CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-6134 – chromium-browser: Referrer Policy bypass in Blink
https://notcve.org/view.php?id=CVE-2018-6134
07 Jun 2018 — Information leak in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to bypass no-referrer policy via a crafted HTML page. La filtración de información en Blink en Google Chrome antes de 67.0.3396.62 permitió a un atacante remoto eludir la política sin referencia a través de una página HTML diseñada. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 67.0.3396.62. Issues addressed include buffer overflow and bypass vulnerabilities. • https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop_58.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-6145 – chromium-browser: Incorrect escaping of MathML in Blink
https://notcve.org/view.php?id=CVE-2018-6145
07 Jun 2018 — Insufficient data validation in HTML parser in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to bypass same origin policy via a crafted HTML page. Una validación de datos insuficiente en el analizador de HTML en Google Chrome antes de 67.0.3396.62 permitió que un atacante remoto pasara por alto la misma política de origen a través de una página HTML diseñada. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 67.0.3396.62. Issues addressed inc... • https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop_58.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 1%CPEs: 5EXPL: 0CVE-2018-6133 – chromium-browser: URL spoof in Omnibox
https://notcve.org/view.php?id=CVE-2018-6133
07 Jun 2018 — Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. Aplicación insuficiente de caracteres confundibles en URL Formatter en Google Chrome, en versiones anteriores a la 67.0.3396.62, permitía que un atacante remoto suplantase dominios mediante homogramas IDN mediante un nombre de dominio manipulado. Chromium is an open-source web browser, powered by WebKit. This up... • http://www.securityfocus.com/bid/104309 • CWE-19: Data Processing Errors •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 2CVE-2018-6130 – WebRTC - VP9 Frame Processing Out-of-Bounds Memory Access
https://notcve.org/view.php?id=CVE-2018-6130
07 Jun 2018 — Incorrect handling of object lifetimes in WebRTC in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. El manejo incorrecto de la vida útil de los objetos en WebRTC en Google Chrome antes de 67.0.3396.62 permitió que un atacante remoto pudiera realizar un acceso a la memoria fuera de límites a través de una página HTML diseñada. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to ve... • https://packetstorm.news/files/id/148093 • CWE-125: Out-of-bounds Read •
CVSS: 8.8EPSS: 3%CPEs: 5EXPL: 0CVE-2018-6123 – chromium-browser: Use after free in Blink
https://notcve.org/view.php?id=CVE-2018-6123
07 Jun 2018 — A use after free in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Un uso de memoria previamente liberada en Blink en Google Chrome, en versiones anteriores a la 67.0.3396.62, permitía que un atacante remoto pudiese explotar una corrupción de memoria dinámica (heap) mediante una página HTML manipulada. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 67.0.3396.62. Issues... • http://www.securityfocus.com/bid/104309 • CWE-416: Use After Free CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-6132 – chromium-browser: Use of uninitialized memory in WebRTC
https://notcve.org/view.php?id=CVE-2018-6132
07 Jun 2018 — Uninitialized data in WebRTC in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted video file. Los datos no inicializados en WebRTC en Google Chrome antes de 67.0.3396.62 permitieron a un atacante remoto obtener información potencialmente sensible de la memoria de proceso a través de un archivo de video creado. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 67.0.3396.... • https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop_58.html • CWE-908: Use of Uninitialized Resource •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-6131 – chromium-browser: Incorrect mutability protection in WebAssembly
https://notcve.org/view.php?id=CVE-2018-6131
07 Jun 2018 — Object lifecycle issue in WebAssembly in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. El problema del lifecycle del objeto en WebAssembly en Google Chrome antes de 67.0.3396.62 permitía a un atacante remoto explotar potencialmente la corrupción del montón a través de una página HTML diseñada. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 67.0.3396.62. Issues addressed includ... • https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop_58.html • CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 1%CPEs: 5EXPL: 0CVE-2018-6141 – chromium-browser: Heap buffer overflow in Skia
https://notcve.org/view.php?id=CVE-2018-6141
07 Jun 2018 — Insufficient validation of an image filter in Skia in Google Chrome prior to 67.0.3396.62 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory read via a crafted HTML page. La validación insuficiente de un filtro de imagen en Skia en Google Chrome, en versiones anteriores a la 67.0.3396.62, permitía que un atacante remoto, que hubiese comprometido el proceso renderer, pudiese realizar una escritura de memoria fuera de límites mediante una página HTML manipula... • http://www.securityfocus.com/bid/104309 • CWE-125: Out-of-bounds Read •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-6125 – chromium-browser: Overly permissive policy in WebUSB
https://notcve.org/view.php?id=CVE-2018-6125
07 Jun 2018 — Insufficient policy enforcement in USB in Google Chrome on Windows prior to 67.0.3396.62 allowed a remote attacker to obtain potentially sensitive information via a crafted HTML page. Una aplicación insuficiente de políticas en USB en Google Chrome en Windows versiones anteriores a 67.0.3396.62, permitía a un atacante remoto obtener información potencialmente confidencial por medio de una página HTML diseñada Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version... • https://crbug.com/818592 •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2018-6147 – chromium-browser: Password fields not taking advantage of OS protections in Views
https://notcve.org/view.php?id=CVE-2018-6147
07 Jun 2018 — Lack of secure text entry mode in Browser UI in Google Chrome on Mac prior to 67.0.3396.62 allowed a local attacker to obtain potentially sensitive information from process memory via a local process. La falta de un modo seguro de introducción de texto en Browser UI en Google Chrome, en versiones anteriores a la 67.0.3396.62, permitía que un atacante local pudiese obtener información potencialmente sensible del la memoria del proceso mediante un proceso local. Chromium is an open-source web browser, powered... • http://www.securityfocus.com/bid/104309 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •