CVSS: 8.8EPSS: 10%CPEs: 17EXPL: 0CVE-2016-5131 – libxml2: Use after free triggered by XPointer paths beginning with range-to
https://notcve.org/view.php?id=CVE-2016-5131
23 Jul 2016 — Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the XPointer range-to function. Vulnerabilidad de uso después de liberación de memoria en libxml2 hasta la versión 2.9.4, como se utiliza en Google Chrome en versiones anteriores a 52.0.2743.82, permite a atacantes remotos provocar una denegación de servicio o posiblemente tener otro impacto ... • http://googlechromereleases.blogspot.com/2016/07/stable-channel-update.html • CWE-416: Use After Free •
CVSS: 8.8EPSS: 2%CPEs: 2EXPL: 0CVE-2016-1709 – chromium-browser: heap-buffer-overflow in sfntly
https://notcve.org/view.php?id=CVE-2016-1709
23 Jul 2016 — Heap-based buffer overflow in the ByteArray::Get method in data/byte_array.cc in Google sfntly before 2016-06-10, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted SFNT font. Desbordamiento de buffer basado en memoria dinámica en el método ByteArray::Get en data/byte_array.cc en Google sfntly en versiones anteriores a 2016-06-10, como se utiliza en Google Chrome en versiones anteriores a 52.0.2743.82, pe... • http://googlechromereleases.blogspot.com/2016/07/stable-channel-update.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.8EPSS: 1%CPEs: 1EXPL: 0CVE-2016-5134 – chromium-browser: url leakage via pac script
https://notcve.org/view.php?id=CVE-2016-5134
23 Jul 2016 — net/proxy/proxy_service.cc in the Proxy Auto-Config (PAC) feature in Google Chrome before 52.0.2743.82 does not ensure that URL information is restricted to a scheme, host, and port, which allows remote attackers to discover credentials by operating a server with a PAC script, a related issue to CVE-2016-3763. net/proxy/proxy_service.cc en la funcionalidad Proxy Auto-Config (PAC) en Google Chrome en versiones anteriores a 52.0.2743.82 no asegura que la información de URL está restringida a un esquema, host ... • http://googlechromereleases.blogspot.com/2016/07/stable-channel-update.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-1710 – chromium-browser: same-origin bypass in blink
https://notcve.org/view.php?id=CVE-2016-1710
23 Jul 2016 — The ChromeClientImpl::createWindow method in WebKit/Source/web/ChromeClientImpl.cpp in Blink, as used in Google Chrome before 52.0.2743.82, does not prevent window creation by a deferred frame, which allows remote attackers to bypass the Same Origin Policy via a crafted web site. El método ChromeClientImpl::createWindow en WebKit/Source/web/ChromeClientImpl.cpp en Blink, como se utiliza en Google Chrome en versiones anteriores a 52.0.2743.82, no previene la creación de la ventana por un marco diferido, lo q... • http://googlechromereleases.blogspot.com/2016/07/stable-channel-update.html • CWE-285: Improper Authorization •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-1707
https://notcve.org/view.php?id=CVE-2016-1707
23 Jul 2016 — ios/web/web_state/ui/crw_web_controller.mm in Google Chrome before 52.0.2743.82 on iOS does not ensure that an invalid URL is replaced with the about:blank URL, which allows remote attackers to spoof the URL display via a crafted web site. ios/web/web_state/ui/crw_web_controller.mm en Google Chrome en versiones anteriores en 52.0.2743.82 en iOS no asegura que una URL no válida sea reemplazada con la URL about:blank, lo que permite a atacantes remotos suplantar la URL mostrada a través de un sitio web manipu... • http://googlechromereleases.blogspot.com/2016/07/stable-channel-update.html • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-1705 – chromium-browser: various fixes from internal audits
https://notcve.org/view.php?id=CVE-2016-1705
23 Jul 2016 — Multiple unspecified vulnerabilities in Google Chrome before 52.0.2743.82 allow attackers to cause a denial of service or possibly have other impact via unknown vectors. Múltiples vulnerabilidades no especificadas en Google Chrome en versiones anteriores a 52.0.2743.82 permiten a atacantes provocar una denegación de servicio o posiblemente tener otro impacto a través de vectores desconocidos. • http://crbug.com/590619 •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5137 – chromium-browser: history sniffing with hsts and csp
https://notcve.org/view.php?id=CVE-2016-5137
23 Jul 2016 — The CSPSource::schemeMatches function in WebKit/Source/core/frame/csp/CSPSource.cpp in the Content Security Policy (CSP) implementation in Blink, as used in Google Chrome before 52.0.2743.82, does not apply http :80 policies to https :443 URLs and does not apply ws :80 policies to wss :443 URLs, which makes it easier for remote attackers to determine whether a specific HSTS web site has been visited by reading a CSP report. NOTE: this vulnerability is associated with a specification change after CVE-2016-16... • http://googlechromereleases.blogspot.com/2016/07/stable-channel-update.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 0%CPEs: 11EXPL: 0CVE-2016-1704 – chromium-browser: various fixes from internal audits
https://notcve.org/view.php?id=CVE-2016-1704
21 Jun 2016 — Multiple unspecified vulnerabilities in Google Chrome before 51.0.2704.103 allow attackers to cause a denial of service or possibly have other impact via unknown vectors. Múltiples vulnerabilidades no especificadas en Google Chrome en versiones anteriores a 51.0.2704.103 permiten a atacantes causar una denegación de servicio o posiblemente tener otro impacto a través de vectores desconocidos. • http://googlechromereleases.blogspot.com/2016/06/stable-channel-update_16.html •
CVSS: 8.8EPSS: 0%CPEs: 11EXPL: 0CVE-2016-1703 – chromium-browser: various fixes from internal audits
https://notcve.org/view.php?id=CVE-2016-1703
02 Jun 2016 — Multiple unspecified vulnerabilities in Google Chrome before 51.0.2704.79 allow attackers to cause a denial of service or possibly have other impact via unknown vectors. Múltiples vulnerabilidades no especificadas en Google Chrome en versiones anteriores a 51.0.2704.79 permiten a atacantes remotos provocar una denegación del servicio o posiblemente tener otro impacto a través de vectores desconocidos. • http://googlechromereleases.blogspot.com/2016/06/stable-channel-update.html •
CVSS: 6.5EPSS: 0%CPEs: 8EXPL: 0CVE-2016-1698 – chromium-browser: information leak in extension bindings
https://notcve.org/view.php?id=CVE-2016-1698
02 Jun 2016 — The createCustomType function in extensions/renderer/resources/binding.js in the extension bindings in Google Chrome before 51.0.2704.79 does not validate module types, which might allow attackers to load arbitrary modules or obtain sensitive information by leveraging a poisoned definition. La función createCustomType en extensions/renderer/resources/binding.js en las extensiones vinculantes en Google Chrome en versiones anteriores a 51.0.2704.79 no valida los tipos de módulos, lo que podría permitir a atac... • http://googlechromereleases.blogspot.com/2016/06/stable-channel-update.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •