CVSS: 8.8EPSS: 2%CPEs: 5EXPL: 0CVE-2018-6153 – chromium-browser: Stack buffer overflow in Skia
https://notcve.org/view.php?id=CVE-2018-6153
A precision error in Skia in Google Chrome prior to 68.0.3440.75 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted HTML page. Un error de precisión en Skia en Google Chrome, en versiones anteriores a la 68.0.3440.75, permitía que un atacante remoto que hubiese comprometido el proceso renderer pudiese realizar una escritura de memoria fuera de límites mediante una página HTML manipulada. • http://www.securityfocus.com/bid/104887 https://access.redhat.com/errata/RHSA-2018:2282 https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html https://crbug.com/850350 https://security.gentoo.org/glsa/201808-01 https://www.debian.org/security/2018/dsa-4256 https://access.redhat.com/security/cve/CVE-2018-6153 https://bugzilla.redhat.com/show_bug.cgi?id=1608177 • CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2018-6167 – chromium-browser: URL spoof in Omnibox
https://notcve.org/view.php?id=CVE-2018-6167
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. Aplicación insuficiente de caracteres confundibles en URL Formatter en Google Chrome, en versiones anteriores a la 68.0.3440.75, permitía que un atacante remoto suplantase dominios mediante homogramas IDN mediante un nombre de dominio manipulado. • http://www.securityfocus.com/bid/104887 https://access.redhat.com/errata/RHSA-2018:2282 https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html https://crbug.com/833143 https://security.gentoo.org/glsa/201808-01 https://www.debian.org/security/2018/dsa-4256 https://access.redhat.com/security/cve/CVE-2018-6167 https://bugzilla.redhat.com/show_bug.cgi?id=1608191 •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-6150 – chromium-browser: Cross origin information disclosure in Service Workers
https://notcve.org/view.php?id=CVE-2018-6150
Incorrect handling of CORS in ServiceWorker in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak cross-origin data via a crafted HTML page. El manejo incorrecto de CORS en ServiceWorker en Google Chrome antes de 66.0.3359.117 permitió a un atacante remoto filtrar datos de origen cruzado a través de una página HTML diseñada. • https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html https://crbug.com/812667 https://access.redhat.com/security/cve/CVE-2018-6150 https://bugzilla.redhat.com/show_bug.cgi?id=1608206 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2018-6172 – chromium-browser: URL spoof in Omnibox
https://notcve.org/view.php?id=CVE-2018-6172
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. Aplicación insuficiente de caracteres confundibles en URL Formatter en Google Chrome, en versiones anteriores a la 68.0.3440.75, permitía que un atacante remoto suplantase dominios mediante homogramas IDN mediante un nombre de dominio manipulado. • http://www.securityfocus.com/bid/104887 https://access.redhat.com/errata/RHSA-2018:2282 https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html https://crbug.com/847242 https://security.gentoo.org/glsa/201808-01 https://www.debian.org/security/2018/dsa-4256 https://access.redhat.com/security/cve/CVE-2018-6172 https://bugzilla.redhat.com/show_bug.cgi?id=1608196 •
CVSS: 7.5EPSS: 2%CPEs: 5EXPL: 0CVE-2018-6158 – chromium-browser: Use after free in Blink
https://notcve.org/view.php?id=CVE-2018-6158
A race condition in Oilpan in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Una condición de carrera en Oilpan en Google Chrome, en versiones anteriores a la 68.0.3440.75, permitía que un atacante remoto pudiese explotar una corrupción de memoria dinámica (heap) mediante una página HTML manipulada. • http://www.securityfocus.com/bid/104887 https://access.redhat.com/errata/RHSA-2018:2282 https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html https://crbug.com/841280 https://security.gentoo.org/glsa/201808-01 https://www.debian.org/security/2018/dsa-4256 https://access.redhat.com/security/cve/CVE-2018-6158 https://bugzilla.redhat.com/show_bug.cgi?id=1608182 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •