CVSS: 9.6EPSS: 8%CPEs: 6EXPL: 0CVE-2018-6086 – chromium-browser: Use after free in Disk Cache
https://notcve.org/view.php?id=CVE-2018-6086
24 Apr 2018 — A double-eviction in the Incognito mode cache that lead to a user-after-free in Networking Disk Cache in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code via a crafted HTML page. Una doble expulsión en la caché del modo incógnito que conducía a un uso de memoria previamente liberada en Networking Disk Cache en Google Chrome, en versiones anteriores a la 66.0.3359.117, permitía que un atacante remoto ejecutase código arbitrario mediante una página HTML manipulada. Chro... • http://www.securityfocus.com/bid/103917 • CWE-416: Use After Free •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2018-6103 – chromium-browser: UI spoof in Permissions
https://notcve.org/view.php?id=CVE-2018-6103
24 Apr 2018 — A stagnant permission prompt in Prompts in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to bypass permission policy via a crafted HTML page. Un mensaje de permisos estancado en Prompts en Google Chrome, en versiones anteriores a la 66.0.3359.117, permitía que un atacante remoto omitiese las políticas de permisos mediante una página HTML manipulada. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 66.0.3359.117. Issues addressed include buf... • http://www.securityfocus.com/bid/103917 •
CVSS: 8.8EPSS: 8%CPEs: 6EXPL: 0CVE-2018-6090 – chromium-browser: Heap buffer overflow in Skia
https://notcve.org/view.php?id=CVE-2018-6090
24 Apr 2018 — An integer overflow that lead to a heap buffer-overflow in Skia in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Un desbordamiento de enteros que conduce a un desbordamiento de búfer basado en memoria dinámica (heap) en Skia en Google Chrome, en versiones anteriores a la 66.0.3359.117, permitía que un atacante remoto ejecutase código arbitrario dentro de un sandbox mediante una página HTML manipulada. Chromium is an open-so... • http://www.securityfocus.com/bid/103917 • CWE-190: Integer Overflow or Wraparound •
CVSS: 8.8EPSS: 3%CPEs: 6EXPL: 1CVE-2018-6106 – chromium-browser: Incorrect handling of promises in V8
https://notcve.org/view.php?id=CVE-2018-6106
24 Apr 2018 — An asynchronous generator may return an incorrect state in V8 in Google Chrome prior to 66.0.3359.117 allowing a remote attacker to potentially exploit object corruption via a crafted HTML page. Un generador asíncrono podría devolver un estado incorrecto en V8 en Google Chrome, en versiones anteriores a la 66.0.3359.117, lo que permite que un atacante remoto explote una corrupción de objetos mediante una página HTML manipulada. Google Chrome V8 Await methods call ResolveNativePromise which calls InternalRes... • https://packetstorm.news/files/id/147386 • CWE-19: Data Processing Errors •
CVSS: 6.5EPSS: 1%CPEs: 6EXPL: 0CVE-2018-6093 – chromium-browser: Same origin bypass in Service Worker
https://notcve.org/view.php?id=CVE-2018-6093
24 Apr 2018 — Insufficient origin checks in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Comprobación de origen insuficiente en Blink en Google Chrome, en versiones anteriores a la 66.0.3359.117, permitía que un atacante remoto filtrase los datos cross-origin mediante una página HTML manipulada. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 66.0.3359.117. Issues addressed include buffer over... • http://www.securityfocus.com/bid/103917 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2018-6105 – chromium-browser: URL spoof in Omnibox
https://notcve.org/view.php?id=CVE-2018-6105
24 Apr 2018 — Incorrect handling of confusable characters in Omnibox in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. Aplicación insuficiente de caracteres confundibles en Omnibox en Google Chrome, en versiones anteriores a la 66.0.3359.117, permitía que un atacante remoto suplantase dominios mediante homogramas IDN mediante un nombre de dominio manipulado. Chromium is an open-source web browser, powered by WebKit. This update upgra... • http://www.securityfocus.com/bid/103917 •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2018-6107 – chromium-browser: URL spoof in Omnibox
https://notcve.org/view.php?id=CVE-2018-6107
24 Apr 2018 — Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. Aplicación insuficiente de caracteres confundibles en URL Formatter en Google Chrome, en versiones anteriores a la 66.0.3359.117, permitía que un atacante remoto suplantase dominios mediante homogramas IDN mediante un nombre de dominio manipulado. Chromium is an open-source web browser, powered by WebKit. This ... • http://www.securityfocus.com/bid/103917 •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2018-6102 – chromium-browser: URL spoof in Omnibox
https://notcve.org/view.php?id=CVE-2018-6102
24 Apr 2018 — Missing confusable characters in Internationalization in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name. La falta de caracteres confundibles en Internationalization en Google Chrome, en versiones anteriores a la 66.0.3359.117, permitía que un atacante remoto suplantase el contenido de Omnibox (barra de direcciones) mediante un nombre de dominio manipulado. Chromium is an open-source web browser, powered by WebKit. This ... • http://www.securityfocus.com/bid/103917 • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 0%CPEs: 5EXPL: 0CVE-2018-6111 – chromium-browser: Heap-use-after-free in DevTools
https://notcve.org/view.php?id=CVE-2018-6111
24 Apr 2018 — An object lifetime issue in the developer tools network handler in Google Chrome prior to 66.0.3359.117 allowed a local attacker to execute arbitrary code via a crafted HTML page. Un problema de ciclo de vida de objetos en el manejador de la red de herramientas de desarrollador en Google Chrome, en versiones anteriores a la 66.0.3359.117, permitía que un atacante local ejecutase código arbitrario mediante una página HTML manipulada. Chromium is an open-source web browser, powered by WebKit. This update upgr... • http://www.securityfocus.com/bid/103917 • CWE-20: Improper Input Validation •
CVSS: 9.6EPSS: 8%CPEs: 6EXPL: 0CVE-2018-6085 – chromium-browser: Use after free in Disk Cache
https://notcve.org/view.php?id=CVE-2018-6085
24 Apr 2018 — Re-entry of a destructor in Networking Disk Cache in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code via a crafted HTML page. La reentrada de un destructor en Networking Disk Cache en Google Chrome, en versiones anteriores a la 66.0.3359.117, permitía que un atacante remoto ejecutase código arbitrario mediante una página HTML manipulada. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 66.0.3359.117. Issues addressed... • http://www.securityfocus.com/bid/103917 • CWE-416: Use After Free •