CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2017-15429 – chromium-browser: uxss in v8
https://notcve.org/view.php?id=CVE-2017-15429
Inappropriate implementation in V8 WebAssembly JS bindings in Google Chrome prior to 63.0.3239.108 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. Implementación inadecuada en los enlaces V8 WebAssembly JS en Google Chrome en versiones anteriores a la 63.0.3239.108 permitía que un atacante remoto inyectase scripts o HTML arbitrarios (UXSS) mediante una página HTML manipulada. • http://www.securityfocus.com/bid/102196 https://access.redhat.com/errata/RHSA-2017:3479 https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop_14.html https://crbug.com/788453 https://security.gentoo.org/glsa/201801-03 https://www.debian.org/security/2018/dsa-4103 https://access.redhat.com/security/cve/CVE-2017-15429 https://bugzilla.redhat.com/show_bug.cgi?id=1526405 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 1%CPEs: 5EXPL: 0CVE-2017-15416 – chromium-browser: out of bounds read in blink
https://notcve.org/view.php?id=CVE-2017-15416
Heap buffer overflow in Blob API in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page, aka a Blink out-of-bounds read. Desbordamiento de búfer basado en memoria dinámica (heap) en Blob API en Google Chrome en versiones anteriores a la 63.0.3239.84 permitía que un atacante remoto pudiese explotar una corrupción de memoria dinámica (heap) mediante una página HTML manipulada. Esto también se conoce como lectura Blink fuera de límites. • https://access.redhat.com/errata/RHSA-2017:3401 https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html https://crbug.com/779314 https://security.gentoo.org/glsa/201801-03 https://www.debian.org/security/2017/dsa-4064 https://access.redhat.com/security/cve/CVE-2017-15416 https://bugzilla.redhat.com/show_bug.cgi?id=1523131 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2017-15424 – chromium-browser: url spoof in omnibox
https://notcve.org/view.php?id=CVE-2017-15424
Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name. Una aplicación de políticas insuficiente en Omnibox en Google Chrome en versiones anteriores a la 63.0.3239.84 permitía que un atacante remoto suplantase dominios mediante homogramas IDN en un nombre de dominio manipulado. • https://access.redhat.com/errata/RHSA-2017:3401 https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html https://crbug.com/756226 https://security.gentoo.org/glsa/201801-03 https://www.debian.org/security/2017/dsa-4064 https://access.redhat.com/security/cve/CVE-2017-15424 https://bugzilla.redhat.com/show_bug.cgi?id=1523138 • CWE-20: Improper Input Validation •
CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 0CVE-2017-15427 – chromium-browser: insufficient blocking of javascript in omnibox
https://notcve.org/view.php?id=CVE-2017-15427
Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a socially engineered user to XSS themselves by dragging and dropping a javascript: URL into the URL bar. Una aplicación de políticas insuficiente en Omnibox en Google Chrome en versiones anteriores a la 63.0.3239.84 permitía que un usuario creado mediante ingeniería social emplee Cross-Site Scripting (XSS) contra sí mismo arrastrando y soltando una URL javascript: en la barra de direcciones. • https://access.redhat.com/errata/RHSA-2017:3401 https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html https://crbug.com/768910 https://security.gentoo.org/glsa/201801-03 https://www.debian.org/security/2017/dsa-4064 https://access.redhat.com/security/cve/CVE-2017-15427 https://bugzilla.redhat.com/show_bug.cgi?id=1523141 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 2%CPEs: 10EXPL: 0CVE-2017-15422 – chromium-browser: integer overflow in icu
https://notcve.org/view.php?id=CVE-2017-15422
Integer overflow in international date handling in International Components for Unicode (ICU) for C/C++ before 60.1, as used in V8 in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. Un desbordamiento de enteros en el manejo de fechas internacionales en International Components for Unicode (ICU) for C/C++ en versiones anteriores a la 60.1, tal y como se emplea en V8 en Google Chrome en versiones anteriores a la 63.0.3239.84 y otros productos, permitía que un atacante remoto realizase una lectura de memoria fuera de límites mediante una página HTML manipulada. • https://access.redhat.com/errata/RHSA-2017:3401 https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html https://crbug.com/774382 https://security.gentoo.org/glsa/201801-03 https://usn.ubuntu.com/3610-1 https://www.debian.org/security/2018/dsa-4150 https://access.redhat.com/security/cve/CVE-2017-15422 https://bugzilla.redhat.com/show_bug.cgi?id=1523136 • CWE-190: Integer Overflow or Wraparound •