
CVE-2016-5182 – chromium-browser: heap overflow in blink
https://notcve.org/view.php?id=CVE-2016-5182
18 Oct 2016 — Blink in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android had insufficient validation in bitmap handling, which allowed a remote attacker to potentially exploit heap corruption via crafted HTML pages. Blink en Google Chrome en versiones previas a 54.0.2840.59 para Windows, Mac y Linux; 54.0.2840.85 para Android tiene una validación insuficiente en el manejo de bitmap, lo que permite a un atacante remoto explotar potencialmente una corrupción de memoria a través de pá... • http://rhn.redhat.com/errata/RHSA-2016-2067.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •

CVE-2016-5193 – chromium-browser: scheme bypass
https://notcve.org/view.php?id=CVE-2016-5193
18 Oct 2016 — Google Chrome prior to 54.0 for iOS had insufficient validation of URLs for windows open by DOM, which allowed a remote attacker to bypass restrictions on navigation to certain URL schemes via crafted HTML pages. Google Chrome en versiones previas a 54.0 para iOS tiene una validación insuficiente de URLs para windows en ventanas abiertas por DOM, lo que permite a un atacante remoto eludir restricciones de navegación a ciertos esquemas de URL a través de páginas HTML manipuladas. Chromium is an open-source w... • http://rhn.redhat.com/errata/RHSA-2016-2067.html • CWE-20: Improper Input Validation •

CVE-2016-5181 – chromium-browser: universal xss in blink
https://notcve.org/view.php?id=CVE-2016-5181
18 Oct 2016 — Blink in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android permitted execution of v8 microtasks while the DOM was in an inconsistent state, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via crafted HTML pages. Blink en Google Chrome en versiones previas a 54.0.2840.59 para Windows, Mac y Linux; 54.0.2840.85 para Android permite la ejecución de microtareas v8 mientras la DOM está en un estado inconsistente, lo que permite a un atacante remo... • http://rhn.redhat.com/errata/RHSA-2016-2067.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVE-2016-5187 – chromium-browser: url spoofing
https://notcve.org/view.php?id=CVE-2016-5187
18 Oct 2016 — Google Chrome prior to 54.0.2840.85 for Android incorrectly handled rapid transition into and out of full screen mode, which allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via crafted HTML pages. Google Chrome en versiones previas a 54.0.2840.85 para Android maneja incorrectamente transición rápida de entrada y salida del modo de pantalla completa, lo que permite a un atacante remoto suplantar los contenidos de la Omnibox (barra de URL) a través de páginas HTML manipuladas. It was ... • http://rhn.redhat.com/errata/RHSA-2016-2067.html • CWE-20: Improper Input Validation •

CVE-2016-5183 – chromium-browser: use after free in pdfium
https://notcve.org/view.php?id=CVE-2016-5183
18 Oct 2016 — A heap use after free in PDFium in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android allows a remote attacker to potentially exploit heap corruption via crafted PDF files. Un uso después de liberación de memoria en PDFium en Google Chrome en versiones previas a 54.0.2840.59 para Windows, Mac y Linux; 54.0.2840.85 para Android permite a un atacante remoto explotar potencialmente una corrupción de memoria a través de archivos PDF manipulados. Chromium is an open-source ... • http://rhn.redhat.com/errata/RHSA-2016-2067.html • CWE-416: Use After Free •

CVE-2016-5190 – chromium-browser: use after free in internals
https://notcve.org/view.php?id=CVE-2016-5190
18 Oct 2016 — Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android incorrectly handled object lifecycles during shutdown, which allowed a remote attacker to perform an out of bounds memory read via crafted HTML pages. Google Chrome en versiones previas a 54.0.2840.59 para Windows, Mac y Linux; 54.0.2840.85 para Android maneja incorrectamente los ciclos de vida de objetos durante el apagado, lo que permite a un atacante remoto llevar a cabo una lectura de memoria fuera de límites a tra... • http://rhn.redhat.com/errata/RHSA-2016-2067.html • CWE-416: Use After Free •

CVE-2016-5191 – chromium-browser: universal xss in bookmarks
https://notcve.org/view.php?id=CVE-2016-5191
18 Oct 2016 — Bookmark handling in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android had insufficient validation of supplied data, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via crafted HTML pages, as demonstrated by an interpretation conflict between userinfo and scheme in an http://javascript:payload@example.com URL. El manejo de etiquetas en Google Chrome en versiones previas a 54.0.2840.59 para Windows, Mac y Linux; 54.0.2840.85 para Android tien... • http://rhn.redhat.com/errata/RHSA-2016-2067.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVE-2016-5184 – chromium-browser: use after free in pdfium
https://notcve.org/view.php?id=CVE-2016-5184
18 Oct 2016 — PDFium in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android incorrectly handled object lifecycles in CFFL_FormFillter::KillFocusForAnnot, which allowed a remote attacker to potentially exploit heap corruption via crafted PDF files. PDFium en Google Chrome en versiones previas a 54.0.2840.59 para Windows, Mac y Linux; 54.0.2840.85 para Android maneja incorrectamente los ciclos de vida de objetos en CFFL_FormFillter::KillFocusForAnnot, lo que permite a un atacante remot... • http://rhn.redhat.com/errata/RHSA-2016-2067.html • CWE-416: Use After Free •

CVE-2016-5194 – chromium-browser: various fixes from internal audits
https://notcve.org/view.php?id=CVE-2016-5194
18 Oct 2016 — Unspecified vulnerabilities in Google Chrome before 54.0.2840.59. Vulnerabilidades no especificadas en Google Chrome versiones anteriores a la versión 54.0.2840.59. It was discovered that a long running unload handler could cause an incognito profile to be reused in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to obtain sensitive information. Multiple security vulnerabilities were discovered in Chromium. • https://chromereleases.googleblog.com/2016/10/stable-channel-update-for-desktop.html •

CVE-2016-5188 – chromium-browser: ui spoofing
https://notcve.org/view.php?id=CVE-2016-5188
18 Oct 2016 — Multiple issues in Blink in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux allow a remote attacker to spoof various parts of browser UI via crafted HTML pages. Múltiples problemas en Blink en Google Chrome en versiones previas a 54.0.2840.59 para Windows, Mac y Linux permiten a un atacante remoto suplantar varias partes de la interfaz de usuario del navegador a través de páginas HTML manipuladas. It was discovered that a long running unload handler could cause an incognito profile to be reu... • http://rhn.redhat.com/errata/RHSA-2016-2067.html • CWE-20: Improper Input Validation •