svn commit: r468227 - head/security/vuxml
Thomas Zander
riggs at FreeBSD.org
Tue Apr 24 18:07:22 UTC 2018
Author: riggs
Date: Tue Apr 24 18:07:21 2018
New Revision: 468227
URL: https://svnweb.freebsd.org/changeset/ports/468227
Log:
Document vulnerabilities in chromium before 66.0.3359.117
Submitted by: tommi.pernila at iki.fi (via mail to ports-secteam)
Reviewed by: riggs
Modified:
head/security/vuxml/vuln.xml
Modified: head/security/vuxml/vuln.xml
==============================================================================
--- head/security/vuxml/vuln.xml Tue Apr 24 18:05:23 2018 (r468226)
+++ head/security/vuxml/vuln.xml Tue Apr 24 18:07:21 2018 (r468227)
@@ -58,6 +58,101 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+ <vuln vid="36ff7a74-47b1-11e8-a7d6-54e1ad544088">
+ <topic>chromium -- vulnerability</topic>
+ <affects>
+ <package>
+ <name>chromium</name>
+ <range><lt>66.0.3359.117</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>Google Chrome Releases reports:</p>
+ <blockquote cite="https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html">
+ <p>62 security fixes in this release:</p>
+ <ul>
+ <li>[826626] Critical CVE-2018-6085: Use after free in Disk Cache. Reported by Ned Williamson on 2018-03-28</li>
+ <li>[827492] Critical CVE-2018-6086: Use after free in Disk Cache. Reported by Ned Williamson on 2018-03-30</li>
+ <li>[813876] High CVE-2018-6087: Use after free in WebAssembly. Reported by Anonymous on 2018-02-20</li>
+ <li>[822091] High CVE-2018-6088: Use after free in PDFium. Reported by Anonymous on 2018-03-15</li>
+ <li>[808838] High CVE-2018-6089: Same origin policy bypass in Service Worker. Reported by Rob Wu on 2018-02-04</li>
+ <li>[820913] High CVE-2018-6090: Heap buffer overflow in Skia. Reported by ZhanJia Song on 2018-03-12</li>
+ <li>[771933] High CVE-2018-6091: Incorrect handling of plug-ins by Service Worker. Reported by Jun Kokatsu (@shhnjk) on 2017-10-05</li>
+ <li>[819869] High CVE-2018-6092: Integer overflow in WebAssembly. Reported by Natalie Silvanovich of Google Project Zero on 2018-03-08</li>
+ <li>[780435] Medium CVE-2018-6093: Same origin bypass in Service Worker. Reported by Jun Kokatsu (@shhnjk) on 2017-11-01</li>
+ <li>[633030] Medium CVE-2018-6094: Exploit hardening regression in Oilpan. Reported by Chris Rohlf on 2016-08-01</li>
+ <li>[637098] Medium CVE-2018-6095: Lack of meaningful user interaction requirement before file upload. Reported by Abdulrahman Alqabandi (@qab) on 2016-08-11</li>
+ <li>[776418] Medium CVE-2018-6096: Fullscreen UI spoof. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-10-19</li>
+ <li>[806162] Medium CVE-2018-6097: Fullscreen UI spoof. Reported by xisigr of Tencent's Xuanwu Lab on 2018-01-26</li>
+ <li>[798892] Medium CVE-2018-6098: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-01-03</li>
+ <li>[808825] Medium CVE-2018-6099: CORS bypass in ServiceWorker. Reported by Jun Kokatsu (@shhnjk) on 2018-02-03</li>
+ <li>[811117] Medium CVE-2018-6100: URL spoof in Omnibox. Reported by Lnyas Zhang on 2018-02-11</li>
+ <li>[813540] Medium CVE-2018-6101: Insufficient protection of remote debugging prototol in DevTools . Reported by Rob Wu on 2018-02-19</li>
+ <li>[813814] Medium CVE-2018-6102: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-02-20</li>
+ <li>[816033] Medium CVE-2018-6103: UI spoof in Permissions. Reported by Khalil Zhani on 2018-02-24</li>
+ <li>[820068] Medium CVE-2018-6104: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-03-08</li>
+ <li>[803571] Medium CVE-2018-6105: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-01-18</li>
+ <li>[805729] Medium CVE-2018-6106: Incorrect handling of promises in V8. Reported by lokihardt of Google Project Zero on 2018-01-25</li>
+ <li>[808316] Medium CVE-2018-6107: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-02-02</li>
+ <li>[816769] Medium CVE-2018-6108: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-02-27</li>
+ <li>[710190] Low CVE-2018-6109: Incorrect handling of files by FileAPI. Reported by Dominik Weber (@DoWeb_) on 2017-04-10</li>
+ <li>[777737] Low CVE-2018-6110: Incorrect handling of plaintext files via file:// . Reported by Wenxiang Qian (aka blastxiang) on 2017-10-24</li>
+ <li>[780694] Low CVE-2018-6111: Heap-use-after-free in DevTools. Reported by Khalil Zhani on 2017-11-02</li>
+ <li>[798096] Low CVE-2018-6112: Incorrect URL handling in DevTools. Reported by Rob Wu on 2017-12-29</li>
+ <li>[805900] Low CVE-2018-6113: URL spoof in Navigation. Reported by Khalil Zhani on 2018-01-25</li>
+ <li>[811691] Low CVE-2018-6114: CSP bypass. Reported by Lnyas Zhang on 2018-02-13</li>
+ <li>[819809] Low CVE-2018-6115: SmartScreen bypass in downloads. Reported by James Feher on 2018-03-07</li>
+ <li>[822266] Low CVE-2018-6116: Incorrect low memory handling in WebAssembly. Reported by Jin from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd. on 2018-03-15</li>
+ <li>[822465] Low CVE-2018-6117: Confusing autofill settings. Reported by Spencer Dailey on 2018-03-15</li>
+ <li>[822424] Low CVE-2018-6084: Incorrect use of Distributed Objects in Google Software Updater on MacOS. Reported by Ian Beer of Google Project Zero on 2018-03-15</li>
+ </ul>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <url>https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html</url>
+ <cvename>CVE-2018-6085</cvename>
+ <cvename>CVE-2018-6086</cvename>
+ <cvename>CVE-2018-6087</cvename>
+ <cvename>CVE-2018-6088</cvename>
+ <cvename>CVE-2018-6089</cvename>
+ <cvename>CVE-2018-6090</cvename>
+ <cvename>CVE-2018-6091</cvename>
+ <cvename>CVE-2018-6092</cvename>
+ <cvename>CVE-2018-6093</cvename>
+ <cvename>CVE-2018-6094</cvename>
+ <cvename>CVE-2018-6095</cvename>
+ <cvename>CVE-2018-6096</cvename>
+ <cvename>CVE-2018-6097</cvename>
+ <cvename>CVE-2018-6098</cvename>
+ <cvename>CVE-2018-6099</cvename>
+ <cvename>CVE-2018-6100</cvename>
+ <cvename>CVE-2018-6101</cvename>
+ <cvename>CVE-2018-6102</cvename>
+ <cvename>CVE-2018-6103</cvename>
+ <cvename>CVE-2018-6104</cvename>
+ <cvename>CVE-2018-6105</cvename>
+ <cvename>CVE-2018-6106</cvename>
+ <cvename>CVE-2018-6107</cvename>
+ <cvename>CVE-2018-6108</cvename>
+ <cvename>CVE-2018-6109</cvename>
+ <cvename>CVE-2018-6110</cvename>
+ <cvename>CVE-2018-6111</cvename>
+ <cvename>CVE-2018-6112</cvename>
+ <cvename>CVE-2018-6113</cvename>
+ <cvename>CVE-2018-6114</cvename>
+ <cvename>CVE-2018-6115</cvename>
+ <cvename>CVE-2018-6116</cvename>
+ <cvename>CVE-2018-6117</cvename>
+ <cvename>CVE-2018-6084</cvename>
+ </references>
+ <dates>
+ <discovery>2017-04-10</discovery>
+ <entry>2018-04-24</entry>
+ </dates>
+ </vuln>
+
<vuln vid="d8382a69-4728-11e8-ba83-0011d823eebd">
<topic>mbed TLS (PolarSSL) -- multiple vulnerabilities</topic>
<affects>
More information about the svn-ports-head
mailing list