CVSS: 6.5EPSS: 0%CPEs: 11EXPL: 0CVE-2017-5118 – chromium-browser: bypass of content security policy in blink
https://notcve.org/view.php?id=CVE-2017-5118
12 Sep 2017 — Blink in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81 for Android, failed to correctly propagate CSP restrictions to javascript scheme pages, which allowed a remote attacker to bypass content security policy via a crafted HTML page. Blink en Google Chrome, en versiones anteriores a la 61.0.3163.79 para Mac, Windows y Linux y a la 61.0.3163.81 para Android, no propagaba correctamente las restricciones CSP para páginas de temas JavaScript, lo que permitía que un atacante r... • http://www.debian.org/security/2017/dsa-3985 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 8.8EPSS: 1%CPEs: 2EXPL: 0CVE-2017-5115 – chromium-browser: type confusion in v8
https://notcve.org/view.php?id=CVE-2017-5115
12 Sep 2017 — Type confusion in V8 in Google Chrome prior to 61.0.3163.79 for Windows allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. Una confusión de tipos en V8 en Google Chrome, en versiones anteriores a la 61.0.3163.79 para Windows, permitía que un atacante remoto pudiese explotar una corrupción de objetos mediante una página HTML manipulada. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 61.0.3163.79. Security Fix: Multi... • http://www.debian.org/security/2017/dsa-3985 • CWE-704: Incorrect Type Conversion or Cast •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-10403 – Google Chrome PDFium JPEG Out-Of-Bounds Read Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2016-10403
23 Aug 2017 — Insufficient data validation on image data in PDFium in Google Chrome prior to 51.0.2704.63 allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file. La validación de datos insuficiente en image data en PDFium en Google Chrome, en versiones anteriores a la 51.0.2704.63, permitió que un atacante remoto realizara una lectura de memoria fuera de límites mediante un archivo PDF manipulado. This vulnerability allows an attacker to leak sensitive information on vulnerable installat... • https://chromereleases.googleblog.com/2016/05/stable-channel-update_25.html • CWE-125: Out-of-bounds Read •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2017-5104 – chromium-browser: ui spoofing in browser
https://notcve.org/view.php?id=CVE-2017-5104
31 Jul 2017 — Inappropriate implementation in interstitials in Google Chrome prior to 60.0.3112.78 for Mac allowed a remote attacker to spoof the contents of the omnibox via a crafted HTML page. Una implementación incorrecta en interstitials en Google Chrome, en versiones anteriores a la 60.0.3112.78 para Mac, permitía que un atacante remoto suplantase el contenido de Omnibox mediante una página HTML manipulada. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 60.0.3112.... • http://www.debian.org/security/2017/dsa-3926 • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 2%CPEs: 9EXPL: 0CVE-2017-5098 – chromium-browser: use after free in v8
https://notcve.org/view.php?id=CVE-2017-5098
31 Jul 2017 — A use after free in V8 in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. Un uso de memoria previamente liberada en V8 en Google Chrome, en versiones anteriores a la 60.0.3112.78 para Mac, Windows, Linux y Android, permitía que un atacante remoto realizase una lectura de memoria fuera de límites mediante una página HTML manipulada. Chromium is an open-source web browser, powered by WebKit. Thi... • http://www.debian.org/security/2017/dsa-3926 • CWE-416: Use After Free •
CVSS: 6.5EPSS: 0%CPEs: 9EXPL: 0CVE-2017-5110 – chromium-browser: ui spoofing in payments dialog
https://notcve.org/view.php?id=CVE-2017-5110
31 Jul 2017 — Inappropriate implementation of the web payments API on blob: and data: schemes in Web Payments in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to spoof the contents of the Omnibox via a crafted HTML page. Una implementación incorrecta de la API de pagos web en las combinaciones blob: y data: en Web Payments en Google Chrome, en versiones anteriores a la 60.0.3112.78 para Mac, Windows, Linux y Android, permitía que un atacante remoto suplantase el conten... • http://www.debian.org/security/2017/dsa-3926 • CWE-20: Improper Input Validation •
CVSS: 4.3EPSS: 0%CPEs: 8EXPL: 0CVE-2017-5109 – chromium-browser: ui spoofing in browser
https://notcve.org/view.php?id=CVE-2017-5109
31 Jul 2017 — Inappropriate implementation of unload handler handling in permission prompts in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to display UI on a non attacker controlled tab via a crafted HTML page. Una implementación incorrecta de la gestión del manipulador de descargas en solicitudes de permisos en Google Chrome, en versiones anteriores a la 60.0.3112.78 para Linux, Windows y Mac, permitía que un atacante remoto mostrase la interfaz de usuario en una pestaña no ... • http://www.debian.org/security/2017/dsa-3926 • CWE-20: Improper Input Validation •
CVSS: 5.3EPSS: 0%CPEs: 7EXPL: 0CVE-2017-5107 – chromium-browser: user information leak via svg
https://notcve.org/view.php?id=CVE-2017-5107
31 Jul 2017 — A timing attack in SVG rendering in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to extract pixel values from a cross-origin page being iframe'd via a crafted HTML page. Un ataque basado en tiempo en SVG rendering en Google Chrome, en versiones anteriores a la 60.0.3112.78 para Linux, Windows y Mac, permitía que un atacante remoto extrajese valores de píxel desde una página cross-origin a la que se le está incrustando iframes mediante una página HTML manipulada. ... • http://www.debian.org/security/2017/dsa-3926 • CWE-203: Observable Discrepancy •
CVSS: 6.5EPSS: 1%CPEs: 9EXPL: 0CVE-2017-5102 – chromium-browser: uninitialized use in skia
https://notcve.org/view.php?id=CVE-2017-5102
31 Jul 2017 — Use of an uninitialized value in Skia in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. El uso de un valor no inicializado en Skia en Google Chrome, en versiones anteriores a la 60.0.3112.78 para Mac, Windows, Linux y Android, permitía que un atacante remoto obtuviese información sensible de la memoria de procesos mediante una página HTML manipulada. Chromium is an ope... • http://www.debian.org/security/2017/dsa-3926 • CWE-908: Use of Uninitialized Resource •
CVSS: 8.8EPSS: 1%CPEs: 8EXPL: 0CVE-2017-5095 – chromium-browser: out-of-bounds write in pdfium
https://notcve.org/view.php?id=CVE-2017-5095
31 Jul 2017 — Stack overflow in PDFium in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to potentially exploit stack corruption via a crafted PDF file. Un desbordamiento de pila en PDFium en Google Chrome, en versiones anteriores a la 60.0.3112.78 para Linux, Windows y Mac, permitía que un atacante remoto explotase una corrupción de pila mediante un archivo PDF manipulado. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 60.0.3... • http://www.debian.org/security/2017/dsa-3926 • CWE-787: Out-of-bounds Write •