CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2017-15429 – chromium-browser: uxss in v8
https://notcve.org/view.php?id=CVE-2017-15429
Inappropriate implementation in V8 WebAssembly JS bindings in Google Chrome prior to 63.0.3239.108 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. Implementación inadecuada en los enlaces V8 WebAssembly JS en Google Chrome en versiones anteriores a la 63.0.3239.108 permitía que un atacante remoto inyectase scripts o HTML arbitrarios (UXSS) mediante una página HTML manipulada. • http://www.securityfocus.com/bid/102196 https://access.redhat.com/errata/RHSA-2017:3479 https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop_14.html https://crbug.com/788453 https://security.gentoo.org/glsa/201801-03 https://www.debian.org/security/2018/dsa-4103 https://access.redhat.com/security/cve/CVE-2017-15429 https://bugzilla.redhat.com/show_bug.cgi?id=1526405 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 2%CPEs: 8EXPL: 0CVE-2017-15412 – libxml2: Use after free in xmlXPathCompOpEvalPositionalPredicate() function in xpath.c
https://notcve.org/view.php?id=CVE-2017-15412
Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Uso de memoria previamente liberada en libxml2 en versiones anteriores a la 2.9.5, tal y como se emplea en Google Chrome en versiones anteriores a la 63.0.3239.84 y otros productos, permitía que un atacante remoto pudiese explotar una corrupción de memoria dinámica (heap) mediante una página HTML manipulada. A use-after-free flaw was found in the libxml2 library. An attacker could use this flaw to cause an application linked against libxml2 to crash when parsing a specially crafted XML file. • http://www.securitytracker.com/id/1040348 https://access.redhat.com/errata/RHSA-2017:3401 https://access.redhat.com/errata/RHSA-2018:0287 https://bugzilla.gnome.org/show_bug.cgi?id=783160 https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html https://crbug.com/727039 https://lists.debian.org/debian-lts-announce/2017/12/msg00014.html https://security.gentoo.org/glsa/201801-03 https://www.debian.org/security/2018/dsa-4086 https://access.redhat. • CWE-416: Use After Free •
CVSS: 8.8EPSS: 1%CPEs: 5EXPL: 0CVE-2017-15409 – chromium-browser: out of bounds write in skia
https://notcve.org/view.php?id=CVE-2017-15409
Heap buffer overflow in Skia in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Desbordamiento de búfer basado en memoria dinámica (heap) en Skia en Google Chrome en versiones anteriores a la 63.0.3239.84 permitía que un atacante remoto pudiese explotar una corrupción de memoria dinámica (heap) mediante una página HTML manipulada. • https://access.redhat.com/errata/RHSA-2017:3401 https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html https://crbug.com/763972 https://security.gentoo.org/glsa/201801-03 https://www.debian.org/security/2017/dsa-4064 https://access.redhat.com/security/cve/CVE-2017-15409 https://bugzilla.redhat.com/show_bug.cgi?id=1523125 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2017-15425 – chromium-browser: url spoof in omnibox
https://notcve.org/view.php?id=CVE-2017-15425
Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name. Una aplicación de políticas insuficiente en Omnibox en Google Chrome en versiones anteriores a la 63.0.3239.84 permitía que un atacante remoto suplantase dominios mediante homogramas IDN en un nombre de dominio manipulado. • https://access.redhat.com/errata/RHSA-2017:3401 https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html https://crbug.com/756456 https://security.gentoo.org/glsa/201801-03 https://www.debian.org/security/2017/dsa-4064 https://access.redhat.com/security/cve/CVE-2017-15425 https://bugzilla.redhat.com/show_bug.cgi?id=1523139 • CWE-20: Improper Input Validation •
CVSS: 9.6EPSS: 2%CPEs: 5EXPL: 0CVE-2017-15407 – chromium-browser: out of bounds write in quic
https://notcve.org/view.php?id=CVE-2017-15407
Out-of-bounds Write in the QUIC networking stack in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to gain code execution via a malicious server. Una escritura fuera de límites en la pila de networking QUIC en Google Chrome en versiones anteriores a la 63.0.3239.84 permitía que un atacante remoto pudiese ejecutar código mediante un servidor malicioso. • https://access.redhat.com/errata/RHSA-2017:3401 https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html https://crbug.com/778505 https://security.gentoo.org/glsa/201801-03 https://www.debian.org/security/2017/dsa-4064 https://access.redhat.com/security/cve/CVE-2017-15407 https://bugzilla.redhat.com/show_bug.cgi?id=1523123 • CWE-787: Out-of-bounds Write •