CVSS: 6.5EPSS: 1%CPEs: 5EXPL: 0CVE-2017-15415 – chromium-browser: pointer information disclosure in ipc call
https://notcve.org/view.php?id=CVE-2017-15415
Incorrect serialization in IPC in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak the value of a pointer via a crafted HTML page. Serialización incorrecta en IPC en Google Chrome en versiones anteriores a la 63.0.3239.84 permitía que un atacante remoto filtrase el valor de un puntero mediante una página HTML manipulada. • https://access.redhat.com/errata/RHSA-2017:3401 https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html https://crbug.com/765512 https://security.gentoo.org/glsa/201801-03 https://www.debian.org/security/2017/dsa-4064 https://access.redhat.com/security/cve/CVE-2017-15415 https://bugzilla.redhat.com/show_bug.cgi?id=1523130 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.3EPSS: 0%CPEs: 5EXPL: 0CVE-2017-15423 – chromium-browser: issue with spake implementation in boringssl
https://notcve.org/view.php?id=CVE-2017-15423
Inappropriate implementation in BoringSSL SPAKE2 in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak the low-order bits of SHA512(password) by inspecting protocol traffic. Implementación inapropiada en BoringSSL SPAKE2 en Google Chrome en versiones anteriores a la 63.0.3239.84 permitía que un atacante remoto filtrase bits de orden bajo de SHA512(contraseña) inspeccionando el tráfico del protocolo. • https://access.redhat.com/errata/RHSA-2017:3401 https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html https://crbug.com/778101 https://security.gentoo.org/glsa/201801-03 https://www.debian.org/security/2017/dsa-4064 https://access.redhat.com/security/cve/CVE-2017-15423 https://bugzilla.redhat.com/show_bug.cgi?id=1523137 • CWE-310: Cryptographic Issues •
CVSS: 8.8EPSS: 1%CPEs: 5EXPL: 0CVE-2017-15410 – chromium-browser: use after free in pdfium
https://notcve.org/view.php?id=CVE-2017-15410
Use after free in PDFium in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. Uso de memoria previamente liberada en PDFium en Google Chrome en versiones anteriores a la 63.0.3239.84 permitía que un atacante remoto pudiese explotar una corrupción de memoria dinámica (heap) mediante un archivo PDF manipulado. • https://access.redhat.com/errata/RHSA-2017:3401 https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html https://crbug.com/765921 https://security.gentoo.org/glsa/201801-03 https://www.debian.org/security/2017/dsa-4064 https://access.redhat.com/security/cve/CVE-2017-15410 https://bugzilla.redhat.com/show_bug.cgi?id=1523126 • CWE-416: Use After Free •
CVSS: 9.6EPSS: 2%CPEs: 5EXPL: 0CVE-2017-15407 – chromium-browser: out of bounds write in quic
https://notcve.org/view.php?id=CVE-2017-15407
Out-of-bounds Write in the QUIC networking stack in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to gain code execution via a malicious server. Una escritura fuera de límites en la pila de networking QUIC en Google Chrome en versiones anteriores a la 63.0.3239.84 permitía que un atacante remoto pudiese ejecutar código mediante un servidor malicioso. • https://access.redhat.com/errata/RHSA-2017:3401 https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html https://crbug.com/778505 https://security.gentoo.org/glsa/201801-03 https://www.debian.org/security/2017/dsa-4064 https://access.redhat.com/security/cve/CVE-2017-15407 https://bugzilla.redhat.com/show_bug.cgi?id=1523123 • CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2017-15418 – chromium-browser: use of uninitialized value in skia
https://notcve.org/view.php?id=CVE-2017-15418
Use of uninitialized memory in Skia in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Uso de memoria no inicializada en Skia en Google Chrome en versiones anteriores a la 63.0.3239.84 permitía que un atacante remoto pudiese obtener información potencialmente sensible del la memoria del proceso mediante una página HTML manipulada. • https://access.redhat.com/errata/RHSA-2017:3401 https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html https://crbug.com/765858 https://security.gentoo.org/glsa/201801-03 https://www.debian.org/security/2017/dsa-4064 https://access.redhat.com/security/cve/CVE-2017-15418 https://bugzilla.redhat.com/show_bug.cgi?id=1523133 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •