svn commit: r410211 - head/security/vuxml

Sat Mar 5 20:39:51 UTC 2016

Author: cmt
Date: Sat Mar  5 20:39:49 2016
New Revision: 410211
URL: https://svnweb.freebsd.org/changeset/ports/410211

Log:
  Document recent chromium vulnerabilities
  
  Approved by:	miwi (mentor), rene (mentor)
  Obtained from:	http://googlechromereleases.blogspot.de/2016/03/stable-channel-update.html

Modified:
  head/security/vuxml/vuln.xml

Modified: head/security/vuxml/vuln.xml
==============================================================================

--- head/security/vuxml/vuln.xml	Sat Mar  5 20:36:18 2016	(r410210)
+++ head/security/vuxml/vuln.xml	Sat Mar  5 20:39:49 2016	(r410211)
@@ -58,6 +58,59 @@ Notes:
   * Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
 -->
 <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+  <vuln vid="f85fa236-e2a6-412e-b5c7-c42120892de5">
+    <topic>chromium -- multiple vulnerabilities</topic>
+    <affects>
+      <package>
+	<name>chromium</name>
+	<name>chromium-npapi</name>
+	<name>chromium-pulse</name>
+	<range><lt>49.0.2623.75</lt></range>
+      </package>
+    </affects>
+    <description>
+      <body xmlns="http://www.w3.org/1999/xhtml">
+	<p>Google Chrome Releases reports:</p>
+	<blockquote cite="http://googlechromereleases.blogspot.de/2016/03/stable-channel-update.html">
+	  <p>[560011] High CVE-2016-1630: Same-origin bypass in Blink.</p>
+	  <p>[569496] High CVE-2016-1631: Same-origin bypass in Pepper Plugin.</p>
+	  <p>[549986] High CVE-2016-1632: Bad cast in Extensions.</p>
+	  <p>[572537] High CVE-2016-1633: Use-after-free in Blink.</p>
+	  <p>[559292] High CVE-2016-1634: Use-after-free in Blink.</p>
+	  <p>[585268] High CVE-2016-1635: Use-after-free in Blink.</p>
+	  <p>[584155] High CVE-2016-1636: SRI Validation Bypass.</p>
+	  <p>[555544] Medium CVE-2016-1637: Information Leak in Skia.</p>
+	  <p>[585282] Medium CVE-2016-1638: WebAPI Bypass.</p>
+	  <p>[572224] Medium CVE-2016-1639: Use-after-free in WebRTC.</p>
+	  <p>[550047] Medium CVE-2016-1640: Origin confusion in Extensions UI.</p>
+	  <p>[583718] Medium CVE-2016-1641: Use-after-free in Favicon.</p>
+	  <p>[591402] CVE-2016-1642: Various fixes from internal audits, fuzzing and other initiatives.</p>
+	  <p>Multiple vulnerabilities in V8 fixed.</p>
+	</blockquote>
+      </body>
+    </description>
+    <references>
+      <cvename>CVE-2016-1630</cvename>
+      <cvename>CVE-2016-1631</cvename>
+      <cvename>CVE-2016-1632</cvename>
+      <cvename>CVE-2016-1633</cvename>
+      <cvename>CVE-2016-1634</cvename>
+      <cvename>CVE-2016-1635</cvename>
+      <cvename>CVE-2016-1636</cvename>
+      <cvename>CVE-2016-1637</cvename>
+      <cvename>CVE-2016-1638</cvename>
+      <cvename>CVE-2016-1639</cvename>
+      <cvename>CVE-2016-1640</cvename>
+      <cvename>CVE-2016-1641</cvename>
+      <cvename>CVE-2016-1642</cvename>
+      <url>http://googlechromereleases.blogspot.de/2016/03/stable-channel-update.html</url>
+    </references>
+    <dates>
+      <discovery>2016-03-02</discovery>
+      <entry>2016-03-05</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="6b3591ea-e2d2-11e5-a6be-5453ed2e2b49">
     <topic>libssh -- weak Diffie-Hellman secret generation</topic>
     <affects>
