svn commit: r418932 - head/security/vuxml
Rene Ladan
rene at FreeBSD.org
Fri Jul 22 20:30:18 UTC 2016
Author: rene
Date: Fri Jul 22 20:30:16 2016
New Revision: 418932
URL: https://svnweb.freebsd.org/changeset/ports/418932
Log:
Document new vulnerabilities in www/chromium < 52.0.2743.82
Obtained from: https://googlechromereleases.blogspot.nl/2016/07/stable-channel-update.html
Modified:
head/security/vuxml/vuln.xml
Modified: head/security/vuxml/vuln.xml
==============================================================================
--- head/security/vuxml/vuln.xml Fri Jul 22 20:28:01 2016 (r418931)
+++ head/security/vuxml/vuln.xml Fri Jul 22 20:30:16 2016 (r418932)
@@ -58,6 +58,86 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+ <vuln vid="6fae9fe1-5048-11e6-8aa7-3065ec8fd3ec">
+ <topic>chromium -- multiple vulnerabilities</topic>
+ <affects>
+ <package>
+ <name>chromium</name>
+ <name>chromium-npapi</name>
+ <name>chromium-pulse</name>
+ <range><lt>52.0.2743.82</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>Google Chrome Releases reports:</p>
+ <blockquote cite="https://googlechromereleases.blogspot.nl/2016/07/stable-channel-update.html">
+ <p>48 security fixes in this release, including:</p>
+ <ul>
+ <li>[610600] High CVE-2016-1706: Sandbox escape in PPAPI. Credit to
+ Pinkie Pie xisigr of Tencent's Xuanwu Lab</li>
+ <li>[613949] High CVE-2016-1708: Use-after-free in Extensions.
+ Credit to Adam Varsan</li>
+ <li>[614934] High CVE-2016-1709: Heap-buffer-overflow in sfntly.
+ Credit to ChenQin of Topsec Security Team</li>
+ <li>[616907] High CVE-2016-1710: Same-origin bypass in Blink.
+ Credit to Mariusz Mlynski</li>
+ <li>[617495] High CVE-2016-1711: Same-origin bypass in Blink.
+ Credit to Mariusz Mlynski</li>
+ <li>[618237] High CVE-2016-5127: Use-after-free in Blink. Credit
+ to cloudfuzzer</li>
+ <li>[619166] High CVE-2016-5128: Same-origin bypass in V8. Credit
+ to Anonymous</li>
+ <li>[620553] High CVE-2016-5129: Memory corruption in V8. Credit to
+ Jeonghoon Shin</li>
+ <li>[623319] High CVE-2016-5130: URL spoofing. Credit to Wadih
+ Matar</li>
+ <li>[623378] High CVE-2016-5131: Use-after-free in libxml. Credit
+ to Nick Wellnhofer</li>
+ <li>[607543] Medium CVE-2016-5132: Limited same-origin bypass in
+ Service Workers. Credit to Ben Kelly</li>
+ <li>[613626] Medium CVE-2016-5133: Origin confusion in proxy
+ authentication. Credit to Patch Eudor</li>
+ <li>[593759] Medium CVE-2016-5134: URL leakage via PAC script.
+ Credit to Paul Stone</li>
+ <li>[605451] Medium CVE-2016-5135: Content-Security-Policy bypass.
+ Credit to kingxwy</li>
+ <li>[625393] Medium CVE-2016-5136: Use after free in extensions.
+ Credit to Rob Wu</li>
+ <li>[625945] Medium CVE-2016-5137: History sniffing with HSTS and
+ CSP. Credit to Xiaoyin Liu</li>
+ <li>[629852] CVE-2016-1705: Various fixes from internal audits,
+ fuzzing and other initiatives.</li>
+ </ul>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2016-1705</cvename>
+ <cvename>CVE-2016-1706</cvename>
+ <cvename>CVE-2016-1708</cvename>
+ <cvename>CVE-2016-1709</cvename>
+ <cvename>CVE-2016-1710</cvename>
+ <cvename>CVE-2016-1711</cvename>
+ <cvename>CVE-2016-5127</cvename>
+ <cvename>CVE-2016-5128</cvename>
+ <cvename>CVE-2016-5129</cvename>
+ <cvename>CVE-2016-5130</cvename>
+ <cvename>CVE-2016-5131</cvename>
+ <cvename>CVE-2016-5132</cvename>
+ <cvename>CVE-2016-5133</cvename>
+ <cvename>CVE-2016-5134</cvename>
+ <cvename>CVE-2016-5135</cvename>
+ <cvename>CVE-2016-5136</cvename>
+ <cvename>CVE-2016-5137</cvename>
+ <url>https://googlechromereleases.blogspot.nl/2016/07/stable-channel-update.html</url>
+ </references>
+ <dates>
+ <discovery>2016-07-20</discovery>
+ <entry>2016-07-22</entry>
+ </dates>
+ </vuln>
+
<vuln vid="62d45229-4fa0-11e6-9d13-206a8a720317">
<topic>krb5 -- KDC denial of service vulnerability</topic>
<affects>
More information about the svn-ports-all
mailing list