diff options
| author | riggs <riggs@FreeBSD.org> | 2018-02-28 04:15:39 +0800 |
|---|---|---|
| committer | riggs <riggs@FreeBSD.org> | 2018-02-28 04:15:39 +0800 |
| commit | dcb4371c17cb4f17f65859e5f476631df2af0451 (patch) | |
| tree | 0da0a5fa0c6455863bff0470a7bafd3dd9b15255 | |
| parent | e6ca36c861ea967331a2032e2c8cf256d62293e4 (diff) | |
| download | freebsd-ports-gnome-dcb4371c17cb4f17f65859e5f476631df2af0451.tar.gz freebsd-ports-gnome-dcb4371c17cb4f17f65859e5f476631df2af0451.tar.zst freebsd-ports-gnome-dcb4371c17cb4f17f65859e5f476631df2af0451.zip | |
Document multiple vulnerabilities in chromium 64.0.3282.119
Reported by: Tommi Pernila <tommi.pernila@iki.fi> (via e-mail)
| -rw-r--r-- | security/vuxml/vuln.xml | 76 |
1 files changed, 76 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 2e06833e6a65..2c70bdc2966e 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -58,6 +58,82 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="8e986b2b-1baa-11e8-a944-54ee754af08e"> + <topic>chromium -- multiple vulnerabilities</topic> + <affects> + <package> + <name>chromium</name> + <range><lt>64.0.3282.119</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>Google Chrome Releases reports:</p> + <blockquote cite="https://chromereleases.googleblog.com/2018/01/stable-channel-update-for-desktop_24.html"> + <p>Several security fixes in this release, including:</p> + <ul> + <li>[780450] High CVE-2018-6031: Use after free in PDFium. Reported by Anonymous on 2017-11-01</li> + <li>[787103] High CVE-2018-6032: Same origin bypass in Shared Worker. Reported by Jun Kokatsu (@shhnjk) on 2017-11-20</li> + <li>[793620] High CVE-2018-6033: Race when opening downloaded files. Reported by Juho Nurminen on 2017-12-09</li> + <li>[784183] Medium CVE-2018-6034: Integer overflow in Blink. Reported by Tobias Klein (www.trapkit.de) on 2017-11-12</li> + <li>[797500] Medium CVE-2018-6035: Insufficient isolation of devtools from extensions. Reported by Rob Wu on 2017-12-23</li> + <li>[797500] Medium CVE-2018-6035: Insufficient isolation of devtools from extensions. Reported by Rob Wu on 2017-12-23</li> + <li>[753645] Medium CVE-2018-6037: Insufficient user gesture requirements in autofill. Reported by Paul Stone of Context Information Security on + 2017-08-09</li> + <li>[774174] Medium CVE-2018-6038: Heap buffer overflow in WebGL. Reported by cloudfuzzer on 2017-10-12</li> + <li>[775527] Medium CVE-2018-6039: XSS in DevTools. Reported by Juho Nurminen on 2017-10-17</li> + <li>[778658] Medium CVE-2018-6040: Content security policy bypass. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-10-26</li> + <li>[760342] Medium CVE-2018-6041: URL spoof in Navigation. Reported by Luan Herrera on 2017-08-29</li> + <li>[773930] Medium CVE-2018-6042: URL spoof in OmniBox. Reported by Khalil Zhani on 2017-10-12</li> + <li>[785809] Medium CVE-2018-6043: Insufficient escaping with external URL handlers. Reported by 0x09AL on 2017-11-16</li> + <li>[797497] Medium CVE-2018-6045: Insufficient isolation of devtools from extensions. Reported by Rob Wu on 2017-12-23</li> + <li>[798163] Medium CVE-2018-6046: Insufficient isolation of devtools from extensions. Reported by Rob Wu on 2017-12-31</li> + <li>[799847] Medium CVE-2018-6047: Cross origin URL leak in WebGL. Reported by Masato Kinugawa on 2018-01-08</li> + <li>[763194] Low CVE-2018-6048: Referrer policy bypass in Blink. Reported by Jun Kokatsu (@shhnjk) on 2017-09-08</li> + <li>[771848] Low CVE-2017-15420: URL spoofing in Omnibox. Reported by Drew Springall (@_aaspring_) on 2017-10-05</li> + <li>[774438] Low CVE-2018-6049: UI spoof in Permissions. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-10-13</li> + <li>[774842] Low CVE-2018-6050: URL spoof in OmniBox. Reported by Jonathan Kew on 2017-10-15</li> + <li>[441275] Low CVE-2018-6051: Referrer leak in XSS Auditor. Reported by Antonio Sanso (@asanso) on 2014-12-11</li> + <li>[615608] Low CVE-2018-6052: Incomplete no-referrer policy implementation. Reported by Tanner Emek on 2016-05-28</li> + <li>[758169] Low CVE-2018-6053: Leak of page thumbnails in New Tab Page. Reported by Asset Kabdenov on 2017-08-23</li> + <li>[797511] Low CVE-2018-6054: Use after free in WebUI. Reported by Rob Wu on 2017-12-24</li> + </ul> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2018-6031</cvename> + <cvename>CVE-2018-6032</cvename> + <cvename>CVE-2018-6033</cvename> + <cvename>CVE-2018-6034</cvename> + <cvename>CVE-2018-6035</cvename> + <cvename>CVE-2018-6036</cvename> + <cvename>CVE-2018-6037</cvename> + <cvename>CVE-2018-6038</cvename> + <cvename>CVE-2018-6039</cvename> + <cvename>CVE-2018-6040</cvename> + <cvename>CVE-2018-6041</cvename> + <cvename>CVE-2018-6042</cvename> + <cvename>CVE-2018-6043</cvename> + <cvename>CVE-2018-6045</cvename> + <cvename>CVE-2018-6046</cvename> + <cvename>CVE-2018-6047</cvename> + <cvename>CVE-2018-6048</cvename> + <cvename>CVE-2017-15420</cvename> + <cvename>CVE-2018-6049</cvename> + <cvename>CVE-2018-6050</cvename> + <cvename>CVE-2018-6051</cvename> + <cvename>CVE-2018-6052</cvename> + <cvename>CVE-2018-6053</cvename> + <cvename>CVE-2018-6054</cvename> + <url>https://chromereleases.googleblog.com/2018/01/stable-channel-update-for-desktop_24.html</url> + </references> + <dates> + <discovery>2017-08-09</discovery> + <entry>2018-02-27</entry> + </dates> + </vuln> + <vuln vid="55c4233e-1844-11e8-a712-0025908740c2"> <topic>tomcat -- Security constraints ignored or applied too late</topic> <affects> |