CVSS: 6.5EPSS: 1%CPEs: 6EXPL: 0CVE-2018-6109 – chromium-browser: Incorrect handling of files by FileAPI
https://notcve.org/view.php?id=CVE-2018-6109
readAsText() can indefinitely read the file picked by the user, rather than only once at the time the file is picked in File API in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to access data on the user file system without explicit consent via a crafted HTML page. readAsText() puede leer indefinidamente el archivo escogido por el usuario, en lugar de solo una vez cuando se elige el archivo en la API File en Google Chrome , en versiones anteriores a la 66.0.3359.117, lo que permitía que un atacante remoto accediese a los datos en el sistema de archivos del usuario sin consentimiento explícito mediante una página HTML manipulada. • http://www.securityfocus.com/bid/103917 https://access.redhat.com/errata/RHSA-2018:1195 https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html https://crbug.com/710190 https://security.gentoo.org/glsa/201804-22 https://www.debian.org/security/2018/dsa-4182 https://access.redhat.com/security/cve/CVE-2018-6109 https://bugzilla.redhat.com/show_bug.cgi?id=1568789 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2018-6104 – chromium-browser: URL spoof in Omnibox
https://notcve.org/view.php?id=CVE-2018-6104
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. Aplicación insuficiente de caracteres confundibles en URL Formatter en Google Chrome, en versiones anteriores a la 66.0.3359.117, permitía que un atacante remoto suplantase dominios mediante homogramas IDN mediante un nombre de dominio manipulado. • http://www.securityfocus.com/bid/103917 https://access.redhat.com/errata/RHSA-2018:1195 https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html https://crbug.com/820068 https://security.gentoo.org/glsa/201804-22 https://www.debian.org/security/2018/dsa-4182 https://access.redhat.com/security/cve/CVE-2018-6104 https://bugzilla.redhat.com/show_bug.cgi?id=1568782 •
CVSS: 8.8EPSS: 3%CPEs: 6EXPL: 0CVE-2018-6106 – chromium-browser: Incorrect handling of promises in V8
https://notcve.org/view.php?id=CVE-2018-6106
An asynchronous generator may return an incorrect state in V8 in Google Chrome prior to 66.0.3359.117 allowing a remote attacker to potentially exploit object corruption via a crafted HTML page. Un generador asíncrono podría devolver un estado incorrecto en V8 en Google Chrome, en versiones anteriores a la 66.0.3359.117, lo que permite que un atacante remoto explote una corrupción de objetos mediante una página HTML manipulada. Google Chrome V8 Await methods call ResolveNativePromise which calls InternalResolvePromise which can invoke a user JavaScript code through a "then" getter. If the AwaitedPromise is replaced by the user script, the AwaitedPromise will be immediately overwritten after the call to Await, this may lead the generator to an incorrect state. • http://www.securityfocus.com/bid/103917 https://access.redhat.com/errata/RHSA-2018:1195 https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html https://crbug.com/805729 https://security.gentoo.org/glsa/201804-22 https://www.debian.org/security/2018/dsa-4182 https://access.redhat.com/security/cve/CVE-2018-6106 https://bugzilla.redhat.com/show_bug.cgi?id=1568786 • CWE-19: Data Processing Errors •
CVSS: 6.5EPSS: 1%CPEs: 7EXPL: 0CVE-2018-6100 – chromium-browser: URL spoof in Omnibox
https://notcve.org/view.php?id=CVE-2018-6100
Incorrect handling of confusable characters in URL Formatter in Google Chrome on macOS prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. Aplicación insuficiente de caracteres confundibles en URL Formatter en Google Chrome, en versiones anteriores a la 66.0.3359.117 para macOS, permitía que un atacante remoto suplantase dominios mediante homogramas IDN mediante un nombre de dominio manipulado. • http://www.securityfocus.com/bid/103917 https://access.redhat.com/errata/RHSA-2018:1195 https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html https://crbug.com/811117 https://security.gentoo.org/glsa/201804-22 https://www.debian.org/security/2018/dsa-4182 https://access.redhat.com/security/cve/CVE-2018-6100 https://bugzilla.redhat.com/show_bug.cgi?id=1568778 • CWE-19: Data Processing Errors •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2018-6102 – chromium-browser: URL spoof in Omnibox
https://notcve.org/view.php?id=CVE-2018-6102
Missing confusable characters in Internationalization in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name. La falta de caracteres confundibles en Internationalization en Google Chrome, en versiones anteriores a la 66.0.3359.117, permitía que un atacante remoto suplantase el contenido de Omnibox (barra de direcciones) mediante un nombre de dominio manipulado. • http://www.securityfocus.com/bid/103917 https://access.redhat.com/errata/RHSA-2018:1195 https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html https://crbug.com/813814 https://security.gentoo.org/glsa/201804-22 https://www.debian.org/security/2018/dsa-4182 https://access.redhat.com/security/cve/CVE-2018-6102 https://bugzilla.redhat.com/show_bug.cgi?id=1568780 • CWE-20: Improper Input Validation •