svn commit: r408023 - head/security/vuxml
Koop Mast
kwm at FreeBSD.org
Thu Feb 4 11:03:35 UTC 2016
Author: kwm
Date: Thu Feb 4 11:03:33 2016
New Revision: 408023
URL: https://svnweb.freebsd.org/changeset/ports/408023
Log:
Document webkit CVE-2014-1748.
If people look at the announcement, CVE-2014-3192 is already fixed. This
CVE was against chromium, and the same code in 2.4.9 is in webkit trunk
so I assume it already fixed.
CVE-2013-6663 is for webkit < 2.4.0, and the rest of the CVE's are for
apple products without any attached patches.
PR: 205683
Obtained from: http://webkitgtk.org/security/WSA-2015-0002.html
Modified:
head/security/vuxml/vuln.xml
Modified: head/security/vuxml/vuln.xml
==============================================================================
--- head/security/vuxml/vuln.xml Thu Feb 4 10:44:33 2016 (r408022)
+++ head/security/vuxml/vuln.xml Thu Feb 4 11:03:33 2016 (r408023)
@@ -58,6 +58,36 @@ Notes:
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+ <vuln vid="1091d2d1-cb2e-11e5-b14b-bcaec565249c">
+ <topic>webkit -- UI spoof</topic>
+ <affects>
+ <package>
+ <name>webkit-gtk2</name>
+ <name>webkit-gtk3</name>
+ <range><lt>2.4.9_1</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>webkit reports:</p>
+ <blockquote cite="http://webkitgtk.org/security/WSA-2015-0002.html">
+ <p>The ScrollView::paint function in platform/scroll/ScrollView.cpp
+ in Blink, as used in Google Chrome before 35.0.1916.114, allows
+ remote attackers to spoof the UI by extending scrollbar painting
+ into the parent frame.</p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2014-1748</cvename>
+ <url>http://webkitgtk.org/security/WSA-2015-0002.html</url>
+ </references>
+ <dates>
+ <discovery>2015-12-28</discovery>
+ <entry>2016-02-04</entry>
+ </dates>
+ </vuln>
+
<vuln vid="e78bfc9d-cb1e-11e5-b251-0050562a4d7b">
<topic>py-rsa -- Bleichenbacher'06 signature forgery vulnerability</topic>
<affects>
More information about the svn-ports-all
mailing list