svn commit: r454193 - head/security/vuxml

Tue Nov 14 19:04:26 UTC 2017

Author: jbeich
Date: Tue Nov 14 19:04:24 2017
New Revision: 454193
URL: https://svnweb.freebsd.org/changeset/ports/454193

Log:
  security/vuxml: mark firefox < 57 as vulnerable

Modified:
  head/security/vuxml/vuln.xml

Modified: head/security/vuxml/vuln.xml
==============================================================================

--- head/security/vuxml/vuln.xml	Tue Nov 14 19:04:06 2017	(r454192)
+++ head/security/vuxml/vuln.xml	Tue Nov 14 19:04:24 2017	(r454193)
@@ -58,6 +58,82 @@ Notes:
   * Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
 -->
 <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+  <vuln vid="f78eac48-c3d1-4666-8de5-63ceea25a578">
+    <topic>mozilla -- multiple vulnerabilities</topic>
+    <affects>
+      <package>
+	<name>firefox</name>
+	<!-- 56.0.2_10,1 unlike 57.0,1 has CVE-2017-7827 partially unfixed:
+	     bug 1384615, 1386490, 1393840, 1403716 -->
+	<range><lt>56.0.2_10,1</lt></range>
+      </package>
+      <package>
+	<name>seamonkey</name>
+	<name>linux-seamonkey</name>
+	<range><lt>2.49.2</lt></range>
+      </package>
+      <package>
+	<name>firefox-esr</name>
+	<range><lt>52.5.0,1</lt></range>
+      </package>
+      <package>
+	<name>linux-firefox</name>
+	<range><lt>52.5.0,2</lt></range>
+      </package>
+      <package>
+	<name>libxul</name>
+	<name>thunderbird</name>
+	<name>linux-thunderbird</name>
+	<range><lt>52.5.0</lt></range>
+      </package>
+    </affects>
+    <description>
+      <body xmlns="http://www.w3.org/1999/xhtml">
+	<p>Mozilla Foundation reports:</p>
+	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-24/">
+	  <p>CVE-2017-7828: Use-after-free of PressShell while restyling layout</p>
+	  <p>CVE-2017-7830: Cross-origin URL information leak through Resource Timing API</p>
+	  <p>CVE-2017-7831: Information disclosure of exposed properties on JavaScript proxy objects</p>
+	  <p>CVE-2017-7832: Domain spoofing through use of dotless 'i' character followed by accent markers</p>
+	  <p>CVE-2017-7833: Domain spoofing with Arabic and Indic vowel marker characters</p>
+	  <p>CVE-2017-7834: data: URLs opened in new tabs bypass CSP protections</p>
+	  <p>CVE-2017-7835: Mixed content blocking incorrectly applies with redirects</p>
+	  <p>CVE-2017-7836: Pingsender dynamically loads libcurl on Linux and OS X</p>
+	  <p>CVE-2017-7837: SVG loaded as <img> can use meta tags to set cookies</p>
+	  <p>CVE-2017-7838: Failure of individual decoding of labels in international domain names triggers punycode display of entire IDN</p>
+	  <p>CVE-2017-7839: Control characters before javascript: URLs defeats self-XSS prevention mechanism</p>
+	  <p>CVE-2017-7840: Exported bookmarks do not strip script elements from user-supplied tags</p>
+	  <p>CVE-2017-7842: Referrer Policy is not always respected for <link> elements</p>
+	  <p>CVE-2017-7827: Memory safety bugs fixed in Firefox 57</p>
+	  <p>CVE-2017-7826: Memory safety bugs fixed in Firefox 57 and Firefox ESR 52.5</p>
+	</blockquote>
+      </body>
+    </description>
+    <references>
+      <cvename>CVE-2017-7826</cvename>
+      <cvename>CVE-2017-7827</cvename>
+      <cvename>CVE-2017-7828</cvename>
+      <cvename>CVE-2017-7830</cvename>
+      <cvename>CVE-2017-7831</cvename>
+      <cvename>CVE-2017-7832</cvename>
+      <cvename>CVE-2017-7833</cvename>
+      <cvename>CVE-2017-7834</cvename>
+      <cvename>CVE-2017-7835</cvename>
+      <cvename>CVE-2017-7836</cvename>
+      <cvename>CVE-2017-7837</cvename>
+      <cvename>CVE-2017-7838</cvename>
+      <cvename>CVE-2017-7839</cvename>
+      <cvename>CVE-2017-7840</cvename>
+      <cvename>CVE-2017-7842</cvename>
+      <url>https://www.mozilla.org/security/advisories/mfsa2017-24/</url>
+      <url>https://www.mozilla.org/security/advisories/mfsa2017-25/</url>
+    </references>
+    <dates>
+      <discovery>2017-11-14</discovery>
+      <entry>2017-11-14</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="27b38d85-c891-11e7-a7bd-cd1209e563f2">
     <topic>rubygem-geminabox -- XSS vulnerabilities</topic>
     <affects>
