CVSS: 7.1EPSS: 0%CPEs: 7EXPL: 0CVE-2017-0642
https://notcve.org/view.php?id=CVE-2017-0642
A remote denial of service vulnerability in libhevc in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High severity due to the possibility of remote denial of service. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34819017. • http://www.securityfocus.com/bid/98868 http://www.securitytracker.com/id/1038623 https://android.googlesource.com/platform/external/libhevc/+/913d9e8d93d6b81bb8eac3fc2c1426651f5b259d https://source.android.com/security/bulletin/2017-06-01 •
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2017-0646
https://notcve.org/view.php?id=CVE-2017-0646
An information disclosure vulnerability in Bluetooth component could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate due to details specific to the vulnerability. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-33899337. • http://www.securityfocus.com/bid/98871 http://www.securitytracker.com/id/1038623 https://source.android.com/security/bulletin/2017-06-01 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 87%CPEs: 9EXPL: 1CVE-2017-5070 – Google Chromium V8 Type Confusion Vulnerability
https://notcve.org/view.php?id=CVE-2017-5070
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Una confusión de tipos en V8 en Google Chrome, en versiones anteriores a la 59.0.3071.86 para Linux, Windows y Mac y a la 59.0.3071.92 para Android, permitía que un atacante remoto ejecutase código arbitrario dentro de un espacio aislado o sandbox mediante una página HTML manipulada. Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. • http://www.securityfocus.com/bid/98861 http://www.securitytracker.com/id/1038622 https://access.redhat.com/errata/RHSA-2017:1399 https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop.html https://crbug.com/722756 https://security.gentoo.org/glsa/201706-20 https://access.redhat.com/security/cve/CVE-2017-5070 https://bugzilla.redhat.com/show_bug.cgi?id=1459021 • CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •
CVSS: 8.8EPSS: 1%CPEs: 9EXPL: 0CVE-2017-5077 – chromium-browser: heap buffer overflow in skia
https://notcve.org/view.php?id=CVE-2017-5077
Insufficient validation of untrusted input in Skia in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. Validación insuficiente de entradas no fiables en Skia en Google Chrome, en versiones anteriores a la 59.0.3071.86 para Linux, Windows y Mac y a la 59.0.3071.92 para Android, permitía que un atacante remoto realizase una lectura de memoria fuera de límites mediante una página HTML manipulada. • http://www.securityfocus.com/bid/98861 http://www.securitytracker.com/id/1038622 https://access.redhat.com/errata/RHSA-2017:1399 https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop.html https://crbug.com/716311 https://security.gentoo.org/glsa/201706-20 https://access.redhat.com/security/cve/CVE-2017-5077 https://bugzilla.redhat.com/show_bug.cgi?id=1459030 • CWE-125: Out-of-bounds Read •
CVSS: 6.5EPSS: 0%CPEs: 9EXPL: 0CVE-2017-5076 – chromium-browser: address spoofing in omnibox
https://notcve.org/view.php?id=CVE-2017-5076
Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 59.0.3071.86 for Mac, Windows, and Linux, and 59.0.3071.92 for Android, allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name. La falta de mecanismos suficientes para el cumplimiento de políticas en Omnibox en Google Chrome en versiones anteriores a la 59.0.3071.86 para Mac, Windows y Linux y a la 59.0.3071.92 para Android, permitía que un atacante remoto realizase una suplantación de dominio mediante homografías de IDN en un nombre de dominio manipulado. • http://www.securityfocus.com/bid/98861 http://www.securitytracker.com/id/1038622 https://access.redhat.com/errata/RHSA-2017:1399 https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop.html https://crbug.com/719199 https://security.gentoo.org/glsa/201706-20 https://access.redhat.com/security/cve/CVE-2017-5076 https://bugzilla.redhat.com/show_bug.cgi?id=1459029 • CWE-20: Improper Input Validation •