CVSS: 6.5EPSS: 1%CPEs: 8EXPL: 0CVE-2015-1278 – chromium-browser: URL spoofing using pdf files in unspecified
https://notcve.org/view.php?id=CVE-2015-1278
23 Jul 2015 — content/browser/web_contents/web_contents_impl.cc in Google Chrome before 44.0.2403.89 does not ensure that a PDF document's modal dialog is closed upon navigation to an interstitial page, which allows remote attackers to spoof URLs via a crafted document, as demonstrated by the alert_dialog.pdf document. Vulnerabilidad en content/browser/web_contents/web_contents_impl.cc en Google Chrome en versiones anteriores a la 44.0.2403.89, no asegura que el diálogo modal de un documento PDF esté cerrado en la navega... • http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html • CWE-254: 7PK - Security Features •
CVSS: 7.5EPSS: 0%CPEs: 8EXPL: 0CVE-2015-1288 – chromium-browser: Spell checking dictionaries fetched over HTTP in unspecified
https://notcve.org/view.php?id=CVE-2015-1288
23 Jul 2015 — The Spellcheck API implementation in Google Chrome before 44.0.2403.89 does not use an HTTPS session for downloading a Hunspell dictionary, which allows man-in-the-middle attackers to deliver incorrect spelling suggestions or possibly have unspecified other impact via a crafted file, a related issue to CVE-2015-1263. Vulnerabilidad en la implementación de Spellcheck API en Google Chrome en versiones anteriores a la 44.0.2403.89, no usa una sesión HTTPS para la descarga de un diccionario Hunspell, lo cual pe... • http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html • CWE-17: DEPRECATED: Code •
CVSS: 7.8EPSS: 1%CPEs: 8EXPL: 0CVE-2015-1285 – chromium-browser: Information leak in XSS auditor.
https://notcve.org/view.php?id=CVE-2015-1285
23 Jul 2015 — The XSSAuditor::canonicalize function in core/html/parser/XSSAuditor.cpp in the XSS auditor in Blink, as used in Google Chrome before 44.0.2403.89, does not properly choose a truncation point, which makes it easier for remote attackers to obtain sensitive information via an unspecified linear-time attack. Vulnerabilidad en la función XSSAuditor::canonicalize en core/html/parser/XSSAuditor.cpp en el auditor XSS en Blink, usado en Google Chrome en versiones anteriores a la 44.0.2403.89, no elige correctamente... • http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.8EPSS: 1%CPEs: 8EXPL: 0CVE-2015-1289 – chromium-browser: Various fixes from internal audits, fuzzing and other initiatives
https://notcve.org/view.php?id=CVE-2015-1289
23 Jul 2015 — Multiple unspecified vulnerabilities in Google Chrome before 44.0.2403.89 allow attackers to cause a denial of service or possibly have other impact via unknown vectors. Múltiples vulnerabilidades no especificadas en Google Chrome en versiones anteriores a la 44.0.2403.89, permite a atacantes causar una denegación de servicio o posiblemente tener otro impacto no especificado a través de vectores desconocidos. An uninitialized value issue was discovered in ICU. If a user were tricked in to opening a speciall... • http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html •
CVSS: 8.8EPSS: 2%CPEs: 8EXPL: 0CVE-2015-1273 – chromium-browser: Heap-buffer-overflow in pdfium.
https://notcve.org/view.php?id=CVE-2015-1273
23 Jul 2015 — Heap-based buffer overflow in j2k.c in OpenJPEG before r3002, as used in PDFium in Google Chrome before 44.0.2403.89, allows remote attackers to cause a denial of service or possibly have unspecified other impact via invalid JPEG2000 data in a PDF document. Vulnerabilidad de desbordamiento de buffer basada en memoria en j2k.c en OpenJPEG en sus versiones anteriores a r3002, implementado PDFium en Google Chrome en versiones anteriores a la 4.0.2403.89. Permite a atacantes remotos causar una denegación de ser... • http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-122: Heap-based Buffer Overflow •
CVSS: 8.8EPSS: 1%CPEs: 8EXPL: 0CVE-2015-1279 – chromium-browser: Heap-buffer-overflow in pdfium.
https://notcve.org/view.php?id=CVE-2015-1279
23 Jul 2015 — Integer overflow in the CJBig2_Image::expand function in fxcodec/jbig2/JBig2_Image.cpp in PDFium, as used in Google Chrome before 44.0.2403.89, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via large height and stride values. Desbordamiento de enteros en la función CJBig2_Image::expand en fxcodec/jbig2/JBig2_Image.cpp en PDFium implementado en Google Chrome en versiones anteriores a la 44.0.2403.89. Permite a atacantes remotos cau... • http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html • CWE-122: Heap-based Buffer Overflow CWE-189: Numeric Errors •
CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 0CVE-2015-1287 – chromium-browser: SOP bypass with CSS in unspecified
https://notcve.org/view.php?id=CVE-2015-1287
23 Jul 2015 — Blink, as used in Google Chrome before 44.0.2403.89, enables a quirks-mode exception that limits the cases in which a Cascading Style Sheets (CSS) document is required to have the text/css content type, which allows remote attackers to bypass the Same Origin Policy via a crafted web site, related to core/fetch/CSSStyleSheetResource.cpp. Vulnerabilidad en Blink implementado en Google Chrome en versiones anteriores a la 44.0.2403.89, habilita una excepción en el quirks-mode que limita los casos en los que un ... • http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html • CWE-17: DEPRECATED: Code •
CVSS: 9.8EPSS: 2%CPEs: 8EXPL: 0CVE-2015-1277 – chromium-browser: Use-after-free in accessibility.
https://notcve.org/view.php?id=CVE-2015-1277
23 Jul 2015 — Use-after-free vulnerability in the accessibility implementation in Google Chrome before 44.0.2403.89 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging lack of certain validity checks for accessibility-tree data structures. Vulnerabilidad de uso después de liberación de memoria en la implementación de accesibilidad en Google Chrome en versiones anteriores a la 44.0.2403.89. Permite a atacantes remotos causar una denegación de servicio o posiblemente... • http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html • CWE-416: Use After Free •
CVSS: 8.8EPSS: 1%CPEs: 9EXPL: 0CVE-2015-1250 – chromium-browser: various unspecified flaws
https://notcve.org/view.php?id=CVE-2015-1250
01 May 2015 — Multiple unspecified vulnerabilities in Google Chrome before 42.0.2311.135 allow attackers to cause a denial of service or possibly have other impact via unknown vectors. Múltiples vulnerabilidades no especificadas en Google Chrome anterior a 42.0.2311.135 permiten a atacantes remotos causar una denegación de servicio o posiblemente tener otro impacto a través de vectores desconocidos. A use-after-free was discovered in the DOM implementation in Blink. If a user were tricked in to opening a specially crafte... • http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_28.html •