CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2016-5165 – chromium-browser: script injection in devtools
https://notcve.org/view.php?id=CVE-2016-5165
11 Sep 2016 — Cross-site scripting (XSS) vulnerability in the Developer Tools (aka DevTools) subsystem in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux allows remote attackers to inject arbitrary web script or HTML via the settings parameter in a chrome-devtools-frontend.appspot.com URL's query string. Vulnerabilidad de XSS en el subsistema Developer Tools (también conocido como DevTools) en Google Chrome en versiones anteriores a 53.0.2785.89 en Windows y SO X y en versiones ante... • http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00003.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 1%CPEs: 1EXPL: 0CVE-2016-7395
https://notcve.org/view.php?id=CVE-2016-7395
11 Sep 2016 — SkPath.cpp in Skia, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, does not properly validate the return values of ChopMonoAtY calls, which allows remote attackers to cause a denial of service (uninitialized memory access and application crash) or possibly have unspecified other impact via crafted graphics data. SkPath.cpp en Skia, tal como se utiliza en Google Chrome en versiones anteriores a 53.0.2785.89 en Windows y SO X y en versiones anteriores a 53.0... • http://www.debian.org/security/2016/dsa-3667 • CWE-19: Data Processing Errors •
CVSS: 8.8EPSS: 1%CPEs: 2EXPL: 0CVE-2016-5161 – Google Chrome StylePropertySerializer Type Confusion Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2016-5161
01 Sep 2016 — The EditingStyle::mergeStyle function in WebKit/Source/core/editing/EditingStyle.cpp in Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, mishandles custom properties, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted web site that leverages "type confusion" in the StylePropertySerializer class. La función EditingStyle::mergeStyle en WebKit/Source/core/editing/EditingStyle.cpp en Blink, t... • http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00003.html • CWE-704: Incorrect Type Conversion or Cast •
CVSS: 8.8EPSS: 2%CPEs: 1EXPL: 0CVE-2016-5139 – openjpeg: Heap overflow in parsing of JPEG2000 precincts
https://notcve.org/view.php?id=CVE-2016-5139
07 Aug 2016 — Multiple integer overflows in the opj_tcd_init_tile function in tcd.c in OpenJPEG, as used in PDFium in Google Chrome before 52.0.2743.116, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted JPEG 2000 data. Múltiples desbordamientos de entero en la función opj_tcd_init_tile en tcd.c en OpenJPEG, como se usa en PDFium en Google Chrome en versiones anteriores a 52.0.2743.116, permite a atacantes remotos provocar una denegación... • http://googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-122: Heap-based Buffer Overflow •
CVSS: 8.8EPSS: 1%CPEs: 1EXPL: 0CVE-2016-5145 – chromium-browser: Same origin bypass for images in Blink
https://notcve.org/view.php?id=CVE-2016-5145
07 Aug 2016 — Blink, as used in Google Chrome before 52.0.2743.116, does not ensure that a taint property is preserved after a structure-clone operation on an ImageBitmap object derived from a cross-origin image, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code. Blink, como se usa en Google Chrome en versiones anteriores a 52.0.2743.116, no asegura que una propiedad contaminada se conserva después de una operación de clonado de estructura en un objeto ImageBitmap derivado de una ... • http://googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop.html • CWE-254: 7PK - Security Features •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5141 – chromium-browser: Address bar spoofing
https://notcve.org/view.php?id=CVE-2016-5141
07 Aug 2016 — Blink, as used in Google Chrome before 52.0.2743.116, allows remote attackers to spoof the address bar via vectors involving a provisional URL for an initially empty document, related to FrameLoader.cpp and ScopedPageLoadDeferrer.cpp. Blink, como se usa en Google Chrome en versiones anteriores a 52.0.2743.116, permite a atacantes remotos suplantar la barra de direcciones a través de vectores involucrando una URL provisional para un documento inicialmente vació, relacionado con FrameLoader.cpp y ScopedPageLo... • http://googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop.html • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 2%CPEs: 1EXPL: 0CVE-2016-5140 – chromium-browser: Heap overflow in pdfium
https://notcve.org/view.php?id=CVE-2016-5140
07 Aug 2016 — Heap-based buffer overflow in the opj_j2k_read_SQcd_SQcc function in j2k.c in OpenJPEG, as used in PDFium in Google Chrome before 52.0.2743.116, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JPEG 2000 data. Desbordamiento de búfer basado en memoria dinámica en la función opj_j2k_read_SQcd_SQcc en j2k.c in OpenJPEG, como se usa en PDFium en Google Chrome en versiones anteriores a 52.0.2743.116, permite a atacantes remotos provocar una denegación de... • http://googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2016-5142 – chromium-browser: Use-after-free in Blink
https://notcve.org/view.php?id=CVE-2016-5142
07 Aug 2016 — The Web Cryptography API (aka WebCrypto) implementation in Blink, as used in Google Chrome before 52.0.2743.116, does not properly copy data buffers, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted JavaScript code, related to NormalizeAlgorithm.cpp and SubtleCrypto.cpp. La implementación Web Cryptography API (también conocido como WebCrypto) en Blink, como se usa en Google Chrome en versiones anteriores a 52.0.2743.116, no cop... • http://googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop.html • CWE-416: Use After Free •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2016-5144 – chromium-browser: Parameter sanitization failure in DevTools
https://notcve.org/view.php?id=CVE-2016-5144
07 Aug 2016 — The Developer Tools (aka DevTools) subsystem in Blink, as used in Google Chrome before 52.0.2743.116, mishandles the script-path hostname, remoteBase parameter, and remoteFrontendUrl parameter, which allows remote attackers to bypass intended access restrictions via a crafted URL, a different vulnerability than CVE-2016-5143. El subsistema Developer Tools (también conocido como DevTools) en Blink, como se usa en Google Chrome en versiones anteriores a 52.0.2743.116, no maneja correctamente el nombre de host... • http://googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop.html • CWE-284: Improper Access Control •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5146 – chromium-browser: various fixes from internal audits
https://notcve.org/view.php?id=CVE-2016-5146
07 Aug 2016 — Multiple unspecified vulnerabilities in Google Chrome before 52.0.2743.116 allow attackers to cause a denial of service or possibly have other impact via unknown vectors. Múltiples vulnerabilidades no especificadas en Google Chrome en versiones anteriores a 52.0.2743.116 permite a atacantes provocar una denegación de servicio o posiblemente tener otro impacto a través de vectores no especificados. An issue was discovered in Blink involving the provisional URL for an initially empty document. An attacker cou... • http://googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop.html •