FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The VUXML data was last processed by FreshPorts on 2024-05-02 10:37:19 UTC

List all Vulnerabilities, by package

List all Vulnerabilities, by date

k68

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
10f7bc76-0335-4a88-b391-0b05b3a8ce1cNSS -- MD5 downgrade in TLS 1.2 signatures

The Mozilla Project reports:

Security researcher Karthikeyan Bhargavan reported an issue in Network Security Services (NSS) where MD5 signatures in the server signature within the TLS 1.2 ServerKeyExchange message are still accepted. This is an issue since NSS has officially disallowed the accepting MD5 as a hash algorithm in signatures since 2011. This issues exposes NSS based clients such as Firefox to theoretical collision-based forgery attacks.


Discovery 2015-12-22
Entry 2015-12-28
nss
linux-c6-nss
ge 3.20 lt 3.20.2

< 3.19.2.2

linux-firefox
< 43.0.2,1

linux-thunderbird
< 38.5.1

linux-seamonkey
< 2.40

CVE-2015-7575
https://www.mozilla.org/security/advisories/mfsa2015-150/
https://hg.mozilla.org/projects/nss/rev/94e1157f3fbb
0a9e2b72-4cb7-11e1-9146-14dae9ebcf89mozilla -- multiple vulnerabilities

The Mozilla Project reports:

MFSA 2012-01 Miscellaneous memory safety hazards (rv:10.0/ rv:1.9.2.26)

MFSA 2012-02 Overly permissive IPv6 literal syntax

MFSA 2012-03 iframe element exposed across domains via name attribute

MFSA 2012-04 Child nodes from nsDOMAttribute still accessible after removal of nodes

MFSA 2012-05 Frame scripts calling into untrusted objects bypass security checks

MFSA 2012-06 Uninitialized memory appended when encoding icon images may cause information disclosure

MFSA 2012-07 Potential Memory Corruption When Decoding Ogg Vorbis files

MFSA 2012-08 Crash with malformed embedded XSLT stylesheets

MFSA 2012-09 Firefox Recovery Key.html is saved with unsafe permission


Discovery 2012-01-31
Entry 2012-02-01
Modified 2012-03-18
firefox
gt 4.0,1 lt 10.0,1

ge 3.6.*,1 lt 3.6.26

linux-firefox
< 10.0,1

linux-seamonkey
< 2.7

linux-thunderbird
< 10.0

seamonkey
< 2.7

thunderbird
gt 4.0 lt 10.0

gt 3.1.* lt 3.1.18

CVE-2012-0442
CVE-2012-0443
CVE-2011-3670
CVE-2012-0445
CVE-2011-3659
CVE-2012-0446
CVE-2012-0447
CVE-2012-0449
CVE-2012-0450
http://www.mozilla.org/security/announce/2012/mfsa2012-01.html
http://www.mozilla.org/security/announce/2012/mfsa2012-02.html
http://www.mozilla.org/security/announce/2012/mfsa2012-03.html
http://www.mozilla.org/security/announce/2012/mfsa2012-04.html
http://www.mozilla.org/security/announce/2012/mfsa2012-05.html
http://www.mozilla.org/security/announce/2012/mfsa2012-06.html
http://www.mozilla.org/security/announce/2012/mfsa2012-07.html
http://www.mozilla.org/security/announce/2012/mfsa2012-08.html
http://www.mozilla.org/security/announce/2012/mfsa2012-09.html
9c1495ac-8d8c-4789-a0f3-8ca6b476619cmozilla -- multiple vulnerabilities

The Mozilla Project reports:

MFSA 2014-74 Miscellaneous memory safety hazards (rv:33.0 / rv:31.2)

MFSA 2014-75 Buffer overflow during CSS manipulation

MFSA 2014-76 Web Audio memory corruption issues with custom waveforms

MFSA 2014-78 Further uninitialized memory use during GIF

MFSA 2014-79 Use-after-free interacting with text directionality

MFSA 2014-80 Key pinning bypasses

MFSA 2014-81 Inconsistent video sharing within iframe

MFSA 2014-82 Accessing cross-origin objects via the Alarms API


Discovery 2014-10-14
Entry 2014-10-14
Modified 2015-08-12
firefox
< 33.0,1

firefox-esr
< 31.2.0,1

linux-firefox
< 33.0,1

linux-seamonkey
< 2.30

linux-thunderbird
< 31.2.0

seamonkey
< 2.30

thunderbird
< 31.2.0

libxul
< 31.2.0

CVE-2014-1575
CVE-2014-1574
CVE-2014-1576
CVE-2014-1577
CVE-2014-1580
CVE-2014-1581
CVE-2014-1582
CVE-2014-1583
CVE-2014-1584
CVE-2014-1585
CVE-2014-1586
https://www.mozilla.org/security/announce/2014/mfsa2014-74.html
https://www.mozilla.org/security/announce/2014/mfsa2014-75.html
https://www.mozilla.org/security/announce/2014/mfsa2014-76.html
https://www.mozilla.org/security/announce/2014/mfsa2014-78.html
https://www.mozilla.org/security/announce/2014/mfsa2014-79.html
https://www.mozilla.org/security/announce/2014/mfsa2014-80.html
https://www.mozilla.org/security/announce/2014/mfsa2014-81.html
https://www.mozilla.org/security/announce/2014/mfsa2014-82.html
https://www.mozilla.org/security/announce/
1fade8a3-e9e8-11e0-9580-4061862b8c22Mozilla -- multiple vulnerabilities

The Mozilla Project reports:

MFSA 2011-36 Miscellaneous memory safety hazards (rv:7.0 / rv:1.9.2.23)

MFSA 2011-37 Integer underflow when using JavaScript RegExp

MFSA 2011-38 XSS via plugins and shadowed window.location object

MFSA 2011-39 Defense against multiple Location headers due to CRLF Injection

MFSA 2011-40 Code installation through holding down Enter

MFSA 2011-41 Potentially exploitable WebGL crashes

MFSA 2011-42 Potentially exploitable crash in the YARR regular expression library

MFSA 2011-43 loadSubScript unwraps XPCNativeWrapper scope parameter

MFSA 2011-44 Use after free reading OGG headers

MFSA 2011-45 Inferring Keystrokes from motion data


Discovery 2011-09-27
Entry 2011-09-28
firefox
gt 4.0,1 lt 7.0,1

gt 3.6.*,1 lt 3.6.23,1

libxul
gt 1.9.2.* lt 1.9.2.23

linux-firefox
< 7.0,1

linux-seamonkey
< 2.4

linux-thunderbird
< 7.0

seamonkey
< 2.4

thunderbird
gt 4.0 lt 7.0

< 3.1.15

CVE-2011-2372
CVE-2011-2995
CVE-2011-2996
CVE-2011-2997
CVE-2011-2999
CVE-2011-3000
CVE-2011-3001
CVE-2011-3002
CVE-2011-3003
CVE-2011-3004
CVE-2011-3005
CVE-2011-3232
http://www.mozilla.org/security/announce/2011/mfsa2011-36.html
http://www.mozilla.org/security/announce/2011/mfsa2011-37.html
http://www.mozilla.org/security/announce/2011/mfsa2011-38.html
http://www.mozilla.org/security/announce/2011/mfsa2011-39.html
http://www.mozilla.org/security/announce/2011/mfsa2011-40.html
http://www.mozilla.org/security/announce/2011/mfsa2011-41.html
http://www.mozilla.org/security/announce/2011/mfsa2011-42.html
http://www.mozilla.org/security/announce/2011/mfsa2011-43.html
http://www.mozilla.org/security/announce/2011/mfsa2011-44.html
http://www.mozilla.org/security/announce/2011/mfsa2011-45.html
dfe40cff-9c3f-11e0-9bec-6c626dd55a41mozilla -- multiple vulnerabilities

The Mozilla Project reports:

MFSA 2011-19 Miscellaneous memory safety hazards (rv:3.0/1.9.2.18)

MFSA 2011-20 Use-after-free vulnerability when viewing XUL document with script disabled

MFSA 2011-21 Memory corruption due to multipart/x-mixed-replace images

MFSA 2011-22 Integer overflow and arbitrary code execution in Array.reduceRight()

MFSA 2011-23 Multiple dangling pointer vulnerabilities

MFSA 2011-24 Cookie isolation error

MFSA 2011-25 Stealing of cross-domain images using WebGL textures

MFSA 2011-26 Multiple WebGL crashes

MFSA 2011-27 XSS encoding hazard with inline SVG

MFSA 2011-28 Non-whitelisted site can trigger xpinstall


Discovery 2011-06-21
Entry 2011-06-21
Modified 2011-06-23
firefox
gt 3.5.*,1 lt 3.5.20,1

gt 3.6.*,1 lt 3.6.18,1

gt 4.0.*,1 lt 5.0,1

linux-firefox
< 3.6.18,1

thunderbird
< 3.1.11

linux-thunderbird
< 3.1.11

http://www.mozilla.org/security/announce/2011/mfsa2011-19.html
http://www.mozilla.org/security/announce/2011/mfsa2011-20.html
http://www.mozilla.org/security/announce/2011/mfsa2011-21.html
http://www.mozilla.org/security/announce/2011/mfsa2011-22.html
http://www.mozilla.org/security/announce/2011/mfsa2011-23.html
http://www.mozilla.org/security/announce/2011/mfsa2011-24.html
http://www.mozilla.org/security/announce/2011/mfsa2011-25.html
http://www.mozilla.org/security/announce/2011/mfsa2011-26.html
http://www.mozilla.org/security/announce/2011/mfsa2011-27.html
http://www.mozilla.org/security/announce/2011/mfsa2011-28.html
34e60332-2448-4ed6-93f0-12713749f250libvpx -- multiple buffer overflows

The Mozilla Project reports:

Security researcher Abhishek Arya (Inferno) of the Google Chrome Security Team used the Address Sanitizer tool to discover two buffer overflow issues in the Libvpx library used for WebM video when decoding a malformed WebM video file. These buffer overflows result in potentially exploitable crashes.


Discovery 2015-08-11
Entry 2015-08-11
Modified 2015-08-14
libvpx
< 1.4.0.488

firefox
< 40.0,1

linux-firefox
< 40.0,1

CVE-2015-4485
CVE-2015-4486
https://www.mozilla.org/security/advisories/mfsa2015-89/
b7e23050-2d5d-4e61-9b48-62e89db222camozilla -- multiple vulnerabilities

Mozilla Foundation reports:

CVE-2017-7843: Web worker in Private Browsing mode can write IndexedDB data

CVE-2017-7844: Visited history information leak through SVG image


Discovery 2017-11-29
Entry 2017-12-05
firefox
ge 57.0,1 lt 57.0.1,1

< 56.0.2_11,1

waterfox
< 56.0.s20171130

seamonkey
linux-seamonkey
< 2.49.2

firefox-esr
< 52.5.1,1

linux-firefox
< 52.5.1,2

CVE-2017-7843
CVE-2017-7844
https://www.mozilla.org/security/advisories/mfsa2017-27/
8eee06d4-c21d-4f07-a669-455151ff426fmozilla -- multiple vulnerabilities

The Mozilla Project reports:

MFSA 2015-78 Same origin violation and local file stealing via PDF reader


Discovery 2015-08-06
Entry 2015-08-07
firefox
< 39.0.3,1

linux-firefox
< 39.0.3,1

firefox-esr
< 38.1.1,1

CVE-2015-4495
https://www.mozilla.org/security/advisories/mfsa2015-78/
2273879e-8a2f-11dd-a6fe-0030843d3802mozilla -- multiple vulnerabilities

The Mozilla Foundation reports:

MFSA 2008-37

UTF-8 URL stack buffer overflow

MFSA 2008-38

nsXMLDocument::OnChannelRedirect() same-origin violation

MFSA 2008-39

Privilege escalation using feed preview page and XSS flaw

MFSA 2008-40

Forced mouse drag

MFSA 2008-41

Privilege escalation via XPCnativeWrapper pollution

MFSA 2008-42

Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17)

MFSA 2008-43

BOM characters stripped from JavaScript before execution

MFSA 2008-44

resource: traversal vulnerabilities

MFSA 2008-45

XBM image uninitialized memory reading


Discovery 2008-09-24
Entry 2008-09-24
Modified 2009-12-12
firefox
< 2.0.0.17,1

gt 3.*,1 lt 3.0.2,1

linux-firefox
linux-firefox-devel
< 2.0.0.17

seamonkey
linux-seamonkey
< 1.1.12

thunderbird
linux-thunderbird
< 2.0.0.17

flock
linux-flock
< 2.0

linux-seamonkey-devel
gt 0

CVE-2008-0016
CVE-2008-3835
CVE-2008-3836
CVE-2008-3837
CVE-2008-4058
CVE-2008-4059
CVE-2008-4060
CVE-2008-4061
CVE-2008-4062
CVE-2008-4063
CVE-2008-4064
CVE-2008-4065
CVE-2008-4067
CVE-2008-4068
CVE-2008-4069
http://www.mozilla.org/security/announce/2008/mfsa2008-37.html
http://www.mozilla.org/security/announce/2008/mfsa2008-38.html
http://www.mozilla.org/security/announce/2008/mfsa2008-39.html
http://www.mozilla.org/security/announce/2008/mfsa2008-40.html
http://www.mozilla.org/security/announce/2008/mfsa2008-41.html
http://www.mozilla.org/security/announce/2008/mfsa2008-42.html
http://www.mozilla.org/security/announce/2008/mfsa2008-43.html
http://www.mozilla.org/security/announce/2008/mfsa2008-44.html
http://www.mozilla.org/security/announce/2008/mfsa2008-45.html
42c98cef-62b1-4b8b-9065-f4621e08d526libvpx -- out-of-bounds write

The Mozilla Project reports:

Using the Address Sanitizer tool, security researcher Abhishek Arya (Inferno) of the Google Chrome Security Team found an out-of-bounds write when buffering WebM format video containing frames with invalid tile sizes. This can lead to a potentially exploitable crash during WebM video playback.


Discovery 2014-10-14
Entry 2015-08-12
libvpx
< 1.4.0

firefox
< 33.0,1

firefox-esr
< 31.1.2,1

linux-firefox
< 33.0,1

linux-seamonkey
< 2.30

linux-thunderbird
< 31.1.2

seamonkey
< 2.30

thunderbird
< 31.1.2

libxul
< 31.1.2

CVE-2014-1578
https://www.mozilla.org/security/advisories/mfsa2014-77/
https://hg.mozilla.org/releases/mozilla-esr31/rev/6023f0b4f8ba
76ff65f4-17ca-4d3f-864a-a3d6026194fbmozilla -- multiple vulnerabilities

The Mozilla Project reports:

MFSA-2015-28 Privilege escalation through SVG navigation

MFSA-2015-29 Code execution through incorrect JavaScript bounds checking elimination


Discovery 2015-03-20
Entry 2015-03-22
firefox
< 36.0.4,1

firefox-esr
< 31.5.3,1

linux-firefox
< 36.0.4,1

linux-seamonkey
< 2.33.1

seamonkey
< 2.33.1

libxul
< 31.5.3

CVE-2015-0817
CVE-2015-0818
https://www.mozilla.org/security/advisories/mfsa2015-28/
https://www.mozilla.org/security/advisories/mfsa2015-29/
https://www.mozilla.org/security/advisories/
b2f09169-55af-11e0-9d6f-000f20797edemozilla -- update to HTTPS certificate blacklist

The Mozilla Project reports:

MFSA 2011-11 Update to HTTPS certificate blacklist


Discovery 2011-03-22
Entry 2011-03-24
firefox
gt 3.6.*,1 lt 3.6.16,1

gt 3.5.*,1 lt 3.5.18,1

libxul
gt 1.9.2.* lt 1.9.2.16

linux-firefox
< 3.6.16,1

linux-firefox-devel
< 3.5.18

linux-seamonkey
gt 2.0.* lt 2.0.13

seamonkey
gt 2.0.* lt 2.0.13

http://www.mozilla.org/security/announce/2011/mfsa2011-11.html
8c2ea875-9499-11df-8e32-000f20797edemozilla -- multiple vulnerabilities

The Mozilla Project reports:

MFSA 2010-34 Miscellaneous memory safety hazards (rv:1.9.2.7/ 1.9.1.11)

MFSA 2010-35 DOM attribute cloning remote code execution vulnerability

MFSA 2010-36 Use-after-free error in NodeIterator

MFSA 2010-37 Plugin parameter EnsureCachedAttrParamArrays remote code execution vulnerability

MFSA 2010-38 Arbitrary code execution using SJOW and fast native function

MFSA 2010-39 nsCSSValue::Array index integer overflow

MFSA 2010-40 nsTreeSelection dangling pointer remote code execution vulnerability

MFSA 2010-41 Remote code execution using malformed PNG image

MFSA 2010-42 Cross-origin data disclosure via Web Workers and importScripts

MFSA 2010-43 Same-origin bypass using canvas context

MFSA 2010-44 Characters mapped to U+FFFD in 8 bit encodings cause subsequent character to vanish

MFSA 2010-45 Multiple location bar spoofing vulnerabilities

MFSA 2010-46 Cross-domain data theft using CSS

MFSA 2010-47 Cross-origin data leakage from script filename in error messages


Discovery 2010-07-20
Entry 2010-07-21
firefox
gt 3.6.*,1 lt 3.6.7,1

gt 3.5.*,1 lt 3.5.11,1

linux-firefox
< 3.6.7,1

linux-firefox-devel
< 3.5.11

seamonkey
gt 2.0.* lt 2.0.6

thunderbird
ge 3.0 lt 3.0.6

CVE-2010-0654
CVE-2010-1205
CVE-2010-1206
CVE-2010-1207
CVE-2010-1208
CVE-2010-1209
CVE-2010-1210
CVE-2010-1211
CVE-2010-1212
CVE-2010-1213
CVE-2010-1214
CVE-2010-1215
CVE-2010-2751
CVE-2010-2752
CVE-2010-2753
CVE-2010-2754
http://www.mozilla.org/security/announce/2010/mfsa2010-34.html
http://www.mozilla.org/security/announce/2010/mfsa2010-35.html
http://www.mozilla.org/security/announce/2010/mfsa2010-36.html
http://www.mozilla.org/security/announce/2010/mfsa2010-37.html
http://www.mozilla.org/security/announce/2010/mfsa2010-38.html
http://www.mozilla.org/security/announce/2010/mfsa2010-39.html
http://www.mozilla.org/security/announce/2010/mfsa2010-40.html
http://www.mozilla.org/security/announce/2010/mfsa2010-41.html
http://www.mozilla.org/security/announce/2010/mfsa2010-42.html
http://www.mozilla.org/security/announce/2010/mfsa2010-43.html
http://www.mozilla.org/security/announce/2010/mfsa2010-44.html
http://www.mozilla.org/security/announce/2010/mfsa2010-45.html
http://www.mozilla.org/security/announce/2010/mfsa2010-46.html
http://www.mozilla.org/security/announce/2010/mfsa2010-47.html
2c57c47e-8bb3-4694-83c8-9fc3abad3964mozilla -- multiple vulnerabilities

Mozilla Foundation reports:

CVE-2016-2827 - Out-of-bounds read in mozilla::net::IsValidReferrerPolicy [low]

CVE-2016-5256 - Memory safety bugs fixed in Firefox 49 [critical]

CVE-2016-5257 - Memory safety bugs fixed in Firefox 49 and Firefox ESR 45.4 [critical]

CVE-2016-5270 - Heap-buffer-overflow in nsCaseTransformTextRunFactory::TransformString [high]

CVE-2016-5271 - Out-of-bounds read in PropertyProvider::GetSpacingInternal [low]

CVE-2016-5272 - Bad cast in nsImageGeometryMixin [high]

CVE-2016-5273 - crash in mozilla::a11y::HyperTextAccessible::GetChildOffset [high]

CVE-2016-5274 - use-after-free in nsFrameManager::CaptureFrameState [high]

CVE-2016-5275 - global-buffer-overflow in mozilla::gfx::FilterSupport::ComputeSourceNeededRegions [critical]

CVE-2016-5276 - Heap-use-after-free in mozilla::a11y::DocAccessible::ProcessInvalidationList [high]

CVE-2016-5277 - Heap-use-after-free in nsRefreshDriver::Tick [high]

CVE-2016-5278 - Heap-buffer-overflow in nsBMPEncoder::AddImageFrame [critical]

CVE-2016-5279 - Full local path of files is available to web pages after drag and drop [moderate]

CVE-2016-5280 - Use-after-free in mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap [high]

CVE-2016-5281 - use-after-free in DOMSVGLength [high]

CVE-2016-5282 - Don't allow content to request favicons from non-whitelisted schemes [moderate]

CVE-2016-5283 -