Document new vulnerabilities in www/chromium < 46.0.2490.71

Wed Oct 14 12:55:15 UTC 2015

Current www/chromium is marked as vulnerable on Google Chrome
website[0].

# diff -urN vuln.xml.orig vuln.xml

--- vuln.xml.orig	2015-10-14 14:22:59.089754000 +0200
+++ vuln.xml	2015-10-14 14:50:00.348593000 +0200
@@ -58,6 +58,60 @@
 
 -->
 <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">;
+  <vuln vid="6fa21d3d-726e-11e5-b761-e8e0b747a45a">
+    <topic>chromium -- multiple vulnerabilities</topic>
+    <affects>
+      <package>
+	<name>chromium</name>
+	<range><lt>46.0.2490.71</lt></range>
+      </package>
+    </affects>
+    <description>
+      <body xmlns="http://www.w3.org/1999/xhtml">;
+	<p>Google Chrome Releases reports:</p>
+	<blockquote cite="http://googlechromereleases.blogspot.nl">;
+	  <p>24 security fixes in this release, including:</p>
+          <ul>
+            <li>[519558] High CVE-2015-6755: Cross-origin bypass in
Blink. Credit
+              to Mariusz Mlynski.</li>
+	    <li>[507316] High CVE-2015-6756: User-after-free in
PDFium. Credit
+              to anonymous.</li>
+	    <li>[529520] High CVE-2015-6757: User-after-free in
ServiceWorker. Credit
+              to Collin Payne.</li>
+	    <li>[522131] High CVE-2015-6758: Bad-cast in PDFium.
Credit
+              to Atte Kettunen of OUSPG.</li>
+	    <li>[514076] Medium CVE-2015-6759: Information leakage in
LocalStorage. Credit
+	      to Muneaki Nishimura (nishimunea).</li>
+	    <li>[519642] Medium CVE-2015-6760: Improper error handling
in libANGLE. Credit
+	      to lastland.net.</li>
+	    <li>[447860][532967] Medium CVE-2015-6761: Memory
corruption in FFMpeg. Credit
+	      to Aki Helin of OUSPG and anonymous.</li>
+	    <li>[512678] Low CVE-2015-6762: CORS bypass via CSS fonts.
Credit
+	      to Muneaki Nishimura (nishimunea).</li>
+	    <li>[542517] CVE-2015-6763: Various fixes from internal
audits,
+	      fuzzing and other initiatives.</li>
+          </ul>
+	</blockquote>
+      </body>
+    </description>
+    <references>
+      <cvename>CVE-2015-6755</cvename>
+      <cvename>CVE-2015-6756</cvename>
+      <cvename>CVE-2015-6757</cvename>
+      <cvename>CVE-2015-6758</cvename>
+      <cvename>CVE-2015-6759</cvename>
+      <cvename>CVE-2015-6760</cvename>
+      <cvename>CVE-2015-6761</cvename>
+      <cvename>CVE-2015-6762</cvename>
+      <cvename>CVE-2015-6763</cvename> 
+      <url>http://googlechromereleases.blogspot.nl</url>;
+    </references>
+    <dates>
+      <discovery>2015-10-13</discovery>
+      <entry>2015-10-14</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="8301c04d-71df-11e5-9fcb-00262d5ed8ee">
     <topic>chromium -- multiple vulnerabilities</topic>
     <affects>

                                            
[0] http://googlechromereleases.blogspot.nl/2015/09/stable-channel-upda
te.html
-- 
Carlos Jacobo Puga Medina <cpm at fbsd.es>
PGP fingerprint = C60E 9497 5302 793B CC2D  BB89 A1F3 5D66 E6D0 5453
-------------- next part --------------
A non-text attachment was scrubbed...
Name: vuln.diff
Type: text/x-patch
Size: 2505 bytes
Desc: not available
URL: <http://lists.freebsd.org/pipermail/freebsd-chromium/attachments/20151014/2de3120b/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 473 bytes
Desc: This is a digitally signed message part
URL: <http://lists.freebsd.org/pipermail/freebsd-chromium/attachments/20151014/2de3120b/attachment-0001.bin>
