CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5190 – chromium-browser: use after free in internals
https://notcve.org/view.php?id=CVE-2016-5190
18 Oct 2016 — Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android incorrectly handled object lifecycles during shutdown, which allowed a remote attacker to perform an out of bounds memory read via crafted HTML pages. Google Chrome en versiones previas a 54.0.2840.59 para Windows, Mac y Linux; 54.0.2840.85 para Android maneja incorrectamente los ciclos de vida de objetos durante el apagado, lo que permite a un atacante remoto llevar a cabo una lectura de memoria fuera de límites a tra... • http://rhn.redhat.com/errata/RHSA-2016-2067.html • CWE-416: Use After Free •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5193 – chromium-browser: scheme bypass
https://notcve.org/view.php?id=CVE-2016-5193
18 Oct 2016 — Google Chrome prior to 54.0 for iOS had insufficient validation of URLs for windows open by DOM, which allowed a remote attacker to bypass restrictions on navigation to certain URL schemes via crafted HTML pages. Google Chrome en versiones previas a 54.0 para iOS tiene una validación insuficiente de URLs para windows en ventanas abiertas por DOM, lo que permite a un atacante remoto eludir restricciones de navegación a ciertos esquemas de URL a través de páginas HTML manipuladas. • http://rhn.redhat.com/errata/RHSA-2016-2067.html • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 1%CPEs: 1EXPL: 0CVE-2016-5182 – chromium-browser: heap overflow in blink
https://notcve.org/view.php?id=CVE-2016-5182
18 Oct 2016 — Blink in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android had insufficient validation in bitmap handling, which allowed a remote attacker to potentially exploit heap corruption via crafted HTML pages. Blink en Google Chrome en versiones previas a 54.0.2840.59 para Windows, Mac y Linux; 54.0.2840.85 para Android tiene una validación insuficiente en el manejo de bitmap, lo que permite a un atacante remoto explotar potencialmente una corrupción de memoria a través de pá... • http://rhn.redhat.com/errata/RHSA-2016-2067.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5184 – chromium-browser: use after free in pdfium
https://notcve.org/view.php?id=CVE-2016-5184
18 Oct 2016 — PDFium in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android incorrectly handled object lifecycles in CFFL_FormFillter::KillFocusForAnnot, which allowed a remote attacker to potentially exploit heap corruption via crafted PDF files. PDFium en Google Chrome en versiones previas a 54.0.2840.59 para Windows, Mac y Linux; 54.0.2840.85 para Android maneja incorrectamente los ciclos de vida de objetos en CFFL_FormFillter::KillFocusForAnnot, lo que permite a un atacante remot... • http://rhn.redhat.com/errata/RHSA-2016-2067.html • CWE-416: Use After Free •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5189 – chromium-browser: url spoofing
https://notcve.org/view.php?id=CVE-2016-5189
18 Oct 2016 — Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android permitted navigation to blob URLs with non-canonical origins, which allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via crafted HTML pages. Google Chrome en versiones previas a 54.0.2840.59 para Windows, Mac y Linux; 54.0.2840.85 para Android permite la navegación para borrar URLs con orígenes irregulares, lo que permite a un atacante remoto suplantar contenidos de la Omnibox (barra de URL) a t... • http://rhn.redhat.com/errata/RHSA-2016-2067.html • CWE-284: Improper Access Control •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5191 – chromium-browser: universal xss in bookmarks
https://notcve.org/view.php?id=CVE-2016-5191
18 Oct 2016 — Bookmark handling in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android had insufficient validation of supplied data, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via crafted HTML pages, as demonstrated by an interpretation conflict between userinfo and scheme in an http://javascript:payload@example.com URL. El manejo de etiquetas en Google Chrome en versiones previas a 54.0.2840.59 para Windows, Mac y Linux; 54.0.2840.85 para Android tien... • http://rhn.redhat.com/errata/RHSA-2016-2067.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5192 – chromium-browser: cross-origin bypass in blink
https://notcve.org/view.php?id=CVE-2016-5192
18 Oct 2016 — Blink in Google Chrome prior to 54.0.2840.59 for Windows missed a CORS check on redirect in TextTrackLoader, which allowed a remote attacker to bypass cross-origin restrictions via crafted HTML pages. Blink en Google Chrome en versiones previas a 54.0.2840.59 para Windows falla una comprobación CORS en redirect en TextTrackLoader, lo que permite a un atacante remoto eludir restricciones de origen cruzado a través de páginas HTML manipuladas. • http://rhn.redhat.com/errata/RHSA-2016-2067.html • CWE-284: Improper Access Control •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5187 – chromium-browser: url spoofing
https://notcve.org/view.php?id=CVE-2016-5187
18 Oct 2016 — Google Chrome prior to 54.0.2840.85 for Android incorrectly handled rapid transition into and out of full screen mode, which allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via crafted HTML pages. Google Chrome en versiones previas a 54.0.2840.85 para Android maneja incorrectamente transición rápida de entrada y salida del modo de pantalla completa, lo que permite a un atacante remoto suplantar los contenidos de la Omnibox (barra de URL) a través de páginas HTML manipuladas. • http://rhn.redhat.com/errata/RHSA-2016-2067.html • CWE-20: Improper Input Validation •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5194 – chromium-browser: various fixes from internal audits
https://notcve.org/view.php?id=CVE-2016-5194
18 Oct 2016 — Unspecified vulnerabilities in Google Chrome before 54.0.2840.59. Vulnerabilidades no especificadas en Google Chrome versiones anteriores a la versión 54.0.2840.59. • https://chromereleases.googleblog.com/2016/10/stable-channel-update-for-desktop.html •
CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2005-4900
https://notcve.org/view.php?id=CVE-2005-4900
14 Oct 2016 — SHA-1 is not collision resistant, which makes it easier for context-dependent attackers to conduct spoofing attacks, as demonstrated by attacks on the use of SHA-1 in TLS 1.2. NOTE: this CVE exists to provide a common identifier for referencing this SHA-1 issue; the existence of an identifier is not, by itself, a technology recommendation. SHA-1 no es resistente a la colisión, lo que facilita a atacantes dependientes del contexto llevar a cabo ataques de espionaje, como es demostrado por ataques en el uso d... • http://ia.cr/2007/474 • CWE-326: Inadequate Encryption Strength •