From nobody Wed Mar 02 09:30:46 2022 X-Original-To: dev-commits-ports-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id E8FB91A06159; Wed, 2 Mar 2022 09:30:46 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4K7pkt6D0cz4YcT; Wed, 2 Mar 2022 09:30:46 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1646213446; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=s5tNKZ2796Ig63hGMsYW/gxvxlK58guswxBLfDz+bds=; b=fwddf3dUlHVVI4msdN+z4hxBWJ3f+ilB8XPb2cXcdTfDn7Ptl02/7LwYojaTYpp7G24zkm ANEs3BH11F0BNTOjlVkNFXh/khTGUdqh7yjf3ocARhaoANQHLSDzfhzteJHCu0//oYDNLo q+YeWUckCWy3ENbDnjDirb5c6C2Yp5uowr4xDjA3HyLnTokLyvYJ8jrcV3F4dYPwnMdxqF 5OKs6Z+LIbyOi0HITuZu2qHHnHV3phMwOiiT35WnkfPf4qWuDU2u6e5StSNw51kORCMhI8 IiTiqB4XrqphoDb23BjSm5C7/c7CslqGm+Si8kUGHCFCDmntbafV30gJiHZLxg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id B587621206; Wed, 2 Mar 2022 09:30:46 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 2229UkKi065366; Wed, 2 Mar 2022 09:30:46 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 2229Ukuf065365; Wed, 2 Mar 2022 09:30:46 GMT (envelope-from git) Date: Wed, 2 Mar 2022 09:30:46 GMT Message-Id: <202203020930.2229Ukuf065365@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org From: Rene Ladan Subject: git: e18a8c4a1f1a - main - security/vuxml: add www/chromium < 99.0.4844.51 List-Id: Commits to the main branch of the FreeBSD ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-ports-main@freebsd.org X-BeenThere: dev-commits-ports-main@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: rene X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: e18a8c4a1f1a85473f7d25dadf958405f131c81b Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1646213446; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=s5tNKZ2796Ig63hGMsYW/gxvxlK58guswxBLfDz+bds=; b=bcnSvZgyByLukbKvPYFz9KZfCc+ENWfXasdzScPiqdgc7LLVEgFY3LtcLKtcQM3O3utLc5 QrT/KK6wX5Z2E1UrLTgFuSXysIWw0cxA0jeJOudCqcVncBR3rSyhOH525OBCwwEc05mYUP wVIbcWjIUORdyh3+7kZ1zknvKxiu5u2/r20er6LIA9jqOveT8tsBjV5j64HUrh5NeBD2SO T6ph3n9NO8bWAhTgL0NOXZXRhad2PnwmHSTlqDC+CisghYakM4CKqjYNWnT9m0zbuvpZ3b V3TydwyaY95j4lCsjc38/ns+J5SJtOhx+35VxvQsK7+/ecqQERWm+5A77rHd/w== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1646213446; a=rsa-sha256; cv=none; b=Ypb/WNNP8bFcWNlZJMjJDAvySA95+J0l2wmfKZ9RRbR8HHWZoYIzoniM9iMQPGWyiLaH5g cAO6K+FP9GGzs7S5mLugwSTItmBTzVlzKxugI9plkPKRCkcTHjkYlPa68lGhhc0Il/J7ty R+ipwSSKHyORD4Cg75Q6UZXFGGcYwBk8RBLbFI1FjIG1xsUiffRfhQbWo+6LWoWCp+dGli ePkZ2+gULg/zOSv1zl49rxsrjVW7iOJTAC7oz+0fCnpKRuuPwqbxplR+GewcDU6aZqshMX HdHs2zlVas2XSJkKxQXit42y4k00QImAv6BjfTrlPoyCEIrkjZOqESbpmiMFQQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by rene: URL: https://cgit.FreeBSD.org/ports/commit/?id=e18a8c4a1f1a85473f7d25dadf958405f131c81b commit e18a8c4a1f1a85473f7d25dadf958405f131c81b Author: Rene Ladan AuthorDate: 2022-03-02 09:29:47 +0000 Commit: Rene Ladan CommitDate: 2022-03-02 09:30:34 +0000 security/vuxml: add www/chromium < 99.0.4844.51 Obtained from: https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop.html --- security/vuxml/vuln-2022.xml | 96 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 96 insertions(+) diff --git a/security/vuxml/vuln-2022.xml b/security/vuxml/vuln-2022.xml index 1a0f1db7ff31..961be186f329 100644 --- a/security/vuxml/vuln-2022.xml +++ b/security/vuxml/vuln-2022.xml @@ -1,3 +1,99 @@ + + chromium -- multiple vulnerabilities + + + chromium + 99.0.4844.51 + + + + +

Chrome Releases reports:

+
+

This release contains 28 security fixes, including:

+
    +
  • [1289383] High CVE-2022-0789: Heap buffer overflow in ANGLE. + Reported by SeongHwan Park (SeHwa) on 2022-01-21
    • +
  • [1274077] High CVE-2022-0790: Use after free in Cast UI. + Reported by Anonymous on 2021-11-26
    • +
  • [1278322] High CVE-2022-0791: Use after free in Omnibox. + Reported by Zhihua Yao of KunLun Lab on 2021-12-09
    • +
  • [1285885] High CVE-2022-0792: Out of bounds read in ANGLE. + Reported by Jaehun Jeong (@n3sk) of Theori on 2022-01-11
    • +
  • [1291728] High CVE-2022-0793: Use after free in Views. Reported + by Thomas Orlita on 2022-01-28
    • +
  • [1294097] High CVE-2022-0794: Use after free in WebShare. + Reported by Khalil Zhani on 2022-02-04
    • +
  • [1282782] High CVE-2022-0795: Type Confusion in Blink Layout. + Reported by 0x74960 on 2021-12-27
    • +
  • [1295786] High CVE-2022-0796: Use after free in Media. Reported + by Cassidy Kim of Amber Security Lab, OPPO Mobile + Telecommunications Corp. Ltd. on 2022-02-10
    • +
  • [1281908] High CVE-2022-0797: Out of bounds memory access in + Mojo. Reported by Sergei Glazunov of Google Project Zero on + 2021-12-21
    • +
  • [1283402] Medium CVE-2022-0798: Use after free in MediaStream. + Reported by Samet Bekmezci @sametbekmezci on 2021-12-30
    • +
  • [1279188] Medium CVE-2022-0799: Insufficient policy enforcement + in Installer. Reported by Abdelhamid Naceri (halov) on + 2021-12-12
    • +
  • [1242962] Medium CVE-2022-0800: Heap buffer overflow in Cast UI. + Reported by Khalil Zhani on 2021-08-24
    • +
  • [1231037] Medium CVE-2022-0801: Inappropriate implementation in + HTML parser. Reported by Michal Bentkowski of Securitum on + 2021-07-20
    • +
  • [1270052] Medium CVE-2022-0802: Inappropriate implementation in + Full screen mode. Reported by Irvan Kurniawan (sourc7) on + 2021-11-14
    • +
  • [1280233] Medium CVE-2022-0803: Inappropriate implementation in + Permissions. Reported by Abdulla Aldoseri on 2021-12-15
    • +
  • [1264561] Medium CVE-2022-0804: Inappropriate implementation in + Full screen mode. Reported by Irvan Kurniawan (sourc7) on + 2021-10-29
    • +
  • [1290700] Medium CVE-2022-0805: Use after free in Browser + Switcher. Reported by raven at KunLun Lab on 2022-01-25
    • +
  • [1283434] Medium CVE-2022-0806: Data leak in Canvas. Reported by + Paril on 2021-12-31
    • +
  • [1287364] Medium CVE-2022-0807: Inappropriate implementation in + Autofill. Reported by Alesandro Ortiz on 2022-01-14
    • +
  • [1292271] Medium CVE-2022-0808: Use after free in Chrome OS + Shell. Reported by @ginggilBesel on 2022-01-29
    • +
  • [1293428] Medium CVE-2022-0809: Out of bounds memory access in + WebXR. Reported by @uwu7586 on 2022-02-03
    • +
+
+ + + + CVE-2022-0789 + CVE-2022-0790 + CVE-2022-0791 + CVE-2022-0792 + CVE-2022-0793 + CVE-2022-0794 + CVE-2022-0795 + CVE-2022-0796 + CVE-2022-0797 + CVE-2022-0798 + CVE-2022-0799 + CVE-2022-0800 + CVE-2022-0801 + CVE-2022-0802 + CVE-2022-0803 + CVE-2022-0804 + CVE-2022-0805 + CVE-2022-0806 + CVE-2022-0807 + CVE-2022-0808 + CVE-2022-0809 + https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop.html + + + 2022-03-01 + 2022-03-02 + + + cyrus-sasl -- Fix off by one error