CVSS: 8.8EPSS: 1%CPEs: 8EXPL: 0CVE-2017-5108 – chromium-browser: type confusion in pdfium
https://notcve.org/view.php?id=CVE-2017-5108
31 Jul 2017 — Type confusion in PDFium in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to potentially maliciously modify objects via a crafted PDF file. Una confusión de tipos en PDFium en Google Chrome, en versiones anteriores a la 60.0.3112.78 para Mac, Windows, Linux y Android, permitía que un atacante remoto pudiese modificar objetos con fines maliciosos mediante un archivo PDF manipulado. Chromium is an open-source web browser, powered by WebKit. This update upgr... • http://www.debian.org/security/2017/dsa-3926 • CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •
CVSS: 8.8EPSS: 2%CPEs: 6EXPL: 0CVE-2017-5100 – chromium-browser: use after free in chrome apps
https://notcve.org/view.php?id=CVE-2017-5100
31 Jul 2017 — A use after free in Apps in Google Chrome prior to 60.0.3112.78 for Windows allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. Un uso de memoria previamente liberada en Apps en Google Chrome, en versiones anteriores a la 60.0.3112.78 para Windows, permitía que un atacante remoto realizase una lectura de memoria fuera de límites mediante una página HTML manipulada. Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 60.0.... • http://www.debian.org/security/2017/dsa-3926 • CWE-416: Use After Free •
CVSS: 6.5EPSS: 0%CPEs: 9EXPL: 0CVE-2017-5105 – chromium-browser: url spoofing in omnibox
https://notcve.org/view.php?id=CVE-2017-5105
31 Jul 2017 — Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name. La falta de mecanismos suficientes para el cumplimiento de políticas en Omnibox en Google Chrome, en versiones anteriores a la 60.0.3112.78 para Mac, Windows, Linux y Android, permitía que un atacante remoto realizase una suplantación de dominio mediante homografías de IDN en un nombre de domin... • http://www.debian.org/security/2017/dsa-3926 • CWE-20: Improper Input Validation •
CVSS: 9.6EPSS: 1%CPEs: 9EXPL: 0CVE-2017-5087 – chromium-browser: sandbox escape in indexeddb
https://notcve.org/view.php?id=CVE-2017-5087
19 Jun 2017 — A use after free in Blink in Google Chrome prior to 59.0.3071.104 for Mac, Windows, and Linux, and 59.0.3071.117 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page, aka an IndexedDB sandbox escape. Un uso de memoria previamente liberada en Blink en Google Chrome, en versiones anteriores a la 59.0.3071.104 para Mac, Windows y Linux y a la 59.0.3071.117 para Android, permitía que un atacante remoto realizase una lectura de memoria fuera de límites mediante u... • http://www.debian.org/security/2017/dsa-3926 • CWE-416: Use After Free •
CVSS: 8.8EPSS: 1%CPEs: 9EXPL: 0CVE-2017-5088 – chromium-browser: out of bounds read in v8
https://notcve.org/view.php?id=CVE-2017-5088
19 Jun 2017 — Insufficient validation of untrusted input in V8 in Google Chrome prior to 59.0.3071.104 for Mac, Windows, and Linux, and 59.0.3071.117 for Android, allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. Una validación insuficiente de entradas no fiables en V8 en Google Chrome, en versiones anteriores a la 59.0.3071.104 para Mac, Windows y Linux y a la 59.0.3071.117 para Android, permitía que un atacante remoto realizase un acceso a la memoria fuera de límites mediante una... • http://www.debian.org/security/2017/dsa-3926 • CWE-125: Out-of-bounds Read •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2017-5089 – chromium-browser: domain spoofing in omnibox
https://notcve.org/view.php?id=CVE-2017-5089
19 Jun 2017 — Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 59.0.3071.104 for Mac allowed a remote attacker to perform domain spoofing via a crafted domain name. La falta de mecanismos suficientes para el cumplimiento de políticas en Omnibox en Google Chrome, en versiones anteriores a la 59.0.3071.104 para Mac, permitía que un atacante remoto realizase una suplantación de dominio mediante un nombre de dominio manipulado. Chromium is an open-source web browser, powered by WebKit. This update upgrade... • http://www.debian.org/security/2017/dsa-3926 • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 0%CPEs: 9EXPL: 0CVE-2017-5071 – chromium-browser: out of bounds read in v8
https://notcve.org/view.php?id=CVE-2017-5071
06 Jun 2017 — Insufficient validation of untrusted input in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows and Mac, and 59.0.3071.92 for Android allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. Una validación insuficiente de entradas no fiables en V8 en Google Chrome, en versiones anteriores a la 59.0.3071.86 para Linux, Windows y Mac y a la 59.0.3071.92 para Android, permitía que un atacante remoto realizase una lectura de memoria fuera de límites mediante una pági... • http://www.securityfocus.com/bid/98861 • CWE-20: Improper Input Validation •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2017-5082 – chromium-browser: insufficient hardening in credit card editor
https://notcve.org/view.php?id=CVE-2017-5082
06 Jun 2017 — Failure to take advantage of available mitigations in credit card autofill in Google Chrome prior to 59.0.3071.92 for Android allowed a local attacker to take screen shots of credit card information via a crafted HTML page. Un fallo a la hora de aprovechar las mitigaciones disponibles en el autocompletado de tarjeta de crédito en Google Chrome, en versiones anteriores a la 59.0.3071.92 para Android, permitía que un atacante local realizase capturas de pantalla de linformación de tarjetas de crédito mediante... • http://www.securityfocus.com/bid/98861 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 2%CPEs: 7EXPL: 0CVE-2017-5078 – chromium-browser: possible command injection in mailto handling
https://notcve.org/view.php?id=CVE-2017-5078
06 Jun 2017 — Insufficient validation of untrusted input in Blink's mailto: handling in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac allowed a remote attacker to perform command injection via a crafted HTML page, a similar issue to CVE-2004-0121. For example, characters such as * have an incorrect interaction with xdg-email in xdg-utils, and a space character can be used in front of a command-line argument. Validación insuficiente de entradas no fiables en la manipulación de mailto: de Blink en Google ... • http://www.securityfocus.com/bid/98861 •
CVSS: 6.5EPSS: 0%CPEs: 9EXPL: 0CVE-2017-5075 – chromium-browser: information leak in csp reporting
https://notcve.org/view.php?id=CVE-2017-5075
06 Jun 2017 — Inappropriate implementation in CSP reporting in Blink in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, allowed a remote attacker to obtain the value of url fragments via a crafted HTML page. Una implementación inapropiada en la creación de informes de CSP en Blink en Google Chrome, en versiones anteriores a la 59.0.3071.86 para Linux, Windows y Mac y a la 59.0.3071.92 para Android, permitía que un atacante remoto obtuviese el valor de fragmentos de URL media... • http://www.securityfocus.com/bid/98861 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •