svn commit: r469467 - head/security/vuxml
Jan Beich
jbeich at FreeBSD.org
Wed May 9 20:32:26 UTC 2018
Author: jbeich
Date: Wed May 9 20:32:24 2018
New Revision: 469467
URL: https://svnweb.freebsd.org/changeset/ports/469467
Log:
security/vuxml: mark firefox < 60 as vulnerable
PR: 226476
Modified:
head/security/vuxml/vuln.xml
Modified: head/security/vuxml/vuln.xml
==============================================================================
--- head/security/vuxml/vuln.xml Wed May 9 20:27:51 2018 (r469466)
+++ head/security/vuxml/vuln.xml Wed May 9 20:32:24 2018 (r469467)
@@ -58,6 +58,110 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+ <vuln vid="5aefc41e-d304-4ec8-8c82-824f84f08244">
+ <topic>mozilla -- multiple vulnerabilities</topic>
+ <affects>
+ <package>
+ <name>firefox</name>
+ <range><lt>60.0,1</lt></range>
+ </package>
+ <package>
+ <name>waterfox</name>
+ <range><lt>56.1.0_18</lt></range>
+ </package>
+ <package>
+ <name>seamonkey</name>
+ <name>linux-seamonkey</name>
+ <range><lt>2.49.4</lt></range>
+ </package>
+ <package>
+ <name>firefox-esr</name>
+ <range><lt>52.8.0,1</lt></range>
+ </package>
+ <package>
+ <name>linux-firefox</name>
+ <range><lt>52.8.0,2</lt></range>
+ </package>
+ <package>
+ <name>libxul</name>
+ <name>thunderbird</name>
+ <name>linux-thunderbird</name>
+ <range><lt>52.8.0</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>Mozilla Foundation reports:</p>
+ <blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/">
+ <p>CVE-2018-5183: Backport critical security fixes in Skia</p>
+ <p>CVE-2018-5154: Use-after-free with SVG animations and clip paths</p>
+ <p>CVE-2018-5155: Use-after-free with SVG animations and text paths</p>
+ <p>CVE-2018-5157: Same-origin bypass of PDF Viewer to view protected PDF files</p>
+ <p>CVE-2018-5158: Malicious PDF can inject JavaScript into PDF Viewer</p>
+ <p>CVE-2018-5159: Integer overflow and out-of-bounds write in Skia</p>
+ <p>CVE-2018-5160: Uninitialized memory use by WebRTC encoder</p>
+ <p>CVE-2018-5152: WebExtensions information leak through webRequest API</p>
+ <p>CVE-2018-5153: Out-of-bounds read in mixed content websocket messages</p>
+ <p>CVE-2018-5163: Replacing cached data in JavaScript Start-up Bytecode Cache</p>
+ <p>CVE-2018-5164: CSP not applied to all multipart content sent with multipart/x-mixed-replace</p>
+ <p>CVE-2018-5166: WebExtension host permission bypass through filterReponseData</p>
+ <p>CVE-2018-5167: Improper linkification of chrome: and javascript: content in web console and JavaScript debugger</p>
+ <p>CVE-2018-5168: Lightweight themes can be installed without user interaction</p>
+ <p>CVE-2018-5169: Dragging and dropping link text onto home button can set home page to include chrome pages</p>
+ <p>CVE-2018-5172: Pasted script from clipboard can run in the Live Bookmarks page or PDF viewer</p>
+ <p>CVE-2018-5173: File name spoofing of Downloads panel with Unicode characters</p>
+ <p>CVE-2018-5174: Windows Defender SmartScreen UI runs with less secure behavior for downloaded files in Windows 10 April 2018 Update</p>
+ <p>CVE-2018-5175: Universal CSP bypass on sites using strict-dynamic in their policies</p>
+ <p>CVE-2018-5176: JSON Viewer script injection</p>
+ <p>CVE-2018-5177: Buffer overflow in XSLT during number formatting</p>
+ <p>CVE-2018-5165: Checkbox for enabling Flash protected mode is inverted in 32-bit Firefox</p>
+ <p>CVE-2018-5178: Buffer overflow during UTF-8 to Unicode string conversion through legacy extension</p>
+ <p>CVE-2018-5180: heap-use-after-free in mozilla::WebGLContext::DrawElementsInstanced</p>
+ <p>CVE-2018-5181: Local file can be displayed in noopener tab through drag and drop of hyperlink</p>
+ <p>CVE-2018-5182: Local file can be displayed from hyperlink dragged and dropped on addressbar</p>
+ <p>CVE-2018-5151: Memory safety bugs fixed in Firefox 60</p>
+ <p>CVE-2018-5150: Memory safety bugs fixed in Firefox 60 and Firefox ESR 52.8</p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2018-5150</cvename>
+ <cvename>CVE-2018-5151</cvename>
+ <cvename>CVE-2018-5152</cvename>
+ <cvename>CVE-2018-5153</cvename>
+ <cvename>CVE-2018-5154</cvename>
+ <cvename>CVE-2018-5155</cvename>
+ <cvename>CVE-2018-5157</cvename>
+ <cvename>CVE-2018-5158</cvename>
+ <cvename>CVE-2018-5159</cvename>
+ <cvename>CVE-2018-5160</cvename>
+ <cvename>CVE-2018-5163</cvename>
+ <cvename>CVE-2018-5164</cvename>
+ <cvename>CVE-2018-5165</cvename>
+ <cvename>CVE-2018-5166</cvename>
+ <cvename>CVE-2018-5167</cvename>
+ <cvename>CVE-2018-5168</cvename>
+ <cvename>CVE-2018-5169</cvename>
+ <cvename>CVE-2018-5172</cvename>
+ <cvename>CVE-2018-5173</cvename>
+ <cvename>CVE-2018-5174</cvename>
+ <cvename>CVE-2018-5175</cvename>
+ <cvename>CVE-2018-5176</cvename>
+ <cvename>CVE-2018-5177</cvename>
+ <cvename>CVE-2018-5178</cvename>
+ <cvename>CVE-2018-5180</cvename>
+ <cvename>CVE-2018-5181</cvename>
+ <cvename>CVE-2018-5182</cvename>
+ <cvename>CVE-2018-5183</cvename>
+ <url>https://www.mozilla.org/security/advisories/mfsa2018-11/</url>
+ <url>https://www.mozilla.org/security/advisories/mfsa2018-12/</url>
+ </references>
+ <dates>
+ <discovery>2018-05-09</discovery>
+ <entry>2018-05-09</entry>
+ </dates>
+ </vuln>
+
<vuln vid="5af6378b-bd88-4997-bccc-b9ba2daecdd2">
<topic>kamailio - buffer overflow</topic>
<affects>
More information about the svn-ports-head
mailing list