From owner-svn-ports-head@freebsd.org Mon Dec 5 20:21:13 2016 Return-Path: Delivered-To: svn-ports-head@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 52E1AC6875C; Mon, 5 Dec 2016 20:21:13 +0000 (UTC) (envelope-from rene@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 10AC21C80; Mon, 5 Dec 2016 20:21:12 +0000 (UTC) (envelope-from rene@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id uB5KLCtX069768; Mon, 5 Dec 2016 20:21:12 GMT (envelope-from rene@FreeBSD.org) Received: (from rene@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id uB5KLCb0069766; Mon, 5 Dec 2016 20:21:12 GMT (envelope-from rene@FreeBSD.org) Message-Id: <201612052021.uB5KLCb0069766@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: rene set sender to rene@FreeBSD.org using -f From: Rene Ladan Date: Mon, 5 Dec 2016 20:21:12 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r427919 - head/security/vuxml X-SVN-Group: ports-head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-head@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: SVN commit messages for the ports tree for head List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 05 Dec 2016 20:21:13 -0000 Author: rene Date: Mon Dec 5 20:21:11 2016 New Revision: 427919 URL: https://svnweb.freebsd.org/changeset/ports/427919 Log: Document new vulnerabilities in www/chromium < 55.0.2883.75 Obtained from: https://googlechromereleases.blogspot.nl/2016/12/stable-channel-update-for-desktop.html Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Mon Dec 5 20:04:34 2016 (r427918) +++ head/security/vuxml/vuln.xml Mon Dec 5 20:21:11 2016 (r427919) @@ -58,6 +58,116 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> + + chromium -- multiple vulnerabilities + + + chromium + chromium-npapi + chromium-pulse + 55.0.2883.75 + + + + +

Google Chrome Releases reports:

+
36 security fixes in this release, including:
+
+
[664411] High CVE-2016-9651: Private property access in V8. + Credit to Guang Gong of Alpha Team Of Qihoo 360
+
[658535] High CVE-2016-5208: Universal XSS in Blink. Credit to + Mariusz Mlynski
+
[655904] High CVE-2016-5207: Universal XSS in Blink. Credit to + Mariusz Mlynski
+
[653749] High CVE-2016-5206: Same-origin bypass in PDFium. + Credit to Rob Wu (robwu.nl)
+
[646610] High CVE-2016-5205: Universal XSS in Blink. Credit to + Anonymous
+
[630870] High CVE-2016-5204: Universal XSS in Blink. Credit to + Mariusz Mlynski
+
[664139] High CVE-2016-5209: Out of bounds write in Blink. + Credit to Giwan Go of STEALIEN
+
[644219] High CVE-2016-5203: Use after free in PDFium. Credit + to Anonymous
+
[654183] High CVE-2016-5210: Out of bounds write in PDFium. + Credit to Ke Liu of Tencent's Xuanwu LAB
+
[653134] High CVE-2016-5212: Local file disclosure in DevTools. + Credit to Khalil Zhani
+
[649229] High CVE-2016-5211: Use after free in PDFium. Credit + to Anonymous
+
[652548] High CVE-2016-5213: Use after free in V8. Credit to + Khalil Zhani
+
[601538] Medium CVE-2016-5214: File download protection bypass. + Credit to Jonathan Birch and MSVR
+
[653090] Medium CVE-2016-5216: Use after free in PDFium. Credit + to Anonymous
+
[619463] Medium CVE-2016-5215: Use after free in Webaudio. + Credit to Looben Yang
+
[654280] Medium CVE-2016-5217: Use of unvalidated data in + PDFium. Credit to Rob Wu (robwu.nl)
+
[660498] Medium CVE-2016-5218: Address spoofing in Omnibox. + Credit to Abdulrahman Alqabandi (@qab)
+
[657568] Medium CVE-2016-5219: Use after free in V8. Credit to + Rob Wu (robwu.nl)
+
[660854] Medium CVE-2016-5221: Integer overflow in ANGLE. + Credit to Tim Becker of ForAllSecure
+
[654279] Medium CVE-2016-5220: Local file access in PDFium. + Credit to Rob Wu (robwu.nl)
+
[657720] Medium CVE-2016-5222: Address spoofing in Omnibox. + Credit to xisigr of Tencent's Xuanwu Lab
+
[653034] Low CVE-2016-9650: CSP Referrer disclosure. Credit to + Jakub Żoczek
+
[652038] Low CVE-2016-5223: Integer overflow in PDFium. Credit + to Hwiwon Lee
+
[639750] Low CVE-2016-5226: Limited XSS in Blink. Credit to Jun + Kokatsu (@shhnjk)
+
[630332] Low CVE-2016-5225: CSP bypass in Blink. Credit to + Scott Helme (@Scott_Helme, scotthelme.co.uk)
+
[615851] Low CVE-2016-5224: Same-origin bypass in SVG. Credit + to Roeland Krak
+
[669928] CVE-2016-9652: Various fixes from internal audits, + fuzzing and other initiatives
+
+

+ + + + CVE-2016-9651 + CVE-2016-5208 + CVE-2016-5207 + CVE-2016-5206 + CVE-2016-5205 + CVE-2016-5204 + CVE-2016-5209 + CVE-2016-5203 + CVE-2016-5210 + CVE-2016-5212 + CVE-2016-5211 + CVE-2016-5213 + CVE-2016-5214 + CVE-2016-5216 + CVE-2016-5215 + CVE-2016-5217 + CVE-2016-5218 + CVE-2016-5219 + CVE-2016-5221 + CVE-2016-5220 + CVE-2016-5222 + CVE-2016-9650 + CVE-2016-5223 + CVE-2016-5226 + CVE-2016-5225 + CVE-2016-5224 + CVE-2016-9652 + https://googlechromereleases.blogspot.nl/2016/12/stable-channel-update-for-desktop.html + + + 2016-12-01 + 2016-12-05 + + + ImageMagick7 -- multiple vulnerabilities