CVSS: 8.8EPSS: 1%CPEs: 5EXPL: 0CVE-2018-6170 – chromium-browser: Type confusion in PDFium
https://notcve.org/view.php?id=CVE-2018-6170
A bad cast in PDFium in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. Una mala conversión en PDFium en Google Chrome, en versiones anteriores a la 68.0.3440.75, permitía que un atacante remoto pudiese explotar una corrupción de memoria dinámica (heap) mediante un archivo PDF manipulado. • http://www.securityfocus.com/bid/104887 https://access.redhat.com/errata/RHSA-2018:2282 https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html https://crbug.com/862059 https://security.gentoo.org/glsa/201808-01 https://www.debian.org/security/2018/dsa-4256 https://access.redhat.com/security/cve/CVE-2018-6170 https://bugzilla.redhat.com/show_bug.cgi?id=1608194 • CWE-704: Incorrect Type Conversion or Cast CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2018-6169 – chromium-browser: Permissions bypass in extension installation
https://notcve.org/view.php?id=CVE-2018-6169
Lack of timeout on extension install prompt in Extensions in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to trigger installation of an unwanted extension via a crafted HTML page. La falta de agotamiento de tiempo en el aviso de instalación de extensiones en Extensions en Google Chrome, en versiones anteriores a la 68.0.3440.75, permitía que un atacante remoto desencadenase la instalación de una extensión no deseada mediante una página HTML. • http://www.securityfocus.com/bid/104887 https://access.redhat.com/errata/RHSA-2018:2282 https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html https://crbug.com/394518 https://security.gentoo.org/glsa/201808-01 https://www.debian.org/security/2018/dsa-4256 https://access.redhat.com/security/cve/CVE-2018-6169 https://bugzilla.redhat.com/show_bug.cgi?id=1608193 • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-6155 – chromium-browser: Use after free in WebRTC
https://notcve.org/view.php?id=CVE-2018-6155
Incorrect handling of frames in the VP8 parser in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted video file. El manejo incorrecto de los cuadros en el analizador VP8 en Google Chrome antes de 68.0.3440.75 permitió que un atacante remoto pudiera explotar la corrupción del montón a través de un archivo de video creado. • https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html https://crbug.com/842265 https://access.redhat.com/security/cve/CVE-2018-6155 https://bugzilla.redhat.com/show_bug.cgi?id=1608179 • CWE-416: Use After Free CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 2%CPEs: 5EXPL: 0CVE-2018-6158 – chromium-browser: Use after free in Blink
https://notcve.org/view.php?id=CVE-2018-6158
A race condition in Oilpan in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Una condición de carrera en Oilpan en Google Chrome, en versiones anteriores a la 68.0.3440.75, permitía que un atacante remoto pudiese explotar una corrupción de memoria dinámica (heap) mediante una página HTML manipulada. • http://www.securityfocus.com/bid/104887 https://access.redhat.com/errata/RHSA-2018:2282 https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html https://crbug.com/841280 https://security.gentoo.org/glsa/201808-01 https://www.debian.org/security/2018/dsa-4256 https://access.redhat.com/security/cve/CVE-2018-6158 https://bugzilla.redhat.com/show_bug.cgi?id=1608182 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 8.8EPSS: 2%CPEs: 5EXPL: 0CVE-2018-6153 – chromium-browser: Stack buffer overflow in Skia
https://notcve.org/view.php?id=CVE-2018-6153
A precision error in Skia in Google Chrome prior to 68.0.3440.75 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted HTML page. Un error de precisión en Skia en Google Chrome, en versiones anteriores a la 68.0.3440.75, permitía que un atacante remoto que hubiese comprometido el proceso renderer pudiese realizar una escritura de memoria fuera de límites mediante una página HTML manipulada. • http://www.securityfocus.com/bid/104887 https://access.redhat.com/errata/RHSA-2018:2282 https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html https://crbug.com/850350 https://security.gentoo.org/glsa/201808-01 https://www.debian.org/security/2018/dsa-4256 https://access.redhat.com/security/cve/CVE-2018-6153 https://bugzilla.redhat.com/show_bug.cgi?id=1608177 • CWE-787: Out-of-bounds Write •