CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5175 – chromium-browser: various fixes from internal audits
https://notcve.org/view.php?id=CVE-2016-5175
16 Sep 2016 — Multiple unspecified vulnerabilities in Google Chrome before 53.0.2785.113 allow attackers to cause a denial of service or possibly have other impact via unknown vectors. Múltiples vulnerabilidades no especificadas en Google Chrome en versiones anteriores a 53.0.2785.113 permite a atacantes provocar una denegación de servicio o tener otro posible impacto no especificado a través de vectores desconocidos. • http://rhn.redhat.com/errata/RHSA-2016-1905.html •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5173 – chromium-browser: extension resource access
https://notcve.org/view.php?id=CVE-2016-5173
16 Sep 2016 — The extensions subsystem in Google Chrome before 53.0.2785.113 does not properly restrict access to Object.prototype, which allows remote attackers to load unintended resources, and consequently trigger unintended JavaScript function calls and bypass the Same Origin Policy via an indirect interception attack. El subsistema de extensiones en Google Chrome en versiones anteriores a 53.0.2785.113 no restringe adecuadamente el acceso a Object.prototype, lo que permite a atacantes remotos cargar recursos no inte... • http://rhn.redhat.com/errata/RHSA-2016-1905.html • CWE-284: Improper Access Control •
CVSS: 6.5EPSS: 1%CPEs: 1EXPL: 0CVE-2016-5174 – chromium-browser: popup not correctly suppressed
https://notcve.org/view.php?id=CVE-2016-5174
16 Sep 2016 — browser/ui/cocoa/browser_window_controller_private.mm in Google Chrome before 53.0.2785.113 does not process fullscreen toggle requests during a fullscreen transition, which allows remote attackers to cause a denial of service (unsuppressed popup) via a crafted web site. browser/ui/cocoa/browser_wendow_controller_private.mm en Google Chrome en versiones anteriores a 53.0.2785.113 no procesa peticiones de conmutación a pantalla completa durante una transición a pantalla completa, lo que permite a atacantes r... • http://rhn.redhat.com/errata/RHSA-2016-1905.html • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2016-5172 – chromium-browser: arbitrary memory read in v8
https://notcve.org/view.php?id=CVE-2016-5172
16 Sep 2016 — The parser in Google V8, as used in Google Chrome before 53.0.2785.113, mishandles scopes, which allows remote attackers to obtain sensitive information from arbitrary memory locations via crafted JavaScript code. El analizador en Google V8, como se usa en Google Chrome en versiones anteriores a 53.0.2785.113, no maneja correctamente alcances, lo que permite a atacantes remotos obtener información sensible desde localizaciones de memoria arbitrarias a través de un código JavaScript manipulado. • http://rhn.redhat.com/errata/RHSA-2016-1905.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 1%CPEs: 1EXPL: 0CVE-2016-5171 – chromium-browser: use after free in blink
https://notcve.org/view.php?id=CVE-2016-5171
16 Sep 2016 — WebKit/Source/bindings/templates/interface.cpp in Blink, as used in Google Chrome before 53.0.2785.113, does not prevent certain constructor calls, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted JavaScript code. WebKit/Source/bendengs/templates/enterface.cpp en Blink, como se usa en Google Chrome en versiones anteriores a 53.0.2785.113, no previene ciertas llamadas de constructor, lo que permite a atacantes remotos provocar u... • http://rhn.redhat.com/errata/RHSA-2016-1905.html • CWE-416: Use After Free •
CVSS: 8.8EPSS: 2%CPEs: 2EXPL: 0CVE-2016-5156 – chromium-browser: use after free in event bindings
https://notcve.org/view.php?id=CVE-2016-5156
11 Sep 2016 — extensions/renderer/event_bindings.cc in the event bindings in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux attempts to process filtered events after failure to add an event matcher, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via unknown vectors. extensions/renderer/event_bindings.cc en los vínculos de eventos en Google Chrome en versiones anteriores a 53.0.2785.89 en Windows y SO X y en vers... • http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00003.html • CWE-416: Use After Free •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2016-5167 – chromium-browser: various fixes from internal audits
https://notcve.org/view.php?id=CVE-2016-5167
11 Sep 2016 — Multiple unspecified vulnerabilities in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux allow attackers to cause a denial of service or possibly have other impact via unknown vectors. Múltiples vulnerabilidades no especificadas en Google Chrome en versiones anteriores a 53.0.2785.89 en Windows y SO X y en versiones anteriores a 53.0.2785.92 en Linux permiten a atacantes provocar una denegación de servicio o tener otro posible impacto no especificado a través de vectore... • http://lists.opensuse.org/opensuse-updates/2016-09/msg00073.html •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5148 – chromium-browser: universal xss in blink
https://notcve.org/view.php?id=CVE-2016-5148
11 Sep 2016 — Cross-site scripting (XSS) vulnerability in Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allows remote attackers to inject arbitrary web script or HTML via vectors related to widget updates, aka "Universal XSS (UXSS)." Vulnerabilidad de XSS en Blink, tal como se utiliza en Google Chrome en versiones anteriores a 53.0.2785.89 en Windows y SO X y en versiones anteriores a 53.0.2785.92 en Linux, permite a atacantes remotos inyectar secuencias de coma... • http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00003.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 2%CPEs: 2EXPL: 0CVE-2016-5151 – chromium-browser: use after free in pdfium
https://notcve.org/view.php?id=CVE-2016-5151
11 Sep 2016 — PDFium in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux mishandles timers, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted PDF document, related to fpdfsdk/javascript/JS_Object.cpp and fpdfsdk/javascript/app.cpp. PDFium en Google Chrome en versiones anteriores a 53.0.2785.89 en Windows y SO X y en versiones anteriores a 53.0.2785.92 en Linux no maneja adecuadamente los temporizadores,... • http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00003.html • CWE-416: Use After Free •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2016-5164 – chromium-browser: universal xss using devtools
https://notcve.org/view.php?id=CVE-2016-5164
11 Sep 2016 — Cross-site scripting (XSS) vulnerability in WebKit/Source/platform/v8_inspector/V8Debugger.cpp in Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allows remote attackers to inject arbitrary web script or HTML into the Developer Tools (aka DevTools) subsystem via a crafted web site, aka "Universal XSS (UXSS)." Vulnerabilidad de XSS en WebKit/Source/platform/v8_inspector/V8Debugger.cpp en Blink, tal como se utiliza en Google Chrome en versiones anterio... • http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00003.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •