CVSS: 4.3EPSS: 0%CPEs: 5EXPL: 0CVE-2018-17477 – chromium-browser: UI spoof in Extensions
https://notcve.org/view.php?id=CVE-2018-17477
Incorrect dialog placement in Extensions in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents of extension popups via a crafted HTML page. La colocación incorrecta de diálogos en Extensions en Google Chrome en versiones anteriores a la 70.0.3538.67 permitía que un atacante remoto suplantase el contenido de los popups de extensión mediante una página HTML manipulada. • http://www.securityfocus.com/bid/105666 https://access.redhat.com/errata/RHSA-2018:3004 https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.html https://crbug.com/863703 https://security.gentoo.org/glsa/201811-10 https://www.debian.org/security/2018/dsa-4330 https://access.redhat.com/security/cve/CVE-2018-17477 https://bugzilla.redhat.com/show_bug.cgi?id=1640115 •
CVSS: 8.8EPSS: 1%CPEs: 5EXPL: 0CVE-2018-17465 – chromium-browser: Use after free in V8
https://notcve.org/view.php?id=CVE-2018-17465
Incorrect implementation of object trimming in V8 in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. La implementación incorrecta del recorte de objetos en V8 en Google Chrome en versiones anteriores a la 70.0.3538.67 permitía que un atacante remoto pudiese explotar una corrupción de objetos mediante una página HTML manipulada. • http://www.securityfocus.com/bid/105666 https://access.redhat.com/errata/RHSA-2018:3004 https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.html https://crbug.com/870226 https://security.gentoo.org/glsa/201811-10 https://www.debian.org/security/2018/dsa-4330 https://access.redhat.com/security/cve/CVE-2018-17465 https://bugzilla.redhat.com/show_bug.cgi?id=1640101 • CWE-416: Use After Free •
CVSS: 8.8EPSS: 1%CPEs: 16EXPL: 0CVE-2018-17466 – firefox: Memory corruption in Angle
https://notcve.org/view.php?id=CVE-2018-17466
Incorrect texture handling in Angle in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. El manejo incorrecto de texturas en Angle en Google Chrome en versiones anteriores a la 70.0.3538.67 permitía que un atacante remoto pudiese realizar una lectura de memoria fuera de límites mediante una página HTML manipulada. • http://www.securityfocus.com/bid/105666 http://www.securityfocus.com/bid/106168 https://access.redhat.com/errata/RHSA-2018:3004 https://access.redhat.com/errata/RHSA-2018:3831 https://access.redhat.com/errata/RHSA-2018:3833 https://access.redhat.com/errata/RHSA-2019:0159 https://access.redhat.com/errata/RHSA-2019:0160 https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.html https://crbug.com/880906 https://lists.debian.org/debian-lts-announce/2018& • CWE-125: Out-of-bounds Read •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2018-17459 – chromium-browser: URL Spoofing in Omnibox
https://notcve.org/view.php?id=CVE-2018-17459
Incorrect handling of clicks in the omnibox in Navigation in Google Chrome prior to 69.0.3497.92 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. La gestión incorrecta de los clics en Omnibox (barra de direcciones) en Navigation en Google Chrome, en versiones anteriores a la 69.0.3497.92, permitía que un atacante remoto suplantase el contenido de Omnibox mediante una página HTML manipulada. • https://access.redhat.com/errata/RHSA-2018:2818 https://chromereleases.googleblog.com/2018/09/stable-channel-update-for-desktop_11.html https://crbug.com/880759 https://access.redhat.com/security/cve/CVE-2018-17459 https://bugzilla.redhat.com/show_bug.cgi?id=1628080 •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2018-17458 – chromium-browser: Function signature mismatch in WebAssembly
https://notcve.org/view.php?id=CVE-2018-17458
An improper update of the WebAssembly dispatch table in WebAssembly in Google Chrome prior to 69.0.3497.92 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Una actualización incorrecta de la tabla "dispatch" de WebAssembly en WebAssembly en Google Chrome, en versiones anteriores a la 69.0.3497.92, permitía que un atacante remoto ejecutase código arbitrario dentro de un sandbox mediante una página HTML manipulada. • https://access.redhat.com/errata/RHSA-2018:2818 https://chromereleases.googleblog.com/2018/09/stable-channel-update-for-desktop_11.html https://crbug.com/875322 https://access.redhat.com/security/cve/CVE-2018-17458 https://bugzilla.redhat.com/show_bug.cgi?id=1628078 • CWE-129: Improper Validation of Array Index •