reported by Ashish Arun Dhone on 2021-09-21
+
[1249962] High CVE-2021-38000 : Insufficient validation of + untrusted input in Intents. Reported by Clement Lecigne, Neel + Mehta, and Maddie Stone of Google Threat Analysis Group on + 2021-09-15
+
[1260577] High CVE-2021-38001 : Type Confusion in V8. Reported + by @s0rrymybad of Kunlun Lab via Tianfu Cup on 2021-10-16
+
[1260940] High CVE-2021-38002 : Use after free in Web Transport. + Reported by @__R0ng of 360 Alpha Lab, ? via Tianfu Cup on + 2021-10-16
+
[1263462] High CVE-2021-38003 : Inappropriate implementation in + V8. Reported by Clément Lecigne from Google TAG and Samuel Gross + from Google Project Zero on 2021-10-26
+
+
Google is aware that exploits for CVE-2021-38000 and + CVE-2021-38003 exist in the wild.
+

+ + + + CVE-2021-37997 + CVE-2021-37998 + CVE-2021-37999 + CVE-2021-38000 + CVE-2021-38001 + CVE-2021-38002 + CVE-2021-38003 + https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop_28.html + + + 2021-10-28 + 2021-10-29 + + + fail2ban -- possible RCE vulnerability in mailing action using mailutils