svn commit: r489329 - head/security/vuxml
Carlos J. Puga Medina
cpm at FreeBSD.org
Sat Jan 5 13:10:57 UTC 2019
Author: cpm
Date: Sat Jan 5 13:10:55 2019
New Revision: 489329
URL: https://svnweb.freebsd.org/changeset/ports/489329
Log:
Document new vulnerabilities in www/chromium < 71.0.3578.80
Obtained from: https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html
Modified:
head/security/vuxml/vuln.xml
Modified: head/security/vuxml/vuln.xml
==============================================================================
--- head/security/vuxml/vuln.xml Sat Jan 5 12:05:12 2019 (r489328)
+++ head/security/vuxml/vuln.xml Sat Jan 5 13:10:55 2019 (r489329)
@@ -58,6 +58,96 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+ <vuln vid="546d4dd4-10ea-11e9-b407-080027ef1a23">
+ <topic>chromium -- multiple vulnerabilities</topic>
+ <affects>
+ <package>
+ <name>chromium</name>
+ <range><lt>71.0.3578.80</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>Google Chrome Releases reports:</p>
+ <blockquote cite="https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html">
+ <p>43 security fixes in this release, including:</p>
+ <ul>
+ <li>High CVE-2018-17480: Out of bounds write in V8</li>
+ <li>High CVE-2018-17481: Use after free in PDFium</li>
+ <li>High CVE-2018-18335: Heap buffer overflow in Skia</li>
+ <li>High CVE-2018-18336: Use after free in PDFium</li>
+ <li>High CVE-2018-18337: Use after free in Blink</li>
+ <li>High CVE-2018-18338: Heap buffer overflow in Canvas</li>
+ <li>High CVE-2018-18339: Use after free in WebAudio</li>
+ <li>High CVE-2018-18340: Use after free in MediaRecorder</li>
+ <li>High CVE-2018-18341: Heap buffer overflow in Blink</li>
+ <li>High CVE-2018-18342: Out of bounds write in V8</li>
+ <li>High CVE-2018-18343: Use after free in Skia</li>
+ <li>High CVE-2018-18344: Inappropriate implementation in Extensions</li>
+ <li>High To be allocated: Multiple issues in SQLite via WebSQL</li>
+ <li>Medium CVE-2018-18345: Inappropriate implementation in Site Isolation</li>
+ <li>Medium CVE-2018-18346: Incorrect security UI in Blink</li>
+ <li>Medium CVE-2018-18347: Inappropriate implementation in Navigation</li>
+ <li>Medium CVE-2018-18348: Inappropriate implementation in Omnibox</li>
+ <li>Medium CVE-2018-18349: Insufficient policy enforcement in Blink</li>
+ <li>Medium CVE-2018-18350: Insufficient policy enforcement in Blink</li>
+ <li>Medium CVE-2018-18351: Insufficient policy enforcement in Navigation</li>
+ <li>Medium CVE-2018-18352: Inappropriate implementation in Media</li>
+ <li>Medium CVE-2018-18353: Inappropriate implementation in Network Authentication</li>
+ <li>Medium CVE-2018-18354: Insufficient data validation in Shell Integration</li>
+ <li>Medium CVE-2018-18355: Insufficient policy enforcement in URL Formatter</li>
+ <li>Medium CVE-2018-18356: Use after free in Skia</li>
+ <li>Medium CVE-2018-18357: Insufficient policy enforcement in URL Formatter</li>
+ <li>Medium CVE-2018-18358: Insufficient policy enforcement in Proxy</li>
+ <li>Medium CVE-2018-18359: Out of bounds read in V8</li>
+ <li>Low To be allocated: Inappropriate implementation in PDFium</li>
+ <li>Low To be allocated: Use after free in Extensions</li>
+ <li>Low To be allocated: Inappropriate implementation in Navigation</li>
+ <li>Low To be allocated: Inappropriate implementation in Navigation</li>
+ <li>Low To be allocated: Insufficient policy enforcement in Navigation</li>
+ <li>Low To be allocated: Insufficient policy enforcement in URL Formatter</li>
+ <li>Medium To be allocated: Insufficient policy enforcement in Payments</li>
+ <li>Various fixes from internal audits, fuzzing and other initiatives</li>
+ </ul>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2018-17480</cvename>
+ <cvename>CVE-2018-17481</cvename>
+ <cvename>CVE-2018-18335</cvename>
+ <cvename>CVE-2018-18336</cvename>
+ <cvename>CVE-2018-18337</cvename>
+ <cvename>CVE-2018-18338</cvename>
+ <cvename>CVE-2018-18339</cvename>
+ <cvename>CVE-2018-18340</cvename>
+ <cvename>CVE-2018-18341</cvename>
+ <cvename>CVE-2018-18342</cvename>
+ <cvename>CVE-2018-18343</cvename>
+ <cvename>CVE-2018-18344</cvename>
+ <cvename>CVE-2018-18345</cvename>
+ <cvename>CVE-2018-18346</cvename>
+ <cvename>CVE-2018-18347</cvename>
+ <cvename>CVE-2018-18348</cvename>
+ <cvename>CVE-2018-18349</cvename>
+ <cvename>CVE-2018-18350</cvename>
+ <cvename>CVE-2018-18351</cvename>
+ <cvename>CVE-2018-18352</cvename>
+ <cvename>CVE-2018-18353</cvename>
+ <cvename>CVE-2018-18354</cvename>
+ <cvename>CVE-2018-18355</cvename>
+ <cvename>CVE-2018-18356</cvename>
+ <cvename>CVE-2018-18357</cvename>
+ <cvename>CVE-2018-18358</cvename>
+ <cvename>CVE-2018-18359</cvename>
+ <url>https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html</url>
+ </references>
+ <dates>
+ <discovery>2018-12-04</discovery>
+ <entry>2019-01-05</entry>
+ </dates>
+ </vuln>
+
<vuln vid="3e41c1a6-10bc-11e9-bd85-fcaa147e860e">
<topic>Django -- Content spoofing possibility in the default 404 page</topic>
<affects>
More information about the svn-ports-head
mailing list