svn commit: r463159 - head/security/vuxml
Thomas Zander
riggs at FreeBSD.org
Tue Feb 27 20:15:41 UTC 2018
Author: riggs
Date: Tue Feb 27 20:15:39 2018
New Revision: 463159
URL: https://svnweb.freebsd.org/changeset/ports/463159
Log:
Document multiple vulnerabilities in chromium 64.0.3282.119
Reported by: Tommi Pernila <tommi.pernila at iki.fi> (via e-mail)
Modified:
head/security/vuxml/vuln.xml
Modified: head/security/vuxml/vuln.xml
==============================================================================
--- head/security/vuxml/vuln.xml Tue Feb 27 20:03:56 2018 (r463158)
+++ head/security/vuxml/vuln.xml Tue Feb 27 20:15:39 2018 (r463159)
@@ -58,6 +58,82 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+ <vuln vid="8e986b2b-1baa-11e8-a944-54ee754af08e">
+ <topic>chromium -- multiple vulnerabilities</topic>
+ <affects>
+ <package>
+ <name>chromium</name>
+ <range><lt>64.0.3282.119</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>Google Chrome Releases reports:</p>
+ <blockquote cite="https://chromereleases.googleblog.com/2018/01/stable-channel-update-for-desktop_24.html">
+ <p>Several security fixes in this release, including:</p>
+ <ul>
+ <li>[780450] High CVE-2018-6031: Use after free in PDFium. Reported by Anonymous on 2017-11-01</li>
+ <li>[787103] High CVE-2018-6032: Same origin bypass in Shared Worker. Reported by Jun Kokatsu (@shhnjk) on 2017-11-20</li>
+ <li>[793620] High CVE-2018-6033: Race when opening downloaded files. Reported by Juho Nurminen on 2017-12-09</li>
+ <li>[784183] Medium CVE-2018-6034: Integer overflow in Blink. Reported by Tobias Klein (www.trapkit.de) on 2017-11-12</li>
+ <li>[797500] Medium CVE-2018-6035: Insufficient isolation of devtools from extensions. Reported by Rob Wu on 2017-12-23</li>
+ <li>[797500] Medium CVE-2018-6035: Insufficient isolation of devtools from extensions. Reported by Rob Wu on 2017-12-23</li>
+ <li>[753645] Medium CVE-2018-6037: Insufficient user gesture requirements in autofill. Reported by Paul Stone of Context Information Security on
+ 2017-08-09</li>
+ <li>[774174] Medium CVE-2018-6038: Heap buffer overflow in WebGL. Reported by cloudfuzzer on 2017-10-12</li>
+ <li>[775527] Medium CVE-2018-6039: XSS in DevTools. Reported by Juho Nurminen on 2017-10-17</li>
+ <li>[778658] Medium CVE-2018-6040: Content security policy bypass. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-10-26</li>
+ <li>[760342] Medium CVE-2018-6041: URL spoof in Navigation. Reported by Luan Herrera on 2017-08-29</li>
+ <li>[773930] Medium CVE-2018-6042: URL spoof in OmniBox. Reported by Khalil Zhani on 2017-10-12</li>
+ <li>[785809] Medium CVE-2018-6043: Insufficient escaping with external URL handlers. Reported by 0x09AL on 2017-11-16</li>
+ <li>[797497] Medium CVE-2018-6045: Insufficient isolation of devtools from extensions. Reported by Rob Wu on 2017-12-23</li>
+ <li>[798163] Medium CVE-2018-6046: Insufficient isolation of devtools from extensions. Reported by Rob Wu on 2017-12-31</li>
+ <li>[799847] Medium CVE-2018-6047: Cross origin URL leak in WebGL. Reported by Masato Kinugawa on 2018-01-08</li>
+ <li>[763194] Low CVE-2018-6048: Referrer policy bypass in Blink. Reported by Jun Kokatsu (@shhnjk) on 2017-09-08</li>
+ <li>[771848] Low CVE-2017-15420: URL spoofing in Omnibox. Reported by Drew Springall (@_aaspring_) on 2017-10-05</li>
+ <li>[774438] Low CVE-2018-6049: UI spoof in Permissions. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-10-13</li>
+ <li>[774842] Low CVE-2018-6050: URL spoof in OmniBox. Reported by Jonathan Kew on 2017-10-15</li>
+ <li>[441275] Low CVE-2018-6051: Referrer leak in XSS Auditor. Reported by Antonio Sanso (@asanso) on 2014-12-11</li>
+ <li>[615608] Low CVE-2018-6052: Incomplete no-referrer policy implementation. Reported by Tanner Emek on 2016-05-28</li>
+ <li>[758169] Low CVE-2018-6053: Leak of page thumbnails in New Tab Page. Reported by Asset Kabdenov on 2017-08-23</li>
+ <li>[797511] Low CVE-2018-6054: Use after free in WebUI. Reported by Rob Wu on 2017-12-24</li>
+ </ul>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2018-6031</cvename>
+ <cvename>CVE-2018-6032</cvename>
+ <cvename>CVE-2018-6033</cvename>
+ <cvename>CVE-2018-6034</cvename>
+ <cvename>CVE-2018-6035</cvename>
+ <cvename>CVE-2018-6036</cvename>
+ <cvename>CVE-2018-6037</cvename>
+ <cvename>CVE-2018-6038</cvename>
+ <cvename>CVE-2018-6039</cvename>
+ <cvename>CVE-2018-6040</cvename>
+ <cvename>CVE-2018-6041</cvename>
+ <cvename>CVE-2018-6042</cvename>
+ <cvename>CVE-2018-6043</cvename>
+ <cvename>CVE-2018-6045</cvename>
+ <cvename>CVE-2018-6046</cvename>
+ <cvename>CVE-2018-6047</cvename>
+ <cvename>CVE-2018-6048</cvename>
+ <cvename>CVE-2017-15420</cvename>
+ <cvename>CVE-2018-6049</cvename>
+ <cvename>CVE-2018-6050</cvename>
+ <cvename>CVE-2018-6051</cvename>
+ <cvename>CVE-2018-6052</cvename>
+ <cvename>CVE-2018-6053</cvename>
+ <cvename>CVE-2018-6054</cvename>
+ <url>https://chromereleases.googleblog.com/2018/01/stable-channel-update-for-desktop_24.html</url>
+ </references>
+ <dates>
+ <discovery>2017-08-09</discovery>
+ <entry>2018-02-27</entry>
+ </dates>
+ </vuln>
+
<vuln vid="55c4233e-1844-11e8-a712-0025908740c2">
<topic>tomcat -- Security constraints ignored or applied too late</topic>
<affects>
More information about the svn-ports-head
mailing list