git: 860ccda68e43 - main - security/vuxml: add www/*chromium < 128.0.6613.84

Go to: [ bottom of page ] [ top of archives ] [ this month ]
From: Robert Nagy <rnagy_at_FreeBSD.org>
Date: Thu, 22 Aug 2024 07:47:25 UTC
The branch main has been updated by rnagy:

URL: https://cgit.FreeBSD.org/ports/commit/?id=860ccda68e43cdc3bbf55143dd5500575b656d69

commit 860ccda68e43cdc3bbf55143dd5500575b656d69
Author:     Robert Nagy <rnagy@FreeBSD.org>
AuthorDate: 2024-08-22 07:46:25 +0000
Commit:     Robert Nagy <rnagy@FreeBSD.org>
CommitDate: 2024-08-22 07:47:17 +0000

    security/vuxml: add www/*chromium < 128.0.6613.84
    
    Obtained from:  https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html
---
 security/vuxml/vuln/2024.xml | 71 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 71 insertions(+)

diff --git a/security/vuxml/vuln/2024.xml b/security/vuxml/vuln/2024.xml
index f5e6a31e37f8..50726b410d29 100644
--- a/security/vuxml/vuln/2024.xml
+++ b/security/vuxml/vuln/2024.xml
@@ -1,3 +1,74 @@
+  <vuln vid="b339992e-6059-11ef-8a0f-a8a1599412c6">
+    <topic>chromium -- multiple security fixes</topic>
+    <affects>
+      <package>
+       <name>chromium</name>
+       <range><lt>128.0.6613.84</lt></range>
+      </package>
+      <package>
+       <name>ungoogled-chromium</name>
+       <range><lt>128.0.6613.84</lt></range>
+      </package>
+    </affects>
+    <description>
+      <body xmlns="http://www.w3.org/1999/xhtml">
+       <p>Chrome Releases reports:</p>
+       <blockquote cite="https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html">
+	 <p>This update includes 38 security fixes:</p>
+	 <ul>
+	    <li>[358296941] High CVE-2024-7964: Use after free in Passwords. Reported by Anonymous on 2024-08-08</li>
+	    <li>[356196918] High CVE-2024-7965: Inappropriate implementation in V8. Reported by TheDog on 2024-07-30</li>
+	    <li>[355465305] High CVE-2024-7966: Out of bounds memory access in Skia. Reported by Renan Rios (@HyHy100) on 2024-07-25</li>
+	    <li>[355731798] High CVE-2024-7967: Heap buffer overflow in Fonts. Reported by Tashita Software Security on 2024-07-27</li>
+	    <li>[349253666] High CVE-2024-7968: Use after free in Autofill. Reported by Han Zheng (HexHive) on 2024-06-25</li>
+	    <li>[351865302] High CVE-2024-7969: Type Confusion in V8. Reported by CFF of Topsec Alpha Team on 2024-07-09</li>
+	    <li>[360700873] High CVE-2024-7971: Type confusion in V8. Reported by Microsoft Threat Intelligence Center (MSTIC), Microsoft Security Response Center (MSRC) on 2024-08-19</li>
+	    <li>[345960102] Medium CVE-2024-7972: Inappropriate implementation in V8. Reported by Simon Gerst (intrigus-lgtm) on 2024-06-10</li>
+	    <li>[345518608] Medium CVE-2024-7973: Heap buffer overflow in PDFium. Reported by soiax on 2024-06-06</li>
+	    <li>[339141099] Medium CVE-2024-7974: Insufficient data validation in V8 API. Reported by bowu(@gocrashed) on 2024-05-07</li>
+	    <li>[347588491] Medium CVE-2024-7975: Inappropriate implementation in Permissions. Reported by Thomas Orlita on 2024-06-16</li>
+	    <li>[339654392] Medium CVE-2024-7976: Inappropriate implementation in FedCM. Reported by Alesandro Ortiz on 2024-05-10</li>
+	    <li>[324770940] Medium CVE-2024-7977: Insufficient data validation in Installer. Reported by Kim Dong-uk (@justlikebono) on 2024-02-11</li>
+	    <li>[40060358] Medium CVE-2024-7978: Insufficient policy enforcement in Data Transfer. Reported by NDevTK on 2022-07-21</li>
+	    <li>[356064205] Medium CVE-2024-7979: Insufficient data validation in Installer. Reported by VulnNoob on 2024-07-29</li>
+	    <li>[356328460] Medium CVE-2024-7980: Insufficient data validation in Installer. Reported by VulnNoob on 2024-07-30</li>
+	    <li>[40067456] Low CVE-2024-7981: Inappropriate implementation in Views. Reported by Thomas Orlita on 2023-07-14</li>
+	    <li>[350256139] Low CVE-2024-8033: Inappropriate implementation in WebApp Installs. Reported by Lijo A.T on 2024-06-30</li>
+	    <li>[353858776] Low CVE-2024-8034: Inappropriate implementation in Custom Tabs. Reported by Bharat (mrnoob) on 2024-07-18</li>
+	    <li>[40059470] Low CVE-2024-8035: Inappropriate implementation in Extensions. Reported by Microsoft on 2022-04-26</li>
+	 </ul>
+       </blockquote>
+      </body>
+    </description>
+    <references>
+      <cvename>CVE-2024-7964</cvename>
+      <cvename>CVE-2024-7965</cvename>
+      <cvename>CVE-2024-7966</cvename>
+      <cvename>CVE-2024-7967</cvename>
+      <cvename>CVE-2024-7968</cvename>
+      <cvename>CVE-2024-7969</cvename>
+      <cvename>CVE-2024-7971</cvename>
+      <cvename>CVE-2024-7972</cvename>
+      <cvename>CVE-2024-7973</cvename>
+      <cvename>CVE-2024-7974</cvename>
+      <cvename>CVE-2024-7975</cvename>
+      <cvename>CVE-2024-7976</cvename>
+      <cvename>CVE-2024-7977</cvename>
+      <cvename>CVE-2024-7978</cvename>
+      <cvename>CVE-2024-7979</cvename>
+      <cvename>CVE-2024-7980</cvename>
+      <cvename>CVE-2024-7981</cvename>
+      <cvename>CVE-2024-8033</cvename>
+      <cvename>CVE-2024-8034</cvename>
+      <cvename>CVE-2024-8035</cvename>
+      <url>https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html</url>
+    </references>
+    <dates>
+      <discovery>2024-08-21</discovery>
+      <entry>2024-08-22</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="addc71b8-6024-11ef-86a1-8c164567ca3c">
     <topic>nginx -- Vulnerability in the ngx_http_mp4_module</topic>
     <affects>