svn commit: r475430 - head/security/vuxml
Carlos J. Puga Medina
cpm at FreeBSD.org
Fri Jul 27 12:34:58 UTC 2018
Author: cpm
Date: Fri Jul 27 12:34:57 2018
New Revision: 475430
URL: https://svnweb.freebsd.org/changeset/ports/475430
Log:
Document new vulnerabilites in www/chromium < 68.0.3440.75
Obtained from: https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html
Modified:
head/security/vuxml/vuln.xml
Modified: head/security/vuxml/vuln.xml
==============================================================================
--- head/security/vuxml/vuln.xml Fri Jul 27 12:24:57 2018 (r475429)
+++ head/security/vuxml/vuln.xml Fri Jul 27 12:34:57 2018 (r475430)
@@ -58,6 +58,98 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+ <vuln vid="b9c525d9-9198-11e8-beba-080027ef1a23">
+ <topic>chromium -- multiple vulnerabilities</topic>
+ <affects>
+ <package>
+ <name>chromium</name>
+ <range><lt>68.0.3440.75</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>Google Chrome Releases reports:</p>
+ <blockquote cite="https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html">
+ <p>42 security fixes in this release, including:</p>
+ <ul>
+ <li>[850350] High CVE-2018-6153: Stack buffer overflow in Skia. Reported by Zhen Zhou of NSFOCUS Security Team on 2018-06-07</li>
+ <li>[848914] High CVE-2018-6154: Heap buffer overflow in WebGL. Reported by Omair on 2018-06-01</li>
+ <li>[842265] High CVE-2018-6155: Use after free in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-05-11</li>
+ <li>[841962] High CVE-2018-6156: Heap buffer overflow in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-05-10</li>
+ <li>[840536] High CVE-2018-6157: Type confusion in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-05-07</li>
+ <li>[812667] Medium CVE-2018-6150: Cross origin information disclosure in Service Workers. Reported by Rob Wu on 2018-02-15</li>
+ <li>[805905] Medium CVE-2018-6151: Bad cast in DevTools. Reported by Rob Wu on 2018-01-25</li>
+ <li>[805445] Medium CVE-2018-6152: Local file write in DevTools. Reported by Rob Wu on 2018-01-24</li>
+ <li>[841280] Medium CVE-2018-6158: Use after free in Blink. Reported by Zhe Jin, Luyao Liu from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd on 2018-05-09</li>
+ <li>[837275] Medium CVE-2018-6159: Same origin policy bypass in ServiceWorker. Reported by Jun Kokatsu (@shhnjk) on 2018-04-26</li>
+ <li>[839822] Medium CVE-2018-6160: URL spoof in Chrome on iOS. Reported by evi1m0 of Bilibili Security Team on 2018-05-04</li>
+ <li>[826552] Medium CVE-2018-6161: Same origin policy bypass in WebAudio. Reported by Jun Kokatsu (@shhnjk) on 2018-03-27</li>
+ <li>[804123] Medium CVE-2018-6162: Heap buffer overflow in WebGL. Reported by Omair on 2018-01-21</li>
+ <li>[849398] Medium CVE-2018-6163: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-06-04</li>
+ <li>[848786] Medium CVE-2018-6164: Same origin policy bypass in ServiceWorker. Reported by Jun Kokatsu (@shhnjk) on 2018-06-01</li>
+ <li>[847718] Medium CVE-2018-6165: URL spoof in Omnibox. Reported by evi1m0 of Bilibili Security Team on 2018-05-30</li>
+ <li>[835554] Medium CVE-2018-6166: URL spoof in Omnibox. Reported by Lnyas Zhang on 2018-04-21</li>
+ <li>[833143] Medium CVE-2018-6167: URL spoof in Omnibox. Reported by Lnyas Zhang on 2018-04-15</li>
+ <li>[828265] Medium CVE-2018-6168: CORS bypass in Blink. Reported by Gunes Acar and Danny Y. Huang of Princeton University, Frank Li of UC Berkeley on 2018-04-03</li>
+ <li>[394518] Medium CVE-2018-6169: Permissions bypass in extension installation. Reported by Sam P on 2014-07-16</li>
+ <li>[862059] Medium CVE-2018-6170: Type confusion in PDFium. Reported by Anonymous on 2018-07-10</li>
+ <li>[851799] Medium CVE-2018-6171: Use after free in WebBluetooth. Reported by amazon at mimetics.ca on 2018-06-12</li>
+ <li>[847242] Medium CVE-2018-6172: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-05-28</li>
+ <li>[836885] Medium CVE-2018-6173: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-04-25</li>
+ <li>[835299] Medium CVE-2018-6174: Integer overflow in SwiftShader. Reported by Mark Brand of Google Project Zero on 2018-04-20</li>
+ <li>[826019] Medium CVE-2018-6175: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-03-26</li>
+ <li>[666824] Medium CVE-2018-6176: Local user privilege escalation in Extensions. Reported by Jann Horn of Google Project Zero on 2016-11-18</li>
+ <li>[826187] Low CVE-2018-6177: Cross origin information leak in Blink. Reported by Ron Masas (Imperva) on 2018-03-27</li>
+ <li>[823194] Low CVE-2018-6178: UI spoof in Extensions. Reported by Khalil Zhani on 2018-03-19</li>
+ <li>[816685] Low CVE-2018-6179: Local file information leak in Extensions. Reported by Anonymous on 2018-02-26</li>
+ <li>[797461] Low CVE-2018-6044: Request privilege escalation in Extensions. Reported by Wob Wu on 2017-12-23</li>
+ <li>[791324] Low CVE-2018-4117: Cross origin information leak in Blink. Reported by AhsanEjaz - @AhsanEjazA on 2017-12-03</li>
+ <li>[866821] Various fixes from internal audits, fuzzing and other initiatives</li>
+ </ul>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2018-4117</cvename>
+ <cvename>CVE-2018-6044</cvename>
+ <cvename>CVE-2018-6150</cvename>
+ <cvename>CVE-2018-6151</cvename>
+ <cvename>CVE-2018-6152</cvename>
+ <cvename>CVE-2018-6153</cvename>
+ <cvename>CVE-2018-6154</cvename>
+ <cvename>CVE-2018-6155</cvename>
+ <cvename>CVE-2018-6156</cvename>
+ <cvename>CVE-2018-6157</cvename>
+ <cvename>CVE-2018-6158</cvename>
+ <cvename>CVE-2018-6159</cvename>
+ <cvename>CVE-2018-6160</cvename>
+ <cvename>CVE-2018-6161</cvename>
+ <cvename>CVE-2018-6162</cvename>
+ <cvename>CVE-2018-6163</cvename>
+ <cvename>CVE-2018-6164</cvename>
+ <cvename>CVE-2018-6165</cvename>
+ <cvename>CVE-2018-6166</cvename>
+ <cvename>CVE-2018-6167</cvename>
+ <cvename>CVE-2018-6168</cvename>
+ <cvename>CVE-2018-6169</cvename>
+ <cvename>CVE-2018-6170</cvename>
+ <cvename>CVE-2018-6171</cvename>
+ <cvename>CVE-2018-6172</cvename>
+ <cvename>CVE-2018-6173</cvename>
+ <cvename>CVE-2018-6174</cvename>
+ <cvename>CVE-2018-6175</cvename>
+ <cvename>CVE-2018-6176</cvename>
+ <cvename>CVE-2018-6177</cvename>
+ <cvename>CVE-2018-6178</cvename>
+ <cvename>CVE-2018-6179</cvename>
+ <url>https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html</url>
+ </references>
+ <dates>
+ <discovery>2018-07-24</discovery>
+ <entry>2018-07-27</entry>
+ </dates>
+ </vuln>
+
<vuln vid="3849e28f-8693-11e8-9610-9c5c8e75236a">
<topic>curl -- SMTP send heap buffer overflow</topic>
<affects>
More information about the svn-ports-all
mailing list