mirror/freebsd-ports
1
0
Fork 0
mirror of https://git.FreeBSD.org/ports.git synced 2024-12-13 03:03:15 +00:00
Code Issues Releases Activity

security/vuxml: mark firefox < 57 as vulnerable

Browse Source
This commit is contained in:
Jan Beich 2017-11-14 19:04:24 +00:00
parent 1199e0caa0
commit 45587e15f8
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=454193
1 changed files with 76 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

76
security/vuxml/vuln.xml
View File

@ -58,6 +58,82 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
<vuln vid="f78eac48-c3d1-4666-8de5-63ceea25a578">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<!-- 56.0.2_10,1 unlike 57.0,1 has CVE-2017-7827 partially unfixed:
bug 1384615, 1386490, 1393840, 1403716 -->
<range><lt>56.0.2_10,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.49.2</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>52.5.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>52.5.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>52.5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-24/">
<p>CVE-2017-7828: Use-after-free of PressShell while restyling layout</p>
<p>CVE-2017-7830: Cross-origin URL information leak through Resource Timing API</p>
<p>CVE-2017-7831: Information disclosure of exposed properties on JavaScript proxy objects</p>
<p>CVE-2017-7832: Domain spoofing through use of dotless 'i' character followed by accent markers</p>
<p>CVE-2017-7833: Domain spoofing with Arabic and Indic vowel marker characters</p>
<p>CVE-2017-7834: data: URLs opened in new tabs bypass CSP protections</p>
<p>CVE-2017-7835: Mixed content blocking incorrectly applies with redirects</p>
<p>CVE-2017-7836: Pingsender dynamically loads libcurl on Linux and OS X</p>
<p>CVE-2017-7837: SVG loaded as &lt;img&gt; can use meta tags to set cookies</p>
<p>CVE-2017-7838: Failure of individual decoding of labels in international domain names triggers punycode display of entire IDN</p>
<p>CVE-2017-7839: Control characters before javascript: URLs defeats self-XSS prevention mechanism</p>
<p>CVE-2017-7840: Exported bookmarks do not strip script elements from user-supplied tags</p>
<p>CVE-2017-7842: Referrer Policy is not always respected for &lt;link&gt; elements</p>
<p>CVE-2017-7827: Memory safety bugs fixed in Firefox 57</p>
<p>CVE-2017-7826: Memory safety bugs fixed in Firefox 57 and Firefox ESR 52.5</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-7826</cvename>
<cvename>CVE-2017-7827</cvename>
<cvename>CVE-2017-7828</cvename>
<cvename>CVE-2017-7830</cvename>
<cvename>CVE-2017-7831</cvename>
<cvename>CVE-2017-7832</cvename>
<cvename>CVE-2017-7833</cvename>
<cvename>CVE-2017-7834</cvename>
<cvename>CVE-2017-7835</cvename>
<cvename>CVE-2017-7836</cvename>
<cvename>CVE-2017-7837</cvename>
<cvename>CVE-2017-7838</cvename>
<cvename>CVE-2017-7839</cvename>
<cvename>CVE-2017-7840</cvename>
<cvename>CVE-2017-7842</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2017-24/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2017-25/</url>
</references>
<dates>
<discovery>2017-11-14</discovery>
<entry>2017-11-14</entry>
</dates>
</vuln>
<vuln vid="27b38d85-c891-11e7-a7bd-cd1209e563f2">
<topic>rubygem-geminabox -- XSS vulnerabilities</topic>
<affects>