svn commit: r372740 - head/security/vuxml
Rene Ladan
rene at FreeBSD.org
Tue Nov 18 18:32:23 UTC 2014
Author: rene
Date: Tue Nov 18 18:32:22 2014
New Revision: 372740
URL: https://svnweb.freebsd.org/changeset/ports/372740
QAT: https://qat.redports.org/buildarchive/r372740/
Log:
Document new vulnerabilities in www/chromium < 39.0.2171.65
Obtained from: http://googlechromereleases.blogspot.nl/2014/11/stable-channel-update_18.html
Modified:
head/security/vuxml/vuln.xml
Modified: head/security/vuxml/vuln.xml
==============================================================================
--- head/security/vuxml/vuln.xml Tue Nov 18 16:52:24 2014 (r372739)
+++ head/security/vuxml/vuln.xml Tue Nov 18 18:32:22 2014 (r372740)
@@ -57,6 +57,77 @@ Notes:
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+ <vuln vid="d395e44f-6f4f-11e4-a444-00262d5ed8ee">
+ <topic>chromium -- multiple vulnerabilities</topic>
+ <affects>
+ <package>
+ <name>chromium</name>
+ <range><lt>39.0.2171.65</lt></range>
+ </package>
+ <package>
+ <name>chromium-pulse</name>
+ <range><lt>39.0.2171.65</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>Google Chrome Releases reports:</p>
+ <blockquote cite="http://googlechromereleases.blogspot.nl/2014/11/stable-channel-update_18.html">
+ <p>42 security fixes in this release, including:</p>
+ <ul>
+ <li>[389734] High CVE-2014-7899: Address bar spoofing. Credit to
+ Eli Grey.</li>
+ <li>[406868] High CVE-2014-7900: Use-after-free in pdfium. Credit
+ to Atte Kettunen from OUSPG.</li>
+ <li>[413375] High CVE-2014-7901: Integer overflow in pdfium. Credit
+ to cloudfuzzer.</li>
+ <li>[414504] High CVE-2014-7902: Use-after-free in pdfium. Credit
+ to cloudfuzzer.</li>
+ <li>[414525] High CVE-2014-7903: Buffer overflow in pdfium. Credit
+ to cloudfuzzer.</li>
+ <li>[418161] High CVE-2014-7904: Buffer overflow in Skia. Credit to
+ Atte Kettunen from OUSPG.</li>
+ <li>[421817] High CVE-2014-7905: Flaw allowing navigation to
+ intents that do not have the BROWSABLE category. Credit to
+ WangTao(neobyte) of Baidu X-Team.</li>
+ <li>[423030] High CVE-2014-7906: Use-after-free in pepper plugins.
+ Credit to Chen Zhang (demi6od) of the NSFOCUS Security Team.</li>
+ <li>[423703] High CVE-2014-0574: Double-free in Flash. Credit to
+ biloulehibou.</li>
+ <li>[424453] High CVE-2014-7907: Use-after-free in blink. Credit to
+ Chen Zhang (demi6od) of the NSFOCUS Security Team.</li>
+ <li>[425980] High CVE-2014-7908: Integer overflow in media. Credit
+ to Christoph Diehl.</li>
+ <li>[391001] Medium CVE-2014-7909: Uninitialized memory read in
+ Skia. Credit to miaubiz.</li>
+ <li>CVE-2014-7910: Various fixes from internal audits, fuzzing and
+ other initiatives.</li>
+ </ul>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2014-0574</cvename>
+ <cvename>CVE-2014-7899</cvename>
+ <cvename>CVE-2014-7900</cvename>
+ <cvename>CVE-2014-7901</cvename>
+ <cvename>CVE-2014-7902</cvename>
+ <cvename>CVE-2014-7903</cvename>
+ <cvename>CVE-2014-7904</cvename>
+ <cvename>CVE-2014-7905</cvename>
+ <cvename>CVE-2014-7906</cvename>
+ <cvename>CVE-2014-7907</cvename>
+ <cvename>CVE-2014-7908</cvename>
+ <cvename>CVE-2014-7909</cvename>
+ <cvename>CVE-2014-7910</cvename>
+ <url>http://googlechromereleases.blogspot.nl/2014/11/stable-channel-update_18.html</url>
+ </references>
+ <dates>
+ <discovery>2014-11-18</discovery>
+ <entry>2014-11-18</entry>
+ </dates>
+ </vuln>
+
<vuln vid="dafa13a8-6e9b-11e4-8ef7-5453ed2e2b49">
<topic>kde-workspace -- privilege escalation</topic>
<affects>
More information about the svn-ports-all
mailing list