CVSS: 8.8EPSS: 2%CPEs: 2EXPL: 0CVE-2016-5159 – openjpeg: heap overflow in parsing of JPEG2000 code blocks
https://notcve.org/view.php?id=CVE-2016-5159
11 Sep 2016 — Multiple integer overflows in OpenJPEG, as used in PDFium in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted JPEG 2000 data that is mishandled during opj_aligned_malloc calls in dwt.c and t1.c. Múltiples desbordamiento de entero en OpenJPEG, tal como se utiliza en PDFium en Google Chrome en versiones anteriores a 53.0.2785.89 en Window... • http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00003.html • CWE-122: Heap-based Buffer Overflow CWE-190: Integer Overflow or Wraparound •
CVSS: 8.8EPSS: 1%CPEs: 2EXPL: 0CVE-2016-5161 – Google Chrome StylePropertySerializer Type Confusion Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2016-5161
01 Sep 2016 — The EditingStyle::mergeStyle function in WebKit/Source/core/editing/EditingStyle.cpp in Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, mishandles custom properties, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted web site that leverages "type confusion" in the StylePropertySerializer class. La función EditingStyle::mergeStyle en WebKit/Source/core/editing/EditingStyle.cpp en Blink, t... • http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00003.html • CWE-704: Incorrect Type Conversion or Cast •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2016-5142 – chromium-browser: Use-after-free in Blink
https://notcve.org/view.php?id=CVE-2016-5142
07 Aug 2016 — The Web Cryptography API (aka WebCrypto) implementation in Blink, as used in Google Chrome before 52.0.2743.116, does not properly copy data buffers, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted JavaScript code, related to NormalizeAlgorithm.cpp and SubtleCrypto.cpp. La implementación Web Cryptography API (también conocido como WebCrypto) en Blink, como se usa en Google Chrome en versiones anteriores a 52.0.2743.116, no cop... • http://googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop.html • CWE-416: Use After Free •
CVSS: 8.8EPSS: 1%CPEs: 1EXPL: 0CVE-2016-5145 – chromium-browser: Same origin bypass for images in Blink
https://notcve.org/view.php?id=CVE-2016-5145
07 Aug 2016 — Blink, as used in Google Chrome before 52.0.2743.116, does not ensure that a taint property is preserved after a structure-clone operation on an ImageBitmap object derived from a cross-origin image, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code. Blink, como se usa en Google Chrome en versiones anteriores a 52.0.2743.116, no asegura que una propiedad contaminada se conserva después de una operación de clonado de estructura en un objeto ImageBitmap derivado de una ... • http://googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop.html • CWE-254: 7PK - Security Features •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2016-5144 – chromium-browser: Parameter sanitization failure in DevTools
https://notcve.org/view.php?id=CVE-2016-5144
07 Aug 2016 — The Developer Tools (aka DevTools) subsystem in Blink, as used in Google Chrome before 52.0.2743.116, mishandles the script-path hostname, remoteBase parameter, and remoteFrontendUrl parameter, which allows remote attackers to bypass intended access restrictions via a crafted URL, a different vulnerability than CVE-2016-5143. El subsistema Developer Tools (también conocido como DevTools) en Blink, como se usa en Google Chrome en versiones anteriores a 52.0.2743.116, no maneja correctamente el nombre de host... • http://googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop.html • CWE-284: Improper Access Control •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5146 – chromium-browser: various fixes from internal audits
https://notcve.org/view.php?id=CVE-2016-5146
07 Aug 2016 — Multiple unspecified vulnerabilities in Google Chrome before 52.0.2743.116 allow attackers to cause a denial of service or possibly have other impact via unknown vectors. Múltiples vulnerabilidades no especificadas en Google Chrome en versiones anteriores a 52.0.2743.116 permite a atacantes provocar una denegación de servicio o posiblemente tener otro impacto a través de vectores no especificados. • http://googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop.html •
CVSS: 9.8EPSS: 2%CPEs: 1EXPL: 0CVE-2016-5140 – chromium-browser: Heap overflow in pdfium
https://notcve.org/view.php?id=CVE-2016-5140
07 Aug 2016 — Heap-based buffer overflow in the opj_j2k_read_SQcd_SQcc function in j2k.c in OpenJPEG, as used in PDFium in Google Chrome before 52.0.2743.116, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JPEG 2000 data. Desbordamiento de búfer basado en memoria dinámica en la función opj_j2k_read_SQcd_SQcc en j2k.c in OpenJPEG, como se usa en PDFium en Google Chrome en versiones anteriores a 52.0.2743.116, permite a atacantes remotos provocar una denegación de... • http://googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5141 – chromium-browser: Address bar spoofing
https://notcve.org/view.php?id=CVE-2016-5141
07 Aug 2016 — Blink, as used in Google Chrome before 52.0.2743.116, allows remote attackers to spoof the address bar via vectors involving a provisional URL for an initially empty document, related to FrameLoader.cpp and ScopedPageLoadDeferrer.cpp. Blink, como se usa en Google Chrome en versiones anteriores a 52.0.2743.116, permite a atacantes remotos suplantar la barra de direcciones a través de vectores involucrando una URL provisional para un documento inicialmente vació, relacionado con FrameLoader.cpp y ScopedPageLo... • http://googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop.html • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2016-5143 – chromium-browser: Parameter sanitization failure in DevTools
https://notcve.org/view.php?id=CVE-2016-5143
07 Aug 2016 — The Developer Tools (aka DevTools) subsystem in Blink, as used in Google Chrome before 52.0.2743.116, mishandles the script-path hostname, remoteBase parameter, and remoteFrontendUrl parameter, which allows remote attackers to bypass intended access restrictions via a crafted URL, a different vulnerability than CVE-2016-5144. El subsistema Developer Tools (también conocido como DevTools) en Blink, como se usa en Google Chrome en versiones anteriores a 52.0.2743.116, no maneja correctamente el nombre de host... • http://googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 8.8EPSS: 1%CPEs: 1EXPL: 0CVE-2016-5138
https://notcve.org/view.php?id=CVE-2016-5138
01 Aug 2016 — Integer overflow in the kbasep_vinstr_attach_client function in midgard/mali_kbase_vinstr.c in Google Chrome before 52.0.2743.85 allows remote attackers to cause a denial of service (heap-based buffer overflow and use-after-free) by leveraging an unrestricted multiplication. Desbordamiento de entero en la función kbasep_vinstr_attach_client en midgard/mali_kbase_vinstr.c en Google Chrome en versiones anteriores a 52.0.2743.85 permite a atacantes remotos provocar una denegación de servicio (desbordamiento de... • http://googlechromereleases.blogspot.com/2016/07/stable-channel-update-for-chrome-os_26.html • CWE-190: Integer Overflow or Wraparound •