svn commit: r413661 - head/security/vuxml

Tue Apr 19 20:14:54 UTC 2016

Author: rene
Date: Tue Apr 19 20:14:53 2016
New Revision: 413661
URL: https://svnweb.freebsd.org/changeset/ports/413661

Log:
  Doument new vulnerabilities in www/chromium < 50.0.2661.75
  
  Obtained from:	http://googlechromereleases.blogspot.nl/2016/04/stable-channel-update_13.html

Modified:
  head/security/vuxml/vuln.xml

Modified: head/security/vuxml/vuln.xml
==============================================================================

--- head/security/vuxml/vuln.xml	Tue Apr 19 20:03:17 2016	(r413660)
+++ head/security/vuxml/vuln.xml	Tue Apr 19 20:14:53 2016	(r413661)
@@ -58,6 +58,64 @@ Notes:
   * Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
 -->
 <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+  <vuln vid="6d8505f0-0614-11e6-b39c-00262d5ed8ee">
+    <topic>chromium -- multiple vulnerabilities</topic>
+    <affects>
+      <package>
+	<name>chromium</name>
+	<name>chromium-npapi</name>
+	<name>chromium-pulse</name>
+	<range><lt>50.0.2661.75</lt></range>
+      </package>
+    </affects>
+    <description>
+      <body xmlns="http://www.w3.org/1999/xhtml">
+	<p>Google Chrome Releases reports:</p>
+	<blockquote cite="http://googlechromereleases.blogspot.nl/2016/04/stable-channel-update_13.html">
+	  <p>20 security fixes in this release, including:</p>
+	  <ul>
+	    <li>[590275] High CVE-2016-1652: Universal XSS in extension
+	      bindings. Credit to anonymous.</li>
+	    <li>[589792] High CVE-2016-1653: Out-of-bounds write in V8. Credit
+	      to Choongwoo Han.</li>
+	    <li>[591785] Medium CVE-2016-1651: Out-of-bounds read in Pdfium
+	      JPEG2000 decoding. Credit to kdot working with HP's Zero Day
+	      Initiative.</li>
+	    <li>[589512] Medium CVE-2016-1654: Uninitialized memory read in
+	      media. Credit to Atte Kettunen of OUSPG.</li>
+	    <li>[582008] Medium CVE-2016-1655: Use-after-free related to
+	      extensions. Credit to Rob Wu.</li>
+	    <li>[570750] Medium CVE-2016-1656: Android downloaded file path
+	      restriction bypass. Credit to Dzmitry Lukyanenko.</li>
+	    <li>[567445] Medium CVE-2016-1657: Address bar spoofing. Credit to
+	      Luan Herrera.</li>
+	    <li>[573317] Low CVE-2016-1658: Potential leak of sensitive
+	      information to malicious extensions. Credit to Antonio Sanso
+	      (@asanso) of Adobe.</li>
+	    <li>[602697] CVE-2016-1659: Various fixes from internal audits,
+	      fuzzing and other initiatives.</li>
+	  </ul>
+	</blockquote>
+      </body>
+    </description>
+    <references>
+      <cvename>CVE-2016-1651</cvename>
+      <cvename>CVE-2016-1652</cvename>
+      <cvename>CVE-2016-1653</cvename>
+      <cvename>CVE-2016-1654</cvename>
+      <cvename>CVE-2016-1655</cvename>
+      <cvename>CVE-2016-1656</cvename>
+      <cvename>CVE-2016-1657</cvename>
+      <cvename>CVE-2016-1658</cvename>
+      <cvename>CVE-2016-1659</cvename>
+      <url>http://googlechromereleases.blogspot.nl/2016/04/stable-channel-update_13.html</url>
+    </references>
+    <dates>
+      <discovery>2016-04-13</discovery>
+      <entry>2016-04-19</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="976567f6-05c5-11e6-94fa-002590263bf5">
     <topic>wpa_supplicant -- multiple vulnerabilities</topic>
     <affects>
