CVE-2016-5226 – chromium-browser: limited xss in blink
https://notcve.org/view.php?id=CVE-2016-5226
05 Dec 2016 — Blink in Google Chrome prior to 55.0.2883.75 for Linux, Windows and Mac executed javascript: URLs entered in the URL bar in the context of the current tab, which allowed a socially engineered user to XSS themselves by dragging and dropping a javascript: URL into the URL bar. Blink en Google Chrome anterior a 55.0.2883.75 para Linux, Windows y Mac ejecutó javascript: las URLs escritas en la barra de URL en el contexto de la pestaña actual, lo que permitió a un usuario de ingeniería social realizar XSS por si... • http://rhn.redhat.com/errata/RHSA-2016-2919.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVE-2016-5214 – chromium-browser: file download protection bypass
https://notcve.org/view.php?id=CVE-2016-5214
05 Dec 2016 — Google Chrome prior to 55.0.2883.75 for Windows mishandled downloaded files, which allowed a remote attacker to prevent the downloaded file from receiving the Mark of the Web via a crafted HTML page. Google Chrome anterior a 55.0.2883.75 para Windows no maneja adecuadamente archivos descargados, lo que permitió a un atacante remoto impedir que el archivo descargado recibiera la Mark de la Web a través de una página HTML manipulada. • http://rhn.redhat.com/errata/RHSA-2016-2919.html • CWE-19: Data Processing Errors •
CVE-2016-5212 – chromium-browser: local file disclosure in devtools
https://notcve.org/view.php?id=CVE-2016-5212
05 Dec 2016 — Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android insufficiently sanitized DevTools URLs, which allowed a remote attacker to read local files via a crafted HTML page. Google Chrome anterior a 55.0.2883.75 para Mac, Windows y Linux y 55.0.2883.84 para Android desinfecta insuficientemente URLs DevTools, lo que permitió a un atacante remoto leer archivos locales a través de una página HTML manipulada. • http://rhn.redhat.com/errata/RHSA-2016-2919.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVE-2016-5203 – chromium-browser: use after free in pdfium
https://notcve.org/view.php?id=CVE-2016-5203
05 Dec 2016 — A use after free in PDFium in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. Un uso después de liberación de memoria en PDFium en Google Chrome anterior a 55.0.2883.75 para Mac, Windows y Linux y 55.0.2883.84 para Android permitió a un atacante remoto explotar potencialmente una corrupción de memoria a través de un archivo PDF manipulado. • http://rhn.redhat.com/errata/RHSA-2016-2919.html • CWE-416: Use After Free •
CVE-2016-5208 – chromium-browser: universal xss in blink
https://notcve.org/view.php?id=CVE-2016-5208
05 Dec 2016 — Blink in Google Chrome prior to 55.0.2883.75 for Linux and Windows, and 55.0.2883.84 for Android allowed possible corruption of the DOM tree during synchronous event handling, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. Blink en Google Chrome anterior a 55.0.2883.75 para Linux y Windows y 55.0.2883.84 para Android permitió una posible corrupción del árbol DOM durante el manejo del evento sincronizado, lo que permitió a un atacante remoto inyectar secue... • http://rhn.redhat.com/errata/RHSA-2016-2919.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVE-2016-5209 – chromium-browser: out of bounds write in blink
https://notcve.org/view.php?id=CVE-2016-5209
05 Dec 2016 — Bad casting in bitmap manipulation in Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Mal casting en la manipulación de bitmap en Blink en Google Chrome anterior a 55.0.2883.75 para Mac, Windows y Linux y 55.0.2883.84 para Android permitió a un atacante remoto explotar potencialmente corrupción de memoria a través de una página HTML manipulada. • http://rhn.redhat.com/errata/RHSA-2016-2919.html • CWE-787: Out-of-bounds Write •
CVE-2016-9652 – chromium-browser: various fixes from internal audits
https://notcve.org/view.php?id=CVE-2016-9652
05 Dec 2016 — Multiple unspecified vulnerabilities in Google Chrome before 55.0.2883.75. múltiples vulnerabilidades no especificadas en Google Chrome anterior a la versión 55,0,2883,75 • http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00050.html •
CVE-2016-5199 – chromium-browser: heap corruption in ffmpeg
https://notcve.org/view.php?id=CVE-2016-5199
15 Nov 2016 — An off by one error resulting in an allocation of zero size in FFmpeg in Google Chrome prior to 54.0.2840.98 for Mac, and 54.0.2840.99 for Windows, and 54.0.2840.100 for Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted video file. Un error por un paso resultando en una asignación de tamaño cero en FFmpeg en Google Chrome anterior a 54.0.2840.98 para Mac y 54.0.2840.99 para Windows y 54.0.2840.100 para Linux y 55.0.2883.84 para Android permiti... • http://rhn.redhat.com/errata/RHSA-2016-2718.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVE-2016-5202 – chromium-browser: various fixes from internal audits
https://notcve.org/view.php?id=CVE-2016-5202
15 Nov 2016 — browser/extensions/api/dial/dial_registry.cc in Google Chrome before 54.0.2840.98 on macOS, before 54.0.2840.99 on Windows, and before 54.0.2840.100 on Linux neglects to copy a device ID before an erase() call, which causes the erase operation to access data that that erase operation will destroy. El archivo browser/extensions/api/dial/dial_registry.cc en Google Chrome versiones anteriores a 54.0.2840.98 en macOS, versiones anteriores a 54.0.2840.99 en Windows y versiones anteriores a 54.0.2840.100 en Linux... • http://lists.opensuse.org/opensuse-security-announce/2016-11/msg00029.html • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVE-2016-5201 – chromium-browser: info leak in extensions
https://notcve.org/view.php?id=CVE-2016-5201
15 Nov 2016 — A leak of privateClass in the extensions API in Google Chrome prior to 54.0.2840.100 for Linux, and 54.0.2840.99 for Windows, and 54.0.2840.98 for Mac allowed a remote attacker to access privileged JavaScript code via a crafted HTML page. Un fuga de privateClass en la API de extensiones en Google Chrome anterior a 54.0.2840.100 para Linux y 54.0.2840.99 para Windows y 54.0.2840.98 para Mac permitió a un atacante remoto acceder a código JavaScript privilegiado a través de una página HTML manipulada. • http://rhn.redhat.com/errata/RHSA-2016-2718.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •