svn commit: r428555 - head/security/vuxml

Wed Dec 14 10:19:09 UTC 2016

Author: jbeich
Date: Wed Dec 14 10:19:07 2016
New Revision: 428555
URL: https://svnweb.freebsd.org/changeset/ports/428555

Log:
  security/vuxml: mark www/firefox < 50.1_1,1 as vulnerable

Modified:
  head/security/vuxml/vuln.xml

Modified: head/security/vuxml/vuln.xml
==============================================================================

--- head/security/vuxml/vuln.xml	Wed Dec 14 09:58:26 2016	(r428554)
+++ head/security/vuxml/vuln.xml	Wed Dec 14 10:19:07 2016	(r428555)
@@ -58,6 +58,76 @@ Notes:
   * Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
 -->
 <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+  <vuln vid="512c0ffd-cd39-4da4-b2dc-81ff4ba8e238">
+    <topic>mozilla -- multiple vulnerabilities</topic>
+    <affects>
+      <package>
+	<name>firefox</name>
+	<range><lt>50.1.0_1,1</lt></range>
+      </package>
+      <package>
+	<name>seamonkey</name>
+	<name>linux-seamonkey</name>
+	<range><lt>2.47</lt></range>
+      </package>
+      <package>
+	<name>firefox-esr</name>
+	<range><lt>45.6.0,1</lt></range>
+      </package>
+      <package>
+	<name>linux-firefox</name>
+	<range><lt>45.6.0,2</lt></range>
+      </package>
+      <package>
+	<name>libxul</name>
+	<name>thunderbird</name>
+	<name>linux-thunderbird</name>
+	<range><lt>45.6.0</lt></range>
+      </package>
+    </affects>
+    <description>
+      <body xmlns="http://www.w3.org/1999/xhtml">
+	<p>Mozilla Foundation reports:</p>
+	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-94/">
+	<p>CVE-2016-9894: Buffer overflow in SkiaGL</p>
+	<p>CVE-2016-9899: Use-after-free while manipulating DOM events and audio elements</p>
+	<p>CVE-2016-9895: CSP bypass using marquee tag</p>
+	<p>CVE-2016-9896: Use-after-free with WebVR</p>
+	<p>CVE-2016-9897: Memory corruption in libGLES</p>
+	<p>CVE-2016-9898: Use-after-free in Editor while manipulating DOM subtrees</p>
+	<p>CVE-2016-9900: Restricted external resources can be loaded by SVG images through data URLs</p>
+	<p>CVE-2016-9904: Cross-origin information leak in shared atoms</p>
+	<p>CVE-2016-9901: Data from Pocket server improperly sanitized before execution</p>
+	<p>CVE-2016-9902: Pocket extension does not validate the origin of events</p>
+	<p>CVE-2016-9903: XSS injection vulnerability in add-ons SDK</p>
+	<p>CVE-2016-9080: Memory safety bugs fixed in Firefox 50.1</p>
+	<p>CVE-2016-9893: Memory safety bugs fixed in Firefox 50.1 and Firefox ESR 45.6</p>
+	</blockquote>
+      </body>
+    </description>
+    <references>
+      <cvename>CVE-2016-9894</cvename>
+      <cvename>CVE-2016-9899</cvename>
+      <cvename>CVE-2016-9895</cvename>
+      <cvename>CVE-2016-9896</cvename>
+      <cvename>CVE-2016-9897</cvename>
+      <cvename>CVE-2016-9898</cvename>
+      <cvename>CVE-2016-9900</cvename>
+      <cvename>CVE-2016-9904</cvename>
+      <cvename>CVE-2016-9901</cvename>
+      <cvename>CVE-2016-9902</cvename>
+      <cvename>CVE-2016-9903</cvename>
+      <cvename>CVE-2016-9080</cvename>
+      <cvename>CVE-2016-9893</cvename>
+      <url>https://www.mozilla.org/security/advisories/mfsa2016-94/</url>
+      <url>https://www.mozilla.org/security/advisories/mfsa2016-95/</url>
+    </references>
+    <dates>
+      <discovery>2016-12-13</discovery>
+      <entry>2016-12-14</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="54e50cd9-c1a8-11e6-ae1b-002590263bf5">
     <topic>wordpress -- multiple vulnerabilities</topic>
     <affects>
@@ -1238,6 +1308,14 @@ Notes:
 	<range><lt>45.5.1,2</lt></range>
       </package>
       <package>
+	<name>seamonkey</name>
+	<range><lt>2.47</lt></range>
+      </package>
+      <package>
+	<name>linux-seamonkey</name>
+	<range><lt>2.47</lt></range>
+      </package>
+      <package>
 	<name>libxul</name>
 	<range><lt>45.5.1</lt></range>
       </package>
@@ -1268,6 +1346,7 @@ Notes:
     <dates>
       <discovery>2016-11-30</discovery>
       <entry>2016-12-01</entry>
+      <modified>2016-12-14</modified>
     </dates>
   </vuln>
 
