CVE-2020-16873 – Xamarin.Forms Spoofing Vulnerability

https://notcve.org/view.php?id=CVE-2020-16873

11 Sep 2020 —

A spoofing vulnerability manifests in Microsoft Xamarin.Forms due to the default settings on Android WebView version prior to 83.0.4103.106. This vulnerability could allow an attacker to execute arbitrary Javascript code on a target system.

For the attack to be successful, the targeted user would need to browse to a malicious website or a website serving the malicious code through Xamarin.Forms.

The security update addresses this vulnerability by preventing the malicious Javascript from run... • https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16873 • CWE-1188: Initialization of a Resource with an Insecure Default •

CVE-2020-6575 – chromium-browser: Race in Mojo

https://notcve.org/view.php?id=CVE-2020-6575

10 Sep 2020 — Race in Mojo in Google Chrome prior to 85.0.4183.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Un carrera en Mojo en Google Chrome versiones anteriores a 85.0.4183.102, permitía a un atacante remoto que había comprometido el proceso del renderizador llevar a cabo potencialmente un escape sandbox por medio de una página HTML diseñada • http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00072.html • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •

CVE-2020-6576 – chromium-browser: Use after free in offscreen canvas

https://notcve.org/view.php?id=CVE-2020-6576

10 Sep 2020 — Use after free in offscreen canvas in Google Chrome prior to 85.0.4183.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Un uso de la memoria previamente liberada en offscreen canvas en Google Chrome versiones anteriores a 85.0.4183.102, permitía a un atacante remoto explotar potencialmente una corrupción de la pila por medio de una página HTML diseñada • http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00072.html • CWE-416: Use After Free CWE-787: Out-of-bounds Write •

CVE-2020-6573 – chromium-browser: Use after free in video

https://notcve.org/view.php?id=CVE-2020-6573

10 Sep 2020 — Use after free in video in Google Chrome on Android prior to 85.0.4183.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Un uso de la memoria previamente liberada en video en Google Chrome en Android versiones anteriores a 85.0.4183.102, permitía a un atacante remoto que había comprometido el proceso del renderizador potencialmente llevar a cabo un escape del sandbox por medio de una página HTML diseñada • http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00072.html • CWE-416: Use After Free •

CVE-2020-15959 – chromium-browser: Insufficient policy enforcement in networking

https://notcve.org/view.php?id=CVE-2020-15959

10 Sep 2020 — Insufficient policy enforcement in networking in Google Chrome prior to 85.0.4183.102 allowed an attacker who convinced the user to enable logging to obtain potentially sensitive information from process memory via social engineering. Una aplicación insuficiente de la política en networking en Google Chrome versiones anteriores a 85.0.4183.102, permitía a un atacante que convenció al usuario de habilitar el registro para obtener información potencialmente confidencial de la memoria del proceso por medio de ... • http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00072.html •

CVE-2020-6565 – chromium-browser: Incorrect security UI in Omnibox

https://notcve.org/view.php?id=CVE-2020-6565

27 Aug 2020 — Inappropriate implementation in Omnibox in Google Chrome on iOS prior to 85.0.4183.83 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. Una implementación inapropiada en Omnibox en Google Chrome en iOS versiones anteriores a 85.0.4183.83, permitía a un atacante remoto falsificar el contenido del Omnibox (barra de URL) por medio de una página HTML diseñada • http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00072.html •

CVE-2020-6571 – chromium-browser: Incorrect security UI in Omnibox

https://notcve.org/view.php?id=CVE-2020-6571

27 Aug 2020 — Insufficient data validation in Omnibox in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. Una comprobación insuficiente de datos en Omnibox en Google Chrome versiones anteriores a 85.0.4183.83, permitía a un atacante remoto llevar a cabo una suplantación de dominio por medio de homógrafos de IDN mediante un nombre de dominio diseñado • http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00072.html • CWE-20: Improper Input Validation •

CVE-2020-6567 – chromium-browser: Insufficient validation of untrusted input in command line handling

https://notcve.org/view.php?id=CVE-2020-6567

27 Aug 2020 — Insufficient validation of untrusted input in command line handling in Google Chrome on Windows prior to 85.0.4183.83 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Una comprobación insuficiente de una entrada no confiable en el manejo de la línea de comandos en Google Chrome en Windows versiones anteriores a 85.0.4183.83, permitía a un atacante remoto omitir restricciones de navegación por medio de una página HTML diseñada • http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00072.html • CWE-20: Improper Input Validation •

CVE-2020-6570 – chromium-browser: Side-channel information leakage in WebRTC

https://notcve.org/view.php?id=CVE-2020-6570

27 Aug 2020 — Information leakage in WebRTC in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to obtain potentially sensitive information via a crafted WebRTC interaction. Un filtrado de información en WebRTC en Google Chrome versiones anteriores a 85.0.4183.83, permitía a un atacante remoto potencialmente obtener información confiable por medio de una interacción de WebRTC diseñada • http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00072.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-203: Observable Discrepancy •

CVE-2020-6564 – chromium-browser: Incorrect security UI in permissions

https://notcve.org/view.php?id=CVE-2020-6564

27 Aug 2020 — Inappropriate implementation in permissions in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to spoof the contents of a permission dialog via a crafted HTML page. Una implementación inapropiada en permissions en Google Chrome versiones anteriores a 85.0.4183.83, permitía a un atacante remoto falsificar el contenido de un diálogo de permisos por medio de una página HTML diseñada • http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00072.html • CWE-281: Improper Preservation of Permissions •