svn commit: r436024 - head/security/vuxml
Carlos J. Puga Medina
cpm at FreeBSD.org
Sun Mar 12 20:19:00 UTC 2017
Author: cpm
Date: Sun Mar 12 20:18:59 2017
New Revision: 436024
URL: https://svnweb.freebsd.org/changeset/ports/436024
Log:
Document new vulnerabilities in www/chromium < 57.0.2987.98
Obtained from: https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html
Modified:
head/security/vuxml/vuln.xml
Modified: head/security/vuxml/vuln.xml
==============================================================================
--- head/security/vuxml/vuln.xml Sun Mar 12 20:15:40 2017 (r436023)
+++ head/security/vuxml/vuln.xml Sun Mar 12 20:18:59 2017 (r436024)
@@ -58,6 +58,90 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+ <vuln vid="a505d397-0758-11e7-8d8b-e8e0b747a45a">
+ <topic>chromium -- multiple vulnerabilities</topic>
+ <affects>
+ <package>
+ <name>chromium</name>
+ <name>chromium-npapi</name>
+ <name>chromium-pulse</name>
+ <range><lt>57.0.2987.98</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>Google Chrome Releases reports:</p>
+ <blockquote cite="https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html">
+ <p>36 security fixes in this release, including:</p>
+ <ul>
+ <li>[682194] High CVE-2017-5030: Memory corruption in V8. Credit to
+ Brendon Tiszka</li>
+ <li>[682020] High CVE-2017-5031: Use after free in ANGLE. Credit to
+ Looben Yang</li>
+ <li>[668724] High CVE-2017-5032: Out of bounds write in PDFium. Credit to
+ Ashfaq Ansari - Project Srishti</li>
+ <li>[676623] High CVE-2017-5029: Integer overflow in libxslt. Credit to
+ Holger Fuhrmannek</li>
+ <li>[678461] High CVE-2017-5034: Use after free in PDFium. Credit to
+ Ke Liu of Tencent's Xuanwu Lab</li>
+ <li>[688425] High CVE-2017-5035: Incorrect security UI in Omnibox. Credit to
+ Enzo Aguado</li>
+ <li>[691371] High CVE-2017-5036: Use after free in PDFium. Credit to
+ Anonymous</li>
+ <li>[679640] High CVE-2017-5037: Multiple out of bounds writes in ChunkDemuxer.
+ Credit to Yongke Wang of Tecent's Xuanwu Lab</li>
+ <li>[679649] High CVE-2017-5039: Use after free in PDFium. Credit to
+ jinmo123</li>
+ <li>[691323] Medium CVE-2017-5040: Information disclosure in V8. Credit to
+ Choongwoo Han</li>
+ <li>[642490] Medium CVE-2017-5041: Address spoofing in Omnibox. Credit to
+ Jordi Chancel</li>
+ <li>[669086] Medium CVE-2017-5033: Bypass of Content Security Policy in Blink.
+ Credit to Nicolai Grodum</li>
+ <li>[671932] Medium CVE-2017-5042: Incorrect handling of cookies in Cast.
+ Credit to Mike Ruddy</li>
+ <li>[695476] Medium CVE-2017-5038: Use after free in GuestView. Credit to
+ Anonymous</li>
+ <li>[683523] Medium CVE-2017-5043: Use after free in GuestView. Credit to
+ Anonymous</li>
+ <li>[688987] Medium CVE-2017-5044: Heap overflow in Skia. Credit to
+ Kushal Arvind Shah of Fortinet's FortiGuard Labs</li>
+ <li>[667079] Medium CVE-2017-5045: Information disclosure in XSS Auditor.
+ Credit to Dhaval Kapil</li>
+ <li>[680409] Medium CVE-2017-5046: Information disclosure in Blink. Credit to
+ Masato Kinugawa</li>
+ <li>[699618] Various fixes from internal audits, fuzzing and other initiatives</li>
+ </ul>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2017-5030</cvename>
+ <cvename>CVE-2017-5031</cvename>
+ <cvename>CVE-2017-5032</cvename>
+ <cvename>CVE-2017-5029</cvename>
+ <cvename>CVE-2017-5034</cvename>
+ <cvename>CVE-2017-5035</cvename>
+ <cvename>CVE-2017-5036</cvename>
+ <cvename>CVE-2017-5037</cvename>
+ <cvename>CVE-2017-5039</cvename>
+ <cvename>CVE-2017-5040</cvename>
+ <cvename>CVE-2017-5041</cvename>
+ <cvename>CVE-2017-5033</cvename>
+ <cvename>CVE-2017-5042</cvename>
+ <cvename>CVE-2017-5038</cvename>
+ <cvename>CVE-2017-5043</cvename>
+ <cvename>CVE-2017-5044</cvename>
+ <cvename>CVE-2017-5045</cvename>
+ <cvename>CVE-2017-5046</cvename>
+ <url>https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html</url>
+ </references>
+ <dates>
+ <discovery>2017-03-09</discovery>
+ <entry>2017-03-12</entry>
+ </dates>
+ </vuln>
+
<vuln vid="89cf8cd2-0698-11e7-aa3f-001b216d295b">
<topic>Several Security Defects in the Bouncy Castle Crypto APIs</topic>
<affects>
More information about the svn-ports-all
mailing list